From 50eb188190f6b279a72420e7e7332a912e0200ab Mon Sep 17 00:00:00 2001 From: Michael Chisholm Date: Thu, 27 Feb 2020 16:40:56 -0500 Subject: [PATCH] Add the "sample_ref" property to malware-analysis SDOs, per: https://github.com/oasis-tcs/cti-stix2/issues/210 --- stix2/test/v21/test_malware_analysis.py | 3 ++- stix2/v21/sdo.py | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/stix2/test/v21/test_malware_analysis.py b/stix2/test/v21/test_malware_analysis.py index bfb4ff4..b5e65aa 100644 --- a/stix2/test/v21/test_malware_analysis.py +++ b/stix2/test/v21/test_malware_analysis.py @@ -38,7 +38,8 @@ MALWARE_ANALYSIS_JSON = """{ "analysis_sco_refs": [ "file--fc27e371-6c88-4c5c-868a-4dda0e60b167", "url--6f7a74cd-8eb2-4b88-a4da-aa878e50ac2e" - ] + ], + "sample_ref": "email-addr--499a32d7-74c1-4276-ace9-725ac933e243" }""" diff --git a/stix2/v21/sdo.py b/stix2/v21/sdo.py index 1d97261..2bc02cc 100644 --- a/stix2/v21/sdo.py +++ b/stix2/v21/sdo.py @@ -526,6 +526,7 @@ class MalwareAnalysis(STIXDomainObject): ('analysis_ended', TimestampProperty()), ('av_result', StringProperty()), ('analysis_sco_refs', ListProperty(ReferenceProperty(valid_types="SCO", spec_version='2.1'))), + ('sample_ref', ReferenceProperty(valid_types="SCO", spec_version="2.1")), ]) def _check_object_constraints(self):