This OASIS TC Open Repository ( github.com/oasis-open/cti-python-stix2 ) is a community public repository that supports participation by anyone, whether affiliated with OASIS or not. Substantive contributions (repository "code") and related feedback is invited from all parties, following the common conventions for participation in GitHub public repository projects. Participation is expected to be consistent with the OASIS TC Open Repository Guidelines and Procedures, the LICENSE designated for this particular repository (BSD-3-Clause License), and the requirement for an Individual Contributor License Agreement. Please see the repository README document for other details.
Content accepted as "contributions" to this TC Open Repository, as defined below, are distinct from any Contributions made to the associated OASIS Cyber Threat Intelligence (CTI) TC itself. Participation in the associated Technical Committee is governed by the OASIS Bylaws, OASIS TC Process, IPR Policy, and related policies. This TC Open Repository is not subject to the OASIS TC-related policies. TC Open Repository governance is defined by separate participation and contribution guidelines as referenced in the OASIS TC Open Repositories Overview.
Because different licenses apply to the OASIS TC's specification work, and this TC Open Repository, there is no guarantee that the licensure of specific repository material will be compatible with licensing requirements of an implementation of a TC's specification. Please refer to the LICENSE file for the terms of this material, and to the OASIS IPR Policy for the terms applicable to the TC's specifications, including any applicable declarations.
Formally, "contribution" to this TC Open Repository refers to content merged into the "Code" repository (repository changes represented by code commits), following the GitHub definition of contributor: "someone who has contributed to a project by having a pull request merged but does not have collaborator [i.e., direct write] access." Anyone who signs the TC Open Repository Individual Contributor License Agreement (CLA), signifying agreement with the licensing requirement, may contribute substantive content — subject to evaluation of a GitHub pull request. The main web page for this repository, as with any GitHub public repository, displays a link to a document listing contributions to the repository's default branch (filtered by Commits, Additions, and Deletions).
This TC Open Repository, as with GitHub public repositories generally, also accepts public feedback from any GitHub user. Public feedback includes opening issues, authoring and editing comments, participating in conversations, making wiki edits, creating repository stars, and making suggestions via pull requests. Such feedback does not constitute an OASIS TC Open Repository contribution. Some details are presented under "Read permissions" in the table of permission levels for a GitHub organization. Technical content intended as a substantive contribution (repository "Code") to an TC Open Repository is subject to evaluation, and requires a signed Individual CLA.
OASIS TC Open Repositories use the familiar fork-and-pull collaboration model supported by GitHub and other distributed version-control systems. Any GitHub user wishing to contribute should fork the repository, make additions or other modifications, and then submit a pull request. GitHub pull requests should be accompanied by supporting comments and/or issues. Community conversations about pull requests, supported by GitHub notifications, will provide the basis for a consensus determination to merge, modify, close, or take other action, as communicated by the repository Maintainers.
Questions or comments about this TC Open Repository's activities should be composed as GitHub issues or comments. If use of an issue/comment is not possible or appropriate, questions may be directed by email to the repository Maintainer(s). Please send general questions about TC Open Repository participation to OASIS Staff at repository-admin@oasis-open.org and any specific CLA-related questions to repository-cla@oasis-open.org.
{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--a862ff86-68d9-42e5-8095-cd80c040e112",\n",
" "created": "2020-06-24T15:04:40.048932Z",\n",
" "modified": "2020-06-24T15:04:40.048932Z",\n",
" "name": "File hash for malware variant",\n",
" "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2020-06-24T15:04:40.048932Z"\n",
"}\n",
"{\n",
" "type": "malware",\n",
" "spec_version": "2.1",\n",
" "id": "malware--389c934c-258c-44fb-ae4b-14c6c12270f6",\n",
" "created": "2020-06-24T14:53:20.156644Z",\n",
" "modified": "2020-06-24T14:53:20.156644Z",\n",
" "name": "Poison Ivy",\n",
" "is_family": false\n",
"}\n",
"{\n",
" "type": "relationship",\n",
" "spec_version": "2.1",\n",
" "id": "relationship--2f6a8785-e27b-487e-b870-b85a2121502d",\n",
" "created": "2020-06-24T15:05:18.250605Z",\n",
" "modified": "2020-06-24T15:05:18.250605Z",\n",
" "relationship_type": "indicates",\n",
" "source_ref": "indicator--a862ff86-68d9-42e5-8095-cd80c040e112",\n",
" "target_ref": "malware--389c934c-258c-44fb-ae4b-14c6c12270f6"\n",
"}\n",
"{\n",
" "type": "relationship",\n",
" "spec_version": "2.1",\n",
" "id": "relationship--d43ec245-5496-44f4-8732-3131380435de",\n",
" "created": "2020-06-24T15:05:47.705352Z",\n",
" "modified": "2020-06-24T15:05:47.705352Z",\n",
" "relationship_type": "indicates",\n",
" "source_ref": "indicator--a862ff86-68d9-42e5-8095-cd80c040e112",\n",
" "target_ref": "malware--389c934c-258c-44fb-ae4b-14c6c12270f6"\n",
"}\n",
"{\n",
" "type": "bundle",\n",
" "id": "bundle--177c6477-2dee-43d5-b4c9-8b7f3f5ec517",\n",
" "objects": [\n",
" {\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--a862ff86-68d9-42e5-8095-cd80c040e112",\n",
" "created": "2020-06-24T15:04:40.048932Z",\n",
" "modified": "2020-06-24T15:04:40.048932Z",\n",
" "name": "File hash for malware variant",\n",
" "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2020-06-24T15:04:40.048932Z"\n",
" },\n",
" {\n",
" "type": "malware",\n",
" "spec_version": "2.1",\n",
" "id": "malware--389c934c-258c-44fb-ae4b-14c6c12270f6",\n",
" "created": "2020-06-24T14:53:20.156644Z",\n",
" "modified": "2020-06-24T14:53:20.156644Z",\n",
" "name": "Poison Ivy",\n",
" "is_family": false\n",
" },\n",
" {\n",
" "type": "relationship",\n",
" "spec_version": "2.1",\n",
" "id": "relationship--2f6a8785-e27b-487e-b870-b85a2121502d",\n",
" "created": "2020-06-24T15:05:18.250605Z",\n",
" "modified": "2020-06-24T15:05:18.250605Z",\n",
" "relationship_type": "indicates",\n",
" "source_ref": "indicator--a862ff86-68d9-42e5-8095-cd80c040e112",\n",
" "target_ref": "malware--389c934c-258c-44fb-ae4b-14c6c12270f6"\n",
" }\n",
" ]\n",
"}\n",
"{\n",
" "type": "ipv4-addr",\n",
" "id": "ipv4-addr--dc63603e-e634-5357-b239-d4b562bc5445",\n",
" "value": "177.60.40.7",\n",
" "resolves_to_refs": [\n",
" "mac-addr--43f380fd-37c6-476d-8643-60849bf9240e"\n",
" ],\n",
" "spec_version": "2.1"\n",
"}\n",
"{\n",
" "type": "ipv4-addr",\n",
" "id": "ipv4-addr--dc63603e-e634-5357-b239-d4b562bc5445",\n",
" "value": "177.60.40.7",\n",
" "resolves_to_refs": [\n",
" "mac-addr--f72d7d00-86bd-5cd2-8c86-52f7a83bef62",\n",
" "mac-addr--875ad625-177b-5c2a-9101-d44b0ad55938"\n",
" ],\n",
" "spec_version": "2.1"\n",
"}\n",
"{\n",
" "type": "identity",\n",
" "spec_version": "2.1",\n",
" "id": "identity--a4c49251-0ad1-44e6-8cfc-3dbd75e73fbd",\n",
" "created": "2020-06-24T18:29:07.107425Z",\n",
" "modified": "2020-06-24T18:29:07.107425Z",\n",
" "name": "John Smith",\n",
" "identity_class": "individual",\n",
" "x_foo": "bar"\n",
"}\n",
"{\n",
" "type": "identity",\n",
" "spec_version": "2.1",\n",
" "id": "identity--50c33f36-362b-4815-9f97-f3c7f39aa691",\n",
" "created": "2020-06-24T18:29:15.435425Z",\n",
" "modified": "2020-06-24T18:29:15.435425Z",\n",
" "name": "John Smith",\n",
" "identity_class": "individual",\n",
" "x_foo": "bar"\n",
"}\n",
"bar\n",
"{\n",
" "type": "identity",\n",
" "spec_version": "2.1",\n",
" "id": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",\n",
" "created": "2015-12-21T19:59:11.000Z",\n",
" "modified": "2020-06-24T18:29:24.099Z",\n",
" "name": "John Smith",\n",
" "identity_class": "individual"\n",
"}\n",
"{\n",
" "type": "x-animal",\n",
" "spec_version": "2.1",\n",
" "id": "x-animal--c7dbda16-360a-4622-b9c7-91f0497167cc",\n",
" "created": "2020-06-24T18:33:29.856926Z",\n",
" "modified": "2020-06-24T18:33:29.856926Z",\n",
" "species": "lion",\n",
" "animal_class": "mammal"\n",
"}\n",
"shark\n",
"{\n",
" "type": "x-new-observable",\n",
" "id": "x-new-observable--fdb5fd26-533e-44f4-9463-e8ade73e08c0",\n",
" "a_property": "something",\n",
" "property_2": 10\n",
"}\n",
"foobaz\n",
"5\n",
"{\n",
" "type": "x-new-observable-2",\n",
" "id": "x-new-observable-2--cafee477-4edc-58fd-81c1-2e23e93f9326",\n",
" "a_property": "A property",\n",
" "property_2": 2000\n",
"}\n",
"{\n",
" "type": "x-new-observable-2",\n",
" "id": "x-new-observable-2--cafee477-4edc-58fd-81c1-2e23e93f9326",\n",
" "a_property": "A property",\n",
" "property_2": 3000\n",
"}\n",
"{\n",
" "type": "x-new-observable-2",\n",
" "id": "x-new-observable-2--2945b948-7361-5204-a630-31b828af920c",\n",
" "a_property": "A different property",\n",
" "property_2": 3000\n",
"}\n",
"{\n",
" "property1": "something",\n",
" "property2": 10\n",
"}\n",
"bla\n",
"50\n",
"{\n",
" "type": "intrusion-set",\n",
" "spec_version": "2.1",\n",
" "id": "intrusion-set--f3bdec95-3d62-42d9-a840-29630f6cdc1a",\n",
" "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",\n",
" "created": "2017-05-31T21:31:53.197Z",\n",
" "modified": "2017-05-31T21:31:53.197Z",\n",
" "name": "DragonOK",\n",
" "description": "DragonOK is a threat group that has targeted Japanese organizations with phishing emails. Due to overlapping TTPs, including similar custom tools, DragonOK is thought to have a direct or indirect relationship with the threat group Moafee. [[Citation: Operation Quantum Entanglement]][[Citation: Symbiotic APT Groups]] It is known to use a variety of malware, including Sysget/HelloBridge, PlugX, PoisonIvy, FormerFirstRat, NFlog, and NewCT. [[Citation: New DragonOK]]",\n",
" "aliases": [\n",
" "DragonOK"\n",
" ],\n",
" "external_references": [\n",
" {\n",
" "source_name": "mitre-attack",\n",
" "url": "https://attack.mitre.org/wiki/Group/G0017",\n",
" "external_id": "G0017"\n",
" },\n",
" {\n",
" "source_name": "Operation Quantum Entanglement",\n",
" "description": "Haq, T., Moran, N., Vashisht, S., Scott, M. (2014, September). OPERATION QUANTUM ENTANGLEMENT. Retrieved November 4, 2015.",\n",
" "url": "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-quantum-entanglement.pdf"\n",
" },\n",
" {\n",
" "source_name": "Symbiotic APT Groups",\n",
" "description": "Haq, T. (2014, October). An Insight into Symbiotic APT Groups. Retrieved November 4, 2015.",\n",
" "url": "https://dl.mandiant.com/EE/library/MIRcon2014/MIRcon%202014%20R&D%20Track%20Insight%20into%20Symbiotic%20APT.pdf"\n",
" },\n",
" {\n",
" "source_name": "New DragonOK",\n",
" "description": "Miller-Osborn, J., Grunzweig, J.. (2015, April). Unit 42 Identifies New DragonOK Backdoor Malware Deployed Against Japanese Targets. Retrieved November 4, 2015.",\n",
" "url": "http://researchcenter.paloaltonetworks.com/2015/04/unit-42-identifies-new-dragonok-backdoor-malware-deployed-against-japanese-targets/"\n",
" }\n",
" ],\n",
" "object_marking_refs": [\n",
" "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"\n",
" ]\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--a740531e-63ff-4e49-a9e1-a0a3eed0e3e7",\n",
" "created": "2017-11-13T07:00:24.000Z",\n",
" "modified": "2017-11-13T07:00:24.000Z",\n",
" "name": "Ransomware IP Blocklist",\n",
" "description": "IP Blocklist address from abuse.ch",\n",
" "indicator_types": [\n",
" "malicious-activity",\n",
" "Ransomware",\n",
" "Botnet",\n",
" "C&C"\n",
" ],\n",
" "pattern": "[ ipv4-addr:value = '91.237.247.24' ]",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2017-11-13T07:00:24Z",\n",
" "external_references": [\n",
" {\n",
" "source_name": "abuse.ch",\n",
" "url": "https://ransomwaretracker.abuse.ch/blocklist/"\n",
" }\n",
" ]\n",
"}\n",
"{\n",
" "type": "identity",\n",
" "spec_version": "2.1",\n",
" "id": "identity--a2628104-e357-44a0-b16f-d5f36c0fd0ec",\n",
" "created": "2020-06-26T13:59:21.924055Z",\n",
" "modified": "2020-06-26T13:59:21.924055Z",\n",
" "name": "John Doe",\n",
" "identity_class": "individual"\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--a740531e-63ff-4e49-a9e1-a0a3eed0e3e7",\n",
" "created": "2020-06-26T14:46:08.384618Z",\n",
" "modified": "2020-06-26T14:46:08.384618Z",\n",
" "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2020-06-26T14:46:08.384618Z"\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--4db1493b-8822-4b1c-a471-1c1cdc53ec6d",\n",
" "created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",\n",
" "created": "2020-06-26T14:46:36.666866Z",\n",
" "modified": "2020-06-26T14:46:36.666866Z",\n",
" "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2020-06-26T14:46:36.666866Z"\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--e7e92c87-df40-4ffb-a6da-9667b0acddb1",\n",
" "created": "2017-09-25T18:07:46.255472Z",\n",
" "modified": "2017-09-25T18:07:46.255472Z",\n",
" "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2020-06-26T14:47:58.470047Z"\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--40540b9b-47a7-4855-81a3-b6d3ff6f8592",\n",
" "created_by_ref": "identity--962cabe5-f7f3-438a-9169-585a8c971d12",\n",
" "created": "2017-09-25T18:07:46.255472Z",\n",
" "modified": "2017-09-25T18:07:46.255472Z",\n",
" "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2020-06-26T14:48:11.028904Z"\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--3ab656d1-e549-4a6e-a2df-e84ff515fcd3",\n",
" "created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",\n",
" "created": "2020-06-26T14:48:20.238719Z",\n",
" "modified": "2020-06-26T14:48:20.238719Z",\n",
" "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2020-06-26T14:48:20.238719Z"\n",
"}\n",
"91.81818181818181\n",
"True\n",
"30.0\n",
"False\n",
"100.0\n",
"True\n",
"20.0\n",
"False\n",
"67.20663955882583\n",
"False\n",
"90.0\n",
"True\n",
"6.66666666666667\n",
"False\n",
"100.0\n",
"True\n",
"100.0\n",
"True\n",
"0\n",
"100.0\n",
"6.66666666666667\n",
"Semantic equivalence score using standard weights: 16.666666666666668\n",
"{'name': {'weight': 60, 'contributing_score': 6.666666666666669}, 'threat_actor_types': {'weight': 20, 'contributing_score': 10.0}, 'aliases': {'weight': 20, 'contributing_score': 0.0}, 'matching_score': 16.666666666666668, 'sum_weights': 100.0}\n",
"Prop: name | weight: 60 | contributing_score: 6.666666666666669\n",
"Prop: threat_actor_types | weight: 20 | contributing_score: 10.0\n",
"Prop: aliases | weight: 20 | contributing_score: 0.0\n",
"matching_score: 16.666666666666668\n",
"sum_weights: 100.0\n",
"Using standard weights: 16.666666666666668\n",
"Using custom weights: 28.33333333333334\n",
"{'name': {'weight': 45, 'contributing_score': 5.000000000000002}, 'threat_actor_types': {'weight': 10, 'contributing_score': 5.0}, 'aliases': {'weight': 45, 'contributing_score': 0.0}, 'matching_score': 10.000000000000002, 'sum_weights': 100.0}\n",
"Using custom string comparison: 5.0\n",
"Using standard weights: 16.666666666666668\n",
"Using a custom method: 6.66666666666667\n",
"71.42857142857143\n",
"{'name': (60, 60.0), 'color': (40, 11.428571428571427), 'matching_score': 71.42857142857143, 'sum_weights': 100.0}\n",
"59.68831168831168\n",
"False\n",
"{\n",
" "matching_score": 835.6363636363635,\n",
" "len_pairs": 14,\n",
" "summary": {\n",
" "threat-actor--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f": {\n",
" "lhs": "threat-actor--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",\n",
" "rhs": "threat-actor--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",\n",
" "prop_score": {\n",
" "name": {\n",
" "weight": 60,\n",
" "contributing_score": 6.666666666666669\n",
" },\n",
" "threat_actor_types": {\n",
" "weight": 20,\n",
" "contributing_score": 0.0\n",
" },\n",
" "aliases": {\n",
" "weight": 20,\n",
" "contributing_score": 0.0\n",
" },\n",
" "matching_score": 6.666666666666669,\n",
" "sum_weights": 100.0\n",
" },\n",
" "value": 6.66666666666667\n",
" },\n",
" "campaign--02eb6d99-15d3-4534-99ce-d5f946ca52fe": {\n",
" "lhs": "campaign--02eb6d99-15d3-4534-99ce-d5f946ca52fe",\n",
" "rhs": "campaign--d7fecca0-d020-43ae-977d-8d226df84c36",\n",
" "prop_score": {\n",
" "name": {\n",
" "weight": 60,\n",
" "contributing_score": 18.0\n",
" },\n",
" "matching_score": 18.0,\n",
" "sum_weights": 60.0\n",
" },\n",
" "value": 30.0\n",
" },\n",
" "campaign--d7fecca0-d020-43ae-977d-8d226df84c36": {\n",
" "lhs": "campaign--d7fecca0-d020-43ae-977d-8d226df84c36",\n",
" "rhs": "campaign--02eb6d99-15d3-4534-99ce-d5f946ca52fe",\n",
" "prop_score": {\n",
" "name": {\n",
" "weight": 60,\n",
" "contributing_score": 18.0\n",
" },\n",
" "matching_score": 18.0,\n",
" "sum_weights": 60.0\n",
" },\n",
" "value": 30.0\n",
" },\n",
" "indicator--d17a1296-d6c9-4119-9fbf-433c7f1f11af": {\n",
" "lhs": "indicator--d17a1296-d6c9-4119-9fbf-433c7f1f11af",\n",
" "rhs": "indicator--d2e7d0b6-4229-447d-9c44-2b0f7d93797b",\n",
" "prop_score": {\n",
" "indicator_types": {\n",
" "weight": 15,\n",
" "contributing_score": 15.0\n",
" },\n",
" "pattern": {\n",
" "weight": 80,\n",
" "contributing_score": 0\n",
" },\n",
" "valid_from": {\n",
" "weight": 5,\n",
" "contributing_score": 5.0\n",
" },\n",
" "matching_score": 20.0,\n",
" "sum_weights": 100.0\n",
" },\n",
" "value": 20.0\n",
" },\n",
" "indicator--d2e7d0b6-4229-447d-9c44-2b0f7d93797b": {\n",
" "lhs": "indicator--d2e7d0b6-4229-447d-9c44-2b0f7d93797b",\n",
" "rhs": "indicator--d17a1296-d6c9-4119-9fbf-433c7f1f11af",\n",
" "prop_score": {\n",
" "indicator_types": {\n",
" "weight": 15,\n",
" "contributing_score": 15.0\n",
" },\n",
" "pattern": {\n",
" "weight": 80,\n",
" "contributing_score": 0\n",
" },\n",
" "valid_from": {\n",
" "weight": 5,\n",
" "contributing_score": 5.0\n",
" },\n",
" "matching_score": 20.0,\n",
" "sum_weights": 100.0\n",
" },\n",
" "value": 20.0\n",
" },\n",
" "relationship--b399060e-0cdb-4e41-a30e-5894ae3627e8": {\n",
" "lhs": "relationship--b399060e-0cdb-4e41-a30e-5894ae3627e8",\n",
" "rhs": "relationship--b97e59e9-5e0d-47ef-a3f9-6a6e4fcefaab",\n",
" "prop_score": {\n",
" "relationship_type": {\n",
" "weight": 20,\n",
" "contributing_score": 20.0\n",
" },\n",
" "source_ref": {\n",
" "weight": 40,\n",
" "contributing_score": 2.666666666666668\n",
" },\n",
" "target_ref": {\n",
" "weight": 40,\n",
" "contributing_score": 36.0\n",
" },\n",
" "matching_score": 58.66666666666667,\n",
" "sum_weights": 100.0\n",
" },\n",
" "value": 58.666666666666664\n",
" },\n",
" "relationship--b97e59e9-5e0d-47ef-a3f9-6a6e4fcefaab": {\n",
" "lhs": "relationship--b97e59e9-5e0d-47ef-a3f9-6a6e4fcefaab",\n",
" "rhs": "relationship--b399060e-0cdb-4e41-a30e-5894ae3627e8",\n",
" "prop_score": {\n",
" "relationship_type": {\n",
" "weight": 20,\n",
" "contributing_score": 20.0\n",
" },\n",
" "source_ref": {\n",
" "weight": 40,\n",
" "contributing_score": 2.666666666666668\n",
" },\n",
" "target_ref": {\n",
" "weight": 40,\n",
" "contributing_score": 36.0\n",
" },\n",
" "matching_score": 58.66666666666667,\n",
" "sum_weights": 100.0\n",
" },\n",
" "value": 58.666666666666664\n",
" },\n",
" "report--87a26bd6-2870-44de-980f-e4cc6b63e1d5": {\n",
" "lhs": "report--87a26bd6-2870-44de-980f-e4cc6b63e1d5",\n",
" "rhs": "report--a71101c7-6064-4b8f-a9b4-ff49ff65e524",\n",
" "prop_score": {\n",
" "name": {\n",
" "weight": 30,\n",
" "contributing_score": 30.0\n",
" },\n",
" "published": {\n",
" "weight": 10,\n",
" "contributing_score": 10.0\n",
" },\n",
" "object_refs": {\n",
" "weight": 60,\n",
" "contributing_score": 29.0\n",
" },\n",
" "matching_score": 69.0,\n",
" "sum_weights": 100.0\n",
" },\n",
" "value": 69.0\n",
" },\n",
" "report--a71101c7-6064-4b8f-a9b4-ff49ff65e524": {\n",
" "lhs": "report--a71101c7-6064-4b8f-a9b4-ff49ff65e524",\n",
" "rhs": "report--87a26bd6-2870-44de-980f-e4cc6b63e1d5",\n",
" "prop_score": {\n",
" "name": {\n",
" "weight": 30,\n",
" "contributing_score": 30.0\n",
" },\n",
" "published": {\n",
" "weight": 10,\n",
" "contributing_score": 10.0\n",
" },\n",
" "object_refs": {\n",
" "weight": 60,\n",
" "contributing_score": 29.0\n",
" },\n",
" "matching_score": 69.0,\n",
" "sum_weights": 100.0\n",
" },\n",
" "value": 69.0\n",
" },\n",
" "identity--2b40ba3f-aa22-4e11-bd9d-e4843927ad32": {\n",
" "lhs": "identity--2b40ba3f-aa22-4e11-bd9d-e4843927ad32",\n",
" "rhs": "identity--4d8b54e3-d584-47c6-858f-673fffa45e96",\n",
" "prop_score": {\n",
" "name": {\n",
" "weight": 60,\n",
" "contributing_score": 60.0\n",
" },\n",
" "identity_class": {\n",
" "weight": 20,\n",
" "contributing_score": 20.0\n",
" },\n",
" "matching_score": 80.0,\n",
" "sum_weights": 80.0\n",
" },\n",
" "value": 100.0\n",
" },\n",
" "identity--4d8b54e3-d584-47c6-858f-673fffa45e96": {\n",
" "lhs": "identity--4d8b54e3-d584-47c6-858f-673fffa45e96",\n",
" "rhs": "identity--2b40ba3f-aa22-4e11-bd9d-e4843927ad32",\n",
" "prop_score": {\n",
" "name": {\n",
" "weight": 60,\n",
" "contributing_score": 60.0\n",
" },\n",
" "identity_class": {\n",
" "weight": 20,\n",
" "contributing_score": 20.0\n",
" },\n",
" "matching_score": 80.0,\n",
" "sum_weights": 80.0\n",
" },\n",
" "value": 100.0\n",
" },\n",
" "attack-pattern--57bc38b5-feda-4710-b613-441717c0062c": {\n",
" "lhs": "attack-pattern--57bc38b5-feda-4710-b613-441717c0062c",\n",
" "rhs": "attack-pattern--d9de40c6-a9a0-4e6f-ae59-d90a91e4f0e8",\n",
" "prop_score": {\n",
" "name": {\n",
" "weight": 30,\n",
" "contributing_score": 21.818181818181817\n",
" },\n",
" "external_references": {\n",
" "weight": 70,\n",
" "contributing_score": 70.0\n",
" },\n",
" "matching_score": 91.81818181818181,\n",
" "sum_weights": 100.0\n",
" },\n",
" "value": 91.81818181818181\n",
" },\n",
" "attack-pattern--d9de40c6-a9a0-4e6f-ae59-d90a91e4f0e8": {\n",
" "lhs": "attack-pattern--d9de40c6-a9a0-4e6f-ae59-d90a91e4f0e8",\n",
" "rhs": "attack-pattern--57bc38b5-feda-4710-b613-441717c0062c",\n",
" "prop_score": {\n",
" "name": {\n",
" "weight": 30,\n",
" "contributing_score": 21.818181818181817\n",
" },\n",
" "external_references": {\n",
" "weight": 70,\n",
" "contributing_score": 70.0\n",
" },\n",
" "matching_score": 91.81818181818181,\n",
" "sum_weights": 100.0\n",
" },\n",
" "value": 91.81818181818181\n",
" },\n",
" "malware--9c4638ec-f1de-4ddb-abf4-1b760417654e": {\n",
" "lhs": "malware--9c4638ec-f1de-4ddb-abf4-1b760417654e",\n",
" "rhs": "malware--9c4638ec-f1de-4ddb-abf4-1b760417654e",\n",
" "prop_score": {\n",
" "malware_types": {\n",
" "weight": 20,\n",
" "contributing_score": 10.0\n",
" },\n",
" "name": {\n",
" "weight": 80,\n",
" "contributing_score": 80.0\n",
" },\n",
" "matching_score": 90.0,\n",
" "sum_weights": 100.0\n",
" },\n",
" "value": 90.0\n",
" }\n",
" }\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--e97bfccf-8970-4a3c-9cd1-5b5b97ed5d0c",\n",
" "created": "2014-02-20T09:16:08.989Z",\n",
" "modified": "2014-02-20T09:16:08.989Z",\n",
" "name": "File hash for Poison Ivy variant",\n",
" "description": "This file hash indicates that a sample of Poison Ivy is present.",\n",
" "pattern": "[file:hashes.'SHA-256' = 'ef537f25c895bfa782526529a9b63d97aa631564d5d789c2b765448c8635fb6c']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2014-02-20T09:00:00Z",\n",
" "labels": [\n",
" "malicious-activity"\n",
" ],\n",
" "extensions": {\n",
" "extension-definition--dd73de4f-a7f3-49ea-8ec1-8e884196b7a8": {\n",
" "extension_type": "toplevel-property-extension"\n",
" }\n",
" },\n",
" "rank": 5,\n",
" "toxicity": 8\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--e97bfccf-8970-4a3c-9cd1-5b5b97ed5d0c",\n",
" "created": "2014-02-20T09:16:08.989Z",\n",
" "modified": "2014-02-20T09:16:08.989Z",\n",
" "name": "File hash for Poison Ivy variant",\n",
" "description": "This file hash indicates that a sample of Poison Ivy is present.",\n",
" "pattern": "[file:hashes.'SHA-256' = 'ef537f25c895bfa782526529a9b63d97aa631564d5d789c2b765448c8635fb6c']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2014-02-20T09:00:00Z",\n",
" "labels": [\n",
" "malicious-activity"\n",
" ],\n",
" "extensions": {\n",
" "extension-definition--dd73de4f-a7f3-49ea-8ec1-8e884196b7a8": {\n",
" "extension_type": "toplevel-property-extension"\n",
" }\n",
" },\n",
" "rank": 5,\n",
" "toxicity": 8\n",
"}\n",
"{\n",
" "type": "my-favorite-sco",\n",
" "spec_version": "2.1",\n",
" "id": "my-favorite-sco--f9dbe89c-0030-4a9d-8b78-0dcd0a0de874",\n",
" "name": "This is the name of my favorite SCO",\n",
" "some_network_protocol_field": "value",\n",
" "extensions": {\n",
" "extension-definition--150c1738-28c9-44d0-802d-70523218240b": {\n",
" "extension_type": "new-sco"\n",
" }\n",
" }\n",
"}\n",
"{\n",
" "type": "marking-definition",\n",
" "spec_version": "2.1",\n",
" "id": "marking-definition--9155f07c-dd4c-4320-be6a-0701311c3b84",\n",
" "created": "2021-07-12T00:56:31.47566Z",\n",
" "name": "This is the name of my favorite Marking",\n",
" "extensions": {\n",
" "extension-definition--a932fcc6-e032-176c-126f-cb970a5a1fff": {\n",
" "extension_type": "property-extension",\n",
" "some_marking_field": "value"\n",
" }\n",
" }\n",
"}\n",
"{\n",
" "type": "my-favorite-sro",\n",
" "spec_version": "2.1",\n",
" "id": "my-favorite-sro--d6306d62-c08d-4d78-baf7-11e7a4c9bc36",\n",
" "created": "2021-03-31T22:43:42.807698Z",\n",
" "modified": "2021-03-31T22:43:42.807698Z",\n",
" "name": "My First SRO",\n",
" "some_source_ref": "identity--b1da8c3e-34d8-470f-9d2b-392e275f1f7d",\n",
" "some_target_ref": "identity--1ddfed54-e8cd-49c9-9c7d-8d1b03c94685",\n",
" "extensions": {\n",
" "extension-definition--e96690a5-dc13-4f27-99dd-0f2188ad74ce": {\n",
" "extension_type": "new-sro"\n",
" }\n",
" }\n",
"}\n",
"{\n",
" "type": "malware",\n",
" "spec_version": "2.1",\n",
" "id": "malware--92ec0cbd-2c30-44a2-b270-73f4ec949841",\n",
" "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",\n",
" "created": "2017-05-31T21:33:26.565Z",\n",
" "modified": "2017-05-31T21:33:26.565Z",\n",
" "name": "RTM",\n",
" "description": "RTM is custom malware written in Delphi. It is used by the group of the same name (RTM).[[Citation: ESET RTM Feb 2017]]",\n",
" "malware_types": [\n",
" "malware"\n",
" ],\n",
" "is_family": false,\n",
" "external_references": [\n",
" {\n",
" "source_name": "mitre-attack",\n",
" "url": "https://attack.mitre.org/wiki/Software/S0148",\n",
" "external_id": "S0148"\n",
" },\n",
" {\n",
" "source_name": "ESET RTM Feb 2017",\n",
" "description": "Faou, M. and Boutin, J.. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.",\n",
" "url": "https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"\n",
" }\n",
" ],\n",
" "object_marking_refs": [\n",
" "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"\n",
" ]\n",
"}\n",
"{\n",
" "type": "attack-pattern",\n",
" "spec_version": "2.1",\n",
" "id": "attack-pattern--0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22",\n",
