MISP
/
cti-python-stix2
mirror of https://github.com/MISP/cti-python-stix2
2
0
Fork 0
Code Issues Releases Wiki Activity

Add KillChainPhase, AttackPattern, IntrusionSet, Tool

stix2.1
clenk 2017-02-22 10:06:35 -05:00
parent 417b43b1fe
commit 375b915da4
2 changed files with 112 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
stix2/common.py
View File

@ -52,3 +52,14 @@ class ExternalReference(_STIXBase):
'url': {}, 'url': {},
'external_id': {}, 'external_id': {},
} }
class KillChainPhase(_STIXBase):
_properties = {
'kill_chain_name': {
'required': True,
},
'phase_name': {
'required': True,
},
}

103
stix2/sdo.py
View File

@ -5,6 +5,34 @@ from .common import COMMON_PROPERTIES
from .utils import NOW from .utils import NOW
class AttackPattern(_STIXBase):
_type = 'attack-pattern'
_properties = COMMON_PROPERTIES.copy()
_properties.update({
'labels': {
'required': True,
},
'name': {
'required': True,
},
'description': {},
'kill_chain_phases': {},
})
def __init__(self, **kwargs):
# TODO:
# - created_by_ref
# - external_references
# - object_marking_refs
# - granular_markings
# - description
# - kill_chain_phases
super(AttackPattern, self).__init__(**kwargs)
class Indicator(_STIXBase): class Indicator(_STIXBase):
_type = 'indicator' _type = 'indicator'
@ -13,18 +41,21 @@ class Indicator(_STIXBase):
'labels': { 'labels': {
'required': True, 'required': True,
}, },
'name': {},
'description': {},
'pattern': { 'pattern': {
'required': True, 'required': True,
}, },
'valid_from': { 'valid_from': {
'default': NOW, 'default': NOW,
}, },
'valid_until': {},
'kill_chain_phases': {},
}) })
def __init__(self, **kwargs): def __init__(self, **kwargs):
# TODO: # TODO:
# - created_by_ref # - created_by_ref
# - revoked
# - external_references # - external_references
# - object_marking_refs # - object_marking_refs
# - granular_markings # - granular_markings
@ -37,6 +68,43 @@ class Indicator(_STIXBase):
super(Indicator, self).__init__(**kwargs) super(Indicator, self).__init__(**kwargs)
class IntrusionSet(_STIXBase):
_type = 'intrusion-set'
_properties = COMMON_PROPERTIES.copy()
_properties.update({
'name': {
'required': True,
},
'description': {},
'aliases': {},
'first_seen': {},
'last_seen ': {},
'goals': {},
'resource_level': {},
'primary_motivation': {},
'secondary_motivations': {},
})
def __init__(self, **kwargs):
# TODO:
# - created_by_ref
# - external_references
# - object_marking_refs
# - granular_markings
# - description
# - aliases
# - first_seen
# - last_seen
# - goals
# - resource_level
# - primary_motivation
# - secondary_motivations
super(IntrusionSet, self).__init__(**kwargs)
class Malware(_STIXBase): class Malware(_STIXBase):
_type = 'malware' _type = 'malware'
@ -48,12 +116,13 @@ class Malware(_STIXBase):
'name': { 'name': {
'required': True, 'required': True,
}, },
'description': {},
'kill_chain_phases': {},
}) })
def __init__(self, **kwargs): def __init__(self, **kwargs):
# TODO: # TODO:
# - created_by_ref # - created_by_ref
# - revoked
# - external_references # - external_references
# - object_marking_refs # - object_marking_refs
# - granular_markings # - granular_markings
@ -62,3 +131,33 @@ class Malware(_STIXBase):
# - kill_chain_phases # - kill_chain_phases
super(Malware, self).__init__(**kwargs) super(Malware, self).__init__(**kwargs)
class Tool(_STIXBase):
_type = 'tool'
_properties = COMMON_PROPERTIES.copy()
_properties.update({
'labels': {
'required': True,
},
'name': {
'required': True,
},
'description': {},
'kill_chain_phases': {},
'tool_version': {},
})
def __init__(self, **kwargs):
# TODO:
# - created_by_ref
# - external_references
# - object_marking_refs
# - granular_markings
# - description
# - kill_chain_phases
# - tool_version
super(Tool, self).__init__(**kwargs)