230 lines
6.9 KiB
Python
230 lines
6.9 KiB
Python
import uuid
|
|
|
|
import pytest
|
|
|
|
import stix2
|
|
|
|
from .constants import (
|
|
FAKE_TIME, GROUPING_KWARGS, INDICATOR_KWARGS, INFRASTRUCTURE_KWARGS,
|
|
MALWARE_KWARGS, RELATIONSHIP_KWARGS,
|
|
)
|
|
|
|
|
|
# Inspired by: http://stackoverflow.com/a/24006251
|
|
@pytest.fixture
|
|
def clock(monkeypatch):
|
|
|
|
class mydatetime(stix2.utils.STIXdatetime):
|
|
@classmethod
|
|
def now(cls, tz=None):
|
|
return FAKE_TIME
|
|
|
|
monkeypatch.setattr(stix2.utils, 'STIXdatetime', mydatetime)
|
|
|
|
|
|
@pytest.fixture
|
|
def uuid4(monkeypatch):
|
|
def wrapper():
|
|
data = [0]
|
|
|
|
def wrapped():
|
|
data[0] += 1
|
|
return "00000000-0000-4000-8000-00000000%04x" % data[0]
|
|
|
|
return wrapped
|
|
monkeypatch.setattr(uuid, "uuid4", wrapper())
|
|
|
|
|
|
@pytest.fixture
|
|
def indicator(uuid4, clock):
|
|
return stix2.v21.Indicator(**INDICATOR_KWARGS)
|
|
|
|
|
|
@pytest.fixture
|
|
def infrastructure(uuid4, clock):
|
|
return stix2.v21.Infrastructure(**INFRASTRUCTURE_KWARGS)
|
|
|
|
|
|
@pytest.fixture
|
|
def grouping(uuid4, clock):
|
|
return stix2.v21.Grouping(**GROUPING_KWARGS)
|
|
|
|
|
|
@pytest.fixture
|
|
def malware(uuid4, clock):
|
|
return stix2.v21.Malware(**MALWARE_KWARGS)
|
|
|
|
|
|
@pytest.fixture
|
|
def relationship(uuid4, clock):
|
|
return stix2.v21.Relationship(**RELATIONSHIP_KWARGS)
|
|
|
|
|
|
@pytest.fixture
|
|
def stix_objs1():
|
|
ind1 = {
|
|
"created": "2017-01-27T13:49:53.935Z",
|
|
"id": "indicator--00000000-0000-4000-8000-000000000001",
|
|
"indicator_types": [
|
|
"url-watchlist",
|
|
],
|
|
"modified": "2017-01-27T13:49:53.935Z",
|
|
"name": "Malicious site hosting downloader",
|
|
"pattern": "[url:value = 'http://x4z9arb.cn/4712']",
|
|
"pattern_type": "stix",
|
|
"spec_version": "2.1",
|
|
"type": "indicator",
|
|
"valid_from": "2017-01-27T13:49:53.935382Z",
|
|
}
|
|
ind2 = {
|
|
"created": "2017-01-27T13:49:53.935Z",
|
|
"id": "indicator--00000000-0000-4000-8000-000000000001",
|
|
"indicator_types": [
|
|
"url-watchlist",
|
|
],
|
|
"modified": "2017-01-27T13:49:53.935Z",
|
|
"name": "Malicious site hosting downloader",
|
|
"pattern": "[url:value = 'http://x4z9arb.cn/4712']",
|
|
"pattern_type": "stix",
|
|
"spec_version": "2.1",
|
|
"type": "indicator",
|
|
"valid_from": "2017-01-27T13:49:53.935382Z",
|
|
}
|
|
ind3 = {
|
|
"created": "2017-01-27T13:49:53.935Z",
|
|
"id": "indicator--00000000-0000-4000-8000-000000000001",
|
|
"indicator_types": [
|
|
"url-watchlist",
|
|
],
|
|
"modified": "2017-01-27T13:49:53.936Z",
|
|
"name": "Malicious site hosting downloader",
|
|
"pattern": "[url:value = 'http://x4z9arb.cn/4712']",
|
|
"pattern_type": "stix",
|
|
"spec_version": "2.1",
|
|
"type": "indicator",
|
|
"valid_from": "2017-01-27T13:49:53.935382Z",
|
|
}
|
|
ind4 = {
|
|
"created": "2017-01-27T13:49:53.935Z",
|
|
"id": "indicator--00000000-0000-4000-8000-000000000002",
|
|
"indicator_types": [
|
|
"url-watchlist",
|
|
],
|
|
"modified": "2017-01-27T13:49:53.935Z",
|
|
"name": "Malicious site hosting downloader",
|
|
"pattern": "[url:value = 'http://x4z9arb.cn/4712']",
|
|
"pattern_type": "stix",
|
|
"spec_version": "2.1",
|
|
"type": "indicator",
|
|
"valid_from": "2017-01-27T13:49:53.935382Z",
|
|
}
|
|
ind5 = {
|
|
"created": "2017-01-27T13:49:53.935Z",
|
|
"id": "indicator--00000000-0000-4000-8000-000000000002",
