MISP
/
cti-python-stix2
mirror of https://github.com/MISP/cti-python-stix2
2
0
Fork 0
Code Issues Releases Wiki Activity

added test for Timestamp_Constant

stix2.1
Richard Piazza 2017-10-05 13:43:56 -04:00
parent ebd28aca9d
commit 0dc3226048
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
stix2/test/test_pattern_expressions.py
View File

@ -170,3 +170,18 @@ def test_set_op():
exp = stix2.ObservationExpression(stix2.IsSubsetComparisonExpression("network-traffic:dst_ref.value", exp = stix2.ObservationExpression(stix2.IsSubsetComparisonExpression("network-traffic:dst_ref.value",
"2001:0db8:dead:beef:0000:0000:0000:0000/64")) "2001:0db8:dead:beef:0000:0000:0000:0000/64"))
assert str(exp) == "[network-traffic:dst_ref.value ISSUBSET '2001:0db8:dead:beef:0000:0000:0000:0000/64']" assert str(exp) == "[network-traffic:dst_ref.value ISSUBSET '2001:0db8:dead:beef:0000:0000:0000:0000/64']"
# [(file:name = 'pdf.exe' OR file:size = '371712') AND file:created = t'2014-01-13T07:03:17Z']
def test_timestamp():
exp_or = stix2.OrBooleanExpression([stix2.EqualityComparisonExpression("file:name",
"pdf.exe"),
stix2.EqualityComparisonExpression("file:size",
stix2.IntegerConstant('371712'))])
exp_paren = stix2.ParentheticalExpression(exp_or)
exp_and = stix2.AndBooleanExpression([exp_paren,
stix2.EqualityComparisonExpression("file:created",
stix2.TimestampConstant('2014-01-13T07:03:17Z'))])
exp = stix2.ObservationExpression(exp_and)
assert str(exp) == "[(file:name = 'pdf.exe' OR file:size = 371712) AND file:created = t'2014-01-13T07:03:17Z']"