Update required properties, indicator label and tests. closes #68
parent
4d819820e5
commit
24bc282d7e
|
@ -116,7 +116,6 @@ class Indicator(STIXDomainObject):
|
||||||
('created_by_ref', ReferenceProperty(type="identity")),
|
('created_by_ref', ReferenceProperty(type="identity")),
|
||||||
('created', TimestampProperty(default=lambda: NOW, precision='millisecond')),
|
('created', TimestampProperty(default=lambda: NOW, precision='millisecond')),
|
||||||
('modified', TimestampProperty(default=lambda: NOW, precision='millisecond')),
|
('modified', TimestampProperty(default=lambda: NOW, precision='millisecond')),
|
||||||
('labels', ListProperty(StringProperty, required=True)),
|
|
||||||
('name', StringProperty()),
|
('name', StringProperty()),
|
||||||
('description', StringProperty()),
|
('description', StringProperty()),
|
||||||
('pattern', PatternProperty(required=True)),
|
('pattern', PatternProperty(required=True)),
|
||||||
|
@ -124,6 +123,7 @@ class Indicator(STIXDomainObject):
|
||||||
('valid_until', TimestampProperty()),
|
('valid_until', TimestampProperty()),
|
||||||
('kill_chain_phases', ListProperty(KillChainPhase)),
|
('kill_chain_phases', ListProperty(KillChainPhase)),
|
||||||
('revoked', BooleanProperty()),
|
('revoked', BooleanProperty()),
|
||||||
|
('labels', ListProperty(StringProperty, required=True)),
|
||||||
('external_references', ListProperty(ExternalReference)),
|
('external_references', ListProperty(ExternalReference)),
|
||||||
('object_marking_refs', ListProperty(ReferenceProperty(type="marking-definition"))),
|
('object_marking_refs', ListProperty(ReferenceProperty(type="marking-definition"))),
|
||||||
('granular_markings', ListProperty(GranularMarking)),
|
('granular_markings', ListProperty(GranularMarking)),
|
||||||
|
@ -191,7 +191,7 @@ class ObservedData(STIXDomainObject):
|
||||||
('first_observed', TimestampProperty(required=True)),
|
('first_observed', TimestampProperty(required=True)),
|
||||||
('last_observed', TimestampProperty(required=True)),
|
('last_observed', TimestampProperty(required=True)),
|
||||||
('number_observed', IntegerProperty(required=True)),
|
('number_observed', IntegerProperty(required=True)),
|
||||||
('objects', ObservableProperty()),
|
('objects', ObservableProperty(required=True)),
|
||||||
('revoked', BooleanProperty()),
|
('revoked', BooleanProperty()),
|
||||||
('labels', ListProperty(StringProperty)),
|
('labels', ListProperty(StringProperty)),
|
||||||
('external_references', ListProperty(ExternalReference)),
|
('external_references', ListProperty(ExternalReference)),
|
||||||
|
@ -212,8 +212,8 @@ class Report(STIXDomainObject):
|
||||||
('modified', TimestampProperty(default=lambda: NOW, precision='millisecond')),
|
('modified', TimestampProperty(default=lambda: NOW, precision='millisecond')),
|
||||||
('name', StringProperty(required=True)),
|
('name', StringProperty(required=True)),
|
||||||
('description', StringProperty()),
|
('description', StringProperty()),
|
||||||
('published', TimestampProperty()),
|
('published', TimestampProperty(required=True)),
|
||||||
('object_refs', ListProperty(ReferenceProperty)),
|
('object_refs', ListProperty(ReferenceProperty, required=True)),
|
||||||
('revoked', BooleanProperty()),
|
('revoked', BooleanProperty()),
|
||||||
('labels', ListProperty(StringProperty, required=True)),
|
