diff --git a/stix2/__init__.py b/stix2/__init__.py index 4a3420e..80eaa41 100644 --- a/stix2/__init__.py +++ b/stix2/__init__.py @@ -43,7 +43,13 @@ class Indicator: self.created = created or now self.modified = modified or now + + if not labels: + raise ValueError("Missing required field for Indicator: 'labels'.") self.labels = labels + + if not pattern: + raise ValueError("Missing required field for Indicator: 'pattern'.") self.pattern = pattern self.valid_from = valid_from or now diff --git a/stix2/test/test_stix2.py b/stix2/test/test_stix2.py index 59dd820..902b7de 100644 --- a/stix2/test/test_stix2.py +++ b/stix2/test/test_stix2.py @@ -81,3 +81,16 @@ def test_indicator_id_must_start_with_indicator(): indicator = stix2.Indicator(id='my-prefix--') assert "Indicator id values must begin with 'indicator--'." in str(excinfo) + + +def test_indicator_required_field_labels(): + with pytest.raises(ValueError) as excinfo: + indicator = stix2.Indicator() + assert "Missing required field for Indicator: 'labels'." in str(excinfo) + + +def test_indicator_required_field_pattern(): + with pytest.raises(ValueError) as excinfo: + # Label is checked first, so make sure that is provided + indicator = stix2.Indicator(labels=['malicious-activity']) + assert "Missing required field for Indicator: 'pattern'." in str(excinfo)