MISP
/
cti-python-stix2
mirror of https://github.com/MISP/cti-python-stix2
2
0
Fork 0
Code Issues Releases Wiki Activity

Replace most SDO/SRO values in tests with IDs from constants.py

master
Desai, Kartikey H 2019-01-29 10:52:59 -05:00
parent 10bfde0e86
commit a788dbb64c
31 changed files with 189 additions and 169 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
stix2/test/v20/constants.py
View File

@ -50,7 +50,7 @@ CAMPAIGN_KWARGS = dict(
CAMPAIGN_MORE_KWARGS = dict(
type='campaign',
id=CAMPAIGN_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T20:03:00.000Z",
modified="2016-04-06T20:03:00.000Z",
name="Green Group Attacks Against Finance",

4
stix2/test/v20/test_bundle.py
View File

@ -4,6 +4,8 @@ import pytest
import stix2
from .constants import IDENTITY_ID
EXPECTED_BUNDLE = """{
"type": "bundle",
"id": "bundle--00000000-0000-4000-8000-000000000007",
@ -185,7 +187,7 @@ def test_parse_unknown_type():
"id": "other--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created": "2016-04-06T20:03:00Z",
"modified": "2016-04-06T20:03:00Z",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": IDENTITY_ID,
"description": "Campaign by Green Group against a series of targets in the financial services sector.",
"name": "Green Group Attacks Against Finance",
}

8
stix2/test/v20/test_campaign.py
View File

@ -5,12 +5,12 @@ import pytz
import stix2
from .constants import CAMPAIGN_ID, CAMPAIGN_MORE_KWARGS
from .constants import CAMPAIGN_ID, CAMPAIGN_MORE_KWARGS, IDENTITY_ID
EXPECTED = """{
"type": "campaign",
"id": "campaign--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2016-04-06T20:03:00.000Z",
"modified": "2016-04-06T20:03:00.000Z",
"name": "Green Group Attacks Against Finance",
@ -32,7 +32,7 @@ def test_campaign_example():
"id": CAMPAIGN_ID,
"created": "2016-04-06T20:03:00Z",
"modified": "2016-04-06T20:03:00Z",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": IDENTITY_ID,
"description": "Campaign by Green Group against a series of targets in the financial services sector.",
"name": "Green Group Attacks Against Finance",
},
@ -45,7 +45,7 @@ def test_parse_campaign(data):
assert cmpn.id == CAMPAIGN_ID
assert cmpn.created == dt.datetime(2016, 4, 6, 20, 3, 0, tzinfo=pytz.utc)
assert cmpn.modified == dt.datetime(2016, 4, 6, 20, 3, 0, tzinfo=pytz.utc)
assert cmpn.created_by_ref == "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff"
assert cmpn.created_by_ref == IDENTITY_ID
assert cmpn.description == "Campaign by Green Group against a series of targets in the financial services sector."
assert cmpn.name == "Green Group Attacks Against Finance"

6
stix2/test/v20/test_core.py
View File

@ -3,6 +3,8 @@ import pytest
import stix2
from stix2 import core, exceptions
from .constants import IDENTITY_ID
BUNDLE = {
"type": "bundle",
"spec_version": "2.0",
@ -96,7 +98,7 @@ def test_register_marking_with_no_version():
def test_register_observable_with_version():
observed_data = stix2.v20.ObservedData(
id="observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf",
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T19:58:16.000Z",
modified="2016-04-06T19:58:16.000Z",
first_observed="2015-12-21T19:00:00Z",
@ -134,7 +136,7 @@ def test_register_observable_with_version():
def test_register_observable_extension_with_version():
observed_data = stix2.v20.ObservedData(
id="observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf",
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T19:58:16.000Z",
modified="2016-04-06T19:58:16.000Z",
first_observed="2015-12-21T19:00:00Z",

10
stix2/test/v20/test_course_of_action.py
View File

@ -5,12 +5,12 @@ import pytz
import stix2
from .constants import COURSE_OF_ACTION_ID
from .constants import COURSE_OF_ACTION_ID, IDENTITY_ID
EXPECTED = """{
"type": "course-of-action",
"id": "course-of-action--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2016-04-06T20:03:48.000Z",
"modified": "2016-04-06T20:03:48.000Z",
"name": "Add TCP port 80 Filter Rule to the existing Block UDP 1434 Filter",
@ -21,7 +21,7 @@ EXPECTED = """{
def test_course_of_action_example():
coa = stix2.v20.CourseOfAction(
id=COURSE_OF_ACTION_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T20:03:48.000Z",
modified="2016-04-06T20:03:48.000Z",
name="Add TCP port 80 Filter Rule to the existing Block UDP 1434 Filter",
@ -36,7 +36,7 @@ def test_course_of_action_example():
EXPECTED,
{
"created": "2016-04-06T20:03:48.000Z",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": IDENTITY_ID,
"description": "This is how to add a filter rule to block inbound access to TCP port 80 to the existing UDP 1434 filter ...",
"id": COURSE_OF_ACTION_ID,
"modified": "2016-04-06T20:03:48.000Z",
@ -52,7 +52,7 @@ def test_parse_course_of_action(data):
assert coa.id == COURSE_OF_ACTION_ID
assert coa.created == dt.datetime(2016, 4, 6, 20, 3, 48, tzinfo=pytz.utc)
assert coa.modified == dt.datetime(2016, 4, 6, 20, 3, 48, tzinfo=pytz.utc)
assert coa.created_by_ref == "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff"
assert coa.created_by_ref == IDENTITY_ID
assert coa.description == "This is how to add a filter rule to block inbound access to TCP port 80 to the existing UDP 1434 filter ..."
assert coa.name == "Add TCP port 80 Filter Rule to the existing Block UDP 1434 Filter"