" "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",\n",
" "created": "2017-05-31T21:30:19.735Z",\n",
" "modified": "2017-05-31T21:30:19.735Z",\n",
" "name": "Credential Dumping",\n",
" "description": "Credential dumping is the process of obtaining account login and password information from the operating system and software. Credentials can be used to perform Windows Credential Editor, Mimikatz, and gsecdump. These tools are in use by both professional security testers and adversaries.\\n\\nPlaintext passwords can be obtained using tools such as Mimikatz to extract passwords stored by the Local Security Authority (LSA). If smart cards are used to authenticate to a domain using a personal identification number (PIN), then that PIN is also cached as a result and may be dumped.Mimikatz access the LSA Subsystem Service (LSASS) process by opening the process, locating the LSA secrets key, and decrypting the sections in memory where credential details are stored. Credential dumpers may also use methods for reflective DLL Injection to reduce potential indicators of malicious activity.\\n\\nNTLM hash dumpers open the Security Accounts Manager (SAM) on the local file system (%SystemRoot%/system32/config/SAM) or create a dump of the Registry SAM key to access stored account password hashes. Some hash dumpers will open the local file system as a device and parse to the SAM table to avoid file access defenses. Others will make an in-memory copy of the SAM table before reading hashes. Detection of compromised Legitimate Credentials in-use by adversaries may help as well. \\n\\nOn Windows 8.1 and Windows Server 2012 R2, monitor Windows Logs for LSASS.exe creation to verify that LSASS started as a protected process.\\n\\nMonitor processes and command-line arguments for program execution that may be indicative of credential dumping. Remote access tools may contain built-in features or incorporate existing tools like Mimikatz. PowerShell scripts also exist that contain credential dumping functionality, such as PowerSploit's Invoke-Mimikatz module,[[Citation: Powersploit]] which may require additional logging features to be configured in the operating system to collect necessary information for analysis.\\n\\nPlatforms: Windows Server 2003, Windows Server 2008, Windows Server 2012, Windows XP, Windows 7, Windows 8, Windows Server 2003 R2, Windows Server 2008 R2, Windows Server 2012 R2, Windows Vista, Windows 8.1\\n\\nData Sources: API monitoring, Process command-line parameters, Process monitoring, PowerShell logs",\n",
" "kill_chain_phases": [\n",
" {\n",
" "kill_chain_name": "mitre-attack",\n",
" "phase_name": "credential-access"\n",
" }\n",
" ],\n",
" "external_references": [\n",
" {\n",
" "source_name": "mitre-attack",\n",
" "url": "https://attack.mitre.org/wiki/Technique/T1003",\n",
" "external_id": "T1003"\n",
" },\n",
" {\n",
" "source_name": "Github Mimikatz Module sekurlsa",\n",
" "description": "Delpy, B. (2014, September 14). Mimikatz module ~ sekurlsa. Retrieved January 10, 2016.",\n",
" "url": "https://github.com/gentilkiwi/mimikatz/wiki/module-~-sekurlsa"\n",
" },\n",
" {\n",
" "source_name": "Powersploit",\n",
" "description": "PowerSploit. (n.d.). Retrieved December 4, 2014.",\n",
" "url": "https://github.com/mattifestation/PowerSploit"\n",
" }\n",
" ],\n",
" "object_marking_refs": [\n",
" "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"\n",
" ]\n",
"}\n",
"malware--92ec0cbd-2c30-44a2-b270-73f4ec949841\n",
"malware--b42378e0-f147-496f-992a-26a49705395b\n",
"malware--96b08451-b27a-4ff6-893f-790e26393a8e\n",
"malware--6b616fc1-1505-48e3-8b2c-0d19337bff38\n",
"malware--6b616fc1-1505-48e3-8b2c-0d19337bff38\n",
"malware--6b616fc1-1505-48e3-8b2c-0d19337bff38\n",
"malware--6b616fc1-1505-48e3-8b2c-0d19337bff38\n",
"malware--92ec0cbd-2c30-44a2-b270-73f4ec949841\n",
"malware--6b616fc1-1505-48e3-8b2c-0d19337bff38\n",
"malware--6b616fc1-1505-48e3-8b2c-0d19337bff38\n",
"malware--6b616fc1-1505-48e3-8b2c-0d19337bff38\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--a315ce0b-1211-478e-812a-cd6d3eecc3c1",\n",
" "created": "2021-04-09T13:59:48.911595Z",\n",
" "modified": "2021-04-09T13:59:48.911595Z",\n",
" "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2021-04-09T13:59:48.911595Z",\n",
" "object_marking_refs": [\n",
" "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"\n",
" ]\n",
"}\n",
"{\n",
" "type": "marking-definition",\n",
" "spec_version": "2.1",\n",
" "id": "marking-definition--4b8e86b5-d505-46a4-91b4-a8db17f4ff4d",\n",
" "created": "2021-04-09T13:59:50.587649Z",\n",
" "definition_type": "statement",\n",
" "definition": {\n",
" "statement": "Copyright 2017, Example Corp"\n",
" }\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--91ed23a6-c5f0-4b16-8369-64cf39f974bf",\n",
" "created": "2021-04-09T13:59:52.602254Z",\n",
" "modified": "2021-04-09T13:59:52.602254Z",\n",
" "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2021-04-09T13:59:52.602254Z",\n",
" "object_marking_refs": [\n",
" "marking-definition--4b8e86b5-d505-46a4-91b4-a8db17f4ff4d"\n",
" ]\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--42ae262e-4839-4c1a-a50a-3a6690623a9d",\n",
" "created": "2021-04-09T13:59:54.207797Z",\n",
" "modified": "2021-04-09T13:59:54.207797Z",\n",
" "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2021-04-09T13:59:54.207797Z",\n",
" "object_marking_refs": [\n",
" "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"\n",
" ]\n",
"}\n",
"{\n",
" "type": "malware",\n",
" "spec_version": "2.1",\n",
" "id": "malware--2658ac6a-44e9-44ea-8c8a-d67abae4d0d5",\n",
" "created": "2021-04-09T13:59:56.556801Z",\n",
" "modified": "2021-04-09T13:59:56.556801Z",\n",
" "name": "Poison Ivy",\n",
" "description": "A ransomware related to ...",\n",
" "is_family": false,\n",
" "granular_markings": [\n",
" {\n",
" "marking_ref": "marking-definition--4b8e86b5-d505-46a4-91b4-a8db17f4ff4d",\n",
" "selectors": [\n",
" "description"\n",
" ]\n",
" },\n",
" {\n",
" "marking_ref": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",\n",
" "selectors": [\n",
" "name"\n",
" ]\n",
" }\n",
" ]\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--a315ce0b-1211-478e-812a-cd6d3eecc3c1",\n",
" "created": "2021-04-09T13:59:48.911595Z",\n",
" "modified": "2021-04-09T14:00:01.165749Z",\n",
" "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2021-04-09T13:59:48.911595Z",\n",
" "object_marking_refs": [\n",
" "marking-definition--4b8e86b5-d505-46a4-91b4-a8db17f4ff4d",\n",
" "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"\n",
" ]\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--a315ce0b-1211-478e-812a-cd6d3eecc3c1",\n",
" "created": "2021-04-09T13:59:48.911595Z",\n",
" "modified": "2021-04-09T14:00:03.00911Z",\n",
" "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2021-04-09T13:59:48.911595Z",\n",
" "object_marking_refs": [\n",
" "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"\n",
" ]\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--a315ce0b-1211-478e-812a-cd6d3eecc3c1",\n",
" "created": "2021-04-09T13:59:48.911595Z",\n",
" "modified": "2021-04-09T14:00:04.531083Z",\n",
" "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2021-04-09T13:59:48.911595Z",\n",
" "object_marking_refs": [\n",
" "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da",\n",
" "marking-definition--4b8e86b5-d505-46a4-91b4-a8db17f4ff4d"\n",
" ]\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--a315ce0b-1211-478e-812a-cd6d3eecc3c1",\n",
" "created": "2021-04-09T13:59:48.911595Z",\n",
" "modified": "2021-04-09T14:00:06.512465Z",\n",
" "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2021-04-09T13:59:48.911595Z"\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--a2fd263a-ec46-4fff-84af-27419f0b9f15",\n",
" "created": "2021-04-09T14:02:31.991141Z",\n",
" "modified": "2021-04-09T14:02:31.991141Z",\n",
" "description": "Una descripcion sobre este indicador",\n",
" "indicator_types": [\n",
" "malware"\n",
" ],\n",
" "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2021-04-09T14:02:31.991141Z",\n",
" "object_marking_refs": [\n",
" "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"\n",
" ],\n",
" "granular_markings": [\n",
" {\n",
" "lang": "es",\n",
" "selectors": [\n",
" "description"\n",
" ]\n",
" },\n",
" {\n",
" "marking_ref": "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da",\n",
" "selectors": [\n",
" "description"\n",
" ]\n",
" }\n",
" ]\n",
"}\n",
"['marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da', 'es']\n",
"['marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da']\n",
"['es']\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--a2fd263a-ec46-4fff-84af-27419f0b9f15",\n",
" "created": "2021-04-09T14:02:31.991141Z",\n",
" "modified": "2021-04-09T14:03:11.817032Z",\n",
" "description": "Una descripcion sobre este indicador",\n",
" "indicator_types": [\n",
" "malware"\n",
" ],\n",
" "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2021-04-09T14:02:31.991141Z",\n",
" "object_marking_refs": [\n",
" "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"\n",
" ]\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--a2fd263a-ec46-4fff-84af-27419f0b9f15",\n",
" "created": "2021-04-09T14:02:31.991141Z",\n",
" "modified": "2021-04-09T14:03:24.701927Z",\n",
" "description": "Una descripcion sobre este indicador",\n",
" "indicator_types": [\n",
" "malware"\n",
" ],\n",
" "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2021-04-09T14:02:31.991141Z",\n",
" "object_marking_refs": [\n",
" "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"\n",
" ],\n",
" "granular_markings": [\n",
" {\n",
" "lang": "es",\n",
" "selectors": [\n",
" "description"\n",
" ]\n",
" }\n",
" ]\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--a2fd263a-ec46-4fff-84af-27419f0b9f15",\n",
" "created": "2021-04-09T14:02:31.991141Z",\n",
" "modified": "2021-04-09T14:03:29.751985Z",\n",
" "description": "Una descripcion sobre este indicador",\n",
" "indicator_types": [\n",
" "malware"\n",
" ],\n",
" "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2021-04-09T14:02:31.991141Z",\n",
" "object_marking_refs": [\n",
" "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"\n",
" ],\n",
" "granular_markings": [\n",
" {\n",
" "marking_ref": "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da",\n",
" "selectors": [\n",
" "description"\n",
" ]\n",
" }\n",
" ]\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--96120abd-f767-4292-b8b0-b739749e03b6",\n",
" "created": "2020-06-26T18:28:55.582226Z",\n",
" "modified": "2020-06-26T18:28:55.582226Z",\n",
" "description": "Crusades C2 implant",\n",
" "pattern": "[file:hashes.'SHA-256' = '54b7e05e39a59428743635242e4a867c932140a999f52a1e54fa7ee6a440c73b']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2020-06-26T18:28:55.582226Z"\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--dd5a0203-356d-415c-a118-fb6b0eae9de0",\n",
" "created": "2020-06-26T18:28:58.047811Z",\n",
" "modified": "2020-06-26T18:28:58.047811Z",\n",
" "description": "Crusades stage 2 implant variant",\n",
" "pattern": "[file:hashes.'SHA-256' = '31a45e777e4d58b97f4c43e38006f8cd6580ddabc4037905b2fad734712b582c']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2020-06-26T18:28:58.047811Z"\n",
"}\n",
"{\n",
" "type": "malware",\n",
" "spec_version": "2.1",\n",
" "id": "malware--6cee28b8-4d42-4e72-bd77-ea47897672c0",\n",
" "created": "2020-06-26T18:28:58.049244Z",\n",
" "modified": "2020-06-26T18:28:58.049244Z",\n",
" "name": "Alexios",\n",
" "malware_types": [\n",
" "rootkit"\n",
" ],\n",
" "is_family": false\n",
"}\n",
"{\n",
" "type": "malware",\n",
" "spec_version": "2.1",\n",
" "id": "malware--6cee28b8-4d42-4e72-bd77-ea47897672c0",\n",
" "created": "2020-06-26T18:28:58.049244Z",\n",
" "modified": "2020-06-26T18:28:58.049244Z",\n",
" "name": "Alexios",\n",
" "malware_types": [\n",
" "rootkit"\n",
" ],\n",
" "is_family": false\n",
"}\n",
"<class 'stix2.v21.sdo.ObservedData'>\n",
"{\n",
" "type": "observed-data",\n",
" "spec_version": "2.1",\n",
" "id": "observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf",\n",
" "created": "2016-04-06T19:58:16.000Z",\n",
" "modified": "2016-04-06T19:58:16.000Z",\n",
" "first_observed": "2015-12-21T19:00:00Z",\n",
" "last_observed": "2015-12-21T19:00:00Z",\n",
" "number_observed": 50,\n",
" "object_refs": [\n",
" "file--5d2dc832-b137-4e8c-97b2-5b00c18be611"\n",
" ]\n",
"}\n",
"<class 'stix2.v21.sdo.Identity'>\n",
"{\n",
" "type": "identity",\n",
" "spec_version": "2.1",\n",
" "id": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",\n",
" "created": "2015-12-21T19:59:11.000Z",\n",
" "modified": "2015-12-21T19:59:11.000Z",\n",
" "name": "Cole Powers",\n",
" "identity_class": "individual"\n",
"}\n",
"<class 'stix2.v21.sdo.CourseOfAction'>\n",
"{\n",
" "type": "course-of-action",\n",
" "spec_version": "2.1",\n",
" "id": "course-of-action--d9727aee-48b8-4fdb-89e2-4c49746ba4dd",\n",
" "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",\n",
" "created": "2017-05-31T21:30:41.022Z",\n",
" "modified": "2017-05-31T21:30:41.022Z",\n",
" "name": "Data from Network Shared Drive Mitigation",\n",
" "description": "Identify unnecessary system utilities or potentially malicious software that may be used to collect data from a network share, and audit and/or block them by using whitelisting[[CiteRef::Beechey 2010]] tools, like AppLocker,[[CiteRef::Windows Commands JPCERT]][[CiteRef::NSA MS AppLocker]] or Software Restriction Policies[[CiteRef::Corio 2008]] where appropriate.[[CiteRef::TechNet Applocker vs SRP]]"\n",
"}\n",
"\t[domain-name:value = 'site.of.interest.zaz']\n",
"\t[file:parent_directory_ref.path = 'C:\\\\Windows\\\\System32']\n",
"\t[file:extensions.'windows-pebinary-ext'.sections[*].entropy > 7.0]\n",
"\t[network-traffic:dst_ref.value ISSUBSET '2001:0db8:dead:beef:0000:0000:0000:0000/64']\n",
"(AND)\n",
"[email-message:sender_ref.value = 'stark@example.com' AND email-message:subject = 'Conference Info']\n",
"(OR)\n",
"[url:value = 'http://example.com/foo' OR url:value = 'http://example.com/bar']\n",
"(OR,AND)\n",
"[(file:name = 'pdf.exe' OR file:size = 371712) AND file:created = 2014-01-13 07:03:17+00:00]\n",
"(AND,OR,OR)\n",
"([file:name = 'foo.dll'] AND [win-registry-key:key = 'HKEY_LOCAL_MACHINE\\\\foo\\\\bar']) OR [process:name = 'fooproc' OR process:name = 'procfoo']\n",
"(FollowedBy)\n",
"[file:hashes.MD5 = '79054025255fb1a26e4bc422aef54eb4'] FOLLOWEDBY [win-registry-key:key = 'HKEY_LOCAL_MACHINE\\\\foo\\\\bar']\n",
"(WITHIN)\n",
"([file:hashes.MD5 = '79054025255fb1a26e4bc422aef54eb4'] FOLLOWEDBY [win-registry-key:key = 'HKEY_LOCAL_MACHINE\\\\foo\\\\bar']) WITHIN 300 SECONDS\n",
"(REPEAT, WITHIN)\n",
"[network-traffic:dst_ref.type = 'domain-name' AND network-traffic:dst_ref.value = 'example.com'] REPEATS 5 TIMES WITHIN 180 SECONDS\n",
"(START-STOP)\n",
"[file:name = 'foo.dll'] START t'2016-06-01T00:00:00Z' STOP t'2016-07-01T00:00:00Z'\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--30dbe788-c10c-4905-b2f0-8f738c847f4b",\n",
" "created": "2020-06-26T18:45:26.0832Z",\n",
" "modified": "2020-06-26T18:45:26.0832Z",\n",
" "name": "Cryptotorch",\n",
" "pattern": "[file:name = '$$t00rzch$$.elf']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2020-06-26T18:45:26.0832Z"\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--5e515461-93ad-41a8-a540-4f9d1a098939",\n",
" "created": "2020-06-26T18:47:20.215931Z",\n",
" "modified": "2020-06-26T18:47:20.215931Z",\n",
" "name": "File hash for malware variant",\n",
" "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2020-06-26T18:47:20.215931Z"\n",
"}\n",
"{"name": "File hash for malware variant", "pattern_type": "stix", "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']", "pattern_version": "2.1", "type": "indicator", "spec_version": "2.1", "id": "indicator--5e515461-93ad-41a8-a540-4f9d1a098939", "created": "2020-06-26T18:47:20.215931Z", "modified": "2020-06-26T18:47:20.215931Z", "valid_from": "2020-06-26T18:47:20.215931Z"}\n",
"{\n",
" "name": "File hash for malware variant",\n",
" "pattern_type": "stix",\n",
" "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
" "pattern_version": "2.1",\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--5e515461-93ad-41a8-a540-4f9d1a098939",\n",
" "created": "2020-06-26T18:47:20.215931Z",\n",
" "modified": "2020-06-26T18:47:20.215931Z",\n",
" "valid_from": "2020-06-26T18:47:20.215931Z"\n",
"}\n",
"{\n",
" "type": "malware",\n",
" "spec_version": "2.1",\n",
" "id": "malware--c0931cc6-c75e-47e5-9036-78fabc95d4ec",\n",
" "created": "2017-01-27T13:49:53.997Z",\n",
" "modified": "2017-01-27T13:49:53.997Z",\n",
" "name": "Poison Ivy",\n",
" "description": "Poison Ivy",\n",
" "malware_types": [\n",
" "remote-access-trojan"\n",
" ],\n",
" "is_family": true\n",
"}\n",
"-------\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--6770298f-0fd8-471a-ab8c-1c658a46574e",\n",
" "created": "2016-11-03T12:30:59.000Z",\n",
" "modified": "2016-11-03T12:30:59.000Z",\n",
" "name": "Malicious site hosting downloader",\n",
" "description": "Accessing this url will infect your machine with malware.",\n",
" "indicator_types": [\n",
" "url-watchlist"\n",
" ],\n",
" "pattern": "[url:value = 'http://z4z10farb.cn/4712']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2017-01-27T13:49:53.935382Z"\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--6770298f-0fd8-471a-ab8c-1c658a46574e",\n",
" "created": "2016-11-03T12:30:59.000Z",\n",
" "modified": "2016-12-25T12:30:59.444Z",\n",
" "name": "Malicious site hosting downloader",\n",
" "description": "Accessing this url will infect your machine with malware. Updated indicator",\n",
" "indicator_types": [\n",
" "url-watchlist"\n",
" ],\n",
" "pattern": "[url:value = 'http://x4z9arb.cn/4712']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2017-01-27T13:49:53.935382Z"\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--6770298f-0fd8-471a-ab8c-1c658a46574e",\n",
" "created": "2016-11-03T12:30:59.000Z",\n",
" "modified": "2017-01-27T13:49:53.935Z",\n",
" "name": "Malicious site hosting downloader",\n",
" "description": "Accessing this url will infect your machine with malware. This is the last updated indicator",\n",
" "indicator_types": [\n",
" "url-watchlist"\n",
" ],\n",
" "pattern": "[url:value = 'http://x4z9arb.cn/4712']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2016-11-03T12:30:59Z"\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--cd981c25-8042-4166-8945-51178443bdac",\n",
" "created": "2014-05-08T09:00:00.000Z",\n",
" "modified": "2014-05-08T09:00:00.000Z",\n",
" "name": "File hash for Poison Ivy variant",\n",
" "indicator_types": [\n",
" "file-hash-watchlist"\n",
" ],\n",
" "pattern": "[file:hashes.'SHA-256' = 'ef537f25c895bfa782526529a9b63d97aa631564d5d789c2b765448c8635fb6c']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2014-05-08T09:00:00Z"\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--6770298f-0fd8-471a-ab8c-1c658a46574e",\n",
" "created": "2016-11-03T12:30:59.000Z",\n",
" "modified": "2017-01-27T13:49:53.935Z",\n",
" "name": "Malicious site hosting downloader",\n",
" "description": "Accessing this url will infect your machine with malware. This is the last updated indicator",\n",
" "indicator_types": [\n",
" "url-watchlist"\n",
" ],\n",
" "pattern": "[url:value = 'http://x4z9arb.cn/4712']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2016-11-03T12:30:59Z"\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--d8f573d9-5796-4d3f-98fd-d3b953738520",\n",
" "created": "2020-06-26T19:04:05.608201Z",\n",
" "modified": "2020-06-26T19:04:05.608201Z",\n",
" "description": "Smokey Bear implant",\n",
" "pattern": "[file:hashes.'SHA-256' = '09c7e05a39a59428743635242e4a867c932140a909f12a1e54fa7ee6a440c73b']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2020-06-26T19:04:05.608201Z"\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--acd03fef-b8df-4c45-bd89-1ede90c39959",\n",
" "created": "2020-06-26T19:04:09.476525Z",\n",
" "modified": "2020-06-26T19:04:09.476525Z",\n",
" "description": "Smokey Bear implant",\n",
" "pattern": "[file:hashes.'SHA-256' = '09c7e05a39a59428743635242e4a867c932140a909f12a1e54fa7ee6a440c73b']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2020-06-26T19:04:09.476525Z"\n",
"}\n",
"{\n",
" "type": "malware",\n",
" "spec_version": "2.1",\n",
" "id": "malware--c0931cc6-c75e-47e5-9036-78fabc95d4ec",\n",
" "created": "2017-01-27T13:49:53.997Z",\n",
" "modified": "2017-01-27T13:49:53.997Z",\n",
" "name": "Poison Ivy",\n",
" "description": "Poison Ivy",\n",
" "malware_types": [\n",
" "remote-access-trojan"\n",
" ],\n",
" "is_family": true\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "id": "indicator--dbcbd659-c927-4f9a-994f-0a2632274394",\n",
" "created": "2017-09-26T23:33:39.829Z",\n",
" "modified": "2017-09-26T23:33:39.829Z",\n",
" "name": "File hash for malware variant",\n",
" "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
" "valid_from": "2017-09-26T23:33:39.829952Z",\n",
" "labels": [\n",
" "malicious-activity"\n",
" ]\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--6a7f1c8a-3c9a-471f-8ef0-e95e51457c3f",\n",
" "created": "2016-01-01T08:00:00.000Z",\n",
" "modified": "2020-06-26T19:27:20.792845Z",\n",
" "name": "File hash for Foobar malware",\n",
" "description": "A file indicator",\n",
" "indicator_types": [\n",
" "anomalous-activity"\n",
" ],\n",
" "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2020-06-26T19:27:20.759788Z",\n",
" "labels": [\n",
" "malicious-activity"\n",
" ]\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--6a7f1c8a-3c9a-471f-8ef0-e95e51457c3f",\n",
" "created": "2016-01-01T08:00:00.000Z",\n",
" "modified": "2020-06-26T19:29:37.055139Z",\n",
" "name": "File hash for suspicious file",\n",
" "indicator_types": [\n",
" "anomalous-activity"\n",
" ],\n",
" "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2020-06-26T19:27:20.759788Z"\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--6a7f1c8a-3c9a-471f-8ef0-e95e51457c3f",\n",
" "created": "2016-01-01T08:00:00.000Z",\n",
" "modified": "2020-06-26T19:29:38.943037Z",\n",
" "name": "File hash for suspicious file",\n",
" "indicator_types": [\n",
" "anomalous-activity"\n",
" ],\n",
" "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2020-06-26T19:27:20.759788Z",\n",
" "revoked": true\n",
"}\n",
"indicator--cd981c25-8042-4166-8945-51178443bdac\n",
"indicates\n",
"malware--c0931cc6-c75e-47e5-9036-78fabc95d4ec\n",
"{\n",
" "type": "malware",\n",
" "spec_version": "2.1",\n",
" "id": "malware--c0931cc6-c75e-47e5-9036-78fabc95d4ec",\n",
" "created": "2017-01-27T13:49:53.997Z",\n",
" "modified": "2017-01-27T13:49:53.997Z",\n",
" "name": "Poison Ivy",\n",
" "description": "Poison Ivy",\n",
" "malware_types": [\n",
" "remote-access-trojan"\n",
" ],\n",
" "is_family": true\n",
"}\n",
"{\n",
" "type": "indicator",\n",
" "spec_version": "2.1",\n",
" "id": "indicator--cd981c25-8042-4166-8945-51178443bdac",\n",
" "created": "2014-05-08T09:00:00.000Z",\n",
" "modified": "2014-05-08T09:00:00.000Z",\n",
" "name": "File hash for Poison Ivy variant",\n",
" "indicator_types": [\n",
" "file-hash-watchlist"\n",
" ],\n",
" "pattern": "[file:hashes.'SHA-256' = 'ef537f25c895bfa782526529a9b63d97aa631564d5d789c2b765448c8635fb6c']",\n",
" "pattern_type": "stix",\n",
" "pattern_version": "2.1",\n",
" "valid_from": "2014-05-08T09:00:00Z"\n",
"}\n",
"ACME Threat Intel Co.\n",
"net use commands, and interacting with services.\n\nAliases: Net, net.exe",
"external_references": [
{
"external_id": "S0039",
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/wiki/Software/S0039"
},
{
"description": "Microsoft. (2006, October 18). Net.exe Utility. Retrieved September 22, 2015.",
"source_name": "Microsoft Net Utility",
"url": "https://msdn.microsoft.com/en-us/library/aa939914"
},
{
"description": "Savill, J. (1999, March 4). Net.exe reference. Retrieved September 22, 2015.",
"source_name": "Savill 1999",
"url": "http://windowsitpro.com/windows/netexe-reference"
}
],
"id": "tool--03342581-f790-4f03-ba41-e82e67392e23",
"labels": [
"tool"
],
"modified": "2017-05-31T21:32:31.601Z",
"name": "Net",
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"type": "tool"
}
],
"spec_version": "2.0",
"type": "bundle"
}
cti-python-stix2-3.0.1/stix2/test/v20/stix2_data/tool/tool--242f3da3-4425-4d11-8f5c-b842886da966/ 0000775 0000000 0000000 00000000000 14123351755 0030027 5 ustar 00root root 0000000 0000000 20170531213212684914.json 0000664 0000000 0000000 00000002535 14123351755 0032725 0 ustar 00root root 0000000 0000000 cti-python-stix2-3.0.1/stix2/test/v20/stix2_data/tool/tool--242f3da3-4425-4d11-8f5c-b842886da966 {
"id": "bundle--7dbde18f-6f14-4bf0-8389-505c89d6d5a6",
"objects": [
{
"created": "2017-05-31T21:32:12.684Z",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"description": "Windows Credential Editor is a password dumping tool.[[Citation: Amplia WCE]]\n\nAliases: Windows Credential Editor, WCE",
"external_references": [
{
"external_id": "S0005",
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/wiki/Software/S0005"
},
{
"description": "Amplia Security. (n.d.). Windows Credentials Editor (WCE) F.A.Q.. Retrieved December 17, 2015.",
"source_name": "Amplia WCE",
"url": "http://www.ampliasecurity.com/research/wcefaq.html"
}
],
"id": "tool--242f3da3-4425-4d11-8f5c-b842886da966",
"labels": [
"tool"
],
"modified": "2017-05-31T21:32:12.684Z",
"name": "Windows Credential Editor",
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"type": "tool"
}
],
"spec_version": "2.0",
"type": "bundle"
}
cti-python-stix2-3.0.1/stix2/test/v20/test_attack_pattern.py 0000664 0000000 0000000 00000006242 14123351755 0023746 0 ustar 00root root 0000000 0000000 import datetime as dt
import pytest
import pytz
import stix2
import stix2.exceptions
from .constants import ATTACK_PATTERN_ID
EXPECTED = """{
"type": "attack-pattern",
"id": "attack-pattern--0c7b5b88-8ff7-4a4d-aa9d-feb398cd0061",
"created": "2016-05-12T08:17:27.000Z",
"modified": "2016-05-12T08:17:27.000Z",
"name": "Spear Phishing",
"description": "...",
"external_references": [
{
"source_name": "capec",
"external_id": "CAPEC-163"
}
]
}"""
def test_attack_pattern_example():
ap = stix2.v20.AttackPattern(
id=ATTACK_PATTERN_ID,
created="2016-05-12T08:17:27.000Z",
modified="2016-05-12T08:17:27.000Z",
name="Spear Phishing",
external_references=[{
"source_name": "capec",
"external_id": "CAPEC-163",
}],
description="...",
)
assert ap.serialize(pretty=True) == EXPECTED
@pytest.mark.parametrize(
"data", [
EXPECTED,
{
"type": "attack-pattern",
"id": ATTACK_PATTERN_ID,
"created": "2016-05-12T08:17:27.000Z",
"modified": "2016-05-12T08:17:27.000Z",
"description": "...",
"external_references": [
{
"external_id": "CAPEC-163",
"source_name": "capec",
},
],
"name": "Spear Phishing",
},
],
)
def test_parse_attack_pattern(data):
ap = stix2.parse(data, version="2.0")
assert ap.type == 'attack-pattern'
assert ap.id == ATTACK_PATTERN_ID
assert ap.created == dt.datetime(2016, 5, 12, 8, 17, 27, tzinfo=pytz.utc)
assert ap.modified == dt.datetime(2016, 5, 12, 8, 17, 27, tzinfo=pytz.utc)
assert ap.description == "..."
