MISP
/
cti-python-stix2
mirror of https://github.com/MISP/cti-python-stix2
2
0
Fork 0
Code Issues Releases Wiki Activity

Add variables for each individual enum value in the vocab modules.

pull/1/head
Michael Chisholm 2021-04-15 22:06:57 -04:00
parent 4dc8e49d3c
commit 2b064872a4
2 changed files with 995 additions and 454 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

408
stix2/v20/vocab.py
View File

@ -2,177 +2,329 @@
STIX 2.0 open vocabularies and enums STIX 2.0 open vocabularies and enums
""" """
ATTACK_MOTIVATION_ACCIDENTAL = "accidental"
ATTACK_MOTIVATION_COERCION = "coercion"
ATTACK_MOTIVATION_DOMINANCE = "dominance"
ATTACK_MOTIVATION_IDEOLOGY = "ideology"
ATTACK_MOTIVATION_NOTORIETY = "notoriety"
ATTACK_MOTIVATION_ORGANIZATIONAL_GAIN = "organizational-gain"
ATTACK_MOTIVATION_PERSONAL_GAIN = "personal-gain"
ATTACK_MOTIVATION_PERSONAL_SATISFACTION = "personal-satisfaction"
ATTACK_MOTIVATION_REVENGE = "revenge"
ATTACK_MOTIVATION_UNPREDICTABLE = "unpredictable"
ATTACK_MOTIVATION = [ ATTACK_MOTIVATION = [
"accidental", ATTACK_MOTIVATION_ACCIDENTAL,
"coercion", ATTACK_MOTIVATION_COERCION,
"dominance", ATTACK_MOTIVATION_DOMINANCE,
"ideology", ATTACK_MOTIVATION_IDEOLOGY,
"notoriety", ATTACK_MOTIVATION_NOTORIETY,
"organizational-gain", ATTACK_MOTIVATION_ORGANIZATIONAL_GAIN,
"personal-gain", ATTACK_MOTIVATION_PERSONAL_GAIN,
"personal-satisfaction", ATTACK_MOTIVATION_PERSONAL_SATISFACTION,
"revenge", ATTACK_MOTIVATION_REVENGE,
"unpredictable", ATTACK_MOTIVATION_UNPREDICTABLE,
] ]
ATTACK_RESOURCE_LEVEL_INDIVIDUAL = "individual"
ATTACK_RESOURCE_LEVEL_CLUB = "club"
ATTACK_RESOURCE_LEVEL_CONTEST = "contest"
ATTACK_RESOURCE_LEVEL_TEAM = "team"
ATTACK_RESOURCE_LEVEL_ORGANIZATION = "organization"
ATTACK_RESOURCE_LEVEL_GOVERNMENT = "government"
ATTACK_RESOURCE_LEVEL = [ ATTACK_RESOURCE_LEVEL = [
"individual", ATTACK_RESOURCE_LEVEL_INDIVIDUAL,
"club", ATTACK_RESOURCE_LEVEL_CLUB,
"contest", ATTACK_RESOURCE_LEVEL_CONTEST,
"team", ATTACK_RESOURCE_LEVEL_TEAM,
"organization", ATTACK_RESOURCE_LEVEL_ORGANIZATION,
"government", ATTACK_RESOURCE_LEVEL_GOVERNMENT,
] ]
HASHING_ALGORITHM_MD5 = "MD5"
HASHING_ALGORITHM_MD6 = "MD6"
HASHING_ALGORITHM_RIPEMD_160 = "RIPEMD-160"
HASHING_ALGORITHM_SHA_1 = "SHA-1"
HASHING_ALGORITHM_SHA_224 = "SHA-224"
HASHING_ALGORITHM_SHA_256 = "SHA-256"
HASHING_ALGORITHM_SHA_384 = "SHA-384"
HASHING_ALGORITHM_SHA_512 = "SHA-512"
HASHING_ALGORITHM_SHA3_224 = "SHA3-224"
HASHING_ALGORITHM_SHA3_256 = "SHA3-256"
HASHING_ALGORITHM_SHA3_384 = "SHA3-384"
