MISP
/
cti-python-stix2
mirror of https://github.com/MISP/cti-python-stix2
2
0
Fork 0
Code Issues Releases Wiki Activity

Use correct Property classes for all STIX objects

stix2.1
clenk 2017-04-18 09:21:38 -04:00
parent a14d507f48
commit 05ccffc5bd
4 changed files with 76 additions and 70 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

118
stix2/sdo.py
View File

@ -3,7 +3,8 @@
from .base import _STIXBase from .base import _STIXBase
from .common import COMMON_PROPERTIES, KillChainPhase from .common import COMMON_PROPERTIES, KillChainPhase
from .properties import (Property, ListProperty, StringProperty, TypeProperty, from .properties import (Property, ListProperty, StringProperty, TypeProperty,
IDProperty, ReferenceProperty) IDProperty, TimestampProperty, ReferenceProperty,
IntegerProperty)
from .utils import NOW from .utils import NOW
@ -14,9 +15,9 @@ class AttackPattern(_STIXBase):
_properties.update({ _properties.update({
'type': TypeProperty(_type), 'type': TypeProperty(_type),
'id': IDProperty(_type), 'id': IDProperty(_type),
'name': Property(required=True), 'name': StringProperty(required=True),
'description': Property(), 'description': StringProperty(),
'kill_chain_phases': Property(), 'kill_chain_phases': ListProperty(KillChainPhase),
}) })
@ -27,12 +28,12 @@ class Campaign(_STIXBase):
_properties.update({ _properties.update({
'type': TypeProperty(_type), 'type': TypeProperty(_type),
'id': IDProperty(_type), 'id': IDProperty(_type),
'name': Property(required=True), 'name': StringProperty(required=True),
'description': Property(), 'description': StringProperty(),
'aliases': Property(), 'aliases': ListProperty(StringProperty),
'first_seen': Property(), 'first_seen': TimestampProperty(),
'last_seen': Property(), 'last_seen': TimestampProperty(),
'objective': Property(), 'objective': StringProperty(),
}) })
@ -43,8 +44,8 @@ class CourseOfAction(_STIXBase):
_properties.update({ _properties.update({
'type': TypeProperty(_type), 'type': TypeProperty(_type),
'id': IDProperty(_type), 'id': IDProperty(_type),
'name': Property(required=True), 'name': StringProperty(required=True),
'description': Property(), 'description': StringProperty(),
}) })
@ -55,11 +56,12 @@ class Identity(_STIXBase):
_properties.update({ _properties.update({
'type': TypeProperty(_type), 'type': TypeProperty(_type),
'id': IDProperty(_type), 'id': IDProperty(_type),
'name': Property(required=True), 'labels': ListProperty(StringProperty),
'description': Property(), 'name': StringProperty(required=True),
'identity_class': Property(required=True), 'description': StringProperty(),
'sectors': Property(), 'identity_class': StringProperty(required=True),
'contact_information': Property(), 'sectors': ListProperty(StringProperty),
'contact_information': StringProperty(),
}) })
@ -70,13 +72,13 @@ class Indicator(_STIXBase):
_properties.update({ _properties.update({
'type': TypeProperty(_type), 'type': TypeProperty(_type),
'id': IDProperty(_type), 'id': IDProperty(_type),
'labels': Property(required=True), 'labels': ListProperty(StringProperty, required=True),
'name': Property(), 'name': StringProperty(),
'description': Property(), 'description': StringProperty(),
'pattern': Property(required=True), 'pattern': StringProperty(required=True),
'valid_from': Property(default=lambda: NOW), 'valid_from': TimestampProperty(default=lambda: NOW),
'valid_until': Property(), 'valid_until': TimestampProperty(),
'kill_chain_phases': Property(), 'kill_chain_phases': ListProperty(KillChainPhase),
}) })
@ -87,15 +89,15 @@ class IntrusionSet(_STIXBase):
_properties.update({ _properties.update({
'type': TypeProperty(_type), 'type': TypeProperty(_type),
'id': IDProperty(_type), 'id': IDProperty(_type),
'name': Property(required=True), 'name': StringProperty(required=True),
'description': Property(), 'description': StringProperty(),
'aliases': Property(), 'aliases': ListProperty(StringProperty),
'first_seen': Property(), 'first_seen': TimestampProperty(),
'last_seen ': Property(), 'last_seen ': TimestampProperty(),
'goals': Property(), 'goals': ListProperty(StringProperty),
'resource_level': Property(), 'resource_level': StringProperty(),
'primary_motivation': Property(), 'primary_motivation': StringProperty(),
'secondary_motivations': Property(), 'secondary_motivations': ListProperty(StringProperty),
}) })
@ -120,9 +122,9 @@ class ObservedData(_STIXBase):
_properties.update({ _properties.update({
'type': TypeProperty(_type), 'type': TypeProperty(_type),
'id': IDProperty(_type), 'id': IDProperty(_type),
'first_observed': Property(), 'first_observed': TimestampProperty(required=True),
'last_observed': Property(), 'last_observed': TimestampProperty(required=True),
'number_observed': Property(), 'number_observed': IntegerProperty(required=True),
'objects': Property(), 'objects': Property(),
}) })
@ -134,10 +136,10 @@ class Report(_STIXBase):
_properties.update({ _properties.update({
'type': TypeProperty(_type), 'type': TypeProperty(_type),
'id': IDProperty(_type), 'id': IDProperty(_type),
'labels': Property(required=True), 'labels': ListProperty(StringProperty, required=True),
'name': Property(required=True), 'name': StringProperty(required=True),
'description': Property(), 'description': StringProperty(),
'published': Property(), 'published': TimestampProperty(),
'object_refs': ListProperty(ReferenceProperty), 'object_refs': ListProperty(ReferenceProperty),
}) })
@ -149,17 +151,17 @@ class ThreatActor(_STIXBase):
_properties.update({ _properties.update({
'type': TypeProperty(_type), 'type': TypeProperty(_type),
'id': IDProperty(_type), 'id': IDProperty(_type),
'labels': Property(required=True), 'labels': ListProperty(StringProperty, required=True),
'name': Property(required=True), 'name': StringProperty(required=True),
'description': Property(), 'description': StringProperty(),
'aliases': Property(), 'aliases': ListProperty(StringProperty),
'roles': Property(), 'roles': ListProperty(StringProperty),
'goals': Property(), 'goals': ListProperty(StringProperty),
'sophistication': Property(), 'sophistication': StringProperty(),
'resource_level': Property(), 'resource_level': StringProperty(),
'primary_motivation': Property(), 'primary_motivation': StringProperty(),
'secondary_motivations': Property(), 'secondary_motivations': ListProperty(StringProperty),
'personal_motivations': Property(), 'personal_motivations': ListProperty(StringProperty),
}) })
@ -170,11 +172,11 @@ class Tool(_STIXBase):
_properties.update({ _properties.update({
'type': TypeProperty(_type), 'type': TypeProperty(_type),
'id': IDProperty(_type), 'id': IDProperty(_type),
'labels': Property(required=True), 'labels': ListProperty(StringProperty, required=True),
'name': Property(required=True), 'name': StringProperty(required=True),
'description': Property(), 'description': StringProperty(),
'kill_chain_phases': Property(), 'kill_chain_phases': ListProperty(KillChainPhase),
'tool_version': Property(), 'tool_version': StringProperty(),
}) })
@ -185,6 +187,6 @@ class Vulnerability(_STIXBase):
_properties.update({ _properties.update({
'type': TypeProperty(_type), 'type': TypeProperty(_type),
'id': IDProperty(_type), 'id': IDProperty(_type),
'name': Property(required=True), 'name': StringProperty(required=True),
'description': Property(), 'description': StringProperty(),
}) })