assert ap.external_references[0].external_id == 'CAPEC-163'
assert ap.external_references[0].source_name == 'capec'
assert ap.name == "Spear Phishing"
def test_attack_pattern_invalid_labels():
with pytest.raises(stix2.exceptions.InvalidValueError):
stix2.v20.AttackPattern(
id=ATTACK_PATTERN_ID,
created="2016-05-12T08:17:27Z",
modified="2016-05-12T08:17:27Z",
name="Spear Phishing",
labels=1,
)
def test_overly_precise_timestamps():
with pytest.raises(stix2.exceptions.InvalidValueError):
stix2.v20.AttackPattern(
id=ATTACK_PATTERN_ID,
created="2016-05-12T08:17:27.0000342Z",
modified="2016-05-12T08:17:27.000287Z",
name="Spear Phishing",
external_references=[{
"source_name": "capec",
"external_id": "CAPEC-163",
}],
description="...",
)
def test_less_precise_timestamps():
ap = stix2.v20.AttackPattern(
id=ATTACK_PATTERN_ID,
created="2016-05-12T08:17:27.00Z",
modified="2016-05-12T08:17:27.0Z",
name="Spear Phishing",
external_references=[{
"source_name": "capec",
"external_id": "CAPEC-163",
}],
description="...",
)
assert ap.serialize(pretty=True) == EXPECTED
# TODO: Add other examples
cti-python-stix2-3.0.1/stix2/test/v20/test_base.py 0000664 0000000 0000000 00000001107 14123351755 0021647 0 ustar 00root root 0000000 0000000 import datetime as dt
import json
import pytest
import pytz
from stix2.base import STIXJSONEncoder
def test_encode_json_datetime():
now = dt.datetime(2017, 3, 22, 0, 0, 0, tzinfo=pytz.UTC)
test_dict = {'now': now}
expected = '{"now": "2017-03-22T00:00:00Z"}'
assert json.dumps(test_dict, cls=STIXJSONEncoder) == expected
def test_encode_json_object():
obj = object()
test_dict = {'obj': obj}
with pytest.raises(TypeError) as excinfo:
json.dumps(test_dict, cls=STIXJSONEncoder)
assert " is not JSON serializable" in str(excinfo.value)
cti-python-stix2-3.0.1/stix2/test/v20/test_bundle.py 0000664 0000000 0000000 00000030440 14123351755 0022210 0 ustar 00root root 0000000 0000000 import io
import json
import pytest
import stix2
from ...exceptions import InvalidValueError
from .constants import IDENTITY_ID
EXPECTED_BUNDLE = """{
"type": "bundle",
"id": "bundle--00000000-0000-4000-8000-000000000007",
"spec_version": "2.0",
"objects": [
{
"type": "indicator",
"id": "indicator--00000000-0000-4000-8000-000000000001",
"created": "2017-01-01T12:34:56.000Z",
"modified": "2017-01-01T12:34:56.000Z",
"pattern": "[file:hashes.MD5 = 'd41d8cd98f00b204e9800998ecf8427e']",
"valid_from": "2017-01-01T12:34:56Z",
"labels": [
"malicious-activity"
]
},
{
"type": "malware",
"id": "malware--00000000-0000-4000-8000-000000000003",
"created": "2017-01-01T12:34:56.000Z",
"modified": "2017-01-01T12:34:56.000Z",
"name": "Cryptolocker",
"labels": [
"ransomware"
]
},
{
"type": "relationship",
"id": "relationship--00000000-0000-4000-8000-000000000005",
"created": "2017-01-01T12:34:56.000Z",
"modified": "2017-01-01T12:34:56.000Z",
"relationship_type": "indicates",
"source_ref": "indicator--a740531e-63ff-4e49-a9e1-a0a3eed0e3e7",
"target_ref": "malware--9c4638ec-f1de-4ddb-abf4-1b760417654e"
}
]
}"""
EXPECTED_BUNDLE_DICT = {
"type": "bundle",
"id": "bundle--00000000-0000-4000-8000-000000000007",
"spec_version": "2.0",
"objects": [
{
"type": "indicator",
"id": "indicator--00000000-0000-4000-8000-000000000001",
"created": "2017-01-01T12:34:56.000Z",
"modified": "2017-01-01T12:34:56.000Z",
"pattern": "[file:hashes.MD5 = 'd41d8cd98f00b204e9800998ecf8427e']",
"valid_from": "2017-01-01T12:34:56Z",
"labels": [
"malicious-activity",
],
},
{
"type": "malware",
"id": "malware--00000000-0000-4000-8000-000000000003",
"created": "2017-01-01T12:34:56.000Z",
"modified": "2017-01-01T12:34:56.000Z",
"name": "Cryptolocker",
"labels": [
"ransomware",
],
},
{
"type": "relationship",
"id": "relationship--00000000-0000-4000-8000-000000000005",
"created": "2017-01-01T12:34:56.000Z",
"modified": "2017-01-01T12:34:56.000Z",
"relationship_type": "indicates",
"source_ref": "indicator--a740531e-63ff-4e49-a9e1-a0a3eed0e3e7",
"target_ref": "malware--9c4638ec-f1de-4ddb-abf4-1b760417654e",
},
],
}
def test_empty_bundle():
bundle = stix2.v20.Bundle()
assert bundle.type == "bundle"
assert bundle.id.startswith("bundle--")
with pytest.raises(AttributeError):
assert bundle.objects
def test_bundle_with_wrong_type():
with pytest.raises(stix2.exceptions.InvalidValueError) as excinfo:
stix2.v20.Bundle(type="not-a-bundle")
assert excinfo.value.cls == stix2.v20.Bundle
assert excinfo.value.prop_name == "type"
assert excinfo.value.reason == "must equal 'bundle'."
assert str(excinfo.value) == "Invalid value for Bundle 'type': must equal 'bundle'."
def test_bundle_id_must_start_with_bundle():
with pytest.raises(stix2.exceptions.InvalidValueError) as excinfo:
stix2.v20.Bundle(id='my-prefix--')
assert excinfo.value.cls == stix2.v20.Bundle
assert excinfo.value.prop_name == "id"
assert excinfo.value.reason == "must start with 'bundle--'."
assert str(excinfo.value) == "Invalid value for Bundle 'id': must start with 'bundle--'."
def test_create_bundle_fp_serialize_pretty(indicator, malware, relationship):
bundle = stix2.v20.Bundle(objects=[indicator, malware, relationship])
buffer = io.StringIO()
bundle.fp_serialize(buffer, pretty=True)
assert bundle.serialize(pretty=True) == EXPECTED_BUNDLE
assert buffer.getvalue() == EXPECTED_BUNDLE
def test_create_bundle_fp_serialize_nonpretty(indicator, malware, relationship):
bundle = stix2.v20.Bundle(objects=[indicator, malware, relationship])
buffer = io.StringIO()
bundle.fp_serialize(buffer, sort_keys=True)
assert bundle.serialize(sort_keys=True) == json.dumps(json.loads(EXPECTED_BUNDLE), sort_keys=True)
assert buffer.getvalue() == json.dumps(json.loads(EXPECTED_BUNDLE), sort_keys=True)
def test_create_bundle1(indicator, malware, relationship):
bundle = stix2.v20.Bundle(objects=[indicator, malware, relationship])
assert bundle.serialize(pretty=True) == EXPECTED_BUNDLE
assert bundle.serialize(pretty=True) == EXPECTED_BUNDLE
def test_create_bundle2(indicator, malware, relationship):
bundle = stix2.v20.Bundle(objects=[indicator, malware, relationship])
assert json.loads(bundle.serialize()) == EXPECTED_BUNDLE_DICT
def test_create_bundle_with_positional_args(indicator, malware, relationship):
bundle = stix2.v20.Bundle(indicator, malware, relationship)
assert bundle.serialize(pretty=True) == EXPECTED_BUNDLE
def test_create_bundle_with_positional_listarg(indicator, malware, relationship):
bundle = stix2.v20.Bundle([indicator, malware, relationship])
assert bundle.serialize(pretty=True) == EXPECTED_BUNDLE
def test_create_bundle_with_listarg_and_positional_arg(indicator, malware, relationship):
bundle = stix2.v20.Bundle([indicator, malware], relationship)
assert bundle.serialize(pretty=True) == EXPECTED_BUNDLE
def test_create_bundle_with_listarg_and_kwarg(indicator, malware, relationship):
bundle = stix2.v20.Bundle([indicator, malware], objects=[relationship])
assert bundle.serialize(pretty=True) == EXPECTED_BUNDLE
def test_create_bundle_with_arg_listarg_and_kwarg(indicator, malware, relationship):
bundle = stix2.v20.Bundle([indicator], malware, objects=[relationship])
assert bundle.serialize(pretty=True) == EXPECTED_BUNDLE
def test_create_bundle_invalid(indicator, malware, relationship):
with pytest.raises(InvalidValueError) as excinfo:
stix2.v20.Bundle(objects=[1])
assert excinfo.value.reason == "This property may only contain a dictionary or object"
with pytest.raises(InvalidValueError) as excinfo:
stix2.v20.Bundle(objects=[{}])
assert excinfo.value.reason == "This property may only contain a non-empty dictionary or object"
with pytest.raises(InvalidValueError) as excinfo:
stix2.v20.Bundle(objects=[{'type': 'bundle'}])
assert excinfo.value.reason == 'This property may not contain a Bundle object'
@pytest.mark.parametrize("version", ["2.0"])
def test_parse_bundle(version):
bundle = stix2.parse(EXPECTED_BUNDLE, version=version)
assert bundle.type == "bundle"
assert bundle.id.startswith("bundle--")
assert isinstance(bundle.objects[0], stix2.v20.Indicator)
assert bundle.objects[0].type == 'indicator'
assert bundle.objects[1].type == 'malware'
assert bundle.objects[2].type == 'relationship'
def test_parse_unknown_type():
unknown = {
"type": "other",
"id": "other--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created": "2016-04-06T20:03:00Z",
"modified": "2016-04-06T20:03:00Z",
"created_by_ref": IDENTITY_ID,
"description": "Campaign by Green Group against a series of targets in the financial services sector.",
"name": "Green Group Attacks Against Finance",
}
with pytest.raises(stix2.exceptions.ParseError) as excinfo:
stix2.parse(unknown, version="2.0")
assert str(excinfo.value) == "Can't parse unknown object type 'other'! For custom types, use the CustomObject decorator."
def test_stix_object_property():
prop = stix2.properties.STIXObjectProperty(spec_version='2.0')
identity = stix2.v20.Identity(name="test", identity_class="individual")
assert prop.clean(identity, False) == (identity, False)
def test_bundle_with_different_spec_objects():
# This is a 2.0 case only...
data = [
{
"spec_version": "2.1",
"type": "indicator",
"id": "indicator--00000000-0000-4000-8000-000000000001",
"created": "2017-01-01T12:34:56.000Z",
"modified": "2017-01-01T12:34:56.000Z",
"pattern": "[file:hashes.MD5 = 'd41d8cd98f00b204e9800998ecf8427e']",
"valid_from": "2017-01-01T12:34:56Z",
"labels": [
"malicious-activity",
],
},
{
"type": "malware",
"id": "malware--00000000-0000-4000-8000-000000000003",
"created": "2017-01-01T12:34:56.000Z",
"modified": "2017-01-01T12:34:56.000Z",
"name": "Cryptolocker",
"labels": [
"ransomware",
],
},
]
with pytest.raises(InvalidValueError) as excinfo:
stix2.v20.Bundle(objects=data)
assert "Spec version 2.0 bundles don't yet support containing objects of a different spec version." in str(excinfo.value)
def test_bundle_obj_id_found():
bundle = stix2.parse(EXPECTED_BUNDLE)
mal_list = bundle.get_obj("malware--00000000-0000-4000-8000-000000000003")
assert bundle.objects[1] == mal_list[0]
assert len(mal_list) == 1
@pytest.mark.parametrize(
"bundle_data", [{
"type": "bundle",
"id": "bundle--00000000-0000-4000-8000-000000000007",
"spec_version": "2.0",
"objects": [
{
"type": "indicator",
"id": "indicator--00000000-0000-4000-8000-000000000001",
"created": "2017-01-01T12:34:56.000Z",
"modified": "2017-01-01T12:34:56.000Z",
"pattern": "[file:hashes.MD5 = 'd41d8cd98f00b204e9800998ecf8427e']",
"valid_from": "2017-01-01T12:34:56Z",
"labels": [
"malicious-activity",
],
},
{
"type": "malware",
"id": "malware--00000000-0000-4000-8000-000000000003",
"created": "2017-01-01T12:34:56.000Z",
"modified": "2017-01-01T12:34:56.000Z",
"name": "Cryptolocker1",
"labels": [
"ransomware",
],
},
{
"type": "malware",
"id": "malware--00000000-0000-4000-8000-000000000003",
"created": "2017-01-01T12:34:56.000Z",
"modified": "2017-12-21T12:34:56.000Z",
"name": "CryptolockerOne",
"labels": [
"ransomware",
],
},
{
"type": "relationship",
"id": "relationship--00000000-0000-4000-8000-000000000005",
"created": "2017-01-01T12:34:56.000Z",
"modified": "2017-01-01T12:34:56.000Z",
"relationship_type": "indicates",
"source_ref": "indicator--a740531e-63ff-4e49-a9e1-a0a3eed0e3e7",
"target_ref": "malware--9c4638ec-f1de-4ddb-abf4-1b760417654e",
},
],
}],
)
def test_bundle_objs_ids_found(bundle_data):
bundle = stix2.parse(bundle_data)
mal_list = bundle.get_obj("malware--00000000-0000-4000-8000-000000000003")
assert bundle.objects[1] == mal_list[0]
assert bundle.objects[2] == mal_list[1]
assert len(mal_list) == 2
def test_bundle_getitem_overload_property_found():
bundle = stix2.parse(EXPECTED_BUNDLE)
assert bundle.type == "bundle"
assert bundle['type'] == "bundle"
def test_bundle_getitem_overload_obj_id_found():
bundle = stix2.parse(EXPECTED_BUNDLE)
mal_list = bundle["malware--00000000-0000-4000-8000-000000000003"]
assert bundle.objects[1] == mal_list[0]
assert len(mal_list) == 1
def test_bundle_obj_id_not_found():
bundle = stix2.parse(EXPECTED_BUNDLE)
with pytest.raises(KeyError) as excinfo:
bundle.get_obj('non existent')
assert "does not match the id property of any of the bundle" in str(excinfo.value)
def test_bundle_getitem_overload_obj_id_not_found():
bundle = stix2.parse(EXPECTED_BUNDLE)
with pytest.raises(KeyError) as excinfo:
bundle['non existent']
assert "neither a property on the bundle nor does it match the id property" in str(excinfo.value)
cti-python-stix2-3.0.1/stix2/test/v20/test_campaign.py 0000664 0000000 0000000 00000003275 14123351755 0022524 0 ustar 00root root 0000000 0000000 import datetime as dt
import pytest
import pytz
import stix2
from .constants import CAMPAIGN_ID, CAMPAIGN_MORE_KWARGS, IDENTITY_ID
EXPECTED = """{
"type": "campaign",
"id": "campaign--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2016-04-06T20:03:00.000Z",
"modified": "2016-04-06T20:03:00.000Z",
"name": "Green Group Attacks Against Finance",
"description": "Campaign by Green Group against a series of targets in the financial services sector."
}"""
def test_campaign_example():
campaign = stix2.v20.Campaign(**CAMPAIGN_MORE_KWARGS)
assert campaign.serialize(pretty=True) == EXPECTED
@pytest.mark.parametrize(
"data", [
EXPECTED,
{
"type": "campaign",
"id": CAMPAIGN_ID,
"created": "2016-04-06T20:03:00Z",
"modified": "2016-04-06T20:03:00Z",
"created_by_ref": IDENTITY_ID,
"description": "Campaign by Green Group against a series of targets in the financial services sector.",
"name": "Green Group Attacks Against Finance",
},
],
)
def test_parse_campaign(data):
cmpn = stix2.parse(data, version="2.0")
assert cmpn.type == 'campaign'
assert cmpn.id == CAMPAIGN_ID
assert cmpn.created == dt.datetime(2016, 4, 6, 20, 3, 0, tzinfo=pytz.utc)
assert cmpn.modified == dt.datetime(2016, 4, 6, 20, 3, 0, tzinfo=pytz.utc)
assert cmpn.created_by_ref == IDENTITY_ID
assert cmpn.description == "Campaign by Green Group against a series of targets in the financial services sector."
assert cmpn.name == "Green Group Attacks Against Finance"
# TODO: Add other examples
cti-python-stix2-3.0.1/stix2/test/v20/test_course_of_action.py 0000664 0000000 0000000 00000004352 14123351755 0024263 0 ustar 00root root 0000000 0000000 import datetime as dt
import pytest
import pytz
import stix2
from .constants import COURSE_OF_ACTION_ID, IDENTITY_ID
EXPECTED = """{
"type": "course-of-action",
"id": "course-of-action--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2016-04-06T20:03:48.000Z",
"modified": "2016-04-06T20:03:48.000Z",
"name": "Add TCP port 80 Filter Rule to the existing Block UDP 1434 Filter",
"description": "This is how to add a filter rule to block inbound access to TCP port 80 to the existing UDP 1434 filter ..."