HASHING_ALGORITHM_SHA3_512 = "SHA3-512"
HASHING_ALGORITHM_SSDEEP = "ssdeep"
HASHING_ALGORITHM_WHIRLPOOL = "WHIRLPOOL"
HASHING_ALGORITHM = [ HASHING_ALGORITHM = [
"MD5", HASHING_ALGORITHM_MD5,
"MD6", HASHING_ALGORITHM_MD6,
"RIPEMD-160", HASHING_ALGORITHM_RIPEMD_160,
"SHA-1", HASHING_ALGORITHM_SHA_1,
"SHA-224", HASHING_ALGORITHM_SHA_224,
"SHA-256", HASHING_ALGORITHM_SHA_256,
"SHA-384", HASHING_ALGORITHM_SHA_384,
"SHA-512", HASHING_ALGORITHM_SHA_512,
"SHA3-224", HASHING_ALGORITHM_SHA3_224,
"SHA3-256", HASHING_ALGORITHM_SHA3_256,
"SHA3-384", HASHING_ALGORITHM_SHA3_384,
"SHA3-512", HASHING_ALGORITHM_SHA3_512,
"ssdeep", HASHING_ALGORITHM_SSDEEP,
"WHIRLPOOL", HASHING_ALGORITHM_WHIRLPOOL,
] ]
IDENTITY_CLASS_INDIVIDUAL = "individual"
IDENTITY_CLASS_GROUP = "group"
IDENTITY_CLASS_ORGANIZATION = "organization"
IDENTITY_CLASS_CLASS = "class"
IDENTITY_CLASS_UNKNOWN = "unknown"
IDENTITY_CLASS = [ IDENTITY_CLASS = [
"individual", IDENTITY_CLASS_INDIVIDUAL,
"group", IDENTITY_CLASS_GROUP,
"organization", IDENTITY_CLASS_ORGANIZATION,
"class", IDENTITY_CLASS_CLASS,
"unknown", IDENTITY_CLASS_UNKNOWN,
] ]
INDICATOR_LABEL_ANOMALOUS_ACTIVITY = "anomalous-activity"
INDICATOR_LABEL_ANONYMIZATION = "anonymization"
INDICATOR_LABEL_BENIGN = "benign"
INDICATOR_LABEL_COMPROMISED = "compromised"
INDICATOR_LABEL_MALICIOUS_ACTIVITY = "malicious-activity"
INDICATOR_LABEL_ATTRIBUTION = "attribution"
INDICATOR_LABEL = [ INDICATOR_LABEL = [
"anomalous-activity", INDICATOR_LABEL_ANOMALOUS_ACTIVITY,
"anonymization", INDICATOR_LABEL_ANONYMIZATION,
"benign", INDICATOR_LABEL_BENIGN,
"compromised", INDICATOR_LABEL_COMPROMISED,
"malicious-activity", INDICATOR_LABEL_MALICIOUS_ACTIVITY,
"attribution", INDICATOR_LABEL_ATTRIBUTION,
] ]
INDUSTRY_SECTOR_AGRICULTURE = "agriculture"
INDUSTRY_SECTOR_AEROSPACE = "aerospace"
INDUSTRY_SECTOR_AUTOMOTIVE = "automotive"
INDUSTRY_SECTOR_COMMUNICATIONS = "communications"
INDUSTRY_SECTOR_CONSTRUCTION = "construction"
INDUSTRY_SECTOR_DEFENCE = "defence"
INDUSTRY_SECTOR_EDUCATION = "education"
INDUSTRY_SECTOR_ENERGY = "energy"
INDUSTRY_SECTOR_ENTERTAINMENT = "entertainment"
INDUSTRY_SECTOR_FINANCIAL_SERVICES = "financial-services"
INDUSTRY_SECTOR_GOVERNMENT_NATIONAL = "government-national"
INDUSTRY_SECTOR_GOVERNMENT_REGIONAL = "government-regional"
INDUSTRY_SECTOR_GOVERNMENT_LOCAL = "government-local"
INDUSTRY_SECTOR_GOVERNMENT_PUBLIC_SERVICES = "government-public-services"
INDUSTRY_SECTOR_HEALTHCARE = "healthcare"
INDUSTRY_SECTOR_HOSPITALITY_LEISURE = "hospitality-leisure"