16
stix2/sro.py
View File

@ -2,7 +2,9 @@
from .base import _STIXBase from .base import _STIXBase
from .common import COMMON_PROPERTIES from .common import COMMON_PROPERTIES
from .properties import IDProperty, TypeProperty, ReferenceProperty, ListProperty, Property from .properties import (ListProperty, StringProperty, TypeProperty,
IDProperty, TimestampProperty, ReferenceProperty,
IntegerProperty)
class Relationship(_STIXBase): class Relationship(_STIXBase):
@ -12,8 +14,8 @@ class Relationship(_STIXBase):
_properties.update({ _properties.update({
'id': IDProperty(_type), 'id': IDProperty(_type),
'type': TypeProperty(_type), 'type': TypeProperty(_type),
'relationship_type': Property(required=True), 'relationship_type': StringProperty(required=True),
'description': Property(), 'description': StringProperty(),
'source_ref': ReferenceProperty(required=True), 'source_ref': ReferenceProperty(required=True),
'target_ref': ReferenceProperty(required=True), 'target_ref': ReferenceProperty(required=True),
}) })
@ -41,13 +43,13 @@ class Sighting(_STIXBase):
_properties.update({ _properties.update({
'id': IDProperty(_type), 'id': IDProperty(_type),
'type': TypeProperty(_type), 'type': TypeProperty(_type),
'first_seen': Property(), 'first_seen': TimestampProperty(),
'last_seen': Property(), 'last_seen': TimestampProperty(),
'count': Property(), 'count': IntegerProperty(),
'sighting_of_ref': ReferenceProperty(required=True), 'sighting_of_ref': ReferenceProperty(required=True),
'observed_data_refs': ListProperty(ReferenceProperty(type="observed-data")), 'observed_data_refs': ListProperty(ReferenceProperty(type="observed-data")),
'where_sighted_refs': ListProperty(ReferenceProperty(type="identity")), 'where_sighted_refs': ListProperty(ReferenceProperty(type="identity")),
'summary': Property(), 'summary': StringProperty(),
}) })
# Explicitly define the first kwargs to make readable Sighting declarations. # Explicitly define the first kwargs to make readable Sighting declarations.