16
stix2/test/v20/test_custom.py
View File

@ -2,7 +2,7 @@ import pytest
import stix2
from .constants import FAKE_TIME, MARKING_DEFINITION_ID
from .constants import FAKE_TIME, IDENTITY_ID, MARKING_DEFINITION_ID
IDENTITY_CUSTOM_PROP = stix2.v20.Identity(
name="John Smith",
@ -15,7 +15,7 @@ IDENTITY_CUSTOM_PROP = stix2.v20.Identity(
def test_identity_custom_property():
with pytest.raises(ValueError) as excinfo:
stix2.v20.Identity(
id="identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
id=IDENTITY_ID,
created="2015-12-21T19:59:11Z",
modified="2015-12-21T19:59:11Z",
name="John Smith",
@ -26,7 +26,7 @@ def test_identity_custom_property():
with pytest.raises(stix2.exceptions.ExtraPropertiesError) as excinfo:
stix2.v20.Identity(
id="identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
id=IDENTITY_ID,
created="2015-12-21T19:59:11Z",
modified="2015-12-21T19:59:11Z",
name="John Smith",
@ -39,7 +39,7 @@ def test_identity_custom_property():
assert "Unexpected properties for Identity" in str(excinfo.value)
identity = stix2.v20.Identity(
id="identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
id=IDENTITY_ID,
created="2015-12-21T19:59:11Z",
modified="2015-12-21T19:59:11Z",
name="John Smith",
@ -54,7 +54,7 @@ def test_identity_custom_property():
def test_identity_custom_property_invalid():
with pytest.raises(stix2.exceptions.ExtraPropertiesError) as excinfo:
stix2.v20.Identity(
id="identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
id=IDENTITY_ID,
created="2015-12-21T19:59:11Z",
modified="2015-12-21T19:59:11Z",
name="John Smith",
@ -68,7 +68,7 @@ def test_identity_custom_property_invalid():
def test_identity_custom_property_allowed():
identity = stix2.v20.Identity(
id="identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
id=IDENTITY_ID,
created="2015-12-21T19:59:11Z",
modified="2015-12-21T19:59:11Z",
name="John Smith",
@ -127,7 +127,7 @@ def test_custom_properties_object_in_bundled_object():
def test_custom_property_dict_in_bundled_object():
custom_identity = {
'type': 'identity',
'id': 'identity--311b2d2d-f010-4473-83ec-1edf84858f4c',
'id': IDENTITY_ID,
'created': '2015-12-21T19:59:11Z',
'name': 'John Smith',
'identity_class': 'individual',
@ -144,7 +144,7 @@ def test_custom_property_dict_in_bundled_object():
def test_custom_properties_dict_in_bundled_object():
custom_identity = {
'type': 'identity',
'id': 'identity--311b2d2d-f010-4473-83ec-1edf84858f4c',
'id': IDENTITY_ID,
'created': '2015-12-21T19:59:11Z',
'name': 'John Smith',
'identity_class': 'individual',

4
stix2/test/v20/test_datastore_memory.py
View File

@ -275,13 +275,13 @@ def test_memory_store_object_creator_of_present(mem_store):
camp = Campaign(
name="Scipio Africanus",
objective="Defeat the Carthaginians",
created_by_ref="identity--e4196283-7420-4277-a7a3-d57f61ef1389",
created_by_ref=IDENTITY_ID,
x_empire="Roman",
allow_custom=True,
)
iden = Identity(
id="identity--e4196283-7420-4277-a7a3-d57f61ef1389",
id=IDENTITY_ID,
name="Foo Corp.",
identity_class="corporation",
)

8
stix2/test/v20/test_intrusion_set.py
View File

@ -5,12 +5,12 @@ import pytz
import stix2
from .constants import INTRUSION_SET_ID
from .constants import IDENTITY_ID, INTRUSION_SET_ID
EXPECTED = """{
"type": "intrusion-set",
"id": "intrusion-set--4e78f46f-a023-4e5f-bc24-71b3ca22ec29",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2016-04-06T20:03:48.000Z",
"modified": "2016-04-06T20:03:48.000Z",
"name": "Bobcat Breakin",
@ -29,7 +29,7 @@ EXPECTED = """{
def test_intrusion_set_example():
intrusion_set = stix2.v20.IntrusionSet(
id=INTRUSION_SET_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T20:03:48.000Z",
modified="2016-04-06T20:03:48.000Z",
name="Bobcat Breakin",
@ -49,7 +49,7 @@ def test_intrusion_set_example():
"Zookeeper",
],
"created": "2016-04-06T20:03:48.000Z",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": IDENTITY_ID,
"description": "Incidents usually feature a shared TTP of a bobcat being released...",
"goals": [
"acquisition-theft",

12
stix2/test/v20/test_markings.py
View File

@ -6,7 +6,7 @@ import pytz
import stix2
from stix2.v20 import TLP_WHITE
from .constants import CAMPAIGN_ID, MARKING_DEFINITION_ID
from .constants import CAMPAIGN_ID, IDENTITY_ID, MARKING_DEFINITION_ID
EXPECTED_TLP_MARKING_DEFINITION = """{
"type": "marking-definition",
@ -31,7 +31,7 @@ EXPECTED_STATEMENT_MARKING_DEFINITION = """{
EXPECTED_CAMPAIGN_WITH_OBJECT_MARKING = """{
"type": "campaign",
"id": "campaign--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2016-04-06T20:03:00.000Z",
"modified": "2016-04-06T20:03:00.000Z",
"name": "Green Group Attacks Against Finance",
@ -54,7 +54,7 @@ EXPECTED_GRANULAR_MARKING = """{
EXPECTED_CAMPAIGN_WITH_GRANULAR_MARKINGS = """{
"type": "campaign",
"id": "campaign--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2016-04-06T20:03:00.000Z",
"modified": "2016-04-06T20:03:00.000Z",
"name": "Green Group Attacks Against Finance",
@ -111,7 +111,7 @@ def test_campaign_with_markings_example():
campaign = stix2.v20.Campaign(
type='campaign',
id=CAMPAIGN_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T20:03:00.000Z",
modified="2016-04-06T20:03:00.000Z",
name="Green Group Attacks Against Finance",
@ -147,7 +147,7 @@ def test_campaign_with_granular_markings_example():
campaign = stix2.v20.Campaign(
type='campaign',
id=CAMPAIGN_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T20:03:00.000Z",
modified="2016-04-06T20:03:00.000Z",
name="Green Group Attacks Against Finance",
@ -261,7 +261,7 @@ def test_marking_wrong_type_construction():
def test_campaign_add_markings():
campaign = stix2.v20.Campaign(
id=CAMPAIGN_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T20:03:00Z",
modified="2016-04-06T20:03:00Z",
name="Green Group Attacks Against Finance",