}"""
def test_course_of_action_example():
coa = stix2.v20.CourseOfAction(
id=COURSE_OF_ACTION_ID,
created_by_ref=IDENTITY_ID,
created="2016-04-06T20:03:48.000Z",
modified="2016-04-06T20:03:48.000Z",
name="Add TCP port 80 Filter Rule to the existing Block UDP 1434 Filter",
description="This is how to add a filter rule to block inbound access to TCP port 80 to the existing UDP 1434 filter ...",
)
assert coa.serialize(pretty=True) == EXPECTED
@pytest.mark.parametrize(
"data", [
EXPECTED,
{
"created": "2016-04-06T20:03:48.000Z",
"created_by_ref": IDENTITY_ID,
"description": "This is how to add a filter rule to block inbound access to TCP port 80 to the existing UDP 1434 filter ...",
"id": COURSE_OF_ACTION_ID,
"modified": "2016-04-06T20:03:48.000Z",
"name": "Add TCP port 80 Filter Rule to the existing Block UDP 1434 Filter",
"type": "course-of-action",
},
],
)
def test_parse_course_of_action(data):
coa = stix2.parse(data, version="2.0")
assert coa.type == 'course-of-action'
assert coa.id == COURSE_OF_ACTION_ID
assert coa.created == dt.datetime(2016, 4, 6, 20, 3, 48, tzinfo=pytz.utc)
assert coa.modified == dt.datetime(2016, 4, 6, 20, 3, 48, tzinfo=pytz.utc)
assert coa.created_by_ref == IDENTITY_ID
assert coa.description == "This is how to add a filter rule to block inbound access to TCP port 80 to the existing UDP 1434 filter ..."
assert coa.name == "Add TCP port 80 Filter Rule to the existing Block UDP 1434 Filter"
# TODO: Add other examples
cti-python-stix2-3.0.1/stix2/test/v20/test_custom.py 0000664 0000000 0000000 00000113422 14123351755 0022253 0 ustar 00root root 0000000 0000000 import pytest
import stix2
import stix2.parsing
import stix2.registration
import stix2.registry
import stix2.v20
from ...exceptions import DuplicateRegistrationError, InvalidValueError
from .constants import FAKE_TIME, IDENTITY_ID, MARKING_DEFINITION_ID
IDENTITY_CUSTOM_PROP = stix2.v20.Identity(
name="John Smith",
identity_class="individual",
x_foo="bar",
allow_custom=True,
)
def test_identity_custom_property():
with pytest.raises(ValueError) as excinfo:
stix2.v20.Identity(
id=IDENTITY_ID,
created="2015-12-21T19:59:11Z",
modified="2015-12-21T19:59:11Z",
name="John Smith",
identity_class="individual",
custom_properties="foobar",
)
assert str(excinfo.value) == "'custom_properties' must be a dictionary"
with pytest.raises(stix2.exceptions.ExtraPropertiesError) as excinfo:
stix2.v20.Identity(
id=IDENTITY_ID,
created="2015-12-21T19:59:11Z",
modified="2015-12-21T19:59:11Z",
name="John Smith",
identity_class="individual",
custom_properties={
"foo": "bar",
},
foo="bar",
)
assert "Unexpected properties for Identity" in str(excinfo.value)
identity = stix2.v20.Identity(
id=IDENTITY_ID,
created="2015-12-21T19:59:11Z",
modified="2015-12-21T19:59:11Z",
name="John Smith",
identity_class="individual",
custom_properties={
"foo": "bar",
},
)
assert identity.foo == "bar"
def test_identity_custom_property_invalid():
with pytest.raises(stix2.exceptions.ExtraPropertiesError) as excinfo:
stix2.v20.Identity(
id=IDENTITY_ID,
created="2015-12-21T19:59:11Z",
modified="2015-12-21T19:59:11Z",
name="John Smith",
identity_class="individual",
x_foo="bar",
)
assert excinfo.value.cls == stix2.v20.Identity
assert excinfo.value.properties == ['x_foo']
assert "Unexpected properties for" in str(excinfo.value)
def test_identity_custom_property_allowed():
identity = stix2.v20.Identity(
id=IDENTITY_ID,
created="2015-12-21T19:59:11Z",
modified="2015-12-21T19:59:11Z",
name="John Smith",
identity_class="individual",
x_foo="bar",
allow_custom=True,
)
assert identity.x_foo == "bar"
@pytest.mark.parametrize(
"data", [
"""{
"type": "identity",
"id": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2015-12-21T19:59:11Z",
"modified": "2015-12-21T19:59:11Z",
"name": "John Smith",
"identity_class": "individual",
"foo": "bar"
}""",
],
)
def test_parse_identity_custom_property(data):
with pytest.raises(stix2.exceptions.ExtraPropertiesError) as excinfo:
stix2.parse(data, version="2.0")
assert issubclass(excinfo.value.cls, stix2.v20.Identity)
assert excinfo.value.properties == ['foo']
assert "Unexpected properties for" in str(excinfo.value)
identity = stix2.parse(data, version="2.0", allow_custom=True)
assert identity.foo == "bar"
def test_custom_property_object_in_bundled_object():
bundle = stix2.v20.Bundle(IDENTITY_CUSTOM_PROP, allow_custom=True)
assert bundle.objects[0].x_foo == "bar"
assert '"x_foo": "bar"' in str(bundle)
def test_custom_properties_object_in_bundled_object():
obj = stix2.v20.Identity(
name="John Smith",
identity_class="individual",
custom_properties={
"x_foo": "bar",
},
)
bundle = stix2.v20.Bundle(obj, allow_custom=True)
assert bundle.objects[0].x_foo == "bar"
assert '"x_foo": "bar"' in str(bundle)
def test_custom_property_dict_in_bundled_object():
custom_identity = {
'type': 'identity',
'id': IDENTITY_ID,
'created': '2015-12-21T19:59:11Z',
'name': 'John Smith',
'identity_class': 'individual',
'x_foo': 'bar',
}
with pytest.raises(InvalidValueError):
stix2.v20.Bundle(custom_identity)
bundle = stix2.v20.Bundle(custom_identity, allow_custom=True)
assert bundle.objects[0].x_foo == "bar"
assert '"x_foo": "bar"' in str(bundle)
def test_custom_properties_dict_in_bundled_object():
custom_identity = {
'type': 'identity',
'id': IDENTITY_ID,
'created': '2015-12-21T19:59:11Z',
'name': 'John Smith',
'identity_class': 'individual',
'custom_properties': {
'x_foo': 'bar',
},
}
# must not succeed: allow_custom was not set to True when creating
# the bundle, so it must reject the customized identity object.
with pytest.raises(InvalidValueError):
stix2.v20.Bundle(custom_identity)
def test_custom_property_in_observed_data():
artifact = stix2.v20.File(
allow_custom=True,
name='test',
x_foo='bar',
)
observed_data = stix2.v20.ObservedData(
allow_custom=True,
first_observed="2015-12-21T19:00:00Z",
last_observed="2015-12-21T19:00:00Z",
number_observed=1,
objects={"0": artifact},
)
assert observed_data.objects['0'].x_foo == "bar"
assert '"x_foo": "bar"' in str(observed_data)
def test_custom_property_object_in_observable_extension():
ntfs = stix2.v20.NTFSExt(
allow_custom=True,
sid=1,
x_foo='bar',
)
artifact = stix2.v20.File(
allow_custom=True,
name='test',
extensions={'ntfs-ext': ntfs},
)
observed_data = stix2.v20.ObservedData(
allow_custom=True,
first_observed="2015-12-21T19:00:00Z",
last_observed="2015-12-21T19:00:00Z",
number_observed=1,
objects={"0": artifact},
)
assert observed_data.objects['0'].extensions['ntfs-ext'].x_foo == "bar"
assert '"x_foo": "bar"' in str(observed_data)
def test_custom_property_dict_in_observable_extension():
with pytest.raises(InvalidValueError):
stix2.v20.File(
name='test',
extensions={
'ntfs-ext': {
'sid': 1,
'x_foo': 'bar',
},
},
)
artifact = stix2.v20.File(
allow_custom=True,
name='test',
extensions={
'ntfs-ext': {
'sid': 1,
'x_foo': 'bar',
},
},
)
observed_data = stix2.v20.ObservedData(
allow_custom=True,
first_observed="2015-12-21T19:00:00Z",
last_observed="2015-12-21T19:00:00Z",
number_observed=1,
objects={"0": artifact},
)
assert observed_data.objects['0'].extensions['ntfs-ext'].x_foo == "bar"
assert '"x_foo": "bar"' in str(observed_data)
def test_identity_custom_property_revoke():
identity = IDENTITY_CUSTOM_PROP.revoke()
assert identity.x_foo == "bar"
def test_identity_custom_property_edit_markings():
marking_obj = stix2.v20.MarkingDefinition(
id=MARKING_DEFINITION_ID,
definition_type="statement",
definition=stix2.v20.StatementMarking(statement="Copyright 2016, Example Corp"),
)
marking_obj2 = stix2.v20.MarkingDefinition(
id=MARKING_DEFINITION_ID,
definition_type="statement",
definition=stix2.v20.StatementMarking(statement="Another one"),
)
# None of the following should throw exceptions
identity = IDENTITY_CUSTOM_PROP.add_markings(marking_obj)
identity2 = identity.add_markings(marking_obj2, ['x_foo'])
identity2.remove_markings(marking_obj.id)
identity2.remove_markings(marking_obj2.id, ['x_foo'])
identity2.clear_markings()
identity2.clear_markings('x_foo')
def test_custom_marking_no_init_1():
@stix2.v20.CustomMarking(
'x-new-obj', [
('property1', stix2.properties.StringProperty(required=True)),
],
)
class NewObj():
pass
no = NewObj(property1='something')
assert no.property1 == 'something'
def test_custom_marking_no_init_2():
@stix2.v20.CustomMarking(
'x-new-obj2', [
('property1', stix2.properties.StringProperty(required=True)),
],
)
class NewObj2(object):
pass
no2 = NewObj2(property1='something')
assert no2.property1 == 'something'
def test_register_duplicate_marking():
with pytest.raises(DuplicateRegistrationError) as excinfo:
@stix2.v20.CustomMarking(
'x-new-obj2', [
('property1', stix2.properties.StringProperty(required=True)),
],
)
class NewObj2():
pass
assert "cannot be registered again" in str(excinfo.value)
@stix2.v20.CustomObject(
'x-new-type', [
('property1', stix2.properties.StringProperty(required=True)),
('property2', stix2.properties.IntegerProperty()),
],
)
class NewType(object):
def __init__(self, property2=None, **kwargs):
if property2 and property2 < 10:
raise ValueError("'property2' is too small.")
if "property3" in kwargs and not isinstance(kwargs.get("property3"), int):
raise TypeError("Must be integer!")
def test_custom_object_raises_exception():
with pytest.raises(TypeError) as excinfo:
NewType(property1='something', property3='something', allow_custom=True)
assert str(excinfo.value) == "Must be integer!"
def test_custom_object_type():
nt = NewType(property1='something')
assert nt.property1 == 'something'
with pytest.raises(stix2.exceptions.MissingPropertiesError) as excinfo:
NewType(property2=42)
assert "No values for required properties" in str(excinfo.value)
with pytest.raises(ValueError) as excinfo:
NewType(property1='something', property2=4)
assert "'property2' is too small." in str(excinfo.value)
def test_custom_object_no_init_1():
@stix2.v20.CustomObject(
'x-new-obj', [
('property1', stix2.properties.StringProperty(required=True)),
],
)
class NewObj():
pass
no = NewObj(property1='something')
assert no.property1 == 'something'
def test_custom_object_no_init_2():
@stix2.v20.CustomObject(
'x-new-obj2', [
('property1', stix2.properties.StringProperty(required=True)),
],
)
class NewObj2(object):
pass
no2 = NewObj2(property1='something')
assert no2.property1 == 'something'
def test_custom_object_invalid_type_name():
with pytest.raises(ValueError) as excinfo:
@stix2.v20.CustomObject(
'x', [
('property1', stix2.properties.StringProperty(required=True)),
],
)
class NewObj(object):
pass # pragma: no cover
assert "Invalid type name 'x': " in str(excinfo.value)
with pytest.raises(ValueError) as excinfo:
@stix2.v20.CustomObject(
'x_new_object', [
('property1', stix2.properties.StringProperty(required=True)),
],
)
class NewObj2(object):
pass # pragma: no cover
assert "Invalid type name 'x_new_object':" in str(excinfo.value)
def test_custom_object_ref_property_as_identifier():
@stix2.v20.CustomObject(
'x-new-obj-with-ref', [
('property_ref', stix2.properties.ReferenceProperty(invalid_types=[])),
],
)
class NewObs():
pass
def test_custom_object_refs_property_containing_identifiers():
@stix2.v20.CustomObject(
'x-new-obj-with-refs', [
('property_refs', stix2.properties.ListProperty(stix2.properties.ReferenceProperty(invalid_types=[]))),
],
)
class NewObs():
pass
def test_custom_object_ref_property_as_objectref():
with pytest.raises(ValueError, match=r"not a subclass of 'ReferenceProperty"):
@stix2.v20.CustomObject(
'x-new-obj-with-objref', [
('property_ref', stix2.properties.ObjectReferenceProperty()),
],
)
class NewObs():
pass
def test_custom_object_refs_property_containing_objectrefs():
with pytest.raises(ValueError, match=r"not a 'ListProperty' containing a subclass of 'ReferenceProperty"):
@stix2.v20.CustomObject(
'x-new-obj-with-objrefs', [
('property_refs', stix2.properties.ListProperty(stix2.properties.ObjectReferenceProperty())),
],
)
class NewObs():
pass
def test_custom_object_invalid_ref_property():
with pytest.raises(ValueError) as excinfo:
@stix2.v20.CustomObject(
'x-new-obj', [
('property_ref', stix2.properties.StringProperty()),
],
)
class NewObs():
pass
assert "is named like a reference property but is not" in str(excinfo.value)
def test_custom_object_invalid_refs_property():
with pytest.raises(ValueError) as excinfo:
@stix2.v20.CustomObject(
'x-new-obj', [
('property_refs', stix2.properties.StringProperty()),
],
)
class NewObs():
pass
assert "is named like a reference list property but is not" in str(excinfo.value)
def test_custom_object_invalid_refs_list_property():
with pytest.raises(ValueError) as excinfo:
@stix2.v20.CustomObject(
'x-new-obj', [
('property_refs', stix2.properties.ListProperty(stix2.properties.StringProperty)),
],
)
class NewObs():
pass
assert "is named like a reference list property but is not" in str(excinfo.value)
def test_custom_subobject_dict():
obj_dict = {
"type": "bundle",
"spec_version": "2.0",
"objects": [
{
"type": "identity",
"name": "alice",
"identity_class": "individual",
"x_foo": 123,
},
],
}
obj = stix2.parse(obj_dict, allow_custom=True)
assert obj["objects"][0]["x_foo"] == 123
assert obj.has_custom
with pytest.raises(InvalidValueError):
stix2.parse(obj_dict, allow_custom=False)
def test_custom_subobject_obj():
ident = stix2.v20.Identity(
name="alice", identity_class=123, x_foo=123, allow_custom=True,
)
obj_dict = {
"type": "bundle",
"spec_version": "2.0",
"objects": [ident],
}
obj = stix2.parse(obj_dict, allow_custom=True)
assert obj["objects"][0]["x_foo"] == 123
assert obj.has_custom
with pytest.raises(InvalidValueError):
stix2.parse(obj_dict, allow_custom=False)
def test_parse_custom_object_type():
nt_string = """{
"type": "x-new-type",
"created": "2015-12-21T19:59:11Z",
"property1": "something"
}"""
nt = stix2.parse(nt_string, version="2.0", allow_custom=True)
assert nt["property1"] == 'something'
def test_parse_unregistered_custom_object_type():
nt_string = """{
"type": "x-foobar-observable",
"created": "2015-12-21T19:59:11Z",
"property1": "something"
}"""
with pytest.raises(stix2.exceptions.ParseError) as excinfo:
stix2.parse(nt_string, version="2.0")
assert "Can't parse unknown object type" in str(excinfo.value)
assert "use the CustomObject decorator." in str(excinfo.value)
def test_parse_unregistered_custom_object_type_w_allow_custom():
"""parse an unknown custom object, allowed by passing
'allow_custom' flag
"""
nt_string = """{
"type": "x-foobar-observable",
"created": "2015-12-21T19:59:11Z",
"property1": "something"
}"""
custom_obj = stix2.parse(nt_string, version="2.0", allow_custom=True)
assert custom_obj["type"] == "x-foobar-observable"
@stix2.v20.CustomObservable(
'x-new-observable', [
('property1', stix2.properties.StringProperty(required=True)),
('property2', stix2.properties.IntegerProperty()),
('x_property3', stix2.properties.BooleanProperty()),
],
)
class NewObservable():
def __init__(self, property2=None, **kwargs):
if property2 and property2 < 10:
raise ValueError("'property2' is too small.")
if "property3" in kwargs and not isinstance(kwargs.get("property3"), int):
raise TypeError("Must be integer!")
def test_custom_observable_object_1():
no = NewObservable(
property1='something',
extensions={
'archive-ext': stix2.v20.observables.ArchiveExt(
contains_refs=['file--e277603e-1060-5ad4-9937-c26c97f1ca68'],
version='2.0',
comment='for real',
),
},
)
assert no.property1 == 'something'
assert no.extensions['archive-ext'].comment == 'for real'
def test_custom_observable_object_2():
with pytest.raises(stix2.exceptions.MissingPropertiesError) as excinfo:
NewObservable(property2=42)
assert excinfo.value.properties == ['property1']
assert "No values for required properties" in str(excinfo.value)
def test_custom_observable_object_3():
with pytest.raises(ValueError) as excinfo:
NewObservable(property1='something', property2=4)
assert "'property2' is too small." in str(excinfo.value)
def test_custom_observable_raises_exception():
with pytest.raises(TypeError) as excinfo:
NewObservable(property1='something', property3='something', allow_custom=True)
assert str(excinfo.value) == "Must be integer!"
def test_custom_observable_object_no_init_1():
@stix2.v20.CustomObservable(
'x-new-observable-1', [
('property1', stix2.properties.StringProperty()),
],
)
class NewObs():
pass
no = NewObs(property1='something')
assert no.property1 == 'something'
def test_custom_observable_object_no_init_2():
@stix2.v20.CustomObservable(
'x-new-obs2', [
('property1', stix2.properties.StringProperty()),
],
)
class NewObs2(object):
pass
no2 = NewObs2(property1='something')
assert no2.property1 == 'something'
def test_custom_observable_object_invalid_type_name():
with pytest.raises(ValueError) as excinfo:
@stix2.v20.CustomObservable(
'x', [
('property1', stix2.properties.StringProperty()),
],
)
class NewObs(object):
pass # pragma: no cover
assert "Invalid type name 'x':" in str(excinfo.value)
with pytest.raises(ValueError) as excinfo:
@stix2.v20.CustomObservable(
'x_new_obs', [
('property1', stix2.properties.StringProperty()),
],
)
class NewObs2(object):
pass # pragma: no cover
assert "Invalid type name 'x_new_obs':" in str(excinfo.value)
def test_custom_observable_object_ref_property_as_identifier():
with pytest.raises(ValueError, match=r"not a subclass of 'ObjectReferenceProperty"):
@stix2.v20.CustomObservable(
'x-new-obs-with-ref', [
('property_ref', stix2.properties.ReferenceProperty(invalid_types=[])),
],
)
class NewObs():
pass
def test_custom_observable_object_refs_property_containing_identifiers():
with pytest.raises(ValueError, match=r"not a 'ListProperty' containing a subclass of 'ObjectReferenceProperty"):
@stix2.v20.CustomObservable(
'x-new-obs-with-refs', [
('property_refs', stix2.properties.ListProperty(stix2.properties.ReferenceProperty(invalid_types=[]))),
],
)
class NewObs():
pass
def test_custom_observable_object_ref_property_as_objectref():
@stix2.v20.CustomObservable(
'x-new-obs-with-objref', [
('property_ref', stix2.properties.ObjectReferenceProperty()),
],
)
class NewObs():
pass
def test_custom_observable_object_refs_property_containing_objectrefs():
@stix2.v20.CustomObservable(
'x-new-obs-with-objrefs', [
('property_refs', stix2.properties.ListProperty(stix2.properties.ObjectReferenceProperty())),
],
)
class NewObs():
pass
def test_custom_observable_object_invalid_ref_property():
with pytest.raises(ValueError) as excinfo:
@stix2.v20.CustomObservable(
'x-new-obs', [
('property_ref', stix2.properties.StringProperty()),
],
)
class NewObs():
pass
assert "is named like a reference property but is not" in str(excinfo.value)
def test_custom_observable_object_invalid_refs_property():
with pytest.raises(ValueError) as excinfo:
@stix2.v20.CustomObservable(
'x-new-obs', [
('property_refs', stix2.properties.StringProperty()),
],
)
class NewObs():
pass
assert "is named like a reference list property but is not" in str(excinfo.value)
def test_custom_observable_object_invalid_refs_list_property():
with pytest.raises(ValueError) as excinfo:
@stix2.v20.CustomObservable(
'x-new-obs', [
('property_refs', stix2.properties.ListProperty(stix2.properties.StringProperty)),
],
)
class NewObs():
pass
assert "is named like a reference list property but is not" in str(excinfo.value)
def test_custom_observable_object_invalid_valid_refs():
@stix2.v20.CustomObservable(
'x-new-obs', [
('property1', stix2.properties.StringProperty(required=True)),
('property_ref', stix2.properties.ObjectReferenceProperty(valid_types='email-addr')),
],
)
class NewObs():
pass
with pytest.raises(Exception) as excinfo:
NewObs(
_valid_refs=['1'],
property1='something',
property_ref='1',
)
assert "must be created with _valid_refs as a dict, not a list" in str(excinfo.value)
def test_custom_no_properties_raises_exception():
with pytest.raises(TypeError):
@stix2.v20.CustomObject('x-new-object-type')
class NewObject1(object):
pass
def test_custom_wrong_properties_arg_raises_exception():
with pytest.raises(ValueError):
@stix2.v20.CustomObservable('x-new-object-type', (("prop", stix2.properties.BooleanProperty())))
class NewObject2(object):
pass
def test_parse_custom_observable_object():
nt_string = """{
"type": "x-new-observable",
"property1": "something"
}"""
nt = stix2.parse_observable(nt_string, [], version='2.0')
assert isinstance(nt, stix2.base._STIXBase)
assert nt.property1 == 'something'
def test_parse_unregistered_custom_observable_object():
nt_string = """{
"type": "x-foobar-observable",
"property1": "something"
}"""
with pytest.raises(stix2.exceptions.ParseError) as excinfo:
stix2.parse_observable(nt_string, version='2.0')
assert "Can't parse unknown observable type" in str(excinfo.value)
parsed_custom = stix2.parse_observable(nt_string, allow_custom=True, version='2.0')
assert parsed_custom['property1'] == 'something'
with pytest.raises(AttributeError) as excinfo:
assert parsed_custom.property1 == 'something'
assert not isinstance(parsed_custom, stix2.base._STIXBase)
def test_parse_unregistered_custom_observable_object_with_no_type():
nt_string = """{
"property1": "something"
}"""
with pytest.raises(stix2.exceptions.ParseError) as excinfo:
stix2.parse_observable(nt_string, allow_custom=True, version='2.0')
assert "Can't parse observable with no 'type' property" in str(excinfo.value)
def test_parse_observed_data_with_custom_observable():
input_str = """{
"type": "observed-data",
"id": "observed-data--dc20c4ca-a2a3-4090-a5d5-9558c3af4758",
"created": "2016-04-06T19:58:16.000Z",
"modified": "2016-04-06T19:58:16.000Z",
"first_observed": "2015-12-21T19:00:00Z",
"last_observed": "2015-12-21T19:00:00Z",
"number_observed": 1,
"objects": {
"0": {
"type": "x-foobar-observable",
"property1": "something"
}
}
}"""
parsed = stix2.parse(input_str, version="2.0", allow_custom=True)
assert parsed.objects['0']['property1'] == 'something'
def test_parse_invalid_custom_observable_object():
nt_string = """{
"property1": "something"
}"""
with pytest.raises(stix2.exceptions.ParseError) as excinfo:
stix2.parse_observable(nt_string, version='2.0')
assert "Can't parse observable with no 'type' property" in str(excinfo.value)
def test_observable_custom_property():
with pytest.raises(ValueError) as excinfo:
NewObservable(
property1='something',
custom_properties="foobar",
)
assert "'custom_properties' must be a dictionary" in str(excinfo.value)
no = NewObservable(
property1='something',
custom_properties={
"foo": "bar",
},
)
assert no.foo == "bar"
def test_observable_custom_property_invalid():
with pytest.raises(stix2.exceptions.ExtraPropertiesError) as excinfo:
NewObservable(
property1='something',
x_foo="bar",
)
assert excinfo.value.properties == ['x_foo']
assert "Unexpected properties for" in str(excinfo.value)
def test_observable_custom_property_allowed():
no = NewObservable(
property1='something',
x_foo="bar",
allow_custom=True,
)
assert no.x_foo == "bar"
def test_observed_data_with_custom_observable_object():
no = NewObservable(property1='something')
ob_data = stix2.v20.ObservedData(
first_observed=FAKE_TIME,
last_observed=FAKE_TIME,
number_observed=1,
objects={'0': no},
allow_custom=True,
)
assert ob_data.objects['0'].property1 == 'something'
@stix2.v20.CustomExtension(
'x-new-ext', [
('property1', stix2.properties.StringProperty(required=True)),
('property2', stix2.properties.IntegerProperty()),
],
)
class NewExtension():
def __init__(self, property2=None, **kwargs):
if property2 and property2 < 10:
raise ValueError("'property2' is too small.")
if "property3" in kwargs and not isinstance(kwargs.get("property3"), int):
raise TypeError("Must be integer!")
def test_custom_extension_raises_exception():
with pytest.raises(TypeError) as excinfo:
NewExtension(property1='something', property3='something', allow_custom=True)
assert str(excinfo.value) == "Must be integer!"
def test_custom_extension():
ext = NewExtension(property1='something')
assert ext.property1 == 'something'
with pytest.raises(stix2.exceptions.MissingPropertiesError) as excinfo:
NewExtension(property2=42)
assert excinfo.value.properties == ['property1']
assert str(excinfo.value) == "No values for required properties for NewExtension: (property1)."
with pytest.raises(ValueError) as excinfo:
NewExtension(property1='something', property2=4)
assert str(excinfo.value) == "'property2' is too small."
def test_custom_extension_wrong_observable_type():
# NewExtension is an extension of DomainName, not File
ext = NewExtension(property1='something')
with pytest.raises(InvalidValueError) as excinfo:
stix2.v20.File(
name="abc.txt",
extensions={
"ntfs-ext": ext,
},
)
assert "Can't create extension 'ntfs-ext' from" in excinfo.value.reason
@pytest.mark.parametrize(
"data", [
"""{
"keys": [
{
"test123": 123,
"test345": "aaaa"
}
]
}""",
],
)
def test_custom_extension_with_list_and_dict_properties_observable_type(data):
@stix2.v20.CustomExtension(
'some-extension', [
('keys', stix2.properties.ListProperty(stix2.properties.DictionaryProperty, required=True)),
],
)
class SomeCustomExtension:
pass
example = SomeCustomExtension(keys=[{'test123': 123, 'test345': 'aaaa'}])
assert data == example.serialize(pretty=True)
def test_custom_extension_invalid_type_name():
with pytest.raises(ValueError) as excinfo:
@stix2.v20.CustomExtension(
'x', {
'property1': stix2.properties.StringProperty(required=True),
},
)
class FooExtension():
pass # pragma: no cover
assert "Invalid type name 'x':" in str(excinfo.value)
with pytest.raises(ValueError) as excinfo:
@stix2.v20.CustomExtension(
'x_new_ext', {
'property1': stix2.properties.StringProperty(required=True),
},
)
class BlaExtension():
pass # pragma: no cover
assert "Invalid type name 'x_new_ext':" in str(excinfo.value)
def test_custom_extension_no_properties():
with pytest.raises(ValueError):
@stix2.v20.CustomExtension('x-new-ext2', None)
class BarExtension():
pass
def test_custom_extension_empty_properties():
with pytest.raises(ValueError):
@stix2.v20.CustomExtension('x-new-ext2', [])
class BarExtension():
pass
def test_custom_extension_dict_properties():
with pytest.raises(ValueError):
@stix2.v20.CustomExtension('x-new-ext2', {})
class BarExtension():
pass
def test_custom_extension_no_init_1():
@stix2.v20.CustomExtension(
'x-new-extension', [
('property1', stix2.properties.StringProperty(required=True)),
],
)
class NewExt():
pass
ne = NewExt(property1="foobar")
assert ne.property1 == "foobar"
def test_custom_extension_no_init_2():
@stix2.v20.CustomExtension(
'x-new-ext2', [
('property1', stix2.properties.StringProperty(required=True)),
],
)
class NewExt2(object):
pass
ne2 = NewExt2(property1="foobar")
assert ne2.property1 == "foobar"
def test_parse_observable_with_custom_extension():
input_str = """{
"type": "domain-name",
"value": "example.com",
"extensions": {
"x-new-ext": {
"property1": "foo",
"property2": 12
}
}
}"""
parsed = stix2.parse_observable(input_str, version='2.0')
assert parsed.extensions['x-new-ext'].property2 == 12
def test_parse_observable_with_custom_extension_property():
input_str = """{
"type": "observed-data",
"first_observed": "1976-09-09T01:50:24.000Z",
"last_observed": "1988-01-18T15:22:10.000Z",
"number_observed": 5,
"objects": {
"0": {
"type": "file",
"name": "cats.png",
"extensions": {
"raster-image-ext": {
"image_height": 1024,
"image_width": 768,
"x-foo": false
}
}
}
}
}"""
parsed = stix2.parse(input_str, version='2.0', allow_custom=True)
assert parsed.has_custom
assert parsed["objects"]["0"]["extensions"]["raster-image-ext"]["x-foo"] is False
with pytest.raises(InvalidValueError):
stix2.parse(input_str, version="2.0", allow_custom=False)
def test_custom_and_spec_extension_mix():
"""
Try to make sure that when allow_custom=True, encountering a custom
extension doesn't result in a completely uncleaned extensions property.