|
|
"indicator_types": [
|
|
"url-watchlist",
|
|
],
|
|
"modified": "2017-01-27T13:49:53.935Z",
|
|
"name": "Malicious site hosting downloader",
|
|
"pattern": "[url:value = 'http://x4z9arb.cn/4712']",
|
|
"pattern_type": "stix",
|
|
"spec_version": "2.1",
|
|
"type": "indicator",
|
|
"valid_from": "2017-01-27T13:49:53.935382Z",
|
|
}
|
|
sco = {
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--cc1deced-d99b-4d72-9268-8182420cb2fd",
|
|
"value": "http://example.com/",
|
|
}
|
|
return [ind1, ind2, ind3, ind4, ind5, sco]
|
|
|
|
|
|
@pytest.fixture
|
|
def stix_objs1_manifests():
|
|
# Tests against latest medallion (TAXII 2.1)
|
|
ind1 = {
|
|
"date_added": "2017-01-27T13:49:53.935Z",
|
|
"id": "indicator--00000000-0000-4000-8000-000000000001",
|
|
"media_type": "application/stix+json;version=2.1",
|
|
"version": "2017-01-27T13:49:53.935Z",
|
|
}
|
|
ind2 = {
|
|
"date_added": "2017-01-27T13:49:53.935Z",
|
|
"id": "indicator--00000000-0000-4000-8000-000000000001",
|
|
"media_type": "application/stix+json;version=2.1",
|
|
"version": "2017-01-27T13:49:53.935Z",
|
|
}
|
|
ind3 = {
|
|
"date_added": "2017-01-27T13:49:53.935Z",
|
|
"id": "indicator--00000000-0000-4000-8000-000000000001",
|
|
"media_type": "application/stix+json;version=2.1",
|
|
"version": "2017-01-27T13:49:53.936Z",
|
|
}
|
|
ind4 = {
|
|
"date_added": "2017-01-27T13:49:53.935Z",
|
|
"id": "indicator--00000000-0000-4000-8000-000000000002",
|
|
"media_type": "application/stix+json;version=2.1",
|
|
"version": "2017-01-27T13:49:53.935Z",
|
|
}
|
|
ind5 = {
|
|
"date_added": "2017-01-27T13:49:53.935Z",
|
|
"id": "indicator--00000000-0000-4000-8000-000000000002",
|
|
"media_type": "application/stix+json;version=2.1",
|
|
"version": "2017-01-27T13:49:53.935Z",
|
|
}
|
|
return [ind1, ind2, ind3, ind4, ind5]
|
|
|
|
|
|
@pytest.fixture
|
|
def stix_objs2():
|
|
ind6 = {
|
|
"created": "2017-01-27T13:49:53.935Z",
|
|
"id": "indicator--00000000-0000-4000-8000-000000000001",
|
|
"indicator_types": [
|
|
"url-watchlist",
|
|
],
|
|
"modified": "2017-01-31T13:49:53.935Z",
|
|
"name": "Malicious site hosting downloader",
|
|
"pattern_type": "stix",
|
|
"pattern": "[url:value = 'http://x4z9arb.cn/4712']",
|
|
"spec_version": "2.1",
|
|
"type": "indicator",
|
|
"valid_from": "2017-01-27T13:49:53.935382Z",
|
|
}
|
|
ind7 = {
|
|
"created": "2017-01-27T13:49:53.935Z",
|
|
"id": "indicator--00000000-0000-4000-8000-000000000002",
|
|
"indicator_types": [
|
|
"url-watchlist",
|
|
],
|
|
"modified": "2017-01-27T13:49:53.935Z",
|
|
"name": "Malicious site hosting downloader",
|
|
"pattern_type": "stix",
|
|
"pattern": "[url:value = 'http://x4z9arb.cn/4712']",
|
|
"spec_version": "2.1",
|
|
"type": "indicator",
|
|
"valid_from": "2017-01-27T13:49:53.935382Z",
|
|
}
|
|
ind8 = {
|
|
"created": "2017-01-27T13:49:53.935Z",
|
|
"id": "indicator--00000000-0000-4000-8000-000000000002",
|
|
"indicator_types": [
|
|
"url-watchlist",
|
|
],
|
|
"modified": "2017-01-27T13:49:53.935Z",
|
|
"name": "Malicious site hosting downloader",
|
|
"pattern_type": "stix",
|
|
"pattern": "[url:value = 'http://x4z9arb.cn/4712']",
|
|
"spec_version": "2.1",
|
|
"type": "indicator",
|
|
"valid_from": "2017-01-27T13:49:53.935382Z",
|
|
}
|
|
return [ind6, ind7, ind8]
|
|
|
|
|
|
@pytest.fixture
|
|
def real_stix_objs2(stix_objs2):
|
|
return [stix2.parse(x, version="2.1") for x in stix_objs2]
|