24
stix2/test/v20/test_observed_data.py
View File

@ -6,7 +6,7 @@ import pytz
import stix2
from .constants import OBSERVED_DATA_ID
from .constants import IDENTITY_ID, OBSERVED_DATA_ID
OBJECTS_REGEX = re.compile('\"objects\": {(?:.*?)(?:(?:[^{]*?)|(?:{[^{]*?}))*}', re.DOTALL)
@ -14,7 +14,7 @@ OBJECTS_REGEX = re.compile('\"objects\": {(?:.*?)(?:(?:[^{]*?)|(?:{[^{]*?}))*}',
EXPECTED = """{
"type": "observed-data",
"id": "observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2016-04-06T19:58:16.000Z",
"modified": "2016-04-06T19:58:16.000Z",
"first_observed": "2015-12-21T19:00:00Z",
@ -32,7 +32,7 @@ EXPECTED = """{
def test_observed_data_example():
observed_data = stix2.v20.ObservedData(
id=OBSERVED_DATA_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T19:58:16.000Z",
modified="2016-04-06T19:58:16.000Z",
first_observed="2015-12-21T19:00:00Z",
@ -52,7 +52,7 @@ def test_observed_data_example():
EXPECTED_WITH_REF = """{
"type": "observed-data",
"id": "observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2016-04-06T19:58:16.000Z",
"modified": "2016-04-06T19:58:16.000Z",
"first_observed": "2015-12-21T19:00:00Z",
@ -77,7 +77,7 @@ EXPECTED_WITH_REF = """{
def test_observed_data_example_with_refs():
observed_data = stix2.v20.ObservedData(
id=OBSERVED_DATA_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T19:58:16.000Z",
modified="2016-04-06T19:58:16.000Z",
first_observed="2015-12-21T19:00:00Z",
@ -103,7 +103,7 @@ def test_observed_data_example_with_bad_refs():
with pytest.raises(stix2.exceptions.InvalidValueError) as excinfo:
stix2.v20.ObservedData(
id=OBSERVED_DATA_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T19:58:16.000Z",
modified="2016-04-06T19:58:16.000Z",
first_observed="2015-12-21T19:00:00Z",
@ -131,7 +131,7 @@ def test_observed_data_example_with_non_dictionary():
with pytest.raises(stix2.exceptions.InvalidValueError) as excinfo:
stix2.v20.ObservedData(
id=OBSERVED_DATA_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T19:58:16.000Z",
modified="2016-04-06T19:58:16.000Z",
first_observed="2015-12-21T19:00:00Z",
@ -149,7 +149,7 @@ def test_observed_data_example_with_empty_dictionary():
with pytest.raises(stix2.exceptions.InvalidValueError) as excinfo:
stix2.v20.ObservedData(
id=OBSERVED_DATA_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T19:58:16.000Z",
modified="2016-04-06T19:58:16.000Z",
first_observed="2015-12-21T19:00:00Z",
@ -170,7 +170,7 @@ def test_observed_data_example_with_empty_dictionary():
"type": "observed-data",
"id": OBSERVED_DATA_ID,
"created": "2016-04-06T19:58:16.000Z",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": IDENTITY_ID,
"first_observed": "2015-12-21T19:00:00Z",
"last_observed": "2015-12-21T19:00:00Z",
"modified": "2016-04-06T19:58:16.000Z",
@ -193,7 +193,7 @@ def test_parse_observed_data(data):
assert odata.modified == dt.datetime(2016, 4, 6, 19, 58, 16, tzinfo=pytz.utc)
assert odata.first_observed == dt.datetime(2015, 12, 21, 19, 0, 0, tzinfo=pytz.utc)
assert odata.last_observed == dt.datetime(2015, 12, 21, 19, 0, 0, tzinfo=pytz.utc)
assert odata.created_by_ref == "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff"
assert odata.created_by_ref == IDENTITY_ID
assert odata.objects["0"].type == "file"
@ -533,7 +533,7 @@ def test_parse_basic_tcp_traffic_with_error(data):
EXPECTED_PROCESS_OD = """{
"created": "2016-04-06T19:58:16.000Z",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"first_observed": "2015-12-21T19:00:00Z",
"id": "observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf",
"last_observed": "2015-12-21T19:00:00Z",
@ -564,7 +564,7 @@ EXPECTED_PROCESS_OD = """{
def test_observed_data_with_process_example():
observed_data = stix2.v20.ObservedData(
id=OBSERVED_DATA_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T19:58:16.000Z",
modified="2016-04-06T19:58:16.000Z",
first_observed="2015-12-21T19:00:00Z",

4
stix2/test/v20/test_pickle.py
View File

@ -2,13 +2,15 @@ import pickle
import stix2
from .constants import IDENTITY_ID
def test_pickling():
"""
Ensure a pickle/unpickle cycle works okay.
"""
identity = stix2.v20.Identity(
id="identity--d66cb89d-5228-4983-958c-fa84ef75c88c",
id=IDENTITY_ID,
name="alice",
description="this is a pickle test",
identity_class="some_class",

51
stix2/test/v20/test_report.py
View File

@ -5,21 +5,24 @@ import pytz
import stix2
from .constants import INDICATOR_KWARGS, REPORT_ID
from .constants import (
CAMPAIGN_ID, IDENTITY_ID, INDICATOR_ID, INDICATOR_KWARGS, RELATIONSHIP_ID,
REPORT_ID,
)
EXPECTED = """{
"type": "report",
"id": "report--84e4d88f-44ea-4bcd-bbf3-b2c1c320bcb3",
"created_by_ref": "identity--a463ffb3-1bd9-4d94-b02d-74e4f1658283",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2015-12-21T19:59:11.000Z",
"modified": "2015-12-21T19:59:11.000Z",
"name": "The Black Vine Cyberespionage Group",
"description": "A simple report with an indicator and campaign",
"published": "2016-01-20T17:00:00Z",
"object_refs": [
"indicator--26ffb872-1dd9-446e-b6f5-d58527e5b5d2",
"campaign--83422c77-904c-4dc1-aff5-5c38f3a2c55c",
"relationship--f82356ae-fe6c-437c-9c24-6b64314ae68a"
"indicator--a740531e-63ff-4e49-a9e1-a0a3eed0e3e7",
"campaign--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"relationship--df7c87eb-75d2-4948-af81-9d49d246f301"
],
"labels": [
"campaign"
@ -30,7 +33,7 @@ EXPECTED = """{
def test_report_example():
report = stix2.v20.Report(
id=REPORT_ID,
created_by_ref="identity--a463ffb3-1bd9-4d94-b02d-74e4f1658283",
created_by_ref=IDENTITY_ID,
created="2015-12-21T19:59:11.000Z",
modified="2015-12-21T19:59:11.000Z",
name="The Black Vine Cyberespionage Group",
@ -38,9 +41,9 @@ def test_report_example():
published="2016-01-20T17:00:00Z",
labels=["campaign"],
object_refs=[
"indicator--26ffb872-1dd9-446e-b6f5-d58527e5b5d2",
"campaign--83422c77-904c-4dc1-aff5-5c38f3a2c55c",
"relationship--f82356ae-fe6c-437c-9c24-6b64314ae68a",
INDICATOR_ID,
CAMPAIGN_ID,
RELATIONSHIP_ID,
],
)
@ -50,7 +53,7 @@ def test_report_example():
def test_report_example_objects_in_object_refs():
report = stix2.v20.Report(
id=REPORT_ID,
created_by_ref="identity--a463ffb3-1bd9-4d94-b02d-74e4f1658283",
created_by_ref=IDENTITY_ID,
created="2015-12-21T19:59:11.000Z",
modified="2015-12-21T19:59:11.000Z",
name="The Black Vine Cyberespionage Group",
@ -58,9 +61,9 @@ def test_report_example_objects_in_object_refs():
published="2016-01-20T17:00:00Z",
labels=["campaign"],
object_refs=[
stix2.v20.Indicator(id="indicator--26ffb872-1dd9-446e-b6f5-d58527e5b5d2", **INDICATOR_KWARGS),
"campaign--83422c77-904c-4dc1-aff5-5c38f3a2c55c",
"relationship--f82356ae-fe6c-437c-9c24-6b64314ae68a",
stix2.v20.Indicator(id=INDICATOR_ID, **INDICATOR_KWARGS),
CAMPAIGN_ID,
RELATIONSHIP_ID,
],
)
@ -71,7 +74,7 @@ def test_report_example_objects_in_object_refs_with_bad_id():
with pytest.raises(stix2.exceptions.InvalidValueError) as excinfo:
stix2.v20.Report(
id=REPORT_ID,
created_by_ref="identity--a463ffb3-1bd9-4d94-b02d-74e4f1658283",
created_by_ref=IDENTITY_ID,
created="2015-12-21T19:59:11.000Z",
modified="2015-12-21T19:59:11.000Z",
name="The Black Vine Cyberespionage Group",
@ -79,9 +82,9 @@ def test_report_example_objects_in_object_refs_with_bad_id():
published="2016-01-20T17:00:00Z",
labels=["campaign"],
object_refs=[
stix2.v20.Indicator(id="indicator--26ffb872-1dd9-446e-b6f5-d58527e5b5d2", **INDICATOR_KWARGS),
stix2.v20.Indicator(id=INDICATOR_ID, **INDICATOR_KWARGS),
"campaign-83422c77-904c-4dc1-aff5-5c38f3a2c55c", # the "bad" id, missing a "-"
"relationship--f82356ae-fe6c-437c-9c24-6b64314ae68a",
RELATIONSHIP_ID,
],
)
@ -96,7 +99,7 @@ def test_report_example_objects_in_object_refs_with_bad_id():
EXPECTED,
{
"created": "2015-12-21T19:59:11.000Z",
"created_by_ref": "identity--a463ffb3-1bd9-4d94-b02d-74e4f1658283",
"created_by_ref": IDENTITY_ID,
"description": "A simple report with an indicator and campaign",
"id": REPORT_ID,
"labels": [
@ -105,9 +108,9 @@ def test_report_example_objects_in_object_refs_with_bad_id():
"modified": "2015-12-21T19:59:11.000Z",
"name": "The Black Vine Cyberespionage Group",
"object_refs": [
"indicator--26ffb872-1dd9-446e-b6f5-d58527e5b5d2",
"campaign--83422c77-904c-4dc1-aff5-5c38f3a2c55c",
"relationship--f82356ae-fe6c-437c-9c24-6b64314ae68a",
INDICATOR_ID,
CAMPAIGN_ID,
RELATIONSHIP_ID,
],
"published": "2016-01-20T17:00:00Z",
"type": "report",
@ -121,11 +124,11 @@ def test_parse_report(data):
assert rept.id == REPORT_ID
assert rept.created == dt.datetime(2015, 12, 21, 19, 59, 11, tzinfo=pytz.utc)
assert rept.modified == dt.datetime(2015, 12, 21, 19, 59, 11, tzinfo=pytz.utc)
assert rept.created_by_ref == "identity--a463ffb3-1bd9-4d94-b02d-74e4f1658283"
assert rept.created_by_ref == IDENTITY_ID
assert rept.object_refs == [
"indicator--26ffb872-1dd9-446e-b6f5-d58527e5b5d2",
"campaign--83422c77-904c-4dc1-aff5-5c38f3a2c55c",
"relationship--f82356ae-fe6c-437c-9c24-6b64314ae68a",
INDICATOR_ID,
CAMPAIGN_ID,
RELATIONSHIP_ID,
]
assert rept.description == "A simple report with an indicator and campaign"
assert rept.labels == ["campaign"]

