Python anytree.AnyNode() Examples

def __init__(
        self, hierarchy_jsonpath: str, nms_threshold: float = 0.85, max_given_constraints: int = 3
    ):
        def __read_hierarchy(node: anytree.AnyNode, parent: Optional[anytree.AnyNode] = None):
            # Cast an ``anytree.AnyNode`` (after first level of recursion) to dict.
            attributes = dict(node)
            children = attributes.pop("Subcategory", [])

            node = anytree.AnyNode(parent=parent, **attributes)
            for child in children:
                __read_hierarchy(child, parent=node)
            return node

        # Read the object class hierarchy as a tree, to make searching easier.
        self._hierarchy = __read_hierarchy(json.load(open(hierarchy_jsonpath)))

        self._nms_threshold = nms_threshold
        self._max_given_constraints = max_given_constraints 

def create_tree(root_json, root_node):
    con_name = root_json['name']

    if con_name is None:
        con_name = 'container'

    if con_name in ['__i3', 'topdock', 'bottomdock']:
        return None
    else:
        this_node = at.AnyNode(id=con_name,
                               parent=root_node,
                               con_id=root_json['id'],
                               workspace=False,
                               container=False)

    if con_name == 'container':
        this_node.container = True

    for a_node in root_json['nodes']:
        create_tree(a_node, this_node) 

def _node(self, name, type, relpath, parent,
              size=None, md5=None, maccess=None):
        '''generic node creation'''
        return anytree.AnyNode(name=name, type=type, relpath=relpath,
                               parent=parent, size=size,
                               md5=md5, maccess=maccess)

    ###############################################################
    # printing
    ############################################################### 

def archive_node(self, name, path, parent, archive):
        '''crete a new node for archive data'''
        return anytree.AnyNode(name=name, type=self.TYPE_ARC, relpath=path,
                               parent=parent, size=0, md5=None,
                               archive=archive) 

def storage_node(self, name, path, parent, attr=None):
        '''create a new node representing a storage'''
        path = os.path.abspath(path)
        free = shutil.disk_usage(path).free
        total = shutil.disk_usage(path).total
        epoch = int(time.time())
        return anytree.AnyNode(name=name, type=self.TYPE_STORAGE, free=free,
                               total=total, parent=parent, attr=attr, ts=epoch) 

def update_metanode(self, top):
        '''create or update meta node information'''
        meta = self._get_meta_node(top)
        epoch = int(time.time())
        if not meta:
            attr = {}
            attr['created'] = epoch
            attr['created_version'] = VERSION
            meta = anytree.AnyNode(name=self.METANAME, type=self.TYPE_META,
                                   attr=attr)
        meta.attr['access'] = epoch
        meta.attr['access_version'] = VERSION
        return meta 

def new_top_node(self):
        '''create a new top node'''
        return anytree.AnyNode(name=self.TOPNAME, type=self.TYPE_TOP) 

def main(ioc_file, output_dir):

    with open(ioc_file) as csvfile:
        iocreader = csv.reader(csvfile, delimiter=',')
        for row in iocreader:
            root = AnyNode(id=row[1], type=row[0])

            logger.info('=========Start to explore IOC: %s', root.id)

            ioc_list = build_ioc_relation(root)

            timestamp = datetime.now().strftime('%Y%m%d%H%M')
            query_depth = config.get('general','depth')

            txtfile = output_dir + root.id + '_depth_'+ query_depth + '_'+timestamp + '.txt'
            file = open(txtfile, "w")
            file.write(str(RenderTree(root)))
            file.close()

            logger.info('Export IOCs to TXT file: %s', txtfile)

            jsonfile = output_dir + root.id + '_depth_'+ query_depth + '_'+timestamp + '.json'
            file = open(jsonfile, "w")
            exporter = JsonExporter(indent=2, sort_keys=False)
            exporter.write(root, file)
            file.close()

            logger.info('Export IOCs to JSON file: %s', jsonfile)

            logger.info('=========Done exploration for IOC: %s', root.id)

    return 

def test_any_node():
    """Any Node."""
    r = AnyNode()
    a = AnyNode()
    b = AnyNode(foo=4)
    eq_(r.parent, None)
    eq_(a.parent, None)
    eq_(b.parent, None)
    a.parent = r
    b.parent = r
    eq_(r.children, (a, b))
    eq_(repr(r), "AnyNode()")
    eq_(repr(a), "AnyNode()")
    eq_(repr(b), "AnyNode(foo=4)") 

def test_any_node_parent_error():
    """Any Node Parent Error."""