INDUSTRY_SECTOR_INFRASTRUCTURE = "infrastructure"
INDUSTRY_SECTOR_INSURANCE = "insurance"
INDUSTRY_SECTOR_MANUFACTURING = "manufacturing"
INDUSTRY_SECTOR_MINING = "mining"
INDUSTRY_SECTOR_NON_PROFIT = "non-profit"
INDUSTRY_SECTOR_PHARMACEUTICALS = "pharmaceuticals"
INDUSTRY_SECTOR_RETAIL = "retail"
INDUSTRY_SECTOR_TECHNOLOGY = "technology"
INDUSTRY_SECTOR_TELECOMMUNICATIONS = "telecommunications"
INDUSTRY_SECTOR_TRANSPORTATION = "transportation"
INDUSTRY_SECTOR_UTILITIES = "utilities"
INDUSTRY_SECTOR = [ INDUSTRY_SECTOR = [
"agriculture", INDUSTRY_SECTOR_AGRICULTURE,
"aerospace", INDUSTRY_SECTOR_AEROSPACE,
"automotive", INDUSTRY_SECTOR_AUTOMOTIVE,
"communications", INDUSTRY_SECTOR_COMMUNICATIONS,
"construction", INDUSTRY_SECTOR_CONSTRUCTION,
"defence", INDUSTRY_SECTOR_DEFENCE,
"education", INDUSTRY_SECTOR_EDUCATION,
"energy", INDUSTRY_SECTOR_ENERGY,
"entertainment", INDUSTRY_SECTOR_ENTERTAINMENT,
"financial-services", INDUSTRY_SECTOR_FINANCIAL_SERVICES,
"government-national", INDUSTRY_SECTOR_GOVERNMENT_NATIONAL,
"government-regional", INDUSTRY_SECTOR_GOVERNMENT_REGIONAL,
"government-local", INDUSTRY_SECTOR_GOVERNMENT_LOCAL,
"government-public-services", INDUSTRY_SECTOR_GOVERNMENT_PUBLIC_SERVICES,
"healthcare", INDUSTRY_SECTOR_HEALTHCARE,
"hospitality-leisure", INDUSTRY_SECTOR_HOSPITALITY_LEISURE,
"infrastructure", INDUSTRY_SECTOR_INFRASTRUCTURE,
"insurance", INDUSTRY_SECTOR_INSURANCE,
"manufacturing", INDUSTRY_SECTOR_MANUFACTURING,
"mining", INDUSTRY_SECTOR_MINING,
"non-profit", INDUSTRY_SECTOR_NON_PROFIT,
"pharmaceuticals", INDUSTRY_SECTOR_PHARMACEUTICALS,
"retail", INDUSTRY_SECTOR_RETAIL,
"technology", INDUSTRY_SECTOR_TECHNOLOGY,
"telecommunications", INDUSTRY_SECTOR_TELECOMMUNICATIONS,
"transportation", INDUSTRY_SECTOR_TRANSPORTATION,
"utilities", INDUSTRY_SECTOR_UTILITIES,
] ]
MALWARE_LABEL_ADWARE = "adware"
MALWARE_LABEL_BACKDOOR = "backdoor"
MALWARE_LABEL_BOT = "bot"
MALWARE_LABEL_DDOS = "ddos"
MALWARE_LABEL_DROPPER = "dropper"
MALWARE_LABEL_EXPLOIT_KIT = "exploit-kit"
MALWARE_LABEL_KEYLOGGER = "keylogger"
MALWARE_LABEL_RANSOMWARE = "ransomware"
MALWARE_LABEL_REMOTE_ACCESS_TROJAN = "remote-access-trojan"
MALWARE_LABEL_RESOURCE_EXPLOITATION = "resource-exploitation"
MALWARE_LABEL_ROGUE_SECURITY_SOFTWARE = "rogue-security-software"
MALWARE_LABEL_ROOTKIT = "rootkit"
MALWARE_LABEL_SCREEN_CAPTURE = "screen-capture"
MALWARE_LABEL_SPYWARE = "spyware"
MALWARE_LABEL_TROJAN = "trojan"
MALWARE_LABEL_VIRUS = "virus"
MALWARE_LABEL_WORM = "worm"
MALWARE_LABEL = [ MALWARE_LABEL = [
"adware", MALWARE_LABEL_ADWARE,