10
stix2/test/v20/test_sighting.py
View File

@ -5,7 +5,7 @@ import pytz
import stix2
from .constants import INDICATOR_ID, SIGHTING_ID, SIGHTING_KWARGS
from .constants import IDENTITY_ID, INDICATOR_ID, SIGHTING_ID, SIGHTING_KWARGS
EXPECTED_SIGHTING = """{
"type": "sighting",
@ -14,7 +14,7 @@ EXPECTED_SIGHTING = """{
"modified": "2016-04-06T20:06:37.000Z",
"sighting_of_ref": "indicator--a740531e-63ff-4e49-a9e1-a0a3eed0e3e7",
"where_sighted_refs": [
"identity--8cc7afd6-5455-4d2b-a736-e614ee631d99"
"identity--311b2d2d-f010-4473-83ec-1edf84858f4c"
]
}"""
@ -39,7 +39,7 @@ def test_sighting_all_required_properties():
created=now,
modified=now,
sighting_of_ref=INDICATOR_ID,
where_sighted_refs=["identity--8cc7afd6-5455-4d2b-a736-e614ee631d99"],
where_sighted_refs=[IDENTITY_ID],
)
assert str(s) == EXPECTED_SIGHTING
@ -99,7 +99,7 @@ def test_create_sighting_from_objects_rather_than_ids(malware): # noqa: F811
"sighting_of_ref": "indicator--a740531e-63ff-4e49-a9e1-a0a3eed0e3e7",
"type": "sighting",
"where_sighted_refs": [
"identity--8cc7afd6-5455-4d2b-a736-e614ee631d99",
IDENTITY_ID,
],
},
],
@ -112,4 +112,4 @@ def test_parse_sighting(data):
assert sighting.created == dt.datetime(2016, 4, 6, 20, 6, 37, tzinfo=pytz.utc)
assert sighting.modified == dt.datetime(2016, 4, 6, 20, 6, 37, tzinfo=pytz.utc)
assert sighting.sighting_of_ref == INDICATOR_ID
assert sighting.where_sighted_refs == ["identity--8cc7afd6-5455-4d2b-a736-e614ee631d99"]
assert sighting.where_sighted_refs == [IDENTITY_ID]

10
stix2/test/v20/test_threat_actor.py
View File

@ -5,12 +5,12 @@ import pytz
import stix2
from .constants import THREAT_ACTOR_ID
from .constants import IDENTITY_ID, THREAT_ACTOR_ID
EXPECTED = """{
"type": "threat-actor",
"id": "threat-actor--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2016-04-06T20:03:48.000Z",
"modified": "2016-04-06T20:03:48.000Z",
"name": "Evil Org",
@ -24,7 +24,7 @@ EXPECTED = """{
def test_threat_actor_example():
threat_actor = stix2.v20.ThreatActor(
id=THREAT_ACTOR_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T20:03:48.000Z",
modified="2016-04-06T20:03:48.000Z",
description="The Evil Org threat actor group",
@ -40,7 +40,7 @@ def test_threat_actor_example():
EXPECTED,
{
"created": "2016-04-06T20:03:48.000Z",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": IDENTITY_ID,
"description": "The Evil Org threat actor group",
"id": THREAT_ACTOR_ID,
"modified": "2016-04-06T20:03:48.000Z",
@ -57,7 +57,7 @@ def test_parse_threat_actor(data):
assert actor.id == THREAT_ACTOR_ID
assert actor.created == dt.datetime(2016, 4, 6, 20, 3, 48, tzinfo=pytz.utc)
assert actor.modified == dt.datetime(2016, 4, 6, 20, 3, 48, tzinfo=pytz.utc)
assert actor.created_by_ref == "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff"
assert actor.created_by_ref == IDENTITY_ID
assert actor.description == "The Evil Org threat actor group"
assert actor.name == "Evil Org"
assert actor.labels == ["crime-syndicate"]

