Skip to content

Transformer Adapter Configuration

The TAVM framework supports any number of transformer adapters which transform raw data from specific content-types into STIX 2.1 format.

By default, the framework loads all transformer adapters which have a YAML configuration file located in the config/transformers directory. The configuration file lookup-path can be changed in the general.yaml configuration file, see Core Settings.

Each transformer adapter must have a unique id which is defined by the configuration file name.

Transformer Adapter Concepts

Transformer adapters are configured via a YAML configuration file. The configuration filename consists of the adapter name, for example cve. For each transformer adapter, a corresponding plugin folder must exist in the plugins/transfromers directory (path can be overridden in general.yaml, see Core Settings). The folder for an example cve transformer adapter would be plugins/transfromers/cve.

TAVM will start each transformer adapter as a separate process. The entrypoint of the process can be defined in the configuration file. By default, the adapter executable is searched in the plugin folder.

An architectural overview of the transformer adapter concept can be seen in the following image:

Transformer Adapter Architecture!

Configuration File Naming

As each transformer adapter must have a unique id, the configuration file name must follow a specific format:

<transformer_id>.yaml

The <transformer_id> is the name of the transformer adapter. For example cve. A folder with the transformer name (<transformer_id>) must exist in the transformer plugin directory.

Sample filenames can be seen in the following image:

Transformer Adapter Configuration Files

Configuration File Format

The YAML configuration of source adapters must contain the following fields:

  • Enabled: A boolean flag that specifies if the adapter is enabled or not.
  • Description: A short description of the adapter.
  • ContentType: The content type that the adapter can transform. A special value is * which means that the adapter can transform any content type.
  • Executable: The path to the executable of the adapter. The path is relative to the adapter plugin folder. An absolute path can also be used.

The configuration allows the following optional fields:

  • OutputType: The output type of the adapter. The default value is taxii2. The only other supported value is repominer. The output type must be unique for each content type.
  • Configuration: A custom YAML object that contains adapter specific configuration.

A sample configuration file for the RSS source adapter can be seen here:

Enabled: true
Description: A RSS feed (gofeed) to STIX 2.1 converter
ContentType: json-feed
OutputType: taxii2
Executable: ./run.sh
Configuration:
  openai_api_key: the-super-secret-api-key
  use_llm: true