('labels', ListProperty(StringProperty, required=True)),
|
||||||
('external_references', ListProperty(ExternalReference)),
|
('external_references', ListProperty(ExternalReference)),
|
||||||
|
|
|
@ -13,11 +13,11 @@ EXPECTED_BUNDLE = """{
|
||||||
"id": "indicator--00000000-0000-0000-0000-000000000001",
|
"id": "indicator--00000000-0000-0000-0000-000000000001",
|
||||||
"created": "2017-01-01T12:34:56.000Z",
|
"created": "2017-01-01T12:34:56.000Z",
|
||||||
"modified": "2017-01-01T12:34:56.000Z",
|
"modified": "2017-01-01T12:34:56.000Z",
|
||||||
|
"pattern": "[file:hashes.MD5 = 'd41d8cd98f00b204e9800998ecf8427e']",
|
||||||
|
"valid_from": "2017-01-01T12:34:56Z",
|
||||||
"labels": [
|
"labels": [
|
||||||
"malicious-activity"
|
"malicious-activity"
|
||||||
],
|
]
|
||||||
"pattern": "[file:hashes.MD5 = 'd41d8cd98f00b204e9800998ecf8427e']",
|
|
||||||
"valid_from": "2017-01-01T12:34:56Z"
|
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"type": "malware",
|
"type": "malware",
|
||||||
|
|
|
@ -14,11 +14,11 @@ EXPECTED_INDICATOR = """{
|
||||||
"id": "indicator--01234567-89ab-cdef-0123-456789abcdef",
|
"id": "indicator--01234567-89ab-cdef-0123-456789abcdef",
|
||||||
"created": "2017-01-01T00:00:01.000Z",
|
"created": "2017-01-01T00:00:01.000Z",
|
||||||
"modified": "2017-01-01T00:00:01.000Z",
|
"modified": "2017-01-01T00:00:01.000Z",
|
||||||
|
"pattern": "[file:hashes.MD5 = 'd41d8cd98f00b204e9800998ecf8427e']",
|
||||||
|
"valid_from": "1970-01-01T00:00:01Z",
|
||||||
"labels": [
|
"labels": [
|
||||||
"malicious-activity"
|
"malicious-activity"
|
||||||
],
|
]
|
||||||
"pattern": "[file:hashes.MD5 = 'd41d8cd98f00b204e9800998ecf8427e']",
|
|
||||||
"valid_from": "1970-01-01T00:00:01Z"
|
|
||||||
}"""
|
}"""
|
||||||
|
|
||||||
EXPECTED_INDICATOR_REPR = "Indicator(" + " ".join("""
|
EXPECTED_INDICATOR_REPR = "Indicator(" + " ".join("""
|
||||||
|
@ -26,9 +26,9 @@ EXPECTED_INDICATOR_REPR = "Indicator(" + " ".join("""
|
||||||
id='indicator--01234567-89ab-cdef-0123-456789abcdef',
|
id='indicator--01234567-89ab-cdef-0123-456789abcdef',
|
||||||
created='2017-01-01T00:00:01.000Z',
|
created='2017-01-01T00:00:01.000Z',
|
||||||
modified='2017-01-01T00:00:01.000Z',
|
modified='2017-01-01T00:00:01.000Z',
|
||||||
labels=['malicious-activity'],
|
|
||||||
pattern="[file:hashes.MD5 = 'd41d8cd98f00b204e9800998ecf8427e']",
|
pattern="[file:hashes.MD5 = 'd41d8cd98f00b204e9800998ecf8427e']",
|
||||||
valid_from='1970-01-01T00:00:01Z'
|
valid_from='1970-01-01T00:00:01Z',
|
||||||
|
labels=['malicious-activity']
|
||||||
""".split()) + ")"
|
""".split()) + ")"
|
||||||
|
|
||||||
|
|
||||||
|
@ -39,11 +39,11 @@ def test_indicator_with_all_required_properties():
|
||||||
ind = stix2.Indicator(
|
ind = stix2.Indicator(
|
||||||
type="indicator",
|
type="indicator",
|
||||||
id=INDICATOR_ID,
|
id=INDICATOR_ID,
|
||||||
labels=['malicious-activity'],
|
|
||||||
pattern="[file:hashes.MD5 = 'd41d8cd98f00b204e9800998ecf8427e']",
|
|
||||||
created=now,
|
created=now,
|
||||||
modified=now,
|
modified=now,
|
||||||
|
pattern="[file:hashes.MD5 = 'd41d8cd98f00b204e9800998ecf8427e']",
|
||||||
valid_from=epoch,
|
valid_from=epoch,
|
||||||
|
labels=['malicious-activity'],
|
||||||
)
|
)
|
||||||
|
|
||||||
assert str(ind) == EXPECTED_INDICATOR
|
assert str(ind) == EXPECTED_INDICATOR
|
||||||
|
|
Loading…
Reference in New Issue