14
stix2/test/v20/test_tool.py
View File

@ -5,12 +5,12 @@ import pytz
import stix2
from .constants import TOOL_ID
from .constants import IDENTITY_ID, TOOL_ID
EXPECTED = """{
"type": "tool",
"id": "tool--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2016-04-06T20:03:48.000Z",
"modified": "2016-04-06T20:03:48.000Z",
"name": "VNC",
@ -22,7 +22,7 @@ EXPECTED = """{
EXPECTED_WITH_REVOKED = """{
"type": "tool",
"id": "tool--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2016-04-06T20:03:48.000Z",
"modified": "2016-04-06T20:03:48.000Z",
"name": "VNC",
@ -36,7 +36,7 @@ EXPECTED_WITH_REVOKED = """{
def test_tool_example():
tool = stix2.v20.Tool(
id=TOOL_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T20:03:48.000Z",
modified="2016-04-06T20:03:48.000Z",
labels=["remote-access"],
@ -51,7 +51,7 @@ def test_tool_example():
EXPECTED,
{
"created": "2016-04-06T20:03:48Z",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": IDENTITY_ID,
"id": TOOL_ID,
"modified": "2016-04-06T20:03:48Z",
"labels": ["remote-access"],
@ -67,7 +67,7 @@ def test_parse_tool(data):
assert tool.id == TOOL_ID
assert tool.created == dt.datetime(2016, 4, 6, 20, 3, 48, tzinfo=pytz.utc)
assert tool.modified == dt.datetime(2016, 4, 6, 20, 3, 48, tzinfo=pytz.utc)
assert tool.created_by_ref == "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff"
assert tool.created_by_ref == IDENTITY_ID
assert tool.labels == ["remote-access"]
assert tool.name == "VNC"
@ -81,7 +81,7 @@ def test_tool_no_workbench_wrappers():
def test_tool_serialize_with_defaults():
tool = stix2.v20.Tool(
id=TOOL_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T20:03:48.000Z",
modified="2016-04-06T20:03:48.000Z",
labels=["remote-access"],

4
stix2/test/v20/test_utils.py
View File

@ -8,6 +8,8 @@ import pytz
import stix2.utils
from .constants import IDENTITY_ID
amsterdam = pytz.timezone('Europe/Amsterdam')
eastern = pytz.timezone('US/Eastern')
@ -123,7 +125,7 @@ def test_deduplicate(stix_objs1):
(
stix2.v20.ObservedData(
id="observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf",
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T19:58:16.000Z",
modified="2016-04-06T19:58:16.000Z",
first_observed="2015-12-21T19:00:00Z",

2
stix2/test/v21/constants.py
View File

@ -53,7 +53,7 @@ CAMPAIGN_MORE_KWARGS = dict(
type='campaign',
spec_version='2.1',
id=CAMPAIGN_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T20:03:00.000Z",
modified="2016-04-06T20:03:00.000Z",
name="Green Group Attacks Against Finance",

4
stix2/test/v21/test_bundle.py
View File

@ -4,6 +4,8 @@ import pytest
import stix2
from .constants import IDENTITY_ID
EXPECTED_BUNDLE = """{
"type": "bundle",
"id": "bundle--00000000-0000-4000-8000-000000000007",
@ -190,7 +192,7 @@ def test_parse_unknown_type():
"id": "other--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created": "2016-04-06T20:03:00Z",
"modified": "2016-04-06T20:03:00Z",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": IDENTITY_ID,
"description": "Campaign by Green Group against a series of targets in the financial services sector.",
"name": "Green Group Attacks Against Finance",
}

8
stix2/test/v21/test_campaign.py
View File

@ -5,13 +5,13 @@ import pytz
import stix2
from .constants import CAMPAIGN_ID, CAMPAIGN_MORE_KWARGS
from .constants import CAMPAIGN_ID, CAMPAIGN_MORE_KWARGS, IDENTITY_ID
EXPECTED = """{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2016-04-06T20:03:00.000Z",
"modified": "2016-04-06T20:03:00.000Z",
"name": "Green Group Attacks Against Finance",
@ -36,7 +36,7 @@ def test_campaign_example():
"id": CAMPAIGN_ID,
"created": "2016-04-06T20:03:00Z",
"modified": "2016-04-06T20:03:00Z",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": IDENTITY_ID,
"description": "Campaign by Green Group against a series of targets in the financial services sector.",
"name": "Green Group Attacks Against Finance",
},
@ -50,7 +50,7 @@ def test_parse_campaign(data):
assert cmpn.id == CAMPAIGN_ID
assert cmpn.created == dt.datetime(2016, 4, 6, 20, 3, 0, tzinfo=pytz.utc)
assert cmpn.modified == dt.datetime(2016, 4, 6, 20, 3, 0, tzinfo=pytz.utc)
assert cmpn.created_by_ref == "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff"
assert cmpn.created_by_ref == IDENTITY_ID
assert cmpn.description == "Campaign by Green Group against a series of targets in the financial services sector."
assert cmpn.name == "Green Group Attacks Against Finance"

6
stix2/test/v21/test_core.py
View File

@ -3,7 +3,7 @@ import pytest
import stix2
from stix2 import core, exceptions
from .constants import OBSERVED_DATA_ID
from .constants import IDENTITY_ID, OBSERVED_DATA_ID
BUNDLE = {
"type": "bundle",
@ -101,7 +101,7 @@ def test_register_marking_with_no_version():
def test_register_observable_with_default_version():
observed_data = stix2.v21.ObservedData(
id=OBSERVED_DATA_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T19:58:16.000Z",
modified="2016-04-06T19:58:16.000Z",
first_observed="2015-12-21T19:00:00Z",
@ -139,7 +139,7 @@ def test_register_observable_with_default_version():
def test_register_observable_extension_with_default_version():
observed_data = stix2.v21.ObservedData(
id=OBSERVED_DATA_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T19:58:16.000Z",
modified="2016-04-06T19:58:16.000Z",
first_observed="2015-12-21T19:00:00Z",

10
stix2/test/v21/test_course_of_action.py
View File

@ -5,13 +5,13 @@ import pytz
import stix2
from .constants import COURSE_OF_ACTION_ID
from .constants import COURSE_OF_ACTION_ID, IDENTITY_ID
EXPECTED = """{
"type": "course-of-action",
"spec_version": "2.1",
"id": "course-of-action--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2016-04-06T20:03:48.000Z",
"modified": "2016-04-06T20:03:48.000Z",
"name": "Add TCP port 80 Filter Rule to the existing Block UDP 1434 Filter",
@ -22,7 +22,7 @@ EXPECTED = """{
def test_course_of_action_example():
coa = stix2.v21.CourseOfAction(
id=COURSE_OF_ACTION_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T20:03:48.000Z",
modified="2016-04-06T20:03:48.000Z",
name="Add TCP port 80 Filter Rule to the existing Block UDP 1434 Filter",
@ -37,7 +37,7 @@ def test_course_of_action_example():
EXPECTED,
{
"created": "2016-04-06T20:03:48.000Z",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": IDENTITY_ID,
"description": "This is how to add a filter rule to block inbound access to TCP port 80 to the existing UDP 1434 filter ...",
"id": COURSE_OF_ACTION_ID,
"modified": "2016-04-06T20:03:48.000Z",
@ -55,7 +55,7 @@ def test_parse_course_of_action(data):
assert coa.id == COURSE_OF_ACTION_ID
assert coa.created == dt.datetime(2016, 4, 6, 20, 3, 48, tzinfo=pytz.utc)
assert coa.modified == dt.datetime(2016, 4, 6, 20, 3, 48, tzinfo=pytz.utc)
assert coa.created_by_ref == "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff"
assert coa.created_by_ref == IDENTITY_ID
assert coa.description == "This is how to add a filter rule to block inbound access to TCP port 80 to the existing UDP 1434 filter ..."
assert coa.name == "Add TCP port 80 Filter Rule to the existing Block UDP 1434 Filter"