"""
file_obs = stix2.v20.File(
name="my_file.dat",
extensions={
"x-custom1": {
"a": 1,
"b": 2,
},
"ntfs-ext": {
"sid": "S-1-whatever",
},
"x-custom2": {
"z": 99.9,
"y": False,
},
"raster-image-ext": {
"image_height": 1024,
"image_width": 768,
"bits_per_pixel": 32,
},
},
allow_custom=True,
)
assert file_obs.extensions["x-custom1"] == {"a": 1, "b": 2}
assert file_obs.extensions["x-custom2"] == {"y": False, "z": 99.9}
assert file_obs.extensions["ntfs-ext"].sid == "S-1-whatever"
assert file_obs.extensions["raster-image-ext"].image_height == 1024
# Both of these should have been converted to objects, not left as dicts.
assert isinstance(
file_obs.extensions["raster-image-ext"], stix2.v20.RasterImageExt,
)
assert isinstance(
file_obs.extensions["ntfs-ext"], stix2.v20.NTFSExt,
)
@pytest.mark.parametrize(
"data", [
# URL is not in EXT_MAP
"""{
"type": "url",
"value": "example.com",
"extensions": {
"x-foobar-ext": {
"property1": "foo",
"property2": 12
}
}
}""",
# File is in EXT_MAP
"""{
"type": "file",
"name": "foo.txt",
"extensions": {
"x-foobar-ext": {
"property1": "foo",
"property2": 12
}
}
}""",
],
)
def test_parse_observable_with_unregistered_custom_extension(data):
with pytest.raises(InvalidValueError) as excinfo:
stix2.parse_observable(data, version='2.0')
assert "Can't parse unknown extension type" in str(excinfo.value)
parsed_ob = stix2.parse_observable(data, allow_custom=True, version='2.0')
assert parsed_ob['extensions']['x-foobar-ext']['property1'] == 'foo'
assert not isinstance(parsed_ob['extensions']['x-foobar-ext'], stix2.base._STIXBase)
def test_register_custom_object():
# Not the way to register custom object.
class CustomObject2(object):
_type = 'awesome-object'
with pytest.raises(ValueError):
stix2.registration._register_object(CustomObject2, version="2.0")
def test_extension_property_location():
assert 'extensions' in stix2.v20.OBJ_MAP_OBSERVABLE['x-new-observable']._properties
assert 'extensions' not in stix2.v20.EXT_MAP['x-new-ext']._properties
@pytest.mark.parametrize(
"data", [
"""{
"type": "x-example",
"id": "x-example--336d8a9f-91f1-46c5-b142-6441bb9f8b8d",
"created": "2018-06-12T16:20:58.059Z",
"modified": "2018-06-12T16:20:58.059Z",
"dictionary": {
"key": {
"key_a": "value",
"key_b": "value"
}
}
}""",
],
)
def test_custom_object_nested_dictionary(data):
@stix2.v20.CustomObject(
'x-example', [
('dictionary', stix2.properties.DictionaryProperty()),
],
)
class Example(object):
def __init__(self, **kwargs):
pass
example = Example(
id='x-example--336d8a9f-91f1-46c5-b142-6441bb9f8b8d',
created='2018-06-12T16:20:58.059Z',
modified='2018-06-12T16:20:58.059Z',
dictionary={'key': {'key_b': 'value', 'key_a': 'value'}},
)
assert data == example.serialize(pretty=True)
@stix2.v20.CustomObject(
'x-new-type-2', [
('property1', stix2.properties.StringProperty()),
('property2', stix2.properties.IntegerProperty()),
],
)
class NewType2(object):
pass
def test_register_custom_object_with_version():
custom_obj_1 = {
"type": "x-new-type-2",
"id": "x-new-type-2--00000000-0000-4000-8000-000000000007",
}
cust_obj_1 = stix2.parsing.dict_to_stix2(custom_obj_1, version='2.0')
assert cust_obj_1.type in stix2.registry.STIX2_OBJ_MAPS['2.0']['objects']
# spec_version is not in STIX 2.0, and is required in 2.1, so this
# suffices as a test for a STIX 2.0 object.
assert "spec_version" not in cust_obj_1
def test_register_duplicate_object_with_version():
with pytest.raises(DuplicateRegistrationError) as excinfo:
@stix2.v20.CustomObject(
'x-new-type-2', [
('property1', stix2.properties.StringProperty()),
('property2', stix2.properties.IntegerProperty()),
],
)
class NewType2(object):
pass
assert "cannot be registered again" in str(excinfo.value)
@stix2.v20.CustomObservable(
'x-new-observable-2', [
('property1', stix2.properties.StringProperty()),
],
)
class NewObservable2(object):
pass
def test_register_observable_with_version():
custom_obs = NewObservable2(property1="Test Observable")
assert custom_obs.type in stix2.registry.STIX2_OBJ_MAPS['2.0']['observables']
def test_register_duplicate_observable_with_version():
with pytest.raises(DuplicateRegistrationError) as excinfo:
@stix2.v20.CustomObservable(
'x-new-observable-2', [
('property1', stix2.properties.StringProperty()),
],
)
class NewObservable2(object):
pass
assert "cannot be registered again" in str(excinfo.value)
def test_register_marking_with_version():
@stix2.v20.CustomMarking(
'x-new-obj-2', [
('property1', stix2.properties.StringProperty(required=True)),
],
)
class NewObj2():
pass
no = NewObj2(property1='something')
assert no._type in stix2.registry.STIX2_OBJ_MAPS['2.0']['markings']
def test_register_observable_extension_with_version():
@stix2.v20.CustomExtension(
'some-extension-2', [
('keys', stix2.properties.StringProperty(required=True)),
],
)
class SomeCustomExtension2:
pass
example = SomeCustomExtension2(keys='test123')
assert example._type in stix2.registry.STIX2_OBJ_MAPS['2.0']['extensions']
def test_register_duplicate_observable_extension():
with pytest.raises(DuplicateRegistrationError) as excinfo:
@stix2.v20.CustomExtension(
'some-extension-2', [
('property1', stix2.properties.StringProperty(required=True)),
('property2', stix2.properties.IntegerProperty()),
],
)
class NewExtension2():
pass
assert "cannot be registered again" in str(excinfo.value)
cti-python-stix2-3.0.1/stix2/test/v20/test_datastore.py 0000664 0000000 0000000 00000011235 14123351755 0022726 0 ustar 00root root 0000000 0000000 import pytest
from stix2.datastore import (
CompositeDataSource, DataSink, DataSource, DataStoreMixin,
)
from stix2.datastore.filters import Filter
from .constants import CAMPAIGN_MORE_KWARGS
def test_datasource_abstract_class_raises_error():
with pytest.raises(TypeError):
DataSource()
def test_datasink_abstract_class_raises_error():
with pytest.raises(TypeError):
DataSink()
def test_datastore_smoke():
assert DataStoreMixin() is not None
def test_datastore_get_raises():
with pytest.raises(AttributeError) as excinfo:
DataStoreMixin().get("indicator--00000000-0000-4000-8000-000000000001")
assert "DataStoreMixin has no data source to query" == str(excinfo.value)
def test_datastore_all_versions_raises():
with pytest.raises(AttributeError) as excinfo:
DataStoreMixin().all_versions("indicator--00000000-0000-4000-8000-000000000001")
assert "DataStoreMixin has no data source to query" == str(excinfo.value)
def test_datastore_query_raises():
with pytest.raises(AttributeError) as excinfo:
DataStoreMixin().query([Filter("type", "=", "indicator")])
assert "DataStoreMixin has no data source to query" == str(excinfo.value)
def test_datastore_creator_of_raises():
with pytest.raises(AttributeError) as excinfo:
DataStoreMixin().creator_of(CAMPAIGN_MORE_KWARGS)
assert "DataStoreMixin has no data source to query" == str(excinfo.value)
def test_datastore_relationships_raises():
with pytest.raises(AttributeError) as excinfo:
DataStoreMixin().relationships(
obj="indicator--00000000-0000-4000-8000-000000000001",
target_only=True,
)
assert "DataStoreMixin has no data source to query" == str(excinfo.value)
def test_datastore_related_to_raises():
with pytest.raises(AttributeError) as excinfo:
DataStoreMixin().related_to(
obj="indicator--00000000-0000-4000-8000-000000000001",
target_only=True,
)
assert "DataStoreMixin has no data source to query" == str(excinfo.value)
def test_datastore_add_raises():
with pytest.raises(AttributeError) as excinfo:
DataStoreMixin().add(CAMPAIGN_MORE_KWARGS)
assert "DataStoreMixin has no data sink to put objects in" == str(excinfo.value)
def test_composite_datastore_get_raises_error():
with pytest.raises(AttributeError) as excinfo:
CompositeDataSource().get("indicator--00000000-0000-4000-8000-000000000001")
assert "CompositeDataSource has no data sources" == str(excinfo.value)
def test_composite_datastore_all_versions_raises_error():
with pytest.raises(AttributeError) as excinfo:
CompositeDataSource().all_versions("indicator--00000000-0000-4000-8000-000000000001")
assert "CompositeDataSource has no data sources" == str(excinfo.value)
def test_composite_datastore_query_raises_error():
with pytest.raises(AttributeError) as excinfo:
CompositeDataSource().query([Filter("type", "=", "indicator")])
assert "CompositeDataSource has no data sources" == str(excinfo.value)
def test_composite_datastore_relationships_raises_error():
with pytest.raises(AttributeError) as excinfo:
CompositeDataSource().relationships(
obj="indicator--00000000-0000-4000-8000-000000000001",
target_only=True,
)
assert "CompositeDataSource has no data sources" == str(excinfo.value)
def test_composite_datastore_related_to_raises_error():
with pytest.raises(AttributeError) as excinfo:
CompositeDataSource().related_to(
obj="indicator--00000000-0000-4000-8000-000000000001",
target_only=True,
)
assert "CompositeDataSource has no data sources" == str(excinfo.value)
def test_composite_datastore_add_data_source_raises_error():
with pytest.raises(TypeError) as excinfo:
ind = "indicator--00000000-0000-4000-8000-000000000001"
CompositeDataSource().add_data_source(ind)
assert "DataSource (to be added) is not of type stix2.DataSource. DataSource type is '{}'".format(type(ind)) == str(excinfo.value)
def test_composite_datastore_add_data_sources_raises_error():
with pytest.raises(TypeError) as excinfo:
ind = "indicator--00000000-0000-4000-8000-000000000001"
CompositeDataSource().add_data_sources(ind)
assert "DataSource (to be added) is not of type stix2.DataSource. DataSource type is '{}'".format(type(ind)) == str(excinfo.value)
def test_composite_datastore_no_datasource():
cds = CompositeDataSource()
with pytest.raises(AttributeError) as excinfo:
cds.get("indicator--00000000-0000-4000-8000-000000000001")
assert 'CompositeDataSource has no data source' in str(excinfo.value)
cti-python-stix2-3.0.1/stix2/test/v20/test_datastore_composite.py 0000664 0000000 0000000 00000011353 14123351755 0025011 0 ustar 00root root 0000000 0000000 import pytest
from stix2.datastore import CompositeDataSource, make_id
from stix2.datastore.filters import Filter
from stix2.datastore.memory import MemorySink, MemorySource, MemoryStore
from stix2.utils import parse_into_datetime
from stix2.v20.common import TLP_GREEN
def test_add_remove_composite_datasource():
cds = CompositeDataSource()
ds1 = MemorySource()
ds2 = MemorySource()
ds3 = MemorySink()
with pytest.raises(TypeError) as excinfo:
cds.add_data_sources([ds1, ds2, ds1, ds3])
assert str(excinfo.value) == (
"DataSource (to be added) is not of type "
"stix2.DataSource. DataSource type is 'net use commands, and interacting with services.\n\nAliases: Net, net.exe",
"external_references": [
{
"external_id": "S0039",
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/wiki/Software/S0039"
},
{
"description": "Microsoft. (2006, October 18). Net.exe Utility. Retrieved September 22, 2015.",
"source_name": "Microsoft Net Utility",
"url": "https://msdn.microsoft.com/en-us/library/aa939914"
},
{
"description": "Savill, J. (1999, March 4). Net.exe reference. Retrieved September 22, 2015.",
"source_name": "Savill 1999",
"url": "http://windowsitpro.com/windows/netexe-reference"
}
],
"id": "tool--03342581-f790-4f03-ba41-e82e67392e23",
"tool_types": [
"tool"
],
"modified": "2017-05-31T21:32:31.601Z",
"name": "Net",
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"spec_version": "2.1",
"type": "tool"
}
],
"type": "bundle"
}
cti-python-stix2-3.0.1/stix2/test/v21/stix2_data/tool/tool--242f3da3-4425-4d11-8f5c-b842886da966/ 0000775 0000000 0000000 00000000000 14123351755 0030030 5 ustar 00root root 0000000 0000000 20170531213212684914.json 0000664 0000000 0000000 00000002551 14123351755 0032724 0 ustar 00root root 0000000 0000000 cti-python-stix2-3.0.1/stix2/test/v21/stix2_data/tool/tool--242f3da3-4425-4d11-8f5c-b842886da966 {
"id": "bundle--7dbde18f-6f14-4bf0-8389-505c89d6d5a6",
"objects": [
{
"created": "2017-05-31T21:32:12.684Z",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"description": "Windows Credential Editor is a password dumping tool.[[Citation: Amplia WCE]]\n\nAliases: Windows Credential Editor, WCE",
"external_references": [
{
"external_id": "S0005",
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/wiki/Software/S0005"
},
{
"description": "Amplia Security. (n.d.). Windows Credentials Editor (WCE) F.A.Q.. Retrieved December 17, 2015.",
"source_name": "Amplia WCE",
"url": "http://www.ampliasecurity.com/research/wcefaq.html"
}
],
"id": "tool--242f3da3-4425-4d11-8f5c-b842886da966",
"tool_types": [
"tool"
],
"modified": "2017-05-31T21:32:12.684Z",
"name": "Windows Credential Editor",
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"spec_version": "2.1",
"type": "tool"
}
],
"type": "bundle"
}
cti-python-stix2-3.0.1/stix2/test/v21/test_attack_pattern.py 0000664 0000000 0000000 00000006412 14123351755 0023746 0 ustar 00root root 0000000 0000000 import datetime as dt
import pytest
import pytz
import stix2
import stix2.exceptions
from .constants import ATTACK_PATTERN_ID
EXPECTED = """{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--0c7b5b88-8ff7-4a4d-aa9d-feb398cd0061",
"created": "2016-05-12T08:17:27.000Z",
"modified": "2016-05-12T08:17:27.000Z",
"name": "Spear Phishing",
"description": "...",
"external_references": [
{
"source_name": "capec",
"external_id": "CAPEC-163"
}
]
}"""
def test_attack_pattern_example():
ap = stix2.v21.AttackPattern(
id=ATTACK_PATTERN_ID,
created="2016-05-12T08:17:27.000Z",
modified="2016-05-12T08:17:27.000Z",
name="Spear Phishing",
external_references=[{
"source_name": "capec",
"external_id": "CAPEC-163",
}],
description="...",
)
assert ap.serialize(pretty=True) == EXPECTED
@pytest.mark.parametrize(
"data", [
EXPECTED,
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": ATTACK_PATTERN_ID,
"created": "2016-05-12T08:17:27.000Z",
"modified": "2016-05-12T08:17:27.000Z",
"description": "...",
"external_references": [
{
"external_id": "CAPEC-163",
"source_name": "capec",
},
],
"name": "Spear Phishing",
},
],
)
def test_parse_attack_pattern(data):
ap = stix2.parse(data, version="2.1")
assert ap.type == 'attack-pattern'
assert ap.spec_version == '2.1'
assert ap.id == ATTACK_PATTERN_ID
assert ap.created == dt.datetime(2016, 5, 12, 8, 17, 27, tzinfo=pytz.utc)
assert ap.modified == dt.datetime(2016, 5, 12, 8, 17, 27, tzinfo=pytz.utc)
assert ap.description == "..."
assert ap.external_references[0].external_id == 'CAPEC-163'
assert ap.external_references[0].source_name == 'capec'
assert ap.name == "Spear Phishing"
def test_attack_pattern_invalid_labels():
with pytest.raises(stix2.exceptions.InvalidValueError):
stix2.v21.AttackPattern(
id=ATTACK_PATTERN_ID,
created="2016-05-12T08:17:27Z",
modified="2016-05-12T08:17:27Z",
name="Spear Phishing",
labels=1,
)
def test_overly_precise_timestamps():
with pytest.raises(stix2.exceptions.InvalidValueError):
stix2.v21.AttackPattern(
id=ATTACK_PATTERN_ID,
created="2016-05-12T08:17:27.000000342Z",
modified="2016-05-12T08:17:27.000000287Z",
name="Spear Phishing",
external_references=[{
"source_name": "capec",
"external_id": "CAPEC-163",
}],
description="...",
)
def test_less_precise_timestamps():
ap = stix2.v21.AttackPattern(
id=ATTACK_PATTERN_ID,
created="2016-05-12T08:17:27.00Z",
modified="2016-05-12T08:17:27.0Z",
name="Spear Phishing",
external_references=[{
"source_name": "capec",
"external_id": "CAPEC-163",
}],
description="...",
)
assert ap.serialize(pretty=True) == EXPECTED
# TODO: Add other examples
cti-python-stix2-3.0.1/stix2/test/v21/test_base.py 0000664 0000000 0000000 00000001613 14123351755 0021652 0 ustar 00root root 0000000 0000000 import datetime as dt
import json
import uuid
import pytest
import pytz
import stix2
from stix2.base import STIXJSONEncoder
def test_encode_json_datetime():
now = dt.datetime(2017, 3, 22, 0, 0, 0, tzinfo=pytz.UTC)
test_dict = {'now': now}
expected = '{"now": "2017-03-22T00:00:00Z"}'
assert json.dumps(test_dict, cls=STIXJSONEncoder) == expected
def test_encode_json_object():
obj = object()
test_dict = {'obj': obj}
with pytest.raises(TypeError) as excinfo:
json.dumps(test_dict, cls=STIXJSONEncoder)
assert " is not JSON serializable" in str(excinfo.value)
def test_deterministic_id_unicode():
mutex = {'name': u'D*Fl#Ed*\u00a3\u00a8', 'type': 'mutex'}
obs = stix2.parse(mutex, version="2.1")
dd_idx = obs.id.index("--")
id_uuid = uuid.UUID(obs.id[dd_idx+2:])
assert id_uuid.variant == uuid.RFC_4122
assert id_uuid.version == 5
cti-python-stix2-3.0.1/stix2/test/v21/test_bundle.py 0000664 0000000 0000000 00000027564 14123351755 0022226 0 ustar 00root root 0000000 0000000 import io
import json
import pytest
import stix2
from ...exceptions import InvalidValueError
from .constants import IDENTITY_ID
EXPECTED_BUNDLE = """{
"type": "bundle",
"id": "bundle--00000000-0000-4000-8000-000000000007",
"objects": [
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--00000000-0000-4000-8000-000000000001",
"created": "2017-01-01T12:34:56.000Z",
"modified": "2017-01-01T12:34:56.000Z",
"indicator_types": [
"malicious-activity"
],
"pattern": "[file:hashes.MD5 = 'd41d8cd98f00b204e9800998ecf8427e']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-01-01T12:34:56Z"
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--00000000-0000-4000-8000-000000000003",
"created": "2017-01-01T12:34:56.000Z",
"modified": "2017-01-01T12:34:56.000Z",
"name": "Cryptolocker",
"malware_types": [
"ransomware"
],
"is_family": false
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--00000000-0000-4000-8000-000000000005",
"created": "2017-01-01T12:34:56.000Z",
"modified": "2017-01-01T12:34:56.000Z",
"relationship_type": "indicates",
"source_ref": "indicator--a740531e-63ff-4e49-a9e1-a0a3eed0e3e7",
"target_ref": "malware--9c4638ec-f1de-4ddb-abf4-1b760417654e"
}
]
}"""
EXPECTED_BUNDLE_DICT = {
"type": "bundle",
"id": "bundle--00000000-0000-4000-8000-000000000007",
"objects": [
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--00000000-0000-4000-8000-000000000001",
"created": "2017-01-01T12:34:56.000Z",
"modified": "2017-01-01T12:34:56.000Z",
"pattern": "[file:hashes.MD5 = 'd41d8cd98f00b204e9800998ecf8427e']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-01-01T12:34:56Z",
"indicator_types": [
"malicious-activity",
],
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--00000000-0000-4000-8000-000000000003",
"created": "2017-01-01T12:34:56.000Z",
"modified": "2017-01-01T12:34:56.000Z",
"name": "Cryptolocker",
"malware_types": [
"ransomware",
],
"is_family": False,
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--00000000-0000-4000-8000-000000000005",
"created": "2017-01-01T12:34:56.000Z",
"modified": "2017-01-01T12:34:56.000Z",
"relationship_type": "indicates",
"source_ref": "indicator--a740531e-63ff-4e49-a9e1-a0a3eed0e3e7",
"target_ref": "malware--9c4638ec-f1de-4ddb-abf4-1b760417654e",
},
],
}
def test_empty_bundle():
bundle = stix2.v21.Bundle()
assert bundle.type == "bundle"
assert bundle.id.startswith("bundle--")
with pytest.raises(AttributeError):
assert bundle.objects
def test_bundle_with_wrong_type():
with pytest.raises(stix2.exceptions.InvalidValueError) as excinfo:
stix2.v21.Bundle(type="not-a-bundle")
assert excinfo.value.cls == stix2.v21.Bundle
assert excinfo.value.prop_name == "type"
assert excinfo.value.reason == "must equal 'bundle'."
assert str(excinfo.value) == "Invalid value for Bundle 'type': must equal 'bundle'."
def test_bundle_id_must_start_with_bundle():
with pytest.raises(stix2.exceptions.InvalidValueError) as excinfo:
stix2.v21.Bundle(id='my-prefix--')
assert excinfo.value.cls == stix2.v21.Bundle
assert excinfo.value.prop_name == "id"
assert excinfo.value.reason == "must start with 'bundle--'."
assert str(excinfo.value) == "Invalid value for Bundle 'id': must start with 'bundle--'."
def test_create_bundle_fp_serialize_pretty(indicator, malware, relationship):
bundle = stix2.v21.Bundle(objects=[indicator, malware, relationship])
buffer = io.StringIO()
bundle.fp_serialize(buffer, pretty=True)
assert bundle.serialize(pretty=True) == EXPECTED_BUNDLE
assert buffer.getvalue() == EXPECTED_BUNDLE
def test_create_bundle_fp_serialize_nonpretty(indicator, malware, relationship):
bundle = stix2.v21.Bundle(objects=[indicator, malware, relationship])
buffer = io.StringIO()
bundle.fp_serialize(buffer, sort_keys=True)
assert bundle.serialize(sort_keys=True) == json.dumps(json.loads(EXPECTED_BUNDLE), sort_keys=True)
assert buffer.getvalue() == json.dumps(json.loads(EXPECTED_BUNDLE), sort_keys=True)
def test_create_bundle1(indicator, malware, relationship):
bundle = stix2.v21.Bundle(objects=[indicator, malware, relationship])
assert bundle.serialize(pretty=True) == EXPECTED_BUNDLE
assert bundle.serialize(pretty=True) == EXPECTED_BUNDLE
def test_create_bundle2(indicator, malware, relationship):
bundle = stix2.v21.Bundle(objects=[indicator, malware, relationship])
assert json.loads(bundle.serialize()) == EXPECTED_BUNDLE_DICT
def test_create_bundle_with_positional_args(indicator, malware, relationship):
bundle = stix2.v21.Bundle(indicator, malware, relationship)
assert bundle.serialize(pretty=True) == EXPECTED_BUNDLE
def test_create_bundle_with_positional_listarg(indicator, malware, relationship):
bundle = stix2.v21.Bundle([indicator, malware, relationship])
assert bundle.serialize(pretty=True) == EXPECTED_BUNDLE
def test_create_bundle_with_listarg_and_positional_arg(indicator, malware, relationship):
bundle = stix2.v21.Bundle([indicator, malware], relationship)
assert bundle.serialize(pretty=True) == EXPECTED_BUNDLE
def test_create_bundle_with_listarg_and_kwarg(indicator, malware, relationship):
bundle = stix2.v21.Bundle([indicator, malware], objects=[relationship])
assert bundle.serialize(pretty=True) == EXPECTED_BUNDLE
def test_create_bundle_with_arg_listarg_and_kwarg(indicator, malware, relationship):
bundle = stix2.v21.Bundle([indicator], malware, objects=[relationship])
assert bundle.serialize(pretty=True) == EXPECTED_BUNDLE
def test_create_bundle_invalid(indicator, malware, relationship):
with pytest.raises(InvalidValueError) as excinfo:
stix2.v21.Bundle(objects=[1])
assert excinfo.value.reason == "This property may only contain a dictionary or object"
with pytest.raises(InvalidValueError) as excinfo:
stix2.v21.Bundle(objects=[{}])
assert excinfo.value.reason == "This property may only contain a non-empty dictionary or object"
with pytest.raises(InvalidValueError) as excinfo:
stix2.v21.Bundle(objects=[{'type': 'bundle'}])
assert excinfo.value.reason == 'This property may not contain a Bundle object'
@pytest.mark.parametrize("version", ["2.1"])
def test_parse_bundle(version):
bundle = stix2.parse(EXPECTED_BUNDLE, version=version)
assert bundle.type == "bundle"
assert bundle.id.startswith("bundle--")
assert isinstance(bundle.objects[0], stix2.v21.Indicator)
assert bundle.objects[0].type == 'indicator'
assert bundle.objects[1].type == 'malware'
assert bundle.objects[2].type == 'relationship'
def test_parse_unknown_type():
unknown = {
"type": "other",
"spec_version": "2.1",
"id": "other--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created": "2016-04-06T20:03:00Z",
"modified": "2016-04-06T20:03:00Z",
"created_by_ref": IDENTITY_ID,
"description": "Campaign by Green Group against a series of targets in the financial services sector.",
"name": "Green Group Attacks Against Finance",
}
with pytest.raises(stix2.exceptions.ParseError) as excinfo:
stix2.parse(unknown, version="2.1")
assert str(excinfo.value) == "Can't parse unknown object type 'other'! For custom types, use the CustomObject decorator."
def test_stix_object_property():
prop = stix2.properties.STIXObjectProperty(spec_version='2.1')
identity = stix2.v21.Identity(name="test", identity_class="individual")
assert prop.clean(identity, False) == (identity, False)
def test_bundle_obj_id_found():
bundle = stix2.parse(EXPECTED_BUNDLE)
mal_list = bundle.get_obj("malware--00000000-0000-4000-8000-000000000003")
assert bundle.objects[1] == mal_list[0]
assert len(mal_list) == 1
@pytest.mark.parametrize(
"bundle_data", [{
"type": "bundle",
"id": "bundle--00000000-0000-4000-8000-000000000007",
"objects": [
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--00000000-0000-4000-8000-000000000001",
"created": "2017-01-01T12:34:56.000Z",
"modified": "2017-01-01T12:34:56.000Z",
"indicator_types": [
"malicious-activity",
],
"pattern": "[file:hashes.MD5 = 'd41d8cd98f00b204e9800998ecf8427e']",
"pattern_type": "stix",
"valid_from": "2017-01-01T12:34:56Z",
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--00000000-0000-4000-8000-000000000003",
"created": "2017-01-01T12:34:56.000Z",
"modified": "2017-01-01T12:34:56.000Z",
"name": "Cryptolocker1",
"malware_types": [
"ransomware",
],
"is_family": False,
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--00000000-0000-4000-8000-000000000003",
"created": "2017-01-01T12:34:56.000Z",
"modified": "2017-12-21T12:34:56.000Z",
"name": "CryptolockerOne",
"malware_types": [
"ransomware",
],
"is_family": False,
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--00000000-0000-4000-8000-000000000005",
"created": "2017-01-01T12:34:56.000Z",
"modified": "2017-01-01T12:34:56.000Z",
"relationship_type": "indicates",
"source_ref": "indicator--a740531e-63ff-4e49-a9e1-a0a3eed0e3e7",
"target_ref": "malware--9c4638ec-f1de-4ddb-abf4-1b760417654e",
},
],
}],
)
def test_bundle_objs_ids_found(bundle_data):
bundle = stix2.parse(bundle_data)
mal_list = bundle.get_obj("malware--00000000-0000-4000-8000-000000000003")
assert bundle.objects[1] == mal_list[0]
assert bundle.objects[2] == mal_list[1]
assert len(mal_list) == 2
def test_bundle_getitem_overload_property_found():
bundle = stix2.parse(EXPECTED_BUNDLE)
assert bundle.type == "bundle"
assert bundle['type'] == "bundle"
def test_bundle_getitem_overload_obj_id_found():
bundle = stix2.parse(EXPECTED_BUNDLE)
mal_list = bundle["malware--00000000-0000-4000-8000-000000000003"]
assert bundle.objects[1] == mal_list[0]
assert len(mal_list) == 1
def test_bundle_obj_id_not_found():
bundle = stix2.parse(EXPECTED_BUNDLE)
with pytest.raises(KeyError) as excinfo:
bundle.get_obj('non existent')
assert "does not match the id property of any of the bundle" in str(excinfo.value)
def test_bundle_getitem_overload_obj_id_not_found():
bundle = stix2.parse(EXPECTED_BUNDLE)
with pytest.raises(KeyError) as excinfo:
bundle['non existent']
assert "neither a property on the bundle nor does it match the id property" in str(excinfo.value)
cti-python-stix2-3.0.1/stix2/test/v21/test_campaign.py 0000664 0000000 0000000 00000003457 14123351755 0022527 0 ustar 00root root 0000000 0000000 import datetime as dt
import pytest
import pytz
import stix2
from .constants import CAMPAIGN_ID, CAMPAIGN_MORE_KWARGS, IDENTITY_ID
EXPECTED = """{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2016-04-06T20:03:00.000Z",
"modified": "2016-04-06T20:03:00.000Z",
"name": "Green Group Attacks Against Finance",
"description": "Campaign by Green Group against a series of targets in the financial services sector."