    with assert_raises(TreeError, "Parent node 'r' is not of type 'NodeMixin'."):
        AnyNode("r") 

def test_anynode_children_init():
    """Anynode With Children Attribute."""
    root = AnyNode(foo="root", children=[
        AnyNode(foo="a", children=[
            AnyNode(foo="aa")
        ]),
        AnyNode(foo="b")
    ])
    eq_(repr(root.descendants),
        "(AnyNode(foo='a'), AnyNode(foo='aa'), AnyNode(foo='b'))") 

def test_dict_exporter():
    """Dict Exporter."""
    root = AnyNode(id="root")
    s0 = AnyNode(id="sub0", parent=root)
    s0b = AnyNode(id="sub0B", parent=s0)
    s0a = AnyNode(id="sub0A", parent=s0)
    s1 = AnyNode(id="sub1", parent=root, foo="bar")
    s1a = AnyNode(id="sub1A", parent=s1)
    s1b = AnyNode(id="sub1B", parent=s1)
    s1c = AnyNode(id="sub1C", parent=s1)
    s1ca = AnyNode(id="sub1Ca", parent=s1c)

    exporter = DictExporter()
    eq_(exporter.export(root),
        {'id': 'root', 'children': [
            {'id': 'sub0', 'children': [
                {'id': 'sub0B'},
                {'id': 'sub0A'}
            ]},
            {'id': 'sub1', 'foo': 'bar', 'children': [
                {'id': 'sub1A'},
                {'id': 'sub1B'},
                {'id': 'sub1C', 'children': [
                    {'id': 'sub1Ca'}
                ]}
            ]}
        ]}
        ) 

def __init__(self, nodecls=AnyNode):
        u"""
        Import Tree from dictionary.

        Every dictionary is converted to an instance of `nodecls`.
        The dictionaries listed in the children attribute are converted
        likewise and added as children.

        Keyword Args:
            nodecls: class used for nodes.

        >>> from anytree.importer import DictImporter
        >>> from anytree import RenderTree
        >>> importer = DictImporter()
        >>> data = {
        ...     'a': 'root',
        ...     'children': [{'a': 'sub0',
        ...                   'children': [{'a': 'sub0A', 'b': 'foo'}, {'a': 'sub0B'}]},
        ...                  {'a': 'sub1'}]}
        >>> root = importer.import_(data)
        >>> print(RenderTree(root))
        AnyNode(a='root')
        ├── AnyNode(a='sub0')
        │   ├── AnyNode(a='sub0A', b='foo')
        │   └── AnyNode(a='sub0B')
        └── AnyNode(a='sub1')
        """
        self.nodecls = nodecls 

def vt_ip_to_file(parent):
    """
    Files downloaded from the IP address

    Output is a list of file nodes with sha256 value

    Example: 192.99.142.235

    https://developers.virustotal.com/v3.0/reference#domains-relationships

    """

    result = []

    if parent.type != 'ip_address':
        return result

    ip_address = parent.id

    headers = {'x-apikey': config.get('VirusTotal','api_key')}
    params = {'limit': int(config.get('VirusTotal', 'limit'))}
    re_url = config.get('VirusTotal', 'ip_downloaded_files').replace('{ip}', ip_address)

    try:
        logger.debug('[Processing] Relationship query - VT: IP to downloaded files - %s', ip_address)
        r = requests.get(re_url, headers=headers, params=params, timeout=5)

    except:
        logger.debug('[Error] Relationship query - VT: IP to downloaded files - %s', ip_address)
        return result

    logger.debug('[Done] Relationship query - VT: IP to downloaded files - %s', ip_address)

    if r.status_code == 200 and len(r.json()['data']) > 0:
        for i in r.json()['data']:

            if 'attributes' in i:
                child_node = AnyNode(id=i['attributes']['sha256'],
                                     type='file',
                                     relation='VT: IP to downloaded file',
                                     parent=parent)

                result.append(child_node)

    return result 

def vt_domain_to_file(parent):
    """
    Files downloaded from the domain

    Output is a list of file nodes with sha256 value

    Example: xnz.freetzi.com

    https://developers.virustotal.com/v3.0/reference#domains-relationships

    """

    result = []

    if parent.type != 'domain':
        return result

    domain = parent.id

    headers = {'x-apikey': config.get('VirusTotal','api_key')}
    params = {'limit': int(config.get('VirusTotal', 'limit'))}
    re_url = config.get('VirusTotal', 'domain_downloaded_files').replace('{domain}', domain)

    try:
        logger.debug('[Processing] Relationship query - VT: domain to downloaded files - %s', domain)
        r = requests.get(re_url, headers=headers, params=params, timeout=5)

    except:
        logger.debug('[Error] Relationship query - VT: domain to downloaded files - %s', domain)
        return result