4
stix2/test/v21/test_datastore_memory.py
View File

@ -282,13 +282,13 @@ def test_memory_store_object_creator_of_present(mem_store):
camp = Campaign(
name="Scipio Africanus",
objective="Defeat the Carthaginians",
created_by_ref="identity--e4196283-7420-4277-a7a3-d57f61ef1389",
created_by_ref=IDENTITY_ID,
x_empire="Roman",
allow_custom=True,
)
iden = Identity(
id="identity--e4196283-7420-4277-a7a3-d57f61ef1389",
id=IDENTITY_ID,
name="Foo Corp.",
identity_class="corporation",
)

8
stix2/test/v21/test_intrusion_set.py
View File

@ -5,13 +5,13 @@ import pytz
import stix2
from .constants import INTRUSION_SET_ID
from .constants import IDENTITY_ID, INTRUSION_SET_ID
EXPECTED = """{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--4e78f46f-a023-4e5f-bc24-71b3ca22ec29",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2016-04-06T20:03:48.000Z",
"modified": "2016-04-06T20:03:48.000Z",
"name": "Bobcat Breakin",
@ -30,7 +30,7 @@ EXPECTED = """{
def test_intrusion_set_example():
intrusion_set = stix2.v21.IntrusionSet(
id=INTRUSION_SET_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T20:03:48.000Z",
modified="2016-04-06T20:03:48.000Z",
name="Bobcat Breakin",
@ -50,7 +50,7 @@ def test_intrusion_set_example():
"Zookeeper",
],
"created": "2016-04-06T20:03:48.000Z",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": IDENTITY_ID,
"description": "Incidents usually feature a shared TTP of a bobcat being released...",
"goals": [
"acquisition-theft",

12
stix2/test/v21/test_markings.py
View File

@ -6,7 +6,7 @@ import pytz
import stix2
from stix2.v21 import TLP_WHITE
from .constants import MARKING_DEFINITION_ID
from .constants import IDENTITY_ID, MARKING_DEFINITION_ID
EXPECTED_TLP_MARKING_DEFINITION = """{
"type": "marking-definition",
@ -34,7 +34,7 @@ EXPECTED_CAMPAIGN_WITH_OBJECT_MARKING = """{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2016-04-06T20:03:00.000Z",
"modified": "2016-04-06T20:03:00.000Z",
"name": "Green Group Attacks Against Finance",
@ -58,7 +58,7 @@ EXPECTED_CAMPAIGN_WITH_GRANULAR_MARKINGS = """{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2016-04-06T20:03:00.000Z",
"modified": "2016-04-06T20:03:00.000Z",
"name": "Green Group Attacks Against Finance",
@ -114,7 +114,7 @@ def test_marking_def_invalid_type():
def test_campaign_with_markings_example():
campaign = stix2.v21.Campaign(
id="campaign--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T20:03:00Z",
modified="2016-04-06T20:03:00Z",
name="Green Group Attacks Against Finance",
@ -149,7 +149,7 @@ def test_granular_example_with_bad_selector():
def test_campaign_with_granular_markings_example():
campaign = stix2.v21.Campaign(
id="campaign--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T20:03:00Z",
modified="2016-04-06T20:03:00Z",
name="Green Group Attacks Against Finance",
@ -265,7 +265,7 @@ def test_marking_wrong_type_construction():
def test_campaign_add_markings():
campaign = stix2.v21.Campaign(
id="campaign--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T20:03:00Z",
modified="2016-04-06T20:03:00Z",
name="Green Group Attacks Against Finance",

24
stix2/test/v21/test_observed_data.py
View File

@ -6,7 +6,7 @@ import pytz
import stix2
from .constants import OBSERVED_DATA_ID
from .constants import IDENTITY_ID, OBSERVED_DATA_ID
OBJECTS_REGEX = re.compile('\"objects\": {(?:.*?)(?:(?:[^{]*?)|(?:{[^{]*?}))*}', re.DOTALL)
@ -15,7 +15,7 @@ EXPECTED = """{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2016-04-06T19:58:16.000Z",
"modified": "2016-04-06T19:58:16.000Z",
"first_observed": "2015-12-21T19:00:00Z",
@ -33,7 +33,7 @@ EXPECTED = """{
def test_observed_data_example():
observed_data = stix2.v21.ObservedData(
id=OBSERVED_DATA_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T19:58:16.000Z",
modified="2016-04-06T19:58:16.000Z",
first_observed="2015-12-21T19:00:00Z",
@ -54,7 +54,7 @@ EXPECTED_WITH_REF = """{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2016-04-06T19:58:16.000Z",
"modified": "2016-04-06T19:58:16.000Z",
"first_observed": "2015-12-21T19:00:00Z",
@ -79,7 +79,7 @@ EXPECTED_WITH_REF = """{
def test_observed_data_example_with_refs():
observed_data = stix2.v21.ObservedData(
id=OBSERVED_DATA_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T19:58:16.000Z",
modified="2016-04-06T19:58:16.000Z",
first_observed="2015-12-21T19:00:00Z",
@ -105,7 +105,7 @@ def test_observed_data_example_with_bad_refs():
with pytest.raises(stix2.exceptions.InvalidValueError) as excinfo:
stix2.v21.ObservedData(
id=OBSERVED_DATA_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T19:58:16.000Z",
modified="2016-04-06T19:58:16.000Z",
first_observed="2015-12-21T19:00:00Z",
@ -133,7 +133,7 @@ def test_observed_data_example_with_non_dictionary():
with pytest.raises(stix2.exceptions.InvalidValueError) as excinfo:
stix2.v21.ObservedData(
id=OBSERVED_DATA_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T19:58:16.000Z",
modified="2016-04-06T19:58:16.000Z",
first_observed="2015-12-21T19:00:00Z",
@ -151,7 +151,7 @@ def test_observed_data_example_with_empty_dictionary():
with pytest.raises(stix2.exceptions.InvalidValueError) as excinfo:
stix2.v21.ObservedData(
id=OBSERVED_DATA_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T19:58:16.000Z",
modified="2016-04-06T19:58:16.000Z",
first_observed="2015-12-21T19:00:00Z",
@ -173,7 +173,7 @@ def test_observed_data_example_with_empty_dictionary():
"spec_version": "2.1",
"id": OBSERVED_DATA_ID,
"created": "2016-04-06T19:58:16.000Z",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": IDENTITY_ID,
"first_observed": "2015-12-21T19:00:00Z",
"last_observed": "2015-12-21T19:00:00Z",
"modified": "2016-04-06T19:58:16.000Z",
@ -197,7 +197,7 @@ def test_parse_observed_data(data):
assert odata.modified == dt.datetime(2016, 4, 6, 19, 58, 16, tzinfo=pytz.utc)
assert odata.first_observed == dt.datetime(2015, 12, 21, 19, 0, 0, tzinfo=pytz.utc)
assert odata.last_observed == dt.datetime(2015, 12, 21, 19, 0, 0, tzinfo=pytz.utc)
assert odata.created_by_ref == "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff"
assert odata.created_by_ref == IDENTITY_ID
assert odata.objects["0"].type == "file"
@ -537,7 +537,7 @@ def test_parse_basic_tcp_traffic_with_error(data):
EXPECTED_PROCESS_OD = """{
"created": "2016-04-06T19:58:16.000Z",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"first_observed": "2015-12-21T19:00:00Z",
"id": "observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf",
"last_observed": "2015-12-21T19:00:00Z",
@ -566,7 +566,7 @@ EXPECTED_PROCESS_OD = """{
def test_observed_data_with_process_example():
observed_data = stix2.v21.ObservedData(
id=OBSERVED_DATA_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T19:58:16.000Z",
modified="2016-04-06T19:58:16.000Z",
first_observed="2015-12-21T19:00:00Z",