}"""
def test_campaign_example():
campaign = stix2.v21.Campaign(
**CAMPAIGN_MORE_KWARGS
)
assert campaign.serialize(pretty=True) == EXPECTED
@pytest.mark.parametrize(
"data", [
EXPECTED,
{
"type": "campaign",
"spec_version": "2.1",
"id": CAMPAIGN_ID,
"created": "2016-04-06T20:03:00Z",
"modified": "2016-04-06T20:03:00Z",
"created_by_ref": IDENTITY_ID,
"description": "Campaign by Green Group against a series of targets in the financial services sector.",
"name": "Green Group Attacks Against Finance",
},
],
)
def test_parse_campaign(data):
cmpn = stix2.parse(data, version="2.1")
assert cmpn.type == 'campaign'
assert cmpn.spec_version == '2.1'
assert cmpn.id == CAMPAIGN_ID
assert cmpn.created == dt.datetime(2016, 4, 6, 20, 3, 0, tzinfo=pytz.utc)
assert cmpn.modified == dt.datetime(2016, 4, 6, 20, 3, 0, tzinfo=pytz.utc)
assert cmpn.created_by_ref == IDENTITY_ID
assert cmpn.description == "Campaign by Green Group against a series of targets in the financial services sector."
assert cmpn.name == "Green Group Attacks Against Finance"
# TODO: Add other examples
cti-python-stix2-3.0.1/stix2/test/v21/test_confidence.py 0000664 0000000 0000000 00000021706 14123351755 0023042 0 ustar 00root root 0000000 0000000 import pytest
from stix2.confidence.scales import (
admiralty_credibility_to_value, dni_to_value, none_low_med_high_to_value,
value_to_admiralty_credibility, value_to_dni,
value_to_none_low_medium_high, value_to_wep, value_to_zero_ten,
wep_to_value, zero_ten_to_value,
)
CONFIDENCE_ERROR_STR = "STIX Confidence value cannot be determined for %s"
RANGE_ERROR_STR = "Range of values out of bounds: %s"
def _between(x, val, y):
return x >= val >= y
def test_confidence_range_none_low_med_high():
confidence_range = range(-1, 101)
for val in confidence_range:
if val < 0 or val > 100:
with pytest.raises(ValueError) as excinfo:
value_to_none_low_medium_high(val)
assert str(excinfo.value) == RANGE_ERROR_STR % val
continue
if val == 0:
assert value_to_none_low_medium_high(val) == "None"
elif _between(29, val, 1):
assert value_to_none_low_medium_high(val) == "Low"
elif _between(69, val, 30):
assert value_to_none_low_medium_high(val) == "Med"
elif _between(100, val, 70):
assert value_to_none_low_medium_high(val) == "High"
@pytest.mark.parametrize(
"scale_value,result", [
("None", 0),
("Low", 15),
("Med", 50),
("High", 85),
],
)
def test_confidence_scale_valid_none_low_med_high(scale_value, result):
val = none_low_med_high_to_value(scale_value)
assert val == result
@pytest.mark.parametrize(
"scale_value", [
"Super",
"none",
"",
],
)
def test_confidence_scale_invalid_none_low_med_high(scale_value):
with pytest.raises(ValueError) as excinfo:
none_low_med_high_to_value(scale_value)
assert str(excinfo.value) == CONFIDENCE_ERROR_STR % scale_value
def test_confidence_range_zero_ten():
confidence_range = range(-1, 101)
for val in confidence_range:
if val < 0 or val > 100:
with pytest.raises(ValueError) as excinfo:
value_to_zero_ten(val)
assert str(excinfo.value) == RANGE_ERROR_STR % val
continue
if _between(4, val, 0):
assert value_to_zero_ten(val) == "0"
elif _between(14, val, 5):
assert value_to_zero_ten(val) == "1"
elif _between(24, val, 15):
assert value_to_zero_ten(val) == "2"
elif _between(34, val, 25):
assert value_to_zero_ten(val) == "3"
elif _between(44, val, 35):
assert value_to_zero_ten(val) == "4"
elif _between(54, val, 45):
assert value_to_zero_ten(val) == "5"
elif _between(64, val, 55):
assert value_to_zero_ten(val) == "6"
elif _between(74, val, 65):
assert value_to_zero_ten(val) == "7"
elif _between(84, val, 75):
assert value_to_zero_ten(val) == "8"
elif _between(94, val, 85):
assert value_to_zero_ten(val) == "9"
elif _between(100, val, 95):
assert value_to_zero_ten(val) == "10"
@pytest.mark.parametrize(
"scale_value,result", [
("0", 0),
("1", 10),
("2", 20),
("3", 30),
("4", 40),
("5", 50),
("6", 60),
("7", 70),
("8", 80),
("9", 90),
("10", 100),
],
)
def test_confidence_scale_valid_zero_ten(scale_value, result):
val = zero_ten_to_value(scale_value)
assert val == result
@pytest.mark.parametrize(
"scale_value", [
"11",
8,
"",
],
)
def test_confidence_scale_invalid_zero_ten(scale_value):
with pytest.raises(ValueError) as excinfo:
zero_ten_to_value(scale_value)
assert str(excinfo.value) == CONFIDENCE_ERROR_STR % scale_value
def test_confidence_range_admiralty_credibility():
confidence_range = range(-1, 101)
for val in confidence_range:
if val < 0 or val > 100:
with pytest.raises(ValueError) as excinfo:
value_to_admiralty_credibility(val)
assert str(excinfo.value) == RANGE_ERROR_STR % val
continue
if _between(19, val, 0):
assert value_to_admiralty_credibility(val) == "5 - Improbable"
elif _between(39, val, 20):
assert value_to_admiralty_credibility(val) == "4 - Doubtful"
elif _between(59, val, 40):
assert value_to_admiralty_credibility(val) == "3 - Possibly True"
elif _between(79, val, 60):
assert value_to_admiralty_credibility(val) == "2 - Probably True"
elif _between(100, val, 80):
assert value_to_admiralty_credibility(val) == "1 - Confirmed by other sources"
@pytest.mark.parametrize(
"scale_value,result", [
("5 - Improbable", 10),
("4 - Doubtful", 30),
("3 - Possibly True", 50),
("2 - Probably True", 70),
("1 - Confirmed by other sources", 90),
],
)
def test_confidence_scale_valid_admiralty_credibility(scale_value, result):
val = admiralty_credibility_to_value(scale_value)
assert val == result
@pytest.mark.parametrize(
"scale_value", [
"5 - improbable",
"6 - Truth cannot be judged",
"",
],
)
def test_confidence_scale_invalid_admiralty_credibility(scale_value):
with pytest.raises(ValueError) as excinfo:
admiralty_credibility_to_value(scale_value)
assert str(excinfo.value) == CONFIDENCE_ERROR_STR % scale_value
def test_confidence_range_wep():
confidence_range = range(-1, 101)
for val in confidence_range:
if val < 0 or val > 100:
with pytest.raises(ValueError) as excinfo:
value_to_wep(val)
assert str(excinfo.value) == RANGE_ERROR_STR % val
continue
if val == 0:
assert value_to_wep(val) == "Impossible"
elif _between(19, val, 1):
assert value_to_wep(val) == "Highly Unlikely/Almost Certainly Not"
elif _between(39, val, 20):
assert value_to_wep(val) == "Unlikely/Probably Not"
elif _between(59, val, 40):
assert value_to_wep(val) == "Even Chance"
elif _between(79, val, 60):
assert value_to_wep(val) == "Likely/Probable"
elif _between(99, val, 80):
assert value_to_wep(val) == "Highly likely/Almost Certain"
elif val == 100:
assert value_to_wep(val) == "Certain"
@pytest.mark.parametrize(
"scale_value,result", [
("Impossible", 0),
("Highly Unlikely/Almost Certainly Not", 10),
("Unlikely/Probably Not", 30),
("Even Chance", 50),
("Likely/Probable", 70),
("Highly likely/Almost Certain", 90),
("Certain", 100),
],
)
def test_confidence_scale_valid_wep(scale_value, result):
val = wep_to_value(scale_value)
assert val == result
@pytest.mark.parametrize(
"scale_value", [
"Unlikely / Probably Not",
"Almost certain",
"",
],
)
def test_confidence_scale_invalid_wep(scale_value):
with pytest.raises(ValueError) as excinfo:
wep_to_value(scale_value)
assert str(excinfo.value) == CONFIDENCE_ERROR_STR % scale_value
def test_confidence_range_dni():
confidence_range = range(-1, 101)
for val in confidence_range:
if val < 0 or val > 100:
with pytest.raises(ValueError) as excinfo:
value_to_dni(val)
assert str(excinfo.value) == RANGE_ERROR_STR % val
continue
if _between(9, val, 0):
assert value_to_dni(val) == "Almost No Chance / Remote"
elif _between(19, val, 10):
assert value_to_dni(val) == "Very Unlikely / Highly Improbable"
elif _between(39, val, 20):
assert value_to_dni(val) == "Unlikely / Improbable"
elif _between(59, val, 40):
assert value_to_dni(val) == "Roughly Even Chance / Roughly Even Odds"
elif _between(79, val, 60):
assert value_to_dni(val) == "Likely / Probable"
elif _between(89, val, 80):
assert value_to_dni(val) == "Very Likely / Highly Probable"
elif _between(100, val, 90):
assert value_to_dni(val) == "Almost Certain / Nearly Certain"
@pytest.mark.parametrize(
"scale_value,result", [
("Almost No Chance / Remote", 5),
("Very Unlikely / Highly Improbable", 15),
("Unlikely / Improbable", 30),
("Roughly Even Chance / Roughly Even Odds", 50),
("Likely / Probable", 70),
("Very Likely / Highly Probable", 85),
("Almost Certain / Nearly Certain", 95),
],
)
def test_confidence_scale_valid_dni(scale_value, result):
val = dni_to_value(scale_value)
assert val == result
@pytest.mark.parametrize(
"scale_value", [
"Almost Certain/Nearly Certain",
"Almost Certain / nearly Certain",
"",
],
)
def test_confidence_scale_invalid_none_dni(scale_value):
with pytest.raises(ValueError) as excinfo:
dni_to_value(scale_value)
assert str(excinfo.value) == CONFIDENCE_ERROR_STR % scale_value
cti-python-stix2-3.0.1/stix2/test/v21/test_course_of_action.py 0000664 0000000 0000000 00000004347 14123351755 0024270 0 ustar 00root root 0000000 0000000 import json
import pytest
import stix2
import stix2.exceptions
import stix2.utils
COA_WITH_BIN_JSON = """{
"type": "course-of-action",
"spec_version": "2.1",
"id": "course-of-action--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2016-04-06T20:03:48.000Z",
"modified": "2016-04-06T20:03:48.000Z",
"name": "Add TCP port 80 Filter Rule to the existing Block UDP 1434 Filter",
"description": "This is how to add a filter rule to block inbound access to TCP port 80 to the existing UDP 1434 filter ..."
}"""
COA_WITH_REF_JSON = """{
"type": "course-of-action",
"spec_version": "2.1",
"id": "course-of-action--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created_by_ref": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2016-04-06T20:03:48.000Z",
"modified": "2016-04-06T20:03:48.000Z",
"name": "Add TCP port 80 Filter Rule to the existing Block UDP 1434 Filter",
"description": "This is how to add a filter rule to block inbound access to TCP port 80 to the existing UDP 1434 filter ..."
}"""
COA_WITH_BIN_DICT = json.loads(COA_WITH_BIN_JSON)
COA_WITH_REF_DICT = json.loads(COA_WITH_REF_JSON)
@pytest.mark.parametrize(
"sdo_json,sdo_dict", [
(COA_WITH_BIN_JSON, COA_WITH_BIN_DICT),
(COA_WITH_REF_JSON, COA_WITH_REF_DICT),
],
)
def test_course_of_action_example(sdo_json, sdo_dict):
coa = stix2.v21.CourseOfAction(**sdo_dict)
assert coa.serialize(pretty=True) == sdo_json
@pytest.mark.parametrize(
"sdo_json,sdo_dict", [
(COA_WITH_BIN_JSON, COA_WITH_BIN_DICT),
(COA_WITH_REF_JSON, COA_WITH_REF_DICT),
],
)
def test_parse_course_of_action(sdo_json, sdo_dict):
# Names of timestamp-valued attributes
ts_attrs = {"created", "modified"}
for data in (sdo_json, sdo_dict):
coa = stix2.parse(data, version="2.1")
# sdo_dict is handy as a source of attribute names/values to check
for attr_name, attr_value in sdo_dict.items():
cmp_value = stix2.utils.parse_into_datetime(attr_value) \
if attr_name in ts_attrs else attr_value
assert getattr(coa, attr_name) == cmp_value
# TODO: Add other examples
cti-python-stix2-3.0.1/stix2/test/v21/test_custom.py 0000664 0000000 0000000 00000204171 14123351755 0022256 0 ustar 00root root 0000000 0000000 import contextlib
import uuid
import pytest
import stix2
import stix2.base
import stix2.registration
import stix2.registry
import stix2.v21
from ...exceptions import (
DuplicateRegistrationError, InvalidValueError, MissingPropertiesError,
)
from .constants import FAKE_TIME, IDENTITY_ID, MARKING_DEFINITION_ID
# Custom Properties in SDOs
IDENTITY_CUSTOM_PROP = stix2.v21.Identity(
name="John Smith",
identity_class="individual",
x_foo="bar",
allow_custom=True,
)
@contextlib.contextmanager
def _register_extension(ext, props):
"""
A contextmanager useful for registering an extension and then ensuring
it gets unregistered again. A random extension-definition STIX ID is
generated for the extension and yielded as the contextmanager's value.
:param ext: The class which would normally be decorated with the
CustomExtension decorator.
:param props: Properties as would normally be passed into the
CustomExtension decorator.
"""
ext_def_id = "extension-definition--" + str(uuid.uuid4())
stix2.v21.CustomExtension(
ext_def_id,
props,
)(ext)
try:
yield ext_def_id
finally:
# "unregister" the extension
del stix2.registry.STIX2_OBJ_MAPS["2.1"]["extensions"][ext_def_id]
def test_identity_custom_property():
identity = stix2.v21.Identity(
id=IDENTITY_ID,
created="2015-12-21T19:59:11Z",
modified="2015-12-21T19:59:11Z",
name="John Smith",
identity_class="individual",
custom_properties={
"foo": "bar",
},
)
assert identity.foo == "bar"
with pytest.raises(ValueError) as excinfo:
stix2.v21.Identity(
id=IDENTITY_ID,
created="2015-12-21T19:59:11Z",
modified="2015-12-21T19:59:11Z",
name="John Smith",
identity_class="individual",
custom_properties="foobar",
)
assert str(excinfo.value) == "'custom_properties' must be a dictionary"
with pytest.raises(stix2.exceptions.ExtraPropertiesError) as excinfo:
stix2.v21.Identity(
id=IDENTITY_ID,
created="2015-12-21T19:59:11Z",
modified="2015-12-21T19:59:11Z",
name="John Smith",
identity_class="individual",
custom_properties={
"foo": "bar",
},
foo="bar",
)
assert "Unexpected properties for Identity" in str(excinfo.value)
# leading numeric character is illegal in 2.1
with pytest.raises(stix2.exceptions.InvalidValueError) as excinfo:
stix2.v21.Identity(
id=IDENTITY_ID,
created="2015-12-21T19:59:11Z",
modified="2015-12-21T19:59:11Z",
name="John Smith",
identity_class="individual",
custom_properties={
"7foo": "bar",
},
)
assert "must begin with an alpha character." in str(excinfo.value)
# leading "_" is illegal in 2.1
with pytest.raises(stix2.exceptions.InvalidValueError) as excinfo:
stix2.v21.Identity(
id=IDENTITY_ID,
created="2015-12-21T19:59:11Z",
modified="2015-12-21T19:59:11Z",
name="John Smith",
identity_class="individual",
custom_properties={
"_foo": "bar",
},
)
assert "must begin with an alpha character." in str(excinfo.value)
with pytest.raises(stix2.exceptions.InvalidValueError) as excinfo:
identity = stix2.v21.Identity(
id=IDENTITY_ID,
created="2015-12-21T19:59:11Z",
modified="2015-12-21T19:59:11Z",
name="John Smith",
identity_class="individual",
_x_foo="bar",
allow_custom=True,
)
assert "must begin with an alpha character." in str(excinfo.value)
def test_identity_custom_property_invalid():
with pytest.raises(stix2.exceptions.ExtraPropertiesError) as excinfo:
stix2.v21.Identity(
id=IDENTITY_ID,
created="2015-12-21T19:59:11Z",
modified="2015-12-21T19:59:11Z",
name="John Smith",
identity_class="individual",
x_foo="bar",
)
assert excinfo.value.cls == stix2.v21.Identity
assert excinfo.value.properties == ['x_foo']
assert "Unexpected properties for" in str(excinfo.value)
def test_identity_custom_property_allowed():
identity = stix2.v21.Identity(
id=IDENTITY_ID,
created="2015-12-21T19:59:11Z",
modified="2015-12-21T19:59:11Z",
name="John Smith",
identity_class="individual",
x_foo="bar",
allow_custom=True,
)
assert identity.x_foo == "bar"
@pytest.mark.parametrize(
"data", [
"""{
"type": "identity",
"spec_version": "2.1",
"id": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
"created": "2015-12-21T19:59:11Z",
"modified": "2015-12-21T19:59:11Z",
"name": "John Smith",
"identity_class": "individual",
"foo": "bar"
}""",
],
)
def test_parse_identity_custom_property(data):
with pytest.raises(stix2.exceptions.ExtraPropertiesError) as excinfo:
stix2.parse(data, version="2.1")
assert issubclass(excinfo.value.cls, stix2.v21.Identity)
assert excinfo.value.properties == ['foo']
assert "Unexpected properties for" in str(excinfo.value)
identity = stix2.parse(data, version="2.1", allow_custom=True)
assert identity.foo == "bar"
def test_custom_property_object_in_bundled_object():
bundle = stix2.v21.Bundle(IDENTITY_CUSTOM_PROP, allow_custom=True)
assert bundle.objects[0].x_foo == "bar"
assert '"x_foo": "bar"' in str(bundle)
def test_custom_properties_object_in_bundled_object():
obj = stix2.v21.Identity(
name="John Smith",
identity_class="individual",
custom_properties={
"x_foo": "bar",
},
)
bundle = stix2.v21.Bundle(obj, allow_custom=True)
assert bundle.objects[0].x_foo == "bar"
assert '"x_foo": "bar"' in str(bundle)
def test_custom_property_dict_in_bundled_object():
custom_identity = {
'type': 'identity',
'spec_version': '2.1',
'id': IDENTITY_ID,
'created': '2015-12-21T19:59:11Z',
'name': 'John Smith',
'identity_class': 'individual',
'x_foo': 'bar',
}
with pytest.raises(InvalidValueError):
stix2.v21.Bundle(custom_identity)
bundle = stix2.v21.Bundle(custom_identity, allow_custom=True)
assert bundle.objects[0].x_foo == "bar"
assert '"x_foo": "bar"' in str(bundle)
def test_custom_properties_dict_in_bundled_object():
custom_identity = {
'type': 'identity',
'spec_version': '2.1',
'id': IDENTITY_ID,
'created': '2015-12-21T19:59:11Z',
'name': 'John Smith',
'identity_class': 'individual',
'custom_properties': {
'x_foo': 'bar',
},
}
with pytest.raises(InvalidValueError):
stix2.v21.Bundle(custom_identity)
bundle = stix2.v21.Bundle(custom_identity, allow_custom=True)
assert bundle.objects[0].x_foo == "bar"
assert '"x_foo": "bar"' in str(bundle)
# Custom properties in SCOs
def test_custom_property_in_observed_data():
artifact = stix2.v21.File(
allow_custom=True,
name='test',
x_foo='bar',
)
observed_data = stix2.v21.ObservedData(
allow_custom=True,
first_observed="2015-12-21T19:00:00Z",
last_observed="2015-12-21T19:00:00Z",
number_observed=1,
objects={"0": artifact},
)
assert observed_data.objects['0'].x_foo == "bar"
assert '"x_foo": "bar"' in str(observed_data)
def test_invalid_custom_property_in_observed_data():
with pytest.raises(stix2.exceptions.InvalidValueError) as excinfo:
stix2.v21.File(
custom_properties={"8foo": 1},
allow_custom=True,
name='test',
x_foo='bar',
)
assert "must begin with an alpha character." in str(excinfo.value)
def test_custom_property_object_in_observable_extension():
ntfs = stix2.v21.NTFSExt(
allow_custom=True,
sid=1,
x_foo='bar',
)
artifact = stix2.v21.File(
allow_custom=True,
name='test',
extensions={'ntfs-ext': ntfs},
)
observed_data = stix2.v21.ObservedData(
allow_custom=True,
first_observed="2015-12-21T19:00:00Z",
last_observed="2015-12-21T19:00:00Z",
number_observed=1,
objects={"0": artifact},
)
assert observed_data.objects['0'].extensions['ntfs-ext'].x_foo == "bar"
assert '"x_foo": "bar"' in str(observed_data)
def test_custom_property_dict_in_observable_extension():
with pytest.raises(InvalidValueError):
stix2.v21.File(
name='test',
extensions={
'ntfs-ext': {
'sid': 1,
'x_foo': 'bar',
},
},
)
artifact = stix2.v21.File(
allow_custom=True,
name='test',
extensions={
'ntfs-ext': {
'sid': 1,
'x_foo': 'bar',
},
},
)
observed_data = stix2.v21.ObservedData(
allow_custom=True,
first_observed="2015-12-21T19:00:00Z",
last_observed="2015-12-21T19:00:00Z",
number_observed=1,
objects={"0": artifact},
)
assert observed_data.objects['0'].extensions['ntfs-ext'].x_foo == "bar"
assert '"x_foo": "bar"' in str(observed_data)
def test_identity_custom_property_revoke():
identity = IDENTITY_CUSTOM_PROP.revoke()
assert identity.x_foo == "bar"
# Custom markings
def test_identity_custom_property_edit_markings():
marking_obj = stix2.v21.MarkingDefinition(
id=MARKING_DEFINITION_ID,
definition_type="statement",
definition=stix2.v21.StatementMarking(statement="Copyright 2016, Example Corp"),
)
marking_obj2 = stix2.v21.MarkingDefinition(
id=MARKING_DEFINITION_ID,
definition_type="statement",
definition=stix2.v21.StatementMarking(statement="Another one"),
)
# None of the following should throw exceptions
identity = IDENTITY_CUSTOM_PROP.add_markings(marking_obj)
identity2 = identity.add_markings(marking_obj2, ['x_foo'])
identity2.remove_markings(marking_obj.id)
identity2.remove_markings(marking_obj2.id, ['x_foo'])
identity2.clear_markings()
identity2.clear_markings('x_foo')
def test_invalid_custom_property_in_marking():
with pytest.raises(ValueError) as excinfo:
@stix2.v21.CustomMarking(
'x-new-obj', [
('9property1', stix2.properties.StringProperty(required=True)),
],
)
class NewObj():
pass
assert "must begin with an alpha character." in str(excinfo.value)
def test_custom_marking_no_init_1():
@stix2.v21.CustomMarking(
'x-new-obj', [
('property1', stix2.properties.StringProperty(required=True)),
],
)
class NewObj():
pass
no = NewObj(property1='something')
assert no.property1 == 'something'
def test_custom_marking_no_init_2():
@stix2.v21.CustomMarking(
'x-new-obj2', [
('property1', stix2.properties.StringProperty(required=True)),
],
)
class NewObj2(object):
pass
no2 = NewObj2(property1='something')
assert no2.property1 == 'something'
def test_custom_marking_invalid_type_name():
with pytest.raises(ValueError) as excinfo:
@stix2.v21.CustomMarking(
'x', [
('property1', stix2.properties.StringProperty(required=True)),
],
)
class NewObj(object):
pass # pragma: no cover
assert "Invalid type name 'x': " in str(excinfo.value)
with pytest.raises(ValueError) as excinfo:
@stix2.v21.CustomMarking(
'x_new_marking', [
('property1', stix2.properties.StringProperty(required=True)),
],
)
class NewObj2(object):
pass # pragma: no cover
assert "Invalid type name 'x_new_marking':" in str(excinfo.value)
with pytest.raises(ValueError) as excinfo:
@stix2.v21.CustomMarking(
'7x-new-marking', [
('property1', stix2.properties.StringProperty(required=True)),
],
)
class NewObj3(object):
pass # pragma: no cover
assert "Invalid type name '7x-new-marking':" in str(excinfo.value)
def test_register_duplicate_marking():
with pytest.raises(DuplicateRegistrationError) as excinfo:
@stix2.v21.CustomMarking(
'x-new-obj', [
('property1', stix2.properties.StringProperty(required=True)),
],
)
class NewObj2():
pass
assert "cannot be registered again" in str(excinfo.value)
# Custom Objects
@stix2.v21.CustomObject(
'x-new-type', [
('property1', stix2.properties.StringProperty(required=True)),
('property2', stix2.properties.IntegerProperty()),
],
)
class NewType(object):
def __init__(self, property2=None, **kwargs):
if property2 and property2 < 10:
raise ValueError("'property2' is too small.")
