Set STIX 2.1 as default, fix indicator.valid_from

pull/1/head
Chris Lenk 2020-06-12 14:31:01 -04:00
parent 57b371903f
commit b2ee33208f
5 changed files with 14 additions and 8 deletions

View File

@ -33,7 +33,8 @@ be set automatically if not provided as keyword arguments.
from stix2 import Indicator
indicator = Indicator(name="File hash for malware variant",
labels=["malicious-activity"],
indicator_types=["malicious-activity"],
pattern_type="stix",
pattern="[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']")
To parse a STIX JSON string into a Python STIX object, use ``parse()``:

View File

@ -20,7 +20,7 @@
# flake8: noqa
DEFAULT_VERSION = '2.0' # Default version will always be the latest STIX 2.X version
DEFAULT_VERSION = '2.1' # Default version will always be the latest STIX 2.X version
from .confidence import scales
from .datastore import CompositeDataSource
@ -53,7 +53,7 @@ from .patterns import (
RepeatQualifier, StartStopQualifier, StringConstant, TimestampConstant,
WithinQualifier,
)
from .v20 import * # This import will always be the latest STIX 2.X version
from .v21 import * # This import will always be the latest STIX 2.X version
from .version import __version__
from .versioning import new_version, revoke

View File

@ -14,7 +14,7 @@ import stix2
from .base import _STIXBase
from .exceptions import (
CustomContentError, DictionaryKeyError, MissingPropertiesError,
MutuallyExclusivePropertiesError,
MutuallyExclusivePropertiesError, STIXError,
)
from .parsing import STIX2_OBJ_MAPS, parse, parse_observable
from .utils import _get_dict, get_class_hierarchy_names, parse_into_datetime
@ -168,6 +168,11 @@ class Property(object):
def __init__(self, required=False, fixed=None, default=None):
self.required = required
if required and default:
raise STIXError("Cant't use 'required' and 'default' together. 'required'"
"really means 'the user must provide this.'")
if fixed:
self._fixed_value = fixed
self.clean = self._default_clean

View File

@ -98,8 +98,8 @@ def test_indicator_required_properties():
stix2.v21.Indicator()
assert excinfo.value.cls == stix2.v21.Indicator
assert excinfo.value.properties == ["pattern", "pattern_type", "valid_from"]
assert str(excinfo.value) == "No values for required properties for Indicator: (pattern, pattern_type, valid_from)."
assert excinfo.value.properties == ["pattern", "pattern_type"]
assert str(excinfo.value) == "No values for required properties for Indicator: (pattern, pattern_type)."
def test_indicator_required_property_pattern():
@ -107,7 +107,7 @@ def test_indicator_required_property_pattern():
stix2.v21.Indicator(indicator_types=['malicious-activity'])
assert excinfo.value.cls == stix2.v21.Indicator
assert excinfo.value.properties == ["pattern", "pattern_type", "valid_from"]
assert excinfo.value.properties == ["pattern", "pattern_type"]
def test_indicator_created_ref_invalid_format():

View File

@ -187,7 +187,7 @@ class Indicator(_DomainObject):
('pattern', PatternProperty(required=True)),
('pattern_type', StringProperty(required=True)),
('pattern_version', StringProperty()),
('valid_from', TimestampProperty(default=lambda: NOW, required=True)),
('valid_from', TimestampProperty(default=lambda: NOW)),
('valid_until', TimestampProperty()),
('kill_chain_phases', ListProperty(KillChainPhase)),
('revoked', BooleanProperty(default=lambda: False)),