4
stix2/test/v21/test_pickle.py
View File

@ -2,13 +2,15 @@ import pickle
import stix2
from .constants import IDENTITY_ID
def test_pickling():
"""
Ensure a pickle/unpickle cycle works okay.
"""
identity = stix2.v21.Identity(
id="identity--d66cb89d-5228-4983-958c-fa84ef75c88c",
id=IDENTITY_ID,
name="alice",
description="this is a pickle test",
identity_class="some_class",

51
stix2/test/v21/test_report.py
View File

@ -5,13 +5,16 @@ import pytz
import stix2
from .constants import INDICATOR_KWARGS, REPORT_ID
from .constants import (
CAMPAIGN_ID, IDENTITY_ID, INDICATOR_ID, INDICATOR_KWARGS, RELATIONSHIP_ID,
REPORT_ID,
)
EXPECTED = """{
"type": "report",
"spec_version": "2.1",
"id": "report--84e4d88f-44ea-4bcd-bbf3-b2c1c320bcb3",
"created_by_ref": "identity--a463ffb3-1bd9-4d94-b02d-74e4f1658283",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2015-12-21T19:59:11.000Z",
"modified": "2015-12-21T19:59:11.000Z",
"name": "The Black Vine Cyberespionage Group",
@ -21,9 +24,9 @@ EXPECTED = """{
],
"published": "2016-01-20T17:00:00Z",
"object_refs": [
"indicator--26ffb872-1dd9-446e-b6f5-d58527e5b5d2",
"campaign--83422c77-904c-4dc1-aff5-5c38f3a2c55c",
"relationship--f82356ae-fe6c-437c-9c24-6b64314ae68a"
"indicator--a740531e-63ff-4e49-a9e1-a0a3eed0e3e7",
"campaign--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"relationship--df7c87eb-75d2-4948-af81-9d49d246f301"
]
}"""
@ -31,7 +34,7 @@ EXPECTED = """{
def test_report_example():
report = stix2.v21.Report(
id=REPORT_ID,
created_by_ref="identity--a463ffb3-1bd9-4d94-b02d-74e4f1658283",
created_by_ref=IDENTITY_ID,
created="2015-12-21T19:59:11.000Z",
modified="2015-12-21T19:59:11.000Z",
name="The Black Vine Cyberespionage Group",
@ -39,9 +42,9 @@ def test_report_example():
published="2016-01-20T17:00:00Z",
report_types=["campaign"],
object_refs=[
"indicator--26ffb872-1dd9-446e-b6f5-d58527e5b5d2",
"campaign--83422c77-904c-4dc1-aff5-5c38f3a2c55c",
"relationship--f82356ae-fe6c-437c-9c24-6b64314ae68a",
INDICATOR_ID,
CAMPAIGN_ID,
RELATIONSHIP_ID,
],
)
@ -51,7 +54,7 @@ def test_report_example():
def test_report_example_objects_in_object_refs():
report = stix2.v21.Report(
id=REPORT_ID,
created_by_ref="identity--a463ffb3-1bd9-4d94-b02d-74e4f1658283",
created_by_ref=IDENTITY_ID,
created="2015-12-21T19:59:11.000Z",
modified="2015-12-21T19:59:11.000Z",
name="The Black Vine Cyberespionage Group",
@ -59,9 +62,9 @@ def test_report_example_objects_in_object_refs():
published="2016-01-20T17:00:00Z",
report_types=["campaign"],
object_refs=[
stix2.v21.Indicator(id="indicator--26ffb872-1dd9-446e-b6f5-d58527e5b5d2", **INDICATOR_KWARGS),
"campaign--83422c77-904c-4dc1-aff5-5c38f3a2c55c",
"relationship--f82356ae-fe6c-437c-9c24-6b64314ae68a",
stix2.v21.Indicator(id=INDICATOR_ID, **INDICATOR_KWARGS),
CAMPAIGN_ID,
RELATIONSHIP_ID,
],
)
@ -72,7 +75,7 @@ def test_report_example_objects_in_object_refs_with_bad_id():
with pytest.raises(stix2.exceptions.InvalidValueError) as excinfo:
stix2.v21.Report(
id=REPORT_ID,
created_by_ref="identity--a463ffb3-1bd9-4d94-b02d-74e4f1658283",
created_by_ref=IDENTITY_ID,
created="2015-12-21T19:59:11.000Z",
modified="2015-12-21T19:59:11.000Z",
name="The Black Vine Cyberespionage Group",
@ -80,9 +83,9 @@ def test_report_example_objects_in_object_refs_with_bad_id():
published="2016-01-20T17:00:00Z",
report_types=["campaign"],
object_refs=[
stix2.v21.Indicator(id="indicator--26ffb872-1dd9-446e-b6f5-d58527e5b5d2", **INDICATOR_KWARGS),
stix2.v21.Indicator(id=INDICATOR_ID, **INDICATOR_KWARGS),
"campaign-83422c77-904c-4dc1-aff5-5c38f3a2c55c", # the "bad" id, missing a "-"
"relationship--f82356ae-fe6c-437c-9c24-6b64314ae68a",
RELATIONSHIP_ID,
],
)
@ -97,7 +100,7 @@ def test_report_example_objects_in_object_refs_with_bad_id():
EXPECTED,
{
"created": "2015-12-21T19:59:11.000Z",
"created_by_ref": "identity--a463ffb3-1bd9-4d94-b02d-74e4f1658283",
"created_by_ref": IDENTITY_ID,
"description": "A simple report with an indicator and campaign",
"id": REPORT_ID,
"report_types": [
@ -106,9 +109,9 @@ def test_report_example_objects_in_object_refs_with_bad_id():
"modified": "2015-12-21T19:59:11.000Z",
"name": "The Black Vine Cyberespionage Group",
"object_refs": [
"indicator--26ffb872-1dd9-446e-b6f5-d58527e5b5d2",
"campaign--83422c77-904c-4dc1-aff5-5c38f3a2c55c",
"relationship--f82356ae-fe6c-437c-9c24-6b64314ae68a",
INDICATOR_ID,
CAMPAIGN_ID,
RELATIONSHIP_ID,
],
"published": "2016-01-20T17:00:00Z",
"spec_version": "2.1",
@ -124,11 +127,11 @@ def test_parse_report(data):
assert rept.id == REPORT_ID
assert rept.created == dt.datetime(2015, 12, 21, 19, 59, 11, tzinfo=pytz.utc)
assert rept.modified == dt.datetime(2015, 12, 21, 19, 59, 11, tzinfo=pytz.utc)
assert rept.created_by_ref == "identity--a463ffb3-1bd9-4d94-b02d-74e4f1658283"
assert rept.created_by_ref == IDENTITY_ID
assert rept.object_refs == [
"indicator--26ffb872-1dd9-446e-b6f5-d58527e5b5d2",
"campaign--83422c77-904c-4dc1-aff5-5c38f3a2c55c",
"relationship--f82356ae-fe6c-437c-9c24-6b64314ae68a",
INDICATOR_ID,
CAMPAIGN_ID,
RELATIONSHIP_ID,
]
assert rept.description == "A simple report with an indicator and campaign"
assert rept.report_types == ["campaign"]