4
stix2/test/test_indicator.py
View File

@ -2,6 +2,7 @@ import datetime as dt
import pytest import pytest
import pytz import pytz
import re
import stix2 import stix2
@ -45,7 +46,8 @@ def test_indicator_with_all_required_fields():
) )
assert str(ind) == EXPECTED_INDICATOR assert str(ind) == EXPECTED_INDICATOR
assert repr(ind) == EXPECTED_INDICATOR_REPR rep = re.sub(r"(\[|=| )u('|\"|\\\'|\\\")", r"\g<1>\g<2>", repr(ind))
assert rep == EXPECTED_INDICATOR_REPR
def test_indicator_autogenerated_fields(indicator): def test_indicator_autogenerated_fields(indicator):

8
stix2/test/test_report.py
View File

@ -17,7 +17,7 @@ EXPECTED = """{
"campaign--83422c77-904c-4dc1-aff5-5c38f3a2c55c", "campaign--83422c77-904c-4dc1-aff5-5c38f3a2c55c",
"relationship--f82356ae-fe6c-437c-9c24-6b64314ae68a" "relationship--f82356ae-fe6c-437c-9c24-6b64314ae68a"
], ],
"published": "2016-01-201T17:00:00Z", "published": "2016-01-20T17:00:00Z",
"type": "report" "type": "report"
}""" }"""
@ -30,7 +30,7 @@ def test_report_example():
modified="2015-12-21T19:59:11Z", modified="2015-12-21T19:59:11Z",
name="The Black Vine Cyberespionage Group", name="The Black Vine Cyberespionage Group",
description="A simple report with an indicator and campaign", description="A simple report with an indicator and campaign",
published="2016-01-201T17:00:00Z", published="2016-01-20T17:00:00Z",
labels=["campaign"], labels=["campaign"],
object_refs=[ object_refs=[
"indicator--26ffb872-1dd9-446e-b6f5-d58527e5b5d2", "indicator--26ffb872-1dd9-446e-b6f5-d58527e5b5d2",
@ -50,7 +50,7 @@ def test_report_example_objects_in_object_refs():
modified="2015-12-21T19:59:11.000Z", modified="2015-12-21T19:59:11.000Z",
name="The Black Vine Cyberespionage Group", name="The Black Vine Cyberespionage Group",
description="A simple report with an indicator and campaign", description="A simple report with an indicator and campaign",
published="2016-01-201T17:00:00Z", published="2016-01-20T17:00:00Z",
labels=["campaign"], labels=["campaign"],
object_refs=[ object_refs=[
stix2.Indicator(id="indicator--26ffb872-1dd9-446e-b6f5-d58527e5b5d2", **INDICATOR_KWARGS), stix2.Indicator(id="indicator--26ffb872-1dd9-446e-b6f5-d58527e5b5d2", **INDICATOR_KWARGS),
@ -71,7 +71,7 @@ def test_report_example_objects_in_object_refs_with_bad_id():
modified="2015-12-21T19:59:11.000Z", modified="2015-12-21T19:59:11.000Z",
name="The Black Vine Cyberespionage Group", name="The Black Vine Cyberespionage Group",
description="A simple report with an indicator and campaign", description="A simple report with an indicator and campaign",
published="2016-01-201T17:00:00Z", published="2016-01-20T17:00:00Z",
labels=["campaign"], labels=["campaign"],
object_refs=[ object_refs=[
stix2.Indicator(id="indicator--26ffb872-1dd9-446e-b6f5-d58527e5b5d2", **INDICATOR_KWARGS), stix2.Indicator(id="indicator--26ffb872-1dd9-446e-b6f5-d58527e5b5d2", **INDICATOR_KWARGS),