How can I find what regions/continents a country is linked to in location2stix data?

OSS Support
, ,
1

I import location2stix data using stix2arango

python3 utilities/arango_cti_processor/insert_archive_locations.py \
	--database forum_demo

Now let’s say I start with France as a country…

FOR doc IN locations_vertex_collection
    FILTER doc.name == "France"
    LET keys = ATTRIBUTES(doc)
    LET filteredKeys = keys[* FILTER !STARTS_WITH(CURRENT, "_")]
    RETURN KEEP(doc, filteredKeys)

[
  {
    "country": "FR",
    "created": "2020-01-01T00:00:00.000Z",
    "created_by_ref": "identity--674a16c1-8b43-5c3e-8692-b3d8935e4903",
    "external_references": [
      {
        "source_name": "alpha-3",
        "external_id": "FRA"
      },
      {
        "source_name": "iso_3166-2",
        "external_id": "ISO 3166-2:FR"
      },
      {
        "source_name": "country-code",
        "external_id": "250"
      }
    ],
    "id": "location--4e9a8b79-6776-56e3-b72c-cb19a086b6a8",
    "modified": "2020-01-01T00:00:00.000Z",
    "name": "France",
    "object_marking_refs": [
      "marking-definition--674a16c1-8b43-5c3e-8692-b3d8935e4903",
      "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
    ],
    "region": "western-europe",
    "spec_version": "2.1",
    "type": "location"
  }
]

I know location2stix creates regions and continents then links them to countries, so how do I uncover these links?

2

You just need to search the edge collection as follows;

FOR doc IN locations_edge_collection
    FILTER doc.source_ref == "location--4e9a8b79-6776-56e3-b72c-cb19a086b6a8"
    RETURN doc

location--4e9a8b79-6776-56e3-b72c-cb19a086b6a8 is the STIX ID for France (as identified in your last query`

image
image1915×959 61.4 KB

Here we see two links

  1. location--82b2b1a9-5f88-55ab-877e-812017e26fca
  2. location--61df7ce8-5f7e-5a6e-bb33-3b63a6c2a1f6

Putting this into a complete search to answer your question in one query:

LET target_refs = (
  FOR doc IN locations_edge_collection
    FILTER doc.source_ref == "location--4e9a8b79-6776-56e3-b72c-cb19a086b6a8"
    RETURN doc.target_ref
)

FOR vertex IN locations_vertex_collection
  FILTER vertex.id IN target_refs
  RETURN {
    name: vertex.name,
    id: vertex.id
  }

[
  {
    "name": "Europe",
    "id": "location--82b2b1a9-5f88-55ab-877e-812017e26fca"
  },
  {
    "name": "Western Europe",
    "id": "location--61df7ce8-5f7e-5a6e-bb33-3b63a6c2a1f6"
  }
]

and you can also do the reverse

e.g. show me all countries located in Europe…

LET target_refs = (
  FOR doc IN locations_edge_collection
    FILTER doc.target_ref == "location--82b2b1a9-5f88-55ab-877e-812017e26fca"
    RETURN doc.source_ref
)

FOR vertex IN locations_vertex_collection
  FILTER vertex.id IN target_refs
  RETURN {
    name: vertex.name,
    id: vertex.id
  }