10
stix2/test/v21/test_sighting.py
View File

@ -5,7 +5,7 @@ import pytz
import stix2
from .constants import INDICATOR_ID, SIGHTING_ID, SIGHTING_KWARGS
from .constants import IDENTITY_ID, INDICATOR_ID, SIGHTING_ID, SIGHTING_KWARGS
EXPECTED_SIGHTING = """{
"type": "sighting",
@ -15,7 +15,7 @@ EXPECTED_SIGHTING = """{
"modified": "2016-04-06T20:06:37.000Z",
"sighting_of_ref": "indicator--a740531e-63ff-4e49-a9e1-a0a3eed0e3e7",
"where_sighted_refs": [
"identity--8cc7afd6-5455-4d2b-a736-e614ee631d99"
"identity--311b2d2d-f010-4473-83ec-1edf84858f4c"
]
}"""
@ -41,7 +41,7 @@ def test_sighting_all_required_properties():
created=now,
modified=now,
sighting_of_ref=INDICATOR_ID,
where_sighted_refs=["identity--8cc7afd6-5455-4d2b-a736-e614ee631d99"],
where_sighted_refs=[IDENTITY_ID],
)
assert str(s) == EXPECTED_SIGHTING
@ -102,7 +102,7 @@ def test_create_sighting_from_objects_rather_than_ids(malware): # noqa: F811
"spec_version": "2.1",
"type": "sighting",
"where_sighted_refs": [
"identity--8cc7afd6-5455-4d2b-a736-e614ee631d99",
IDENTITY_ID,
],
},
],
@ -116,4 +116,4 @@ def test_parse_sighting(data):
assert sighting.created == dt.datetime(2016, 4, 6, 20, 6, 37, tzinfo=pytz.utc)
assert sighting.modified == dt.datetime(2016, 4, 6, 20, 6, 37, tzinfo=pytz.utc)
assert sighting.sighting_of_ref == INDICATOR_ID
assert sighting.where_sighted_refs == ["identity--8cc7afd6-5455-4d2b-a736-e614ee631d99"]
assert sighting.where_sighted_refs == [IDENTITY_ID]

10
stix2/test/v21/test_threat_actor.py
View File

@ -5,13 +5,13 @@ import pytz
import stix2
from .constants import THREAT_ACTOR_ID
from .constants import IDENTITY_ID, THREAT_ACTOR_ID
EXPECTED = """{
"type": "threat-actor",
"spec_version": "2.1",
"id": "threat-actor--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2016-04-06T20:03:48.000Z",
"modified": "2016-04-06T20:03:48.000Z",
"name": "Evil Org",
@ -25,7 +25,7 @@ EXPECTED = """{
def test_threat_actor_example():
threat_actor = stix2.v21.ThreatActor(
id=THREAT_ACTOR_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T20:03:48.000Z",
modified="2016-04-06T20:03:48.000Z",
name="Evil Org",
@ -41,7 +41,7 @@ def test_threat_actor_example():
EXPECTED,
{
"created": "2016-04-06T20:03:48.000Z",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": IDENTITY_ID,
"description": "The Evil Org threat actor group",
"id": THREAT_ACTOR_ID,
"threat_actor_types": [
@ -62,7 +62,7 @@ def test_parse_threat_actor(data):
assert actor.id == THREAT_ACTOR_ID
assert actor.created == dt.datetime(2016, 4, 6, 20, 3, 48, tzinfo=pytz.utc)
assert actor.modified == dt.datetime(2016, 4, 6, 20, 3, 48, tzinfo=pytz.utc)
assert actor.created_by_ref == "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff"
assert actor.created_by_ref == IDENTITY_ID
assert actor.description == "The Evil Org threat actor group"
assert actor.name == "Evil Org"
assert actor.threat_actor_types == ["crime-syndicate"]

14
stix2/test/v21/test_tool.py
View File

@ -5,13 +5,13 @@ import pytz
import stix2
from .constants import TOOL_ID
from .constants import IDENTITY_ID, TOOL_ID
EXPECTED = """{
"type": "tool",
"spec_version": "2.1",
"id": "tool--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2016-04-06T20:03:48.000Z",
"modified": "2016-04-06T20:03:48.000Z",
"name": "VNC",
@ -24,7 +24,7 @@ EXPECTED_WITH_REVOKED = """{
"type": "tool",
"spec_version": "2.1",
"id": "tool--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2016-04-06T20:03:48.000Z",
"modified": "2016-04-06T20:03:48.000Z",
"name": "VNC",
@ -38,7 +38,7 @@ EXPECTED_WITH_REVOKED = """{
def test_tool_example():
tool = stix2.v21.Tool(
id=TOOL_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T20:03:48.000Z",
modified="2016-04-06T20:03:48.000Z",
name="VNC",
@ -53,7 +53,7 @@ def test_tool_example():
EXPECTED,
{
"created": "2016-04-06T20:03:48Z",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created_by_ref": IDENTITY_ID,
"id": TOOL_ID,
"tool_types": [
"remote-access",
@ -73,7 +73,7 @@ def test_parse_tool(data):
assert tool.id == TOOL_ID
assert tool.created == dt.datetime(2016, 4, 6, 20, 3, 48, tzinfo=pytz.utc)
assert tool.modified == dt.datetime(2016, 4, 6, 20, 3, 48, tzinfo=pytz.utc)
assert tool.created_by_ref == "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff"
assert tool.created_by_ref == IDENTITY_ID
assert tool.tool_types == ["remote-access"]
assert tool.name == "VNC"
@ -87,7 +87,7 @@ def test_tool_no_workbench_wrappers():
def test_tool_serialize_with_defaults():
tool = stix2.v21.Tool(
id=TOOL_ID,
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T20:03:48.000Z",
modified="2016-04-06T20:03:48.000Z",
name="VNC",

4
stix2/test/v21/test_utils.py
View File

@ -8,6 +8,8 @@ import pytz
import stix2.utils
from .constants import IDENTITY_ID
amsterdam = pytz.timezone('Europe/Amsterdam')
eastern = pytz.timezone('US/Eastern')
@ -123,7 +125,7 @@ def test_deduplicate(stix_objs1):
(
stix2.v21.ObservedData(
id="observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf",
created_by_ref="identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
created_by_ref=IDENTITY_ID,
created="2016-04-06T19:58:16.000Z",
modified="2016-04-06T19:58:16.000Z",
first_observed="2015-12-21T19:00:00Z",