Passing a value for ``type`` that does not match the class being
constructed will cause an error:
``python >>> indicator = Indicator(type='xxx', ...) stix2.exceptions.InvalidValueError: Invalid value for Indicator 'type': must equal 'indicator'.``
- If not provided, ``id`` will be generated randomly. If you provide an
``id`` argument, it must begin with the correct prefix:
``python >>> indicator = Indicator(id="campaign--63ce9068-b5ab-47fa-a2cf-a602ea01f21a") stix2.exceptions.InvalidValueError: Invalid value for Indicator 'id': must start with 'indicator--'.``
- If not provided, ``created`` and ``modified`` will be set to the
(same) current time.
For indicators, ``labels`` and ``pattern`` are required and cannot be
set automatically. Trying to create an indicator that is missing one of
these properties will result in an error:
..code:: python
>>> indicator = Indicator()
stix2.exceptions.MissingPropertiesError: No values for required properties for Indicator: (labels, pattern).
However, the required ``valid_from`` attribute on Indicators will be set
to the current time if not provided as a keyword argument.
Once created, the object acts like a frozen dictionary. Properties can
be accessed using the standard Python dictionary syntax:
..code:: python
>>> indicator['name']
'File hash for malware variant'
TBD: Should we allow property access using the standard Python attribute
syntax?
..code:: python
>>> indicator.name
'File hash for malware variant'
Attempting to modify any attributes will raise an error:
..code:: python
>>> indicator['name'] = "This is a revised name"
TypeError: 'Indicator' object does not support item assignment
>>> indicator.name = "This is a revised name"
stix2.exceptions.ImmutableError: Cannot modify properties after creation.
To update the properties of an object, see `Versioning <#versioning>`__
below.
Creating a Malware object follows the same pattern:
..code:: python
from stix2 import Malware
malware = Malware(name="Poison Ivy",
labels=['remote-access-trojan'])
As with indicators, the ``type``, ``id``, ``created``, and ``modified``
properties will be set automatically if not provided. For Malware
objects, the ``labels`` and ``name`` properties must be provided.
Creating Relationships
~~~~~~~~~~~~~~~~~~~~~~
STIX 2 Relationships are separate objects, not properties of the object
on either side of the relationship. They are constructed similarly to
other STIX objects. The ``type``, ``id``, ``created``, and ``modified``
properties are added automatically if not provided. Callers must provide
the ``relationship_type``, ``source_ref``, and ``target_ref``
