def cybox_datatype_extractor(self, enrichment, fact, attr_info, namespace_mapping, add_fact_kargs):
        """

        The datatype extractor is called for each fact with the aim of determining the fact's datatype.
        The extractor function has the following signature:

        - Inputs:
          - info_object: the information object to which the fact is to be added
          - fact: the fact dictionary of the following form::
               { 'node_id': 'N001:L000:N000:A000',
                 'term': 'Hashes/Hash/Simple_Hash_Value',
                 'attribute': 'condition' / False,
                 'value': u'Equals'
               }
          - attr_info:
            A dictionary with mapping of XML attributes concerning the node in question
            (note that the keys do *not* have a leading '@' unless it is an internally
            generated attribute by Dingo.
          - namespace_mapping:
            A dictionary containing the namespace mapping extracted from the imported XML file.
          - add_fact_kargs:
            The arguments with which the fact will be generated after all handler functions
            have been called. The dictionary contains the following keys::

                'fact_dt_kind' : <FactDataType.NO_VOCAB/VOCAB_SINGLE/...>
                'fact_dt_namespace_name': <human-readable shortname for namespace uri>
                'fact_dt_namespace_uri': <namespace uri for datataype namespace>
                'fact_term_name' : <Fact Term such as 'Header/Subject/Address'>
                'fact_term_attribute': <Attribute key such as 'category' for fact terms describing an attribute>
                'values' : <list of FactValue objects that are the values of the fact to be generated>
                'node_id_name' : <node identifier such as 'N000:N000:A000'

        Just as the fact handler functions, the datatype extractor can change the add_fact_kargs dictionary
        and thus change the way in which the fact is created -- usually, this ability is used to change
        the following items in the dictionary:

        - fact_dt_name
        - fact_dt_namespace_uri
        - fact_dt_namespace_name (optional -- the defining part is the uri)
        - fact_dt_kind

        The extractor returns "True" if datatype info was found; otherwise, False is returned
        """

        if "idref" in attr_info:
            # Set up the fact data type as a data type that expresses
            # the referencing that is going on
            embedded_type_info = attr_info.get('@embedded_type_info', None)
            logger.debug("Embedded type info %s" % embedded_type_info)
            type_info = self.derive_iobject_type(attr_info["@ns"],
                                                 embedded_type_info,
                                                 fact['term'].split('/')[-1])

            add_fact_kargs['fact_dt_name'] = type_info['iobject_type_name']
            add_fact_kargs['fact_dt_namespace_uri'] = type_info['iobject_type_namespace_uri']
            add_fact_kargs['fact_dt_kind'] = FactDataType.REFERENCE

            return True

        if "xsi:type" in attr_info:
            # Use xsi:type attribute
            add_fact_kargs['fact_dt_name'] = attr_info["xsi:type"]

        elif "datatype" in attr_info and fact['node_id'] in attr_info["datatype"]:
            # Use 'datatype' attribute
            add_fact_kargs['fact_dt_name'] = attr_info["datatype"]
        else:
            return False

        # It may be the case that the datatype information contains namespace info
        if ':' in add_fact_kargs['fact_dt_name']:
            add_fact_kargs['fact_dt_kind'] = FactDataType.VOCAB_SINGLE
            add_fact_kargs['fact_dt_namespace_name'] = add_fact_kargs['fact_dt_name'].split(':')[0]
            add_fact_kargs['fact_dt_name'] = add_fact_kargs['fact_dt_name'].split(':')[1]

            add_fact_kargs['fact_dt_namespace_uri'] = namespace_mapping.get(add_fact_kargs['fact_dt_namespace_name'],
                                                                            '%s/%s' % (DINGOS_NAMESPACE_URI, (
                                                                                enrichment.iobject_family.name)))

        return True
def cybox_datatype_extractor ( self , enrichment , fact , attr_info , namespace_mapping , add_fact_kargs ) : if "idref" in attr_info : embedded_type_info = attr_info . get ( '@embedded_type_info' , None ) logger . debug ( "Embedded type info %s" % embedded_type_info ) type_info = self . derive_iobject_type ( attr_info [ "@ns" ] , embedded_type_info , fact [ 'term' ] . split ( '/' ) [ - 1 ] ) add_fact_kargs [ 'fact_dt_name' ] = type_info [ 'iobject_type_name' ] add_fact_kargs [ 'fact_dt_namespace_uri' ] = type_info [ 'iobject_type_namespace_uri' ] add_fact_kargs [ 'fact_dt_kind' ] = FactDataType . REFERENCE return True if "xsi:type" in attr_info : add_fact_kargs [ 'fact_dt_name' ] = attr_info [ "xsi:type" ] elif "datatype" in attr_info and fact [ 'node_id' ] in attr_info [ "datatype" ] : add_fact_kargs [ 'fact_dt_name' ] = attr_info [ "datatype" ] else : return False if ':' in add_fact_kargs [ 'fact_dt_name' ] : add_fact_kargs [ 'fact_dt_kind' ] = FactDataType . VOCAB_SINGLE add_fact_kargs [ 'fact_dt_namespace_name' ] = add_fact_kargs [ 'fact_dt_name' ] . split ( ':' ) [ 0 ] add_fact_kargs [ 'fact_dt_name' ] = add_fact_kargs [ 'fact_dt_name' ] . split ( ':' ) [ 1 ] add_fact_kargs [ 'fact_dt_namespace_uri' ] = namespace_mapping . get ( add_fact_kargs [ 'fact_dt_namespace_name' ] , '%s/%s' % ( DINGOS_NAMESPACE_URI , ( enrichment . iobject_family . name ) ) ) return True
The datatype extractor is called for each fact with the aim of determining the fact's datatype.
        The extractor function has the following signature:

        - Inputs:
          - info_object: the information object to which the fact is to be added
          - fact: the fact dictionary of the following form::
               { 'node_id': 'N001:L000:N000:A000',
                 'term': 'Hashes/Hash/Simple_Hash_Value',
                 'attribute': 'condition' / False,
                 'value': u'Equals'
               }
          - attr_info:
            A dictionary with mapping of XML attributes concerning the node in question
            (note that the keys do *not* have a leading '@' unless it is an internally
            generated attribute by Dingo.
          - namespace_mapping:
            A dictionary containing the namespace mapping extracted from the imported XML file.
          - add_fact_kargs:
            The arguments with which the fact will be generated after all handler functions
            have been called. The dictionary contains the following keys::

                'fact_dt_kind' : <FactDataType.NO_VOCAB/VOCAB_SINGLE/...>
                'fact_dt_namespace_name': <human-readable shortname for namespace uri>
                'fact_dt_namespace_uri': <namespace uri for datataype namespace>
                'fact_term_name' : <Fact Term such as 'Header/Subject/Address'>
                'fact_term_attribute': <Attribute key such as 'category' for fact terms describing an attribute>
                'values' : <list of FactValue objects that are the values of the fact to be generated>
                'node_id_name' : <node identifier such as 'N000:N000:A000'

        Just as the fact handler functions, the datatype extractor can change the add_fact_kargs dictionary
        and thus change the way in which the fact is created -- usually, this ability is used to change
        the following items in the dictionary:

        - fact_dt_name
        - fact_dt_namespace_uri
        - fact_dt_namespace_name (optional -- the defining part is the uri)
        - fact_dt_kind

        The extractor returns "True" if datatype info was found; otherwise, False is returned