if "property3" in kwargs and not isinstance(kwargs.get("property3"), int):
raise TypeError("Must be integer!")
def test_custom_object_raises_exception():
with pytest.raises(TypeError) as excinfo:
NewType(property1='something', property3='something', allow_custom=True)
assert str(excinfo.value) == "Must be integer!"
def test_custom_object_type():
nt = NewType(property1='something')
assert nt.property1 == 'something'
with pytest.raises(stix2.exceptions.MissingPropertiesError) as excinfo:
NewType(property2=42)
assert "No values for required properties" in str(excinfo.value)
with pytest.raises(ValueError) as excinfo:
NewType(property1='something', property2=4)
assert "'property2' is too small." in str(excinfo.value)
def test_custom_object_no_init_1():
@stix2.v21.CustomObject(
'x-new-obj', [
('property1', stix2.properties.StringProperty(required=True)),
],
)
class NewObj():
pass
no = NewObj(property1='something')
assert no.property1 == 'something'
def test_custom_object_no_init_2():
@stix2.v21.CustomObject(
'x-new-obj2', [
('property1', stix2.properties.StringProperty(required=True)),
],
)
class NewObj2(object):
pass
no2 = NewObj2(property1='something')
assert no2.property1 == 'something'
def test_custom_object_invalid_type_name():
with pytest.raises(ValueError) as excinfo:
@stix2.v21.CustomObject(
'x', [
('property1', stix2.properties.StringProperty(required=True)),
],
)
class NewObj(object):
pass # pragma: no cover
assert "Invalid type name 'x': " in str(excinfo.value)
with pytest.raises(ValueError) as excinfo:
@stix2.v21.CustomObject(
'x_new_object', [
('property1', stix2.properties.StringProperty(required=True)),
],
)
class NewObj2(object):
pass # pragma: no cover
assert "Invalid type name 'x_new_object':" in str(excinfo.value)
with pytest.raises(ValueError) as excinfo:
@stix2.v21.CustomObject(
'7x-new-object', [
('property1', stix2.properties.StringProperty(required=True)),
],
)
class NewObj3(object):
pass # pragma: no cover
assert "Invalid type name '7x-new-object':" in str(excinfo.value)
def test_custom_object_ref_property_containing_identifier():
@stix2.v21.CustomObject(
'x-new-obj-with-ref', [
('property_ref', stix2.properties.ReferenceProperty(invalid_types=[])),
],
)
class NewObs():
pass
def test_custom_object_refs_property_containing_identifiers():
@stix2.v21.CustomObject(
'x-new-obj-with-refs', [
('property_refs', stix2.properties.ListProperty(stix2.properties.ReferenceProperty(invalid_types=[]))),
],
)
class NewObs():
pass
def test_custom_object_ref_property_containing_objectref():
with pytest.raises(ValueError, match=r"not a subclass of 'ReferenceProperty"):
@stix2.v21.CustomObject(
'x-new-obj-with-objref', [
('property_ref', stix2.properties.ObjectReferenceProperty()),
],
)
class NewObs():
pass
def test_custom_object_refs_property_containing_objectrefs():
with pytest.raises(ValueError, match=r"not a 'ListProperty' containing a subclass of 'ReferenceProperty"):
@stix2.v21.CustomObject(
'x-new-obj-with-objrefs', [
('property_refs', stix2.properties.ListProperty(stix2.properties.ObjectReferenceProperty())),
],
)
class NewObs():
pass
def test_custom_object_invalid_ref_property():
with pytest.raises(ValueError) as excinfo:
@stix2.v21.CustomObject(
'x-new-obj', [
('property_ref', stix2.properties.StringProperty()),
],
)
class NewObs():
pass
assert "is named like a reference property but is not" in str(excinfo.value)
def test_custom_object_invalid_refs_property():
with pytest.raises(ValueError) as excinfo:
@stix2.v21.CustomObject(
'x-new-obj', [
('property_refs', stix2.properties.StringProperty()),
],
)
class NewObs():
pass
assert "is named like a reference list property but is not" in str(excinfo.value)
def test_custom_object_invalid_refs_list_property():
with pytest.raises(ValueError) as excinfo:
@stix2.v21.CustomObject(
'x-new-obj', [
('property_refs', stix2.properties.ListProperty(stix2.properties.StringProperty)),
],
)
class NewObs():
pass
assert "is named like a reference list property but is not" in str(excinfo.value)
def test_custom_subobject_dict():
obj_dict = {
"type": "bundle",
"id": "bundle--78d99c4a-4eda-4c59-b264-60807f05d799",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"name": "alice",
"identity_class": "individual",
"x_foo": 123,
},
],
}
obj = stix2.parse(obj_dict, allow_custom=True)
assert obj["objects"][0]["x_foo"] == 123
assert obj.has_custom
with pytest.raises(InvalidValueError):
stix2.parse(obj_dict, allow_custom=False)
def test_custom_subobject_obj():
ident = stix2.v21.Identity(
name="alice", identity_class=123, x_foo=123, allow_custom=True,
)
obj_dict = {
"type": "bundle",
"id": "bundle--78d99c4a-4eda-4c59-b264-60807f05d799",
"objects": [ident],
}
obj = stix2.parse(obj_dict, allow_custom=True)
assert obj["objects"][0]["x_foo"] == 123
assert obj.has_custom
with pytest.raises(InvalidValueError):
stix2.parse(obj_dict, allow_custom=False)
def test_parse_custom_object_type():
nt_string = """{
"type": "x-new-type",
"created": "2015-12-21T19:59:11Z",
"property1": "something"
}"""
nt = stix2.parse(nt_string, allow_custom=True)
assert nt["property1"] == 'something'
def test_parse_unregistered_custom_object_type():
nt_string = """{
"type": "x-foobar-observable",
"created": "2015-12-21T19:59:11Z",
"property1": "something"
}"""
with pytest.raises(stix2.exceptions.ParseError) as excinfo:
stix2.parse(nt_string, version="2.1")
assert "Can't parse unknown object type" in str(excinfo.value)
assert "use the CustomObject decorator." in str(excinfo.value)
def test_parse_unregistered_custom_object_type_w_allow_custom():
"""parse an unknown custom object, allowed by passing
'allow_custom' flag
"""
nt_string = """{
"type": "x-foobar-observable",
"created": "2015-12-21T19:59:11Z",
"property1": "something"
}"""
custom_obj = stix2.parse(nt_string, version="2.1", allow_custom=True)
assert custom_obj["type"] == "x-foobar-observable"
# Custom SCOs
@stix2.v21.CustomObservable(
'x-new-observable', [
('property1', stix2.properties.StringProperty(required=True)),
('property2', stix2.properties.IntegerProperty()),
('x_property3', stix2.properties.BooleanProperty()),
],
)
class NewObservable():
def __init__(self, property2=None, **kwargs):
if property2 and property2 < 10:
raise ValueError("'property2' is too small.")
if "property3" in kwargs and not isinstance(kwargs.get("property3"), int):
raise TypeError("Must be integer!")
def test_custom_observable_object_1():
no = NewObservable(property1='something')
assert no.property1 == 'something'
def test_custom_observable_object_2():
with pytest.raises(stix2.exceptions.MissingPropertiesError) as excinfo:
NewObservable(property2=42)
assert excinfo.value.properties == ['property1']
assert "No values for required properties" in str(excinfo.value)
def test_custom_observable_object_3():
with pytest.raises(ValueError) as excinfo:
NewObservable(property1='something', property2=4)
assert "'property2' is too small." in str(excinfo.value)
def test_custom_observable_raises_exception():
with pytest.raises(TypeError) as excinfo:
NewObservable(property1='something', property3='something', allow_custom=True)
assert str(excinfo.value) == "Must be integer!"
def test_custom_observable_object_no_init_1():
@stix2.v21.CustomObservable(
'x-new-observable-2', [
('property1', stix2.properties.StringProperty()),
],
)
class NewObs():
pass
no = NewObs(property1='something')
assert no.property1 == 'something'
def test_custom_observable_object_no_init_2():
@stix2.v21.CustomObservable(
'x-new-obs2', [
('property1', stix2.properties.StringProperty()),
],
)
class NewObs2(object):
pass
no2 = NewObs2(property1='something')
assert no2.property1 == 'something'
def test_invalid_custom_property_in_custom_observable_object():
with pytest.raises(ValueError) as excinfo:
@stix2.v21.CustomObservable(
'x-new-sco', [
('5property1', stix2.properties.StringProperty()),
],
)
class NewObs(object):
pass # pragma: no cover
assert "must begin with an alpha character." in str(excinfo.value)
def test_custom_observable_object_invalid_type_name():
with pytest.raises(ValueError) as excinfo:
@stix2.v21.CustomObservable(
'x', [
('property1', stix2.properties.StringProperty()),
],
)
class NewObs(object):
pass # pragma: no cover
assert "Invalid type name 'x':" in str(excinfo.value)
with pytest.raises(ValueError) as excinfo:
@stix2.v21.CustomObservable(
'x_new_obs', [
('property1', stix2.properties.StringProperty()),
],
)
class NewObs2(object):
pass # pragma: no cover
assert "Invalid type name 'x_new_obs':" in str(excinfo.value)
with pytest.raises(ValueError) as excinfo:
@stix2.v21.CustomObservable(
'7x-new-obs', [
('property1', stix2.properties.StringProperty()),
],
)
class NewObs3(object):
pass # pragma: no cover
assert "Invalid type name '7x-new-obs':" in str(excinfo.value)
def test_custom_observable_object_ref_property_as_identifier():
@stix2.v21.CustomObservable(
'x-new-obs-with-ref', [
('property_ref', stix2.properties.ReferenceProperty(invalid_types=[])),
],
)
class NewObs():
pass
def test_custom_observable_object_refs_property_containing_identifiers():
@stix2.v21.CustomObservable(
'x-new-obs-with-refs', [
('property_refs', stix2.properties.ListProperty(stix2.properties.ReferenceProperty(invalid_types=[]))),
],
)
class NewObs():
pass
def test_custom_observable_object_ref_property_as_objectref():
with pytest.raises(ValueError, match=r"not a subclass of 'ReferenceProperty"):
@stix2.v21.CustomObservable(
'x-new-obs-with-objref', [
('property_ref', stix2.properties.ObjectReferenceProperty()),
],
)
class NewObs():
pass
def test_custom_observable_object_refs_property_containing_objectrefs():
with pytest.raises(ValueError, match=r"not a 'ListProperty' containing a subclass of 'ReferenceProperty"):
@stix2.v21.CustomObservable(
'x-new-obs-with-objrefs', [
('property_refs', stix2.properties.ListProperty(stix2.properties.ObjectReferenceProperty())),
],
)
class NewObs():
pass
def test_custom_observable_object_invalid_ref_property():
with pytest.raises(ValueError) as excinfo:
@stix2.v21.CustomObservable(
'x-new-obs', [
('property_ref', stix2.properties.StringProperty()),
],
)
class NewObs():
pass
assert "is named like a reference property but is not" in str(excinfo.value)
def test_custom_observable_object_invalid_refs_property():
with pytest.raises(ValueError) as excinfo:
@stix2.v21.CustomObservable(
'x-new-obs', [
('property_refs', stix2.properties.StringProperty()),
],
)
class NewObs():
pass
assert "is named like a reference list property but is not" in str(excinfo.value)
def test_custom_observable_object_invalid_refs_list_property():
with pytest.raises(ValueError) as excinfo:
@stix2.v21.CustomObservable(
'x-new-obs', [
('property_refs', stix2.properties.ListProperty(stix2.properties.StringProperty)),
],
)
class NewObs():
pass
assert "is named like a reference list property but is not" in str(excinfo.value)
def test_custom_no_properties_raises_exception():
with pytest.raises(TypeError):
@stix2.v21.CustomObject('x-new-object-type')
class NewObject1(object):
pass
def test_custom_wrong_properties_arg_raises_exception():
with pytest.raises(ValueError):
@stix2.v21.CustomObservable('x-new-object-type', (("prop", stix2.properties.BooleanProperty())))
class NewObject2(object):
pass
def test_parse_custom_observable_object():
nt_string = """{
"type": "x-new-observable",
"property1": "something"
}"""
nt = stix2.parse(nt_string, [], version='2.1')
assert isinstance(nt, stix2.base._STIXBase)
assert nt.property1 == 'something'
def test_parse_unregistered_custom_observable_object():
nt_string = """{
"type": "x-foobar-observable",
"property1": "something"
}"""
with pytest.raises(stix2.exceptions.ParseError) as excinfo:
stix2.parse(nt_string, version='2.1')
assert "Can't parse unknown object type" in str(excinfo.value)
parsed_custom = stix2.parse(nt_string, allow_custom=True, version='2.1')
assert parsed_custom['property1'] == 'something'
with pytest.raises(AttributeError) as excinfo:
assert parsed_custom.property1 == 'something'
assert not isinstance(parsed_custom, stix2.base._STIXBase)
def test_parse_unregistered_custom_observable_object_with_no_type():
nt_string = """{
"property1": "something"
}"""
with pytest.raises(stix2.exceptions.ParseError) as excinfo:
stix2.parse(nt_string, allow_custom=True, version='2.1')
assert "Can't parse object with no 'type' property" in str(excinfo.value)
def test_parse_observed_data_with_custom_observable():
input_str = """{
"type": "observed-data",
"id": "observed-data--dc20c4ca-a2a3-4090-a5d5-9558c3af4758",
"created": "2016-04-06T19:58:16.000Z",
"modified": "2016-04-06T19:58:16.000Z",
"first_observed": "2015-12-21T19:00:00Z",
"last_observed": "2015-12-21T19:00:00Z",
"number_observed": 1,
"objects": {
"0": {
"type": "x-foobar-observable",
"property1": "something"
}
}
}"""
parsed = stix2.parse(input_str, version="2.1", allow_custom=True)
assert parsed.objects['0']['property1'] == 'something'
def test_parse_invalid_custom_observable_object():
nt_string = """{
"property1": "something"
}"""
with pytest.raises(stix2.exceptions.ParseError) as excinfo:
stix2.parse(nt_string, version='2.1')
assert "Can't parse object with no 'type' property" in str(excinfo.value)
def test_observable_custom_property():
with pytest.raises(ValueError) as excinfo:
NewObservable(
property1='something',
custom_properties="foobar",
)
assert "'custom_properties' must be a dictionary" in str(excinfo.value)
no = NewObservable(
property1='something',
custom_properties={
"foo": "bar",
},
)
assert no.foo == "bar"
def test_observable_custom_property_invalid():
with pytest.raises(stix2.exceptions.ExtraPropertiesError) as excinfo:
NewObservable(
property1='something',
x_foo="bar",
)
assert excinfo.value.properties == ['x_foo']
assert "Unexpected properties for" in str(excinfo.value)
def test_observable_custom_property_allowed():
no = NewObservable(
property1='something',
x_foo="bar",
allow_custom=True,
)
assert no.x_foo == "bar"
def test_observed_data_with_custom_observable_object():
no = NewObservable(property1='something')
ob_data = stix2.v21.ObservedData(
first_observed=FAKE_TIME,
last_observed=FAKE_TIME,
number_observed=1,
objects={'0': no},
allow_custom=True,
)
assert ob_data.objects['0'].property1 == 'something'
def test_custom_observable_object_det_id_1():
@stix2.v21.CustomObservable(
'x-det-id-observable-1', [
('property1', stix2.properties.StringProperty(required=True)),
('property2', stix2.properties.IntegerProperty()),
], [
'property1',
],
)
class DetIdObs1():
pass
dio_1 = DetIdObs1(property1='I am property1!', property2=42)
dio_2 = DetIdObs1(property1='I am property1!', property2=24)
assert dio_1.property1 == dio_2.property1 == 'I am property1!'
assert dio_1.id == dio_2.id
uuid_obj = uuid.UUID(dio_1.id[-36:])
assert uuid_obj.variant == uuid.RFC_4122
assert uuid_obj.version == 5
dio_3 = DetIdObs1(property1='I am property1!', property2=42)
dio_4 = DetIdObs1(property1='I am also property1!', property2=24)
assert dio_3.property1 == 'I am property1!'
assert dio_4.property1 == 'I am also property1!'
assert dio_3.id != dio_4.id
def test_custom_observable_object_det_id_2():
@stix2.v21.CustomObservable(
'x-det-id-observable-2', [
('property1', stix2.properties.StringProperty(required=True)),
('property2', stix2.properties.IntegerProperty()),
], [
'property1', 'property2',
],
)
class DetIdObs2():
pass
dio_1 = DetIdObs2(property1='I am property1!', property2=42)
dio_2 = DetIdObs2(property1='I am property1!', property2=42)
assert dio_1.property1 == dio_2.property1 == 'I am property1!'
assert dio_1.property2 == dio_2.property2 == 42
assert dio_1.id == dio_2.id
dio_3 = DetIdObs2(property1='I am property1!', property2=42)
dio_4 = DetIdObs2(property1='I am also property1!', property2=42)
assert dio_3.property1 == 'I am property1!'
assert dio_4.property1 == 'I am also property1!'
assert dio_3.property2 == dio_4.property2 == 42
assert dio_3.id != dio_4.id
def test_custom_observable_object_no_id_contrib_props():
@stix2.v21.CustomObservable(
'x-det-id-observable-3', [
('property1', stix2.properties.StringProperty(required=True)),
],
)
class DetIdObs3():
pass
dio = DetIdObs3(property1="I am property1!")
uuid_obj = uuid.UUID(dio.id[-36:])
assert uuid_obj.variant == uuid.RFC_4122
assert uuid_obj.version == 4
# Custom Extensions
@stix2.v21.CustomExtension(
'x-new-ext', [
('property1', stix2.properties.StringProperty(required=True)),
('property2', stix2.properties.IntegerProperty()),
],
)
class NewExtension():
def __init__(self, property2=None, **kwargs):
if property2 and property2 < 10:
raise ValueError("'property2' is too small.")
if "property3" in kwargs and not isinstance(kwargs.get("property3"), int):
raise TypeError("Must be integer!")
def test_custom_extension_raises_exception():
with pytest.raises(TypeError) as excinfo:
NewExtension(property1='something', property3='something', allow_custom=True)
assert str(excinfo.value) == "Must be integer!"
def test_custom_extension():
ext = NewExtension(property1='something')
assert ext.property1 == 'something'
with pytest.raises(stix2.exceptions.MissingPropertiesError) as excinfo:
NewExtension(property2=42)
assert excinfo.value.properties == ['property1']
assert str(excinfo.value) == "No values for required properties for NewExtension: (property1)."
with pytest.raises(ValueError) as excinfo:
NewExtension(property1='something', property2=4)
assert str(excinfo.value) == "'property2' is too small."
def test_custom_extension_wrong_observable_type():
# NewExtension is an extension of DomainName, not File
ext = NewExtension(property1='something')
with pytest.raises(InvalidValueError) as excinfo:
stix2.v21.File(
name="abc.txt",
extensions={
"ntfs-ext": ext,
},
)
assert "Can't create extension 'ntfs-ext'" in excinfo.value.reason
@pytest.mark.parametrize(
"data", [
"""{
"keys": [
{
"test123": 123,
"test345": "aaaa"
}
]
}""",
],
)
def test_custom_extension_with_list_and_dict_properties_observable_type(data):
@stix2.v21.CustomExtension(
'x-some-extension-ext', [
('keys', stix2.properties.ListProperty(stix2.properties.DictionaryProperty, required=True)),
],
)
class SomeCustomExtension:
pass
example = SomeCustomExtension(keys=[{'test123': 123, 'test345': 'aaaa'}])
assert data == example.serialize(pretty=True)
def test_custom_extension_invalid_type_name():
with pytest.raises(ValueError) as excinfo:
@stix2.v21.CustomExtension(
'x', {
'property1': stix2.properties.StringProperty(required=True),
},
)
class FooExtension():
pass # pragma: no cover
assert "Invalid type name 'x':" in str(excinfo.value)
with pytest.raises(ValueError) as excinfo:
@stix2.v21.CustomExtension(
'x_new_ext', {
'property1': stix2.properties.StringProperty(required=True),
},
)
class BlaExtension():
pass # pragma: no cover
assert "Invalid type name 'x_new_ext':" in str(excinfo.value)
with pytest.raises(ValueError) as excinfo:
@stix2.v21.CustomExtension(
'7x-new-ext', {
'property1': stix2.properties.StringProperty(required=True),
},
)
class Bla2Extension():
pass # pragma: no cover
assert "Invalid type name '7x-new-ext':" in str(excinfo.value)
def test_custom_extension_no_properties():
with pytest.raises(ValueError):
@stix2.v21.CustomExtension('x-new2-ext', None)
class BarExtension():
pass
def test_custom_extension_empty_properties():
with pytest.raises(ValueError):
@stix2.v21.CustomExtension('x-new2-ext', [])
class BarExtension():
pass
def test_custom_extension_dict_properties():
with pytest.raises(ValueError):
@stix2.v21.CustomExtension('x-new2-ext', {})
class BarExtension():
pass
def test_custom_extension_no_init_1():
@stix2.v21.CustomExtension(
'x-new-extension-ext', [
('property1', stix2.properties.StringProperty(required=True)),
],
)
class NewExt():
pass
ne = NewExt(property1="foobar")
assert ne.property1 == "foobar"
def test_custom_extension_no_init_2():
@stix2.v21.CustomExtension(
'x-new2-ext', [
('property1', stix2.properties.StringProperty(required=True)),
],
)
class NewExt2(object):
pass
ne2 = NewExt2(property1="foobar")
assert ne2.property1 == "foobar"
def test_invalid_custom_property_in_extension():
with pytest.raises(ValueError) as excinfo:
@stix2.v21.CustomExtension(
'x-new3-ext', [
('6property1', stix2.properties.StringProperty(required=True)),
],
)
class NewExt():
pass
assert "must begin with an alpha character." in str(excinfo.value)
def test_parse_observable_with_custom_extension():
input_str = """{
"type": "domain-name",
"value": "example.com",
"extensions": {
"x-new-ext": {
"property1": "foo",
"property2": 12
}
}
}"""
parsed = stix2.parse(input_str, version='2.1')
assert parsed.extensions['x-new-ext'].property2 == 12
def test_parse_observable_with_custom_extension_property():
input_str = """{
"type": "observed-data",
"spec_version": "2.1",
"first_observed": "1976-09-09T01:50:24.000Z",
"last_observed": "1988-01-18T15:22:10.000Z",
"number_observed": 5,
"objects": {
"0": {
"type": "file",
"spec_version": "2.1",
"name": "cats.png",
"extensions": {
"raster-image-ext": {
"image_height": 1024,
"image_width": 768,
"x-foo": false
}
}
}
}
}"""
parsed = stix2.parse(input_str, version='2.1', allow_custom=True)
assert parsed.has_custom
assert parsed["objects"]["0"]["extensions"]["raster-image-ext"]["x-foo"] is False
with pytest.raises(InvalidValueError):
stix2.parse(input_str, version="2.1", allow_custom=False)
def test_custom_and_spec_extension_mix():
"""
Try to make sure that when allow_custom=True, encountering a custom
extension doesn't result in a completely uncleaned extensions property.