    logger.debug('[Done] Relationship query - VT: domain to downloaded files - %s', domain)

    if r.status_code == 200 and len(r.json()['data']) > 0:
        for i in r.json()['data']:

            if 'attributes' in i:
                child_node = AnyNode(id=i['attributes']['sha256'],
                                     type='file',
                                     relation='VT: domain to downloaded file',
                                     parent=parent)

                result.append(child_node)

    return result 

def vt_domain_to_ip(parent):
    """
    DNS resolutions for the domain

    Output is a list of IP address nodes

    Example: xnz.freetzi.com

    https://developers.virustotal.com/v3.0/reference#domains-relationships

    """

    result = []

    if parent.type != 'domain':
        return result

    domain = parent.id

    headers = {'x-apikey': config.get('VirusTotal','api_key')}
    params = {'limit': int(config.get('VirusTotal', 'limit'))}
    re_url = config.get('VirusTotal', 'domain_resolutions').replace('{domain}', domain)

    try:
        logger.debug('[Processing] Relationship query - VT: domain to resolution ip - %s', domain)
        r = requests.get(re_url, headers=headers, params=params, timeout=5)

    except:
        logger.debug('[Error] Relationship query - VT: domain to resolution ip - %s', domain)
        return result

    logger.debug('[Done] Relationship query - VT: domain to resolution ip - %s', domain)

    if r.status_code == 200 and len(r.json()['data']) > 0:
        for i in r.json()['data']:

            if 'attributes' in i:
                child_node = AnyNode(id=i['attributes']['ip_address'],
                                     type='ip_address',
                                     relation='VT: domain to resolution ip',
                                     parent=parent)

                result.append(child_node)

    return result 

def vt_file_to_ip(parent):
    """
    IP addresses contacted by the file

    Output is a list of IP address nodes

    Example: c3f5add704f2c540f3dd345f853e2d84

    https://developers.virustotal.com/v3.0/reference#domains-relationships

    """

    result = []

    if parent.type != 'file':
        return result


    file_hash = parent.id

    headers = {'x-apikey': config.get('VirusTotal','api_key')}
    params = {'limit': int(config.get('VirusTotal', 'limit'))}
    re_url = config.get('VirusTotal', 'file_contacted_ips').replace('{file}', file_hash)

    try:
        logger.debug('[Processing] Relationship query - VT: file to contacted ip - %s', file_hash)
        r = requests.get(re_url, headers=headers, params=params, timeout=5)

    except:
        logger.debug('[Error] Relationship query - VT: file to contacted ip - %s', file_hash)
        return result

    logger.debug('[Done] Relationship query - VT: file to contacted ip - %s', file_hash)

    if r.status_code == 200 and len(r.json()['data']) > 0:
        for i in r.json()['data']:

            child_node = AnyNode(id=i['id'],
                                type='ip_address',
                                relation='VT: file to contacted ip',
                                parent=parent)

            result.append(child_node)

    return result 

def vt_file_to_file(parent):
    """
    Files that executed the file.

    Output is a list of file hashes

    Example: c0531f812a1ec5e825f7250f7b52db7621ecf93d973f0e3ba1aa0372e0f559f2

    https://developers.virustotal.com/v3.0/reference#domains-relationships

    """

    result = []

    if parent.type != 'file':
        return result


    file_hash = parent.id

    headers = {'x-apikey': config.get('VirusTotal','api_key')}
    params = {'limit': int(config.get('VirusTotal', 'limit'))}
    re_url = config.get('VirusTotal', 'file_execution_parents').replace('{file}', file_hash)

    try:
        logger.debug('[Processing] Relationship query - VT: file to execution parents - %s', file_hash)
        r = requests.get(re_url, headers=headers, params=params, timeout=5)

    except:
        logger.debug('[Error] Relationship query - VT: file to execution parents - %s', file_hash)
        return result

    logger.debug('[Done] Relationship query - VT: file to execution parents - %s', file_hash)

    if r.status_code == 200 and len(r.json()['data']) > 0:
        for i in r.json()['data']:

            if 'attributes' in i:
                child_node = AnyNode(id=i['attributes']['sha256'],
                                     type='file',
                                     relation='VT: file to execution parent',
                                     parent=parent)

                result.append(child_node)

    return result 

def qax_domain_to_ip(parent):
    """
    Private data source of QiAnXin

    DNS resolutions (A record) for the domain

    Output is a list of IP addresses

    Example: xnz.freetzi.com

    https://wiki.example.cn/display/360JSYJ/flint

    """

    result = []