"backdoor", MALWARE_LABEL_BACKDOOR,
"bot", MALWARE_LABEL_BOT,
"ddos", MALWARE_LABEL_DDOS,
"dropper", MALWARE_LABEL_DROPPER,
"exploit-kit", MALWARE_LABEL_EXPLOIT_KIT,
"keylogger", MALWARE_LABEL_KEYLOGGER,
"ransomware", MALWARE_LABEL_RANSOMWARE,
"remote-access-trojan", MALWARE_LABEL_REMOTE_ACCESS_TROJAN,
"resource-exploitation", MALWARE_LABEL_RESOURCE_EXPLOITATION,
"rogue-security-software", MALWARE_LABEL_ROGUE_SECURITY_SOFTWARE,
"rootkit", MALWARE_LABEL_ROOTKIT,
"screen-capture", MALWARE_LABEL_SCREEN_CAPTURE,
"spyware", MALWARE_LABEL_SPYWARE,
"trojan", MALWARE_LABEL_TROJAN,
"virus", MALWARE_LABEL_VIRUS,
"worm", MALWARE_LABEL_WORM,
] ]
REPORT_LABEL_THREAT_REPORT = "threat-report"
REPORT_LABEL_ATTACK_PATTERN = "attack-pattern"
REPORT_LABEL_CAMPAIGN = "campaign"
REPORT_LABEL_IDENTITY = "identity"
REPORT_LABEL_INDICATOR = "indicator"
REPORT_LABEL_INTRUSION_SET = "intrusion-set"
REPORT_LABEL_MALWARE = "malware"
REPORT_LABEL_OBSERVED_DATA = "observed-data"
REPORT_LABEL_THREAT_ACTOR = "threat-actor"
REPORT_LABEL_TOOL = "tool"
REPORT_LABEL_VULNERABILITY = "vulnerability"
REPORT_LABEL = [ REPORT_LABEL = [
"threat-report", REPORT_LABEL_THREAT_REPORT,
"attack-pattern", REPORT_LABEL_ATTACK_PATTERN,
"campaign", REPORT_LABEL_CAMPAIGN,
"identity", REPORT_LABEL_IDENTITY,
"indicator", REPORT_LABEL_INDICATOR,
"intrusion-set", REPORT_LABEL_INTRUSION_SET,
"malware", REPORT_LABEL_MALWARE,
"observed-data", REPORT_LABEL_OBSERVED_DATA,
"threat-actor", REPORT_LABEL_THREAT_ACTOR,
"tool", REPORT_LABEL_TOOL,
"vulnerability", REPORT_LABEL_VULNERABILITY,
] ]
THREAT_ACTOR_LABEL_ACTIVIST = "activist"
THREAT_ACTOR_LABEL_COMPETITOR = "competitor"
THREAT_ACTOR_LABEL_CRIME_SYNDICATE = "crime-syndicate"
THREAT_ACTOR_LABEL_CRIMINAL = "criminal"
THREAT_ACTOR_LABEL_HACKER = "hacker"
THREAT_ACTOR_LABEL_INSIDER_ACCIDENTAL = "insider-accidental"
THREAT_ACTOR_LABEL_INSIDER_DISGRUNTLED = "insider-disgruntled"
THREAT_ACTOR_LABEL_NATION_STATE = "nation-state"
THREAT_ACTOR_LABEL_SENSATIONALIST = "sensationalist"
THREAT_ACTOR_LABEL_SPY = "spy"
THREAT_ACTOR_LABEL_TERRORIST = "terrorist"
THREAT_ACTOR_LABEL = [ THREAT_ACTOR_LABEL = [
"activist", THREAT_ACTOR_LABEL_ACTIVIST,
"competitor", THREAT_ACTOR_LABEL_COMPETITOR,
"crime-syndicate", THREAT_ACTOR_LABEL_CRIME_SYNDICATE,
"criminal", THREAT_ACTOR_LABEL_CRIMINAL,
"hacker", THREAT_ACTOR_LABEL_HACKER,
"insider-accidental", THREAT_ACTOR_LABEL_INSIDER_ACCIDENTAL,
"insider-disgruntled", THREAT_ACTOR_LABEL_INSIDER_DISGRUNTLED,
"nation-state", THREAT_ACTOR_LABEL_NATION_STATE,