"""
file_obs = stix2.v21.File(
name="my_file.dat",
extensions={
"x-custom1-ext": {
"a": 1,
"b": 2,
},
"ntfs-ext": {
"sid": "S-1-whatever",
},
"x-custom2-ext": {
"z": 99.9,
"y": False,
},
"raster-image-ext": {
"image_height": 1024,
"image_width": 768,
"bits_per_pixel": 32,
},
},
allow_custom=True,
)
assert file_obs.extensions["x-custom1-ext"] == {"a": 1, "b": 2}
assert file_obs.extensions["x-custom2-ext"] == {"y": False, "z": 99.9}
assert file_obs.extensions["ntfs-ext"].sid == "S-1-whatever"
assert file_obs.extensions["raster-image-ext"].image_height == 1024
# Both of these should have been converted to objects, not left as dicts.
assert isinstance(
file_obs.extensions["raster-image-ext"], stix2.v21.RasterImageExt,
)
assert isinstance(
file_obs.extensions["ntfs-ext"], stix2.v21.NTFSExt,
)
@pytest.mark.parametrize(
"data", [
# URL is not in EXT_MAP
"""{
"type": "url",
"value": "example.com",
"extensions": {
"x-foobar-ext": {
"property1": "foo",
"property2": 12
}
}
}""",
# File is in EXT_MAP
"""{
"type": "file",
"name": "foo.txt",
"extensions": {
"x-foobar-ext": {
"property1": "foo",
"property2": 12
}
}
}""",
],
)
def test_parse_observable_with_unregistered_custom_extension(data):
with pytest.raises(InvalidValueError) as excinfo:
stix2.parse(data, version='2.1')
assert "Can't parse unknown extension type" in str(excinfo.value)
parsed_ob = stix2.parse(data, allow_custom=True, version='2.1')
assert parsed_ob['extensions']['x-foobar-ext']['property1'] == 'foo'
assert not isinstance(parsed_ob['extensions']['x-foobar-ext'], stix2.base._STIXBase)
def test_unregistered_new_style_extension():
f_dict = {
"type": "file",
"name": "foo.txt",
"extensions": {
"extension-definition--31adb724-a9a4-44b6-8ec2-fd4b181c9507": {
"extension-type": "property-extension",
"a": 1,
"b": True,
},
},
}
f = stix2.parse(f_dict, allow_custom=False)
assert f.extensions[
"extension-definition--31adb724-a9a4-44b6-8ec2-fd4b181c9507"
]["a"] == 1
assert f.extensions[
"extension-definition--31adb724-a9a4-44b6-8ec2-fd4b181c9507"
]["b"]
assert not f.has_custom
f = stix2.parse(f_dict, allow_custom=True)
assert f.extensions[
"extension-definition--31adb724-a9a4-44b6-8ec2-fd4b181c9507"
]["a"] == 1
assert f.extensions[
"extension-definition--31adb724-a9a4-44b6-8ec2-fd4b181c9507"
]["b"]
assert not f.has_custom
def test_register_custom_object():
# Not the way to register custom object.
class CustomObject2(object):
_type = 'awesome-object'
with pytest.raises(ValueError) as excinfo:
stix2.registration._register_object(CustomObject2, version="2.1")
assert '@CustomObject decorator' in str(excinfo)
def test_extension_property_location():
assert 'extensions' in stix2.v21.OBJ_MAP_OBSERVABLE['x-new-observable']._properties
assert 'extensions' not in stix2.v21.EXT_MAP['x-new-ext']._properties
@pytest.mark.parametrize(
"data", [
"""{
"type": "x-example",
"spec_version": "2.1",
"id": "x-example--336d8a9f-91f1-46c5-b142-6441bb9f8b8d",
"created": "2018-06-12T16:20:58.059Z",
"modified": "2018-06-12T16:20:58.059Z",
"dictionary": {
"key": {
"key_a": "value",
"key_b": "value"
}
}
}""",
],
)
def test_custom_object_nested_dictionary(data):
@stix2.v21.CustomObject(
'x-example', [
('dictionary', stix2.properties.DictionaryProperty()),
],
)
class Example(object):
def __init__(self, **kwargs):
pass
example = Example(
id='x-example--336d8a9f-91f1-46c5-b142-6441bb9f8b8d',
created='2018-06-12T16:20:58.059Z',
modified='2018-06-12T16:20:58.059Z',
dictionary={'key': {'key_b': 'value', 'key_a': 'value'}},
)
assert data == example.serialize(pretty=True)
@stix2.v21.CustomObject(
'x-new-type-2', [
('property1', stix2.properties.StringProperty()),
('property2', stix2.properties.IntegerProperty()),
],
)
class NewType3(object):
pass
def test_register_custom_object_with_version():
custom_obj_1 = {
"type": "x-new-type-2",
"id": "x-new-type-2--00000000-0000-4000-8000-000000000007",
"spec_version": "2.1",
}
cust_obj_1 = stix2.parsing.dict_to_stix2(custom_obj_1, version='2.1')
assert cust_obj_1.type in stix2.registry.STIX2_OBJ_MAPS['2.1']['objects']
assert cust_obj_1.spec_version == "2.1"
def test_register_duplicate_object_with_version():
with pytest.raises(DuplicateRegistrationError) as excinfo:
@stix2.v21.CustomObject(
'x-new-type-2', [
('property1', stix2.properties.StringProperty()),
('property2', stix2.properties.IntegerProperty()),
],
)
class NewType2(object):
pass
assert "cannot be registered again" in str(excinfo.value)
@stix2.v21.CustomObservable(
'x-new-observable-3', [
('property1', stix2.properties.StringProperty()),
],
)
class NewObservable3(object):
pass
def test_register_observable():
custom_obs = NewObservable3(property1="Test Observable")
assert custom_obs.type in stix2.registry.STIX2_OBJ_MAPS['2.1']['observables']
def test_register_duplicate_observable():
with pytest.raises(DuplicateRegistrationError) as excinfo:
@stix2.v21.CustomObservable(
'x-new-observable-2', [
('property1', stix2.properties.StringProperty()),
],
)
class NewObservable2(object):
pass
assert "cannot be registered again" in str(excinfo.value)
def test_register_observable_custom_extension():
@stix2.v21.CustomExtension(
'x-new-2-ext', [
('property1', stix2.properties.StringProperty(required=True)),
('property2', stix2.properties.IntegerProperty()),
],
)
class NewExtension2():
pass
example = NewExtension2(property1="Hi there")
assert 'domain-name' in stix2.registry.STIX2_OBJ_MAPS['2.1']['observables']
assert example._type in stix2.registry.STIX2_OBJ_MAPS['2.1']['extensions']
def test_register_duplicate_observable_extension():
with pytest.raises(DuplicateRegistrationError) as excinfo:
@stix2.v21.CustomExtension(
'x-new-2-ext', [
('property1', stix2.properties.StringProperty(required=True)),
('property2', stix2.properties.IntegerProperty()),
],
)
class NewExtension2():
pass
assert "cannot be registered again" in str(excinfo.value)
def test_unregistered_top_level_extension_passes_with_allow_custom_false():
indicator = stix2.v21.Indicator(
id='indicator--e97bfccf-8970-4a3c-9cd1-5b5b97ed5d0c',
created='2014-02-20T09:16:08.989000Z',
modified='2014-02-20T09:16:08.989000Z',
name='File hash for Poison Ivy variant',
description='This file hash indicates that a sample of Poison Ivy is present.',
labels=[
'malicious-activity',
],
rank=5,
toxicity=8,
pattern='[file:hashes.\'SHA-256\' = \'ef537f25c895bfa782526529a9b63d97aa631564d5d789c2b765448c8635fb6c\']',
pattern_type='stix',
valid_from='2014-02-20T09:00:00.000000Z',
extensions={
'extension-definition--d83fce45-ef58-4c6c-a3f4-1fbc32e98c6e': {
'extension_type': 'toplevel-property-extension',
},
},
allow_custom=False,
)
assert indicator.rank == 5
assert indicator.toxicity == 8
assert indicator.extensions['extension-definition--d83fce45-ef58-4c6c-a3f4-1fbc32e98c6e']['extension_type'] == 'toplevel-property-extension'
assert isinstance(indicator.extensions['extension-definition--d83fce45-ef58-4c6c-a3f4-1fbc32e98c6e'], dict)
def test_unregistered_embedded_extension_passes_with_allow_custom_false():
indicator = stix2.v21.Indicator(
id='indicator--e97bfccf-8970-4a3c-9cd1-5b5b97ed5d0c',
created='2014-02-20T09:16:08.989000Z',
modified='2014-02-20T09:16:08.989000Z',
name='File hash for Poison Ivy variant',
description='This file hash indicates that a sample of Poison Ivy is present.',
labels=[
'malicious-activity',
],
pattern='[file:hashes.\'SHA-256\' = \'ef537f25c895bfa782526529a9b63d97aa631564d5d789c2b765448c8635fb6c\']',
pattern_type='stix',
valid_from='2014-02-20T09:00:00.000000Z',
extensions={
'extension-definition--d83fce45-ef58-4c6c-a3f4-1fbc32e98c6e': {
'extension_type': 'property-extension',
'rank': 5,
'toxicity': 8,
},
},
allow_custom=False,
)
assert indicator.extensions['extension-definition--d83fce45-ef58-4c6c-a3f4-1fbc32e98c6e']['rank'] == 5
assert indicator.extensions['extension-definition--d83fce45-ef58-4c6c-a3f4-1fbc32e98c6e']['toxicity'] == 8
assert indicator.extensions['extension-definition--d83fce45-ef58-4c6c-a3f4-1fbc32e98c6e']['extension_type'] == 'property-extension'
assert isinstance(indicator.extensions['extension-definition--d83fce45-ef58-4c6c-a3f4-1fbc32e98c6e'], dict)
def test_registered_top_level_extension_passes_with_allow_custom_false():
@stix2.v21.CustomExtension(
'extension-definition--d83fce45-ef58-4c6c-a3f4-1fbc32e98c6e', [
('rank', stix2.properties.IntegerProperty(required=True)),
('toxicity', stix2.properties.IntegerProperty(required=True)),
],
)
class ExtensionFoo1:
extension_type = 'toplevel-property-extension'
indicator = stix2.v21.Indicator(
id='indicator--e97bfccf-8970-4a3c-9cd1-5b5b97ed5d0c',
created='2014-02-20T09:16:08.989000Z',
modified='2014-02-20T09:16:08.989000Z',
name='File hash for Poison Ivy variant',
description='This file hash indicates that a sample of Poison Ivy is present.',
labels=[
'malicious-activity',
],
rank=5,
toxicity=8,
pattern='[file:hashes.\'SHA-256\' = \'ef537f25c895bfa782526529a9b63d97aa631564d5d789c2b765448c8635fb6c\']',
pattern_type='stix',
valid_from='2014-02-20T09:00:00.000000Z',
extensions={
'extension-definition--d83fce45-ef58-4c6c-a3f4-1fbc32e98c6e': {
'extension_type': 'toplevel-property-extension',
},
},
allow_custom=False,
)
assert indicator.rank == 5
assert indicator.toxicity == 8
assert indicator.extensions['extension-definition--d83fce45-ef58-4c6c-a3f4-1fbc32e98c6e']['extension_type'] == 'toplevel-property-extension'
assert isinstance(indicator.extensions['extension-definition--d83fce45-ef58-4c6c-a3f4-1fbc32e98c6e'], ExtensionFoo1)
def test_registered_embedded_extension_passes_with_allow_custom_false():
@stix2.v21.CustomExtension(
'extension-definition--d83fce45-ef58-4c6c-a3ff-1fbc32e98c6e', [
('rank', stix2.properties.IntegerProperty(required=True)),
('toxicity', stix2.properties.IntegerProperty(required=True)),
],
)
class ExtensionFoo1:
extension_type = "property-extension"
indicator = stix2.v21.Indicator(
id='indicator--e97bfccf-8970-4a3c-9cd1-5b5b97ed5d0c',
created='2014-02-20T09:16:08.989000Z',
modified='2014-02-20T09:16:08.989000Z',
name='File hash for Poison Ivy variant',
description='This file hash indicates that a sample of Poison Ivy is present.',
labels=[
'malicious-activity',
],
pattern='[file:hashes.\'SHA-256\' = \'ef537f25c895bfa782526529a9b63d97aa631564d5d789c2b765448c8635fb6c\']',
pattern_type='stix',
valid_from='2014-02-20T09:00:00.000000Z',
extensions={
'extension-definition--d83fce45-ef58-4c6c-a3ff-1fbc32e98c6e': {
'extension_type': 'property-extension',
'rank': 5,
'toxicity': 8,
},
},
allow_custom=False,
)
assert indicator.extensions['extension-definition--d83fce45-ef58-4c6c-a3ff-1fbc32e98c6e']['rank'] == 5
assert indicator.extensions['extension-definition--d83fce45-ef58-4c6c-a3ff-1fbc32e98c6e']['toxicity'] == 8
assert indicator.extensions['extension-definition--d83fce45-ef58-4c6c-a3ff-1fbc32e98c6e']['extension_type'] == 'property-extension'
assert isinstance(indicator.extensions['extension-definition--d83fce45-ef58-4c6c-a3ff-1fbc32e98c6e'], ExtensionFoo1)
def test_registered_new_extension_sdo_allow_custom_false():
@stix2.v21.CustomObject(
'my-favorite-sdo', [
('name', stix2.properties.StringProperty(required=True)),
('some_property_name1', stix2.properties.StringProperty(required=True)),
('some_property_name2', stix2.properties.StringProperty()),
], 'extension-definition--d83fce45-ef58-4c6c-a3f4-1fbc32e9999',
)
class MyFavSDO:
pass
my_favorite_sdo = {
'type': 'my-favorite-sdo',
'spec_version': '2.1',
'id': 'my-favorite-sdo--c5ba9dba-5ad9-4bbe-9825-df4cb8675774',
'created': '2014-02-20T09:16:08.989000Z',
'modified': '2014-02-20T09:16:08.989000Z',
'name': 'This is the name of my favorite',
'some_property_name1': 'value1',
'some_property_name2': 'value2',
# 'extensions': {
# 'extension-definition--d83fce45-ef58-4c6c-a3f4-1fbc32e9999': ExtensionDefinitiond83fce45ef584c6ca3f41fbc32e98c6e()
# }
}
sdo_object = stix2.parse(my_favorite_sdo)
assert isinstance(sdo_object, MyFavSDO)
assert isinstance(
sdo_object.extensions['extension-definition--d83fce45-ef58-4c6c-a3f4-1fbc32e9999'],
stix2.v21.EXT_MAP['extension-definition--d83fce45-ef58-4c6c-a3f4-1fbc32e9999'],
)
sdo_serialized = sdo_object.serialize()
assert '"extensions": {"extension-definition--d83fce45-ef58-4c6c-a3f4-1fbc32e9999": {"extension_type": "new-sdo"}}' in sdo_serialized
def test_registered_new_extension_sro_allow_custom_false():
@stix2.v21.CustomObject(
'my-favorite-sro', [
('name', stix2.properties.StringProperty(required=True)),
('some_property_name1', stix2.properties.StringProperty(required=True)),
('some_property_name2', stix2.properties.StringProperty()),
], 'extension-definition--e96690a5-dc13-4f27-99dd-0f2188ad74ce', False,
)
class MyFavSRO:
pass
my_favorite_sro = {
'type': 'my-favorite-sro',
'spec_version': '2.1',
'id': 'my-favorite-sro--c5ba9dba-5ad9-4bbe-9825-df4cb8675774',
'created': '2014-02-20T09:16:08.989000Z',
'modified': '2014-02-20T09:16:08.989000Z',
'name': 'This is the name of my favorite',
'some_property_name1': 'value1',
'some_property_name2': 'value2',
# 'extensions': {
# 'extension-definition--e96690a5-dc13-4f27-99dd-0f2188ad74ce': ExtensionDefinitiond83fce45ef584c6ca3f41fbc32e98c6e()
# }
}
sro_object = stix2.parse(my_favorite_sro)
assert isinstance(sro_object, MyFavSRO)
assert isinstance(
sro_object.extensions['extension-definition--e96690a5-dc13-4f27-99dd-0f2188ad74ce'],
stix2.v21.EXT_MAP['extension-definition--e96690a5-dc13-4f27-99dd-0f2188ad74ce'],
)
sdo_serialized = sro_object.serialize()
assert '"extensions": {"extension-definition--e96690a5-dc13-4f27-99dd-0f2188ad74ce": {"extension_type": "new-sro"}}' in sdo_serialized
def test_registered_new_extension_sco_allow_custom_false():
@stix2.v21.CustomObservable(
'my-favorite-sco', [
('name', stix2.properties.StringProperty(required=True)),
('some_network_protocol_field', stix2.properties.StringProperty(required=True)),
], ['name', 'some_network_protocol_field'], 'extension-definition--a932fcc6-e032-177c-126f-cb970a5a1fff',
)
class MyFavSCO:
pass
my_favorite_sco = {
'type': 'my-favorite-sco',
'spec_version': '2.1',
'id': 'my-favorite-sco--f9dbe89c-0030-4a9d-8b78-0dcd0a0de874',
'name': 'This is the name of my favorite SCO',
'some_network_protocol_field': 'value',
# 'extensions': {
# 'extension-definition--a932fcc6-e032-177c-126f-cb970a5a1fff': {
# 'is_extension_so': true
# }
# }
}
sco_object = stix2.parse(my_favorite_sco)
assert isinstance(sco_object, MyFavSCO)
assert isinstance(
sco_object.extensions['extension-definition--a932fcc6-e032-177c-126f-cb970a5a1fff'],
stix2.v21.EXT_MAP['extension-definition--a932fcc6-e032-177c-126f-cb970a5a1fff'],
)
sco_serialized = sco_object.serialize()
assert '"extensions": {"extension-definition--a932fcc6-e032-177c-126f-cb970a5a1fff": {"extension_type": "new-sco"}}' in sco_serialized
def test_registered_new_extension_marking_allow_custom_false():
class MyFavMarking:
extension_type = "property-extension"
props = {
'some_marking_field': stix2.properties.StringProperty(required=True),
}
with _register_extension(MyFavMarking, props) as ext_def_id:
my_favorite_marking = {
'type': 'marking-definition',
'spec_version': '2.1',
'id': 'marking-definition--f9dbe89c-0030-4a9d-8b78-0dcd0a0de874',
'name': 'This is the name of my favorite Marking',
'extensions': {
ext_def_id: {
'extension_type': 'property-extension',
'some_marking_field': 'value',
},
},
}
marking_object = stix2.parse(my_favorite_marking)
assert isinstance(marking_object, stix2.v21.MarkingDefinition)
assert isinstance(
marking_object.extensions[ext_def_id],
stix2.v21.EXT_MAP[ext_def_id],
)
marking_serialized = marking_object.serialize(sort_keys=True)
assert '"extensions": {{"{}": ' \
'{{"extension_type": "property-extension", "some_marking_field": "value"}}}}'.format(ext_def_id) in marking_serialized
def test_custom_marking_toplevel_properties():
class CustomMarking:
extension_type = "toplevel-property-extension"
props = {
"foo": stix2.properties.StringProperty(required=True),
}
with _register_extension(CustomMarking, props) as ext_def_id:
marking_dict = {
"type": "marking-definition",
"spec_version": "2.1",
"foo": "hello",
"extensions": {
ext_def_id: {
"extension_type": "toplevel-property-extension",
},
},
}
marking = stix2.parse(marking_dict)
assert marking.foo == "hello"
def test_nested_ext_prop_meta():
class TestExt:
extension_type = "property-extension"
props = {
"intprop": stix2.properties.IntegerProperty(required=True),
"strprop": stix2.properties.StringProperty(
required=False, default=lambda: "foo",
),
}
with _register_extension(TestExt, props) as ext_def_id:
obj = stix2.v21.Identity(
name="test",
extensions={
ext_def_id: {
"extension_type": "property-extension",
"intprop": "1",
"strprop": 2,
},
},
)
assert obj.extensions[ext_def_id].extension_type == "property-extension"
assert obj.extensions[ext_def_id].intprop == 1
assert obj.extensions[ext_def_id].strprop == "2"
obj = stix2.v21.Identity(
name="test",
extensions={
ext_def_id: {
"extension_type": "property-extension",
"intprop": "1",
},
},
)
# Ensure default kicked in
assert obj.extensions[ext_def_id].strprop == "foo"
with pytest.raises(InvalidValueError):
stix2.v21.Identity(
name="test",
extensions={
ext_def_id: {
"extension_type": "property-extension",
# wrong value type
"intprop": "foo",
},
},
)
with pytest.raises(InvalidValueError):
stix2.v21.Identity(
name="test",
extensions={
ext_def_id: {
"extension_type": "property-extension",
# missing required property
"strprop": "foo",
},
},
)
with pytest.raises(InvalidValueError):
stix2.v21.Identity(
name="test",
extensions={
ext_def_id: {
"extension_type": "property-extension",
"intprop": 1,
# Use of undefined property
"foo": False,
},
},
)
with pytest.raises(InvalidValueError):
stix2.v21.Identity(
name="test",
extensions={
ext_def_id: {
# extension_type doesn't match with registration
"extension_type": "new-sdo",
"intprop": 1,
"strprop": "foo",
},
},
)
def test_toplevel_ext_prop_meta():
class TestExt:
extension_type = "toplevel-property-extension"
props = {
"intprop": stix2.properties.IntegerProperty(required=True),
"strprop": stix2.properties.StringProperty(
required=False, default=lambda: "foo",
),
}
with _register_extension(TestExt, props) as ext_def_id:
obj = stix2.v21.Identity(
name="test",
intprop="1",
strprop=2,
extensions={
ext_def_id: {
"extension_type": "toplevel-property-extension",
},
},
)
assert obj.extensions[ext_def_id].extension_type == "toplevel-property-extension"
assert obj.intprop == 1
assert obj.strprop == "2"
obj = stix2.v21.Identity(
name="test",
intprop=1,
extensions={
ext_def_id: {
"extension_type": "toplevel-property-extension",
},
},
)
# Ensure default kicked in
assert obj.strprop == "foo"
with pytest.raises(InvalidValueError):
stix2.v21.Identity(
name="test",
intprop="foo", # wrong value type
extensions={
ext_def_id: {
"extension_type": "toplevel-property-extension",
},
},
)
with pytest.raises(InvalidValueError):
stix2.v21.Identity(
name="test",
intprop=1,
extensions={
ext_def_id: {
"extension_type": "toplevel-property-extension",
# Use of undefined property
"foo": False,
},
},
)
with pytest.raises(InvalidValueError):
stix2.v21.Identity(
name="test",
intprop=1,
extensions={
ext_def_id: {
"extension_type": "toplevel-property-extension",
# Use of a defined property, but intended for the
# top level. This should still error out.
"strprop": 1,
},
},
)
with pytest.raises(MissingPropertiesError):
stix2.v21.Identity(
name="test",
strprop="foo", # missing required property
extensions={
ext_def_id: {
"extension_type": "toplevel-property-extension",
},
},
)
def test_toplevel_extension_includes_extensions():
"""
Test whether the library allows an extension to enable extension support
itself. :) I.e. a toplevel property extension which adds the "extensions"
property.
"""
class ExtensionsExtension:
extension_type = "toplevel-property-extension"
ext_props = {
"extensions": stix2.properties.ExtensionsProperty(spec_version="2.1"),
}
with _register_extension(ExtensionsExtension, ext_props) as ext_id:
# extension-definition is not defined with an "extensions" property.
obj_dict = {
"type": "extension-definition",
"spec_version": "2.1",
"created_by_ref": "identity--8a1fd5dd-4586-4ded-bd39-04bda62f8415",
"name": "my extension",
"version": "1.2.3",
"schema": "add extension support to an object!",
"extension_types": ["toplevel-property-extension"],
"extensions": {
ext_id: {
"extension_type": "toplevel-property-extension",
},
},
}
stix2.parse(obj_dict)
def test_invalid_extension_prop_name():
with pytest.raises(ValueError):
@stix2.v21.common.CustomExtension(
"extension-definition--0530fdbd-0fa3-42ab-90cf-660e0abad370",
[
("7foo", stix2.properties.StringProperty()),
],
)
class CustomExt:
extension_type = "property-extension"
with pytest.raises(ValueError):
@stix2.v21.common.CustomExtension(
"extension-definition--0530fdbd-0fa3-42ab-90cf-660e0abad370",
[
("7foo", stix2.properties.StringProperty()),
],
)
class CustomExt: # noqa: F811
extension_type = "toplevel-property-extension"
def test_allow_custom_propagation():
obj_dict = {
"type": "bundle",
"objects": [
{
"type": "file",
"spec_version": "2.1",
"name": "data.dat",
"extensions": {
"archive-ext": {
"contains_refs": [
"file--3d4da5f6-31d8-4a66-a172-f31af9bf5238",
"file--4bb16def-cdfc-40d1-b6a4-815de6c60b74",
],
"x_foo": "bar",
},
},
},
],
}
# allow_custom=False at the top level should catch the custom property way
# down in the SCO extension.
with pytest.raises(InvalidValueError):
stix2.parse(obj_dict, allow_custom=False)
cti-python-stix2-3.0.1/stix2/test/v21/test_datastore.py 0000664 0000000 0000000 00000011235 14123351755 0022727 0 ustar 00root root 0000000 0000000 import pytest
from stix2.datastore import (
CompositeDataSource, DataSink, DataSource, DataStoreMixin,
)
from stix2.datastore.filters import Filter
from .constants import CAMPAIGN_MORE_KWARGS
def test_datasource_abstract_class_raises_error():
with pytest.raises(TypeError):
DataSource()
def test_datasink_abstract_class_raises_error():
with pytest.raises(TypeError):
DataSink()
def test_datastore_smoke():
assert DataStoreMixin() is not None
def test_datastore_get_raises():
with pytest.raises(AttributeError) as excinfo:
DataStoreMixin().get("indicator--00000000-0000-4000-8000-000000000001")
assert "DataStoreMixin has no data source to query" == str(excinfo.value)
def test_datastore_all_versions_raises():
with pytest.raises(AttributeError) as excinfo:
DataStoreMixin().all_versions("indicator--00000000-0000-4000-8000-000000000001")
assert "DataStoreMixin has no data source to query" == str(excinfo.value)
def test_datastore_query_raises():
with pytest.raises(AttributeError) as excinfo:
DataStoreMixin().query([Filter("type", "=", "indicator")])
assert "DataStoreMixin has no data source to query" == str(excinfo.value)
def test_datastore_creator_of_raises():
with pytest.raises(AttributeError) as excinfo:
DataStoreMixin().creator_of(CAMPAIGN_MORE_KWARGS)
assert "DataStoreMixin has no data source to query" == str(excinfo.value)
def test_datastore_relationships_raises():
with pytest.raises(AttributeError) as excinfo:
DataStoreMixin().relationships(
obj="indicator--00000000-0000-4000-8000-000000000001",
target_only=True,
)
assert "DataStoreMixin has no data source to query" == str(excinfo.value)
def test_datastore_related_to_raises():
with pytest.raises(AttributeError) as excinfo:
DataStoreMixin().related_to(
obj="indicator--00000000-0000-4000-8000-000000000001",
target_only=True,
)
assert "DataStoreMixin has no data source to query" == str(excinfo.value)
def test_datastore_add_raises():
with pytest.raises(AttributeError) as excinfo:
DataStoreMixin().add(CAMPAIGN_MORE_KWARGS)
assert "DataStoreMixin has no data sink to put objects in" == str(excinfo.value)
def test_composite_datastore_get_raises_error():
with pytest.raises(AttributeError) as excinfo:
CompositeDataSource().get("indicator--00000000-0000-4000-8000-000000000001")
assert "CompositeDataSource has no data sources" == str(excinfo.value)
def test_composite_datastore_all_versions_raises_error():
with pytest.raises(AttributeError) as excinfo:
CompositeDataSource().all_versions("indicator--00000000-0000-4000-8000-000000000001")
assert "CompositeDataSource has no data sources" == str(excinfo.value)
def test_composite_datastore_query_raises_error():
with pytest.raises(AttributeError) as excinfo:
CompositeDataSource().query([Filter("type", "=", "indicator")])
assert "CompositeDataSource has no data sources" == str(excinfo.value)
def test_composite_datastore_relationships_raises_error():
with pytest.raises(AttributeError) as excinfo:
CompositeDataSource().relationships(
obj="indicator--00000000-0000-4000-8000-000000000001",
target_only=True,
)
assert "CompositeDataSource has no data sources" == str(excinfo.value)
def test_composite_datastore_related_to_raises_error():
with pytest.raises(AttributeError) as excinfo:
CompositeDataSource().related_to(
obj="indicator--00000000-0000-4000-8000-000000000001",
target_only=True,
)
assert "CompositeDataSource has no data sources" == str(excinfo.value)
def test_composite_datastore_add_data_source_raises_error():
with pytest.raises(TypeError) as excinfo:
ind = "indicator--00000000-0000-4000-8000-000000000001"
CompositeDataSource().add_data_source(ind)
assert "DataSource (to be added) is not of type stix2.DataSource. DataSource type is '{}'".format(type(ind)) == str(excinfo.value)
def test_composite_datastore_add_data_sources_raises_error():
with pytest.raises(TypeError) as excinfo:
ind = "indicator--00000000-0000-4000-8000-000000000001"
CompositeDataSource().add_data_sources(ind)
assert "DataSource (to be added) is not of type stix2.DataSource. DataSource type is '{}'".format(type(ind)) == str(excinfo.value)
def test_composite_datastore_no_datasource():
cds = CompositeDataSource()
with pytest.raises(AttributeError) as excinfo:
cds.get("indicator--00000000-0000-4000-8000-000000000001")
assert 'CompositeDataSource has no data source' in str(excinfo.value)
cti-python-stix2-3.0.1/stix2/test/v21/test_datastore_composite.py 0000664 0000000 0000000 00000012251 14123351755 0025010 0 ustar 00root root 0000000 0000000 import pytest
from stix2.datastore import CompositeDataSource, make_id
from stix2.datastore.filters import Filter
from stix2.datastore.memory import MemorySink, MemorySource, MemoryStore
from stix2.utils import parse_into_datetime
from stix2.v21.common import TLP_GREEN
def test_add_remove_composite_datasource():
cds = CompositeDataSource()
ds1 = MemorySource()
ds2 = MemorySource()
ds3 = MemorySink()
with pytest.raises(TypeError) as excinfo:
cds.add_data_sources([ds1, ds2, ds1, ds3])
assert str(excinfo.value) == (
"DataSource (to be added) is not of type "
"stix2.DataSource. DataSource type is '