Set STIX 2.1 as default, fix indicator.valid_from

pull/1/head
Chris Lenk 2020-06-12 14:31:01 -04:00
parent 57b371903f
commit b2ee33208f
5 changed files with 14 additions and 8 deletions

View File

@ -33,7 +33,8 @@ be set automatically if not provided as keyword arguments.
from stix2 import Indicator from stix2 import Indicator
indicator = Indicator(name="File hash for malware variant", indicator = Indicator(name="File hash for malware variant",
labels=["malicious-activity"], indicator_types=["malicious-activity"],
pattern_type="stix",
pattern="[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']") pattern="[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']")
To parse a STIX JSON string into a Python STIX object, use ``parse()``: To parse a STIX JSON string into a Python STIX object, use ``parse()``:

View File

@ -20,7 +20,7 @@
# flake8: noqa # flake8: noqa
DEFAULT_VERSION = '2.0' # Default version will always be the latest STIX 2.X version DEFAULT_VERSION = '2.1' # Default version will always be the latest STIX 2.X version
from .confidence import scales from .confidence import scales
from .datastore import CompositeDataSource from .datastore import CompositeDataSource
@ -53,7 +53,7 @@ from .patterns import (
RepeatQualifier, StartStopQualifier, StringConstant, TimestampConstant, RepeatQualifier, StartStopQualifier, StringConstant, TimestampConstant,
WithinQualifier, WithinQualifier,
) )
from .v20 import * # This import will always be the latest STIX 2.X version from .v21 import * # This import will always be the latest STIX 2.X version
from .version import __version__ from .version import __version__
from .versioning import new_version, revoke from .versioning import new_version, revoke

View File

@ -14,7 +14,7 @@ import stix2
from .base import _STIXBase from .base import _STIXBase
from .exceptions import ( from .exceptions import (
CustomContentError, DictionaryKeyError, MissingPropertiesError, CustomContentError, DictionaryKeyError, MissingPropertiesError,
MutuallyExclusivePropertiesError, MutuallyExclusivePropertiesError, STIXError,
) )
from .parsing import STIX2_OBJ_MAPS, parse, parse_observable from .parsing import STIX2_OBJ_MAPS, parse, parse_observable
from .utils import _get_dict, get_class_hierarchy_names, parse_into_datetime from .utils import _get_dict, get_class_hierarchy_names, parse_into_datetime
@ -168,6 +168,11 @@ class Property(object):
def __init__(self, required=False, fixed=None, default=None): def __init__(self, required=False, fixed=None, default=None):
self.required = required self.required = required
if required and default:
raise STIXError("Cant't use 'required' and 'default' together. 'required'"
"really means 'the user must provide this.'")
if fixed: if fixed:
self._fixed_value = fixed self._fixed_value = fixed
self.clean = self._default_clean self.clean = self._default_clean

View File

@ -98,8 +98,8 @@ def test_indicator_required_properties():
stix2.v21.Indicator() stix2.v21.Indicator()
assert excinfo.value.cls == stix2.v21.Indicator assert excinfo.value.cls == stix2.v21.Indicator
assert excinfo.value.properties == ["pattern", "pattern_type", "valid_from"] assert excinfo.value.properties == ["pattern", "pattern_type"]
assert str(excinfo.value) == "No values for required properties for Indicator: (pattern, pattern_type, valid_from)." assert str(excinfo.value) == "No values for required properties for Indicator: (pattern, pattern_type)."
def test_indicator_required_property_pattern(): def test_indicator_required_property_pattern():
@ -107,7 +107,7 @@ def test_indicator_required_property_pattern():
stix2.v21.Indicator(indicator_types=['malicious-activity']) stix2.v21.Indicator(indicator_types=['malicious-activity'])
assert excinfo.value.cls == stix2.v21.Indicator assert excinfo.value.cls == stix2.v21.Indicator
assert excinfo.value.properties == ["pattern", "pattern_type", "valid_from"] assert excinfo.value.properties == ["pattern", "pattern_type"]
def test_indicator_created_ref_invalid_format(): def test_indicator_created_ref_invalid_format():

View File

@ -187,7 +187,7 @@ class Indicator(_DomainObject):
('pattern', PatternProperty(required=True)), ('pattern', PatternProperty(required=True)),
('pattern_type', StringProperty(required=True)), ('pattern_type', StringProperty(required=True)),
('pattern_version', StringProperty()), ('pattern_version', StringProperty()),
('valid_from', TimestampProperty(default=lambda: NOW, required=True)), ('valid_from', TimestampProperty(default=lambda: NOW)),
('valid_until', TimestampProperty()), ('valid_until', TimestampProperty()),
('kill_chain_phases', ListProperty(KillChainPhase)), ('kill_chain_phases', ListProperty(KillChainPhase)),
('revoked', BooleanProperty(default=lambda: False)), ('revoked', BooleanProperty(default=lambda: False)),