Merge branch '1.9.0-branch-visualize-fif_rf' into 'main'

1.9.0 branch visualize fif rf

See merge request integrations/sdk/reversinglabs-sdk-cookbook!8

Author: MislavReversingLabs

Scenarios and Workflows/generate_and_visualize_STIX_bundle.ipynb

@@ -0,0 +1,124 @@
+{
+ "cells": [
+  {
+   "cell_type": "markdown",
+   "id": "f9a8c4ddbec98d57",
+   "metadata": {
+    "collapsed": false
+   },
+   "source": [
+    "# Generate and visualize STIX bundle using Flexible Intel Feed or Ransomware Feed\n",
+    "This notebook contains an example of generating STIX report bundles using Flexible Intel Feed or Ransomware Feed and visualize them with [STIX Viewer](https://oasis-open.github.io/cti-stix-visualization/)"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "id": "7f72de57",
+   "metadata": {},
+   "source": [
+    "A script connects to ReversingLabs TAXII 2.1 feed (via the [ReversingLabs SDK](https://github.com/reversinglabs/reversinglabs-sdk-py3)), pulls down all STIX objects added after a given timestamp, and writes them to a JSON file (matched_stix.json).\n",
+    "\n",
+    "Create JSON (ticloud_credentials.json) or pass your credentials directly using the script below. Obtain the credentials for data.reversinglabs.com access by contacting [email protected]\n",
+    "\n",
+    "Examples of the available API roots:\n",
+    "    \"ransomware-api-root\",\n",
+    "    \"ransomware-lite\",\n",
+    "    \"flexible-intel-feeds\""
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "id": "d9fbf3de",
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "import json\n",
+    "from ReversingLabs.SDK.ticloud import TAXIIRansomwareFeed\n",
+    "\n",
+    "CREDS = json.load(open(\"ticloud_credentials.json\"))\n",
+    "USER = CREDS[\"username\"]\n",
+    "PASS = CREDS[\"password\"]\n",
+    "\n",
+    "feed = TAXIIRansomwareFeed(\n",
+    "    host=\"https://data.reversinglabs.com\",\n",
+    "    username=USER,\n",
+    "    password=PASS\n",
+    ")\n",
+    "\n",
+    "time_string = \"2025-06-11T00:00:00Z\"\n",
+    "\n",
+    "objs = feed.get_objects_aggregated(\n",
+    "    api_root=\"<api_root>\", \n",
+    "    collection_id=\"<collection_id>\",\n",
+    "    result_limit=500,\n",
+    "    added_after=time_string\n",
+    ")\n",
+    "\n",
+    "print(f\"Found {len(objs)} matching STIX objects\")\n",
+    "\n",
+    "with open(\"matched_stix.json\", \"w\") as fp:\n",
+    "    json.dump(objs, fp, indent=2)\n"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "id": "8486a457",
+   "metadata": {},
+   "source": [
+    "Jupyter notebook embeds the OASIS CTI STIX Visualizer in an iFrame. The JSON bundle is automatically produced with previous script and presented in the separate iFrame.\n",
+    "\n",
+    "Select the JSON content and paste in the cti-stix-visualization dialog box to get an interactive graph, table view and timeline information about the STIX objects."
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "id": "9e74918e",
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "# Visualize STIX Bundle\n",
+    "# Cut & paste your JSON file contents below, or load from a file\n",
+    "import json\n",
+    "from IPython.display import display, IFrame\n",
+    "import ipywidgets as widgets\n",
+    "\n",
+    "with open(\"matched_stix.json\") as f:\n",
+    "    bundle = json.load(f)\n",
+    "\n",
+    "ta = widgets.Textarea(\n",
+    "    value=json.dumps(bundle, indent=2),\n",
+    "    layout=widgets.Layout(width=\"1200px\", height=\"300px\")\n",
+    ")\n",
+    "display(ta)\n",
+    "\n",
+    "display(IFrame(\n",
+    "    src=\"https://oasis-open.github.io/cti-stix-visualization/\",\n",
+    "    width=1200, height=1000\n",
+    "))"
+   ]
+  }
+ ],
+ "metadata": {
+  "kernelspec": {
+   "display_name": "Python 3",
+   "language": "python",
+   "name": "python3"
+  },
+  "language_info": {
+   "codemirror_mode": {
+    "name": "ipython",
+    "version": 3
+   },
+   "file_extension": ".py",
+   "mimetype": "text/x-python",
+   "name": "python",
+   "nbconvert_exporter": "python",
+   "pygments_lexer": "ipython3",
+   "version": "3.13.0"
+  }
+ },
+ "nbformat": 4,
+ "nbformat_minor": 5
+}