msticpy/datamodel/pivot_ti_provider.py
def _get_ip_functions(ioc_type_supp, ti_lookup):
    """Get functions for IP IoC Types."""
    # Special case for ipv4 and ipv6
    # we want to merge these into "ip" if these are equivalent
    ioc_queries = defaultdict(dict)
    # Special case for ipv4 and ipv6 - we want to merge these into "ip" if these are equivalent
    ip_types = {"ipv4", "ipv6"}
    ip_all_provs = [
        prov for prov, supp_types in ioc_type_supp.items() if ip_types & supp_types
    ]

    # Register providers where IP v4 and v6 are equivalent, or only support ipv4, as "ip"
    ip_gen_provs = [
        prov
        for prov in ip_all_provs
        if _prov_ipv4v6_equal(ti_lookup.loaded_providers.get(prov))
        or "ipv6" not in ioc_type_supp[prov]
    ]

    _, func_name, func = _create_lookup_func(ti_lookup, "ipv4", "ip", ip_gen_provs)
    ioc_queries["ip"][func_name] = func

    # Also register IP v4 and v6 specific queries
    ip_v4_provs = [
        prov
        for prov in ip_all_provs
        if "ipv4" in ioc_type_supp[prov]
        if prov not in ip_gen_provs
    ]
    _, func_name, func = _create_lookup_func(ti_lookup, "ipv4", "ipv4", ip_v4_provs)
    ioc_queries["ipv4"][func_name] = func

    ip_v6_provs = [
        prov
        for prov in ip_all_provs
        if "ipv6" in ioc_type_supp[prov]
        if prov not in ip_gen_provs
    ]
    _, func_name, func = _create_lookup_func(ti_lookup, "ipv6", "ipv6", ip_v6_provs)
    ioc_queries["ipv6"][func_name] = func

    return ioc_queries
Get functions for IP IoC Types.
Get functions for IP IoC Types.
Get functions for IP IoC Types .
def _get_ip_functions(ioc_type_supp, ti_lookup):
    ioc_queries = defaultdict(dict)
     - we want to merge these into "ip" if these are equivalent
    ip_types = {"ipv4", "ipv6"}
    ip_all_provs = [
        prov for prov, supp_types in ioc_type_supp.items() if ip_types & supp_types
    ]
    ip_gen_provs = [
        prov
        for prov in ip_all_provs
        if _prov_ipv4v6_equal(ti_lookup.loaded_providers.get(prov))
        or "ipv6" not in ioc_type_supp[prov]
    ]
    _, func_name, func = _create_lookup_func(ti_lookup, "ipv4", "ip", ip_gen_provs)
    ioc_queries["ip"][func_name] = func
    ip_v4_provs = [
        prov
        for prov in ip_all_provs
        if "ipv4" in ioc_type_supp[prov]
        if prov not in ip_gen_provs
    ]
    _, func_name, func = _create_lookup_func(ti_lookup, "ipv4", "ipv4", ip_v4_provs)
    ioc_queries["ipv4"][func_name] = func
    ip_v6_provs = [
        prov
        for prov in ip_all_provs
        if "ipv6" in ioc_type_supp[prov]
        if prov not in ip_gen_provs
    ]
    _, func_name, func = _create_lookup_func(ti_lookup, "ipv6", "ipv6", ip_v6_provs)
    ioc_queries["ipv6"][func_name] = func
    return ioc_queries
def _get_ip_functions ( ioc_type_supp , ti_lookup ) : ioc_queries = defaultdict ( dict ) ip_types = { "ipv4" , "ipv6" } ip_all_provs = [ prov for prov , supp_types in ioc_type_supp . items ( ) if ip_types & supp_types ] ip_gen_provs = [ prov for prov in ip_all_provs if _prov_ipv4v6_equal ( ti_lookup . loaded_providers . get ( prov ) ) or "ipv6" not in ioc_type_supp [ prov ] ] _ , func_name , func = _create_lookup_func ( ti_lookup , "ipv4" , "ip" , ip_gen_provs ) ioc_queries [ "ip" ] [ func_name ] = func ip_v4_provs = [ prov for prov in ip_all_provs if "ipv4" in ioc_type_supp [ prov ] if prov not in ip_gen_provs ] _ , func_name , func = _create_lookup_func ( ti_lookup , "ipv4" , "ipv4" , ip_v4_provs ) ioc_queries [ "ipv4" ] [ func_name ] = func ip_v6_provs = [ prov for prov in ip_all_provs if "ipv6" in ioc_type_supp [ prov ] if prov not in ip_gen_provs ] _ , func_name , func = _create_lookup_func ( ti_lookup , "ipv6" , "ipv6" , ip_v6_provs ) ioc_queries [ "ipv6" ] [ func_name ] = func return ioc_queries
Get functions for IP IoC Types.
Get functions for IP IoC Types .
"""Get functions for IP IoC Types.""" # Special case for ipv4 and ipv6 # we want to merge these into "ip" if these are equivalent # Special case for ipv4 and ipv6 - we want to merge these into "ip" if these are equivalent # Register providers where IP v4 and v6 are equivalent, or only support ipv4, as "ip" # Also register IP v4 and v6 specific queries
ioc_type_supp
ti_lookup