Skip to content

Update gen commands (SYN-9906) #4637

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mikemoritz wants to merge 3 commits into
base: synapse-3xx
Choose a base branch
from
+323 −792
Open

Update gen commands (SYN-9906) #4637

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
12364f0
update gen funcs/lib
mikemoritz Dec 29, 2025
ad239f4
update tests
mikemoritz Dec 29, 2025
ebe14a1
fix doc build
mikemoritz Dec 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions docs/synapse/userguides/storm_adv_functions.rstorm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -439,7 +439,7 @@ simplifies this process.

.. TIP::

Synapse includes `gen.*`_ (generator) Storm commands and `$lib.gen`_ APIs that can generate many
Synapse includes `gen.*`_ (generator) Storm commands that can generate many
common guid-based forms using secondary property deconfliction.


Expand Down Expand Up @@ -775,6 +775,5 @@ keyword to yield any nodes into the pipeline; use a for loop to iterate over fun
.. _guid-based: https://synapse.docs.vertex.link/en/latest/synapse/userguides/storm_ref_type_specific.html#guid
.. _secondary property deconfliction: https://synapse.docs.vertex.link/en/latest/synapse/userguides/storm_ref_type_specific.html#guid-best-practices
.. _gen.*: https://synapse.docs.vertex.link/en/latest/synapse/userguides/storm_ref_cmd.html#gen
.. _$lib.gen: https://synapse.docs.vertex.link/en/latest/synapse/autodocs/stormtypes_libs.html#lib-gen
.. _privileged modules: https://synapse.docs.vertex.link/en/latest/synapse/devguides/power-ups.html#privileged-modules
.. _Storm debugging tips: https://synapse.docs.vertex.link/en/latest/synapse/userguides/storm_adv_control.html#storm-debugging-tips
79 changes: 1 addition & 78 deletions docs/synapse/userguides/storm_ref_cmd.rstorm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1009,18 +1009,13 @@ an organization node deconflicted and created based on a name will only have its
property set). Users can set additional property values as they see fit.

- `gen.geo.place`_
- `gen.it.av.scan.result`_
- `gen.it.software`_
- `gen.lang.language`_
- `gen.entity.campaign`_
- `gen.ou.id.number`_
- `gen.ou.id.type`_
- `gen.ou.industry`_
- `gen.ou.org`_
- `gen.ou.org.hq`_
- `gen.pol.country`_
- `gen.pol.country.government`_
- `gen.ps.contact.email`_
- `gen.risk.threat`_
- `gen.risk.tool.software`_
- `gen.risk.vuln`_
Expand Down Expand Up @@ -1049,22 +1044,6 @@ name (``geo:place:name`` and / or ``geo:place:names`` properties).
.. storm-cli:: gen.geo.place --help


.. _storm-gen-it-av-scan-result:

gen.it.av.scan.result
+++++++++++++++++++++

The ``gen.it.av.scan.result`` command locates (lifts) or creates an ``it:av:scan:result`` node based
on the form and value of the object scanned and the signature name used for the scan.

You can optionally include the name of the scanner / scan engine and/or the time the scan was performed
for additional deconfliction.

**Syntax:**

.. storm-cli:: gen.it.av.scan.result --help


.. _storm-gen-it-software:

gen.it.software
Expand Down Expand Up @@ -1105,32 +1084,6 @@ organization (``entity:campaign:reporter:name``).
.. storm-cli:: gen.entity.campaign --help


.. _storm-gen-ou-id-number:

gen.ou.id.number
++++++++++++++++

The ``gen.ou.id.number`` command locates (lifts) or creates an ``ou:id:number`` node based on
the organization ID type (``ou:id:type``) and organization ID value (``ou:id:value``).

**Syntax:**

.. storm-cli:: gen.ou.id.number --help


.. _storm-gen-ou-id-type:

gen.ou.id.type
++++++++++++++

The ``gen.ou.id.type`` command locates (lifts) or creates an ``ou:id:type`` node based on
the friendly name of the organization ID type (``ou:id:type:name``).

**Syntax:**

.. storm-cli:: gen.ou.id.type --help


.. _storm-gen-ou-industry:

gen.ou.industry
Expand All @@ -1157,23 +1110,6 @@ name (``ou:org:name`` and / or ``ou:org:names``).
.. storm-cli:: gen.ou.org --help


.. _storm-gen-ou-org-hq:

gen.ou.org.hq
+++++++++++++

The ``gen.ou.org.hq`` command locates (lifts) the primary ``ps:contact`` node for an organization
(i.e., the contact set for the ``ou:org:hq`` property) or creates the contact node (and sets the
``ou:org:hq`` property) if it does not exist, based on the organization name (``ou:org:name`` and / or
``ou:org:names``).

**Syntax:**

..
FIXME - Correct this for 3.0.0 model changes when it is stable
.. storm-cli:: gen.ou.org.hq --help


.. _storm-gen-pol-country:

gen.pol.country
Expand Down Expand Up @@ -1202,19 +1138,6 @@ on the two-letter ISO-3166 country code (``pol:country:iso2``).
.. storm-cli:: gen.pol.country.government --help


.. _storm-gen-ps-contact-email:

gen.ps.contact.email
++++++++++++++++++++

The ``gen.ps.contact.email`` command locates (lifts) or creates a ``ps:contact`` node using
the contact's primary email address (``ps:contact:email``) and type (``ps:contact:type``).

**Syntax:**

.. storm-cli:: gen.ps.contact.email --help


.. _storm-gen-risk-threat:

gen.risk.threat
Expand Down Expand Up @@ -1251,7 +1174,7 @@ gen.risk.vuln

The ``gen.risk.vuln`` command locates (lifts) or creates a ``risk:tool:vuln`` node using the
Common Vulnerabilities and Exposures (CVE) number associated with the vulnerability
(``risk:vuln:cve``) and the name of the entity reporting on the vulnerability (``risk:vuln:reporter:name``).
(``risk:vuln:id``) and the name of the entity reporting on the vulnerability (``risk:vuln:reporter:name``).

**Syntax:**

Expand Down
Loading