From 0dc3226048e84b6585e5c851825746cd61ee5214 Mon Sep 17 00:00:00 2001 From: Richard Piazza Date: Thu, 5 Oct 2017 13:43:56 -0400 Subject: [PATCH] added test for Timestamp_Constant --- stix2/test/test_pattern_expressions.py | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/stix2/test/test_pattern_expressions.py b/stix2/test/test_pattern_expressions.py index e806aa6..d918cfe 100644 --- a/stix2/test/test_pattern_expressions.py +++ b/stix2/test/test_pattern_expressions.py @@ -170,3 +170,18 @@ def test_set_op(): exp = stix2.ObservationExpression(stix2.IsSubsetComparisonExpression("network-traffic:dst_ref.value", "2001:0db8:dead:beef:0000:0000:0000:0000/64")) assert str(exp) == "[network-traffic:dst_ref.value ISSUBSET '2001:0db8:dead:beef:0000:0000:0000:0000/64']" + + +# [(file:name = 'pdf.exe' OR file:size = '371712') AND file:created = t'2014-01-13T07:03:17Z'] +def test_timestamp(): + exp_or = stix2.OrBooleanExpression([stix2.EqualityComparisonExpression("file:name", + "pdf.exe"), + stix2.EqualityComparisonExpression("file:size", + stix2.IntegerConstant('371712'))]) + exp_paren = stix2.ParentheticalExpression(exp_or) + exp_and = stix2.AndBooleanExpression([exp_paren, + stix2.EqualityComparisonExpression("file:created", + stix2.TimestampConstant('2014-01-13T07:03:17Z'))]) + exp = stix2.ObservationExpression(exp_and) + assert str(exp) == "[(file:name = 'pdf.exe' OR file:size = 371712) AND file:created = t'2014-01-13T07:03:17Z']" +