    if parent.type != 'domain':
        return result


    domain = parent.id

    params = {'limit': int(config.get('QiAnXin_PDNS', 'limit')),
              'start': int(config.get('QiAnXin_PDNS', 'start')),
              'end': int(config.get('QiAnXin_PDNS', 'end')),
              'mode': int(config.get('QiAnXin_PDNS', 'mode')),
              'rtype': int(config.get('QiAnXin_PDNS', 'rtype'))}

    re_url = config.get('QiAnXin_PDNS', 'flint').replace('{domain}', domain)

    try:
        logger.debug('[Processing] Relationship query - QAX: domain to resolution ip - %s', domain)
        r = requests.get(re_url, params=params, timeout=5)

    except:
        logger.debug('[Error] Relationship query - QAX: domain to resolution ip - %s', domain)
        return result

    logger.debug('[Done] Relationship query - QAX: domain to resolution ip - %s', domain)

    if r.status_code == 200 and len(r.json()['data']) > 0:
        for i in r.json()['data']:

            for j in i['rdata'].split(';'):
                if j != '':
                    child_node = AnyNode(id=j,
                                         type='ip_address',
                                         relation='QAX: domain to resolution ip',
                                         parent=parent)

                    result.append(child_node)

    return result 

def qax_domain_to_email(parent):
    """
    Private data source of QiAnXin

    Registrant email for the domain in Whois record

    Output is a list of emails

    Example: freetzi.com

    https://wiki.example.cn/display/360JSYJ/detail

    """

    result = []

    if parent.type != 'domain':
        return result

    domain = parent.id

    re_url = config.get('QiAnXin_Whoisdb', 'registrant_email').replace('{domain}', domain)

    try:
        logger.debug('[Processing] Relationship query - QAX: domain to whois email - %s', domain)
        r = requests.get(re_url, timeout=5)

    except:
        logger.debug('[Error] Relationship query - QAX:  domain to whois email - %s', domain)
        return result

    logger.debug('[Done] Relationship query - QAX: domain to registrant email - %s', domain)

    if r.json()['code'] == 200 and 'registrantEmail' in r.json()['data']:

        email = r.json()['data']['registrantEmail'][0]
        if re.search(regex_email, email):
            child_node = AnyNode(id=email,
                                 type='email',
                                 relation='QAX: domain to whois email',
                                 parent=parent)

            result.append(child_node)

    return result 

def qax_email_to_domain(parent):
    """
    Private data source of QiAnXin

    Domain names registered in the same email

    Output is a list of domains

    Example: 373192510@qq.com

    https://wiki.example.cn/display/360JSYJ/reverse

    """

    result = []

    if parent.type != 'email':
        return result

    email = parent.id

    params = {'limit': int(config.get('QiAnXin_Whoisdb', 'reverse_email_limit'))}
    re_url = config.get('QiAnXin_Whoisdb', 'reverse_email').replace('{email}', email)

    try:
        logger.debug('[Processing] Relationship query - QAX: Whois email to domains - %s', email)
        r = requests.get(re_url, params=params, timeout=5)

    except:
        logger.debug('[Error] Relationship query - QAX: Whois email to domains - %s', email)
        return result

    logger.debug('[Done] Relationship query - QAX: Whois email to domains - %s', email)

    if r.json()['code'] == 200 and len(r.json()['data']) > 0:
        for i in r.json()['data']:
            child_node = AnyNode(id=i,
                                 type='domain',
                                 relation='QAX: Whois email to domain',
                                 parent=parent)

            result.append(child_node)

    return result 

def qax_file_to_ip(parent):
    """
    Private data source of QiAnXin

    IP addresses contacted by the file

    Output is a list of IP addresses

    Example: e889544aff85ffaf8b0d0da705105dee7c97fe26

    https://wiki.example.cn/display/360JSYJ/reverse

    """

    result = []

    if parent.type != 'file':
        return result

    file_hash = parent.id

    params = {'apikey': config.get('QiAnXin_TI', 'api_key'),
              'param':file_hash}
    re_url = config.get('QiAnXin_TI', 'file_reputation')

    try:
        logger.debug('[Processing] Relationship query - QAX: file to contacted IPs - %s', file_hash)
        r = requests.get(re_url, params=params, timeout=5)

    except:
        logger.debug('[Error] Relationship query - QAX: file to contacted IPs - %s', file_hash)
        return result

    logger.debug('[Done] Relationship query - QAX: file to contacted IPs - %s', file_hash)

    if r.json()['status'] == 10000 and len(r.json()['data']) > 0:
        for i in r.json()['data']:
            if 'network' in i and 'ip' in i['network']:
                for j in i['network']['ip']:
                    child_node = AnyNode(id=j,
                                         type='ip_address',
                                         relation='QAX: file to contacted ip',
                                         parent=parent)

                    result.append(child_node)

    return result