"sensationalist", THREAT_ACTOR_LABEL_SENSATIONALIST,
"spy", THREAT_ACTOR_LABEL_SPY,
"terrorist", THREAT_ACTOR_LABEL_TERRORIST,
] ]
THREAT_ACTOR_ROLE_AGENT = "agent"
THREAT_ACTOR_ROLE_DIRECTOR = "director"
THREAT_ACTOR_ROLE_INDEPENDENT = "independent"
THREAT_ACTOR_ROLE_INFRASTRUCTURE_ARCHITECT = "infrastructure-architect"
THREAT_ACTOR_ROLE_INFRASTRUCTURE_OPERATOR = "infrastructure-operator"
THREAT_ACTOR_ROLE_MALWARE_AUTHOR = "malware-author"
THREAT_ACTOR_ROLE_SPONSOR = "sponsor"
THREAT_ACTOR_ROLE = [ THREAT_ACTOR_ROLE = [
"agent", THREAT_ACTOR_ROLE_AGENT,
"director", THREAT_ACTOR_ROLE_DIRECTOR,
"independent", THREAT_ACTOR_ROLE_INDEPENDENT,
"infrastructure-architect", THREAT_ACTOR_ROLE_INFRASTRUCTURE_ARCHITECT,
"infrastructure-operator", THREAT_ACTOR_ROLE_INFRASTRUCTURE_OPERATOR,
"malware-author", THREAT_ACTOR_ROLE_MALWARE_AUTHOR,
"sponsor", THREAT_ACTOR_ROLE_SPONSOR,
] ]
THREAT_ACTOR_SOPHISTICATION_NONE = "none"
THREAT_ACTOR_SOPHISTICATION_MINIMAL = "minimal"
THREAT_ACTOR_SOPHISTICATION_INTERMEDIATE = "intermediate"
THREAT_ACTOR_SOPHISTICATION_ADVANCED = "advanced"
THREAT_ACTOR_SOPHISTICATION_EXPERT = "expert"
THREAT_ACTOR_SOPHISTICATION_INNOVATOR = "innovator"
THREAT_ACTOR_SOPHISTICATION_STRATEGIC = "strategic"
THREAT_ACTOR_SOPHISTICATION = [ THREAT_ACTOR_SOPHISTICATION = [
"none", THREAT_ACTOR_SOPHISTICATION_NONE,
"minimal", THREAT_ACTOR_SOPHISTICATION_MINIMAL,
"intermediate", THREAT_ACTOR_SOPHISTICATION_INTERMEDIATE,
"advanced", THREAT_ACTOR_SOPHISTICATION_ADVANCED,
"expert", THREAT_ACTOR_SOPHISTICATION_EXPERT,
"innovator", THREAT_ACTOR_SOPHISTICATION_INNOVATOR,
"strategic", THREAT_ACTOR_SOPHISTICATION_STRATEGIC,
] ]
TOOL_LABEL_DENIAL_OF_SERVICE = "denial-of-service"
TOOL_LABEL_EXPLOITATION = "exploitation"
TOOL_LABEL_INFORMATION_GATHERING = "information-gathering"
TOOL_LABEL_NETWORK_CAPTURE = "network-capture"
TOOL_LABEL_CREDENTIAL_EXPLOITATION = "credential-exploitation"
TOOL_LABEL_REMOTE_ACCESS = "remote-access"
TOOL_LABEL_VULNERABILITY_SCANNING = "vulnerability-scanning"
TOOL_LABEL = [ TOOL_LABEL = [
"denial-of-service", TOOL_LABEL_DENIAL_OF_SERVICE,
"exploitation", TOOL_LABEL_EXPLOITATION,
"information-gathering", TOOL_LABEL_INFORMATION_GATHERING,
"network-capture", TOOL_LABEL_NETWORK_CAPTURE,
"credential-exploitation", TOOL_LABEL_CREDENTIAL_EXPLOITATION,
"remote-access", TOOL_LABEL_REMOTE_ACCESS,
"vulnerability-scanning", TOOL_LABEL_VULNERABILITY_SCANNING,
] ]

1041
stix2/v21/vocab.py
View File

File diff suppressed because it is too large Load Diff