def add_external_or_partner_actor_ttem(item, pkg):
ta = ThreatActor()
ta.identity = CIQIdentity3_0Instance()
identity_spec = STIXCIQIdentity3_0()
country_item = item.get('country')
if not country_item:
error("Required 'country' item is missing in 'actor/external' or 'actor/partner' item")
else:
for c in country_item:
address = Address()
address.country = Country()
address.country.add_name_element(c)
identity_spec.add_address(address)
ta.identity.specification = identity_spec
motive_item = item.get('motive')
if not motive_item:
error("Required 'motive' item is missing in 'actor/external' or 'actor/partner' item")
else:
for m in motive_item:
motivation = Statement()
motivation.value = map_motive_item_to_motivation(m)
ta.add_motivation(motivation)
variety_item = item.get('variety')
if not variety_item:
error("Required 'variety' item is missing in 'actor/external' or 'actor/partner' item")
else:
for v in variety_item:
ta_type = Statement()
ta_type.value = map_actor_variety_item_to_threat_actor_type(v)
ta.add_type(ta_type)
notes_item = item.get('notes')
if notes_item:
ta.description = "Notes: " + escape(notes_item)
pkg.add_threat_actor(ta)
def add_coa_items(corrective_action_item, cost_corrective_action_item, pkg):
coa = CourseOfAction()
if corrective_action_item:
coa.title = corrective_action_item
if cost_corrective_action_item:
cost = Statement()
cost.value = map_cost_corrective_action_item_to_high_medium_low(cost_corrective_action_item)
coa.cost = cost
pkg.coa = coa
def add_internal_actor_item(internal_item, pkg):
ta = ThreatActor()
motive_item = internal_item.get('motive')
if not motive_item:
error("Required 'motive' item is missing in 'actor/internal' item")
else:
for item in motive_item:
motivation = Statement()
motivation.value = map_motive_item_to_motivation(item)
ta.add_motivation(motivation)
# job_change added in 1.3
variety_item = internal_item.get('variety')
if not variety_item:
error("Required 'variety' item is missing in 'actor/internal' item")
else:
for v in variety_item:
ta_type = Statement()
ta_type.value = ThreatActorType(ThreatActorType.TERM_INSIDER_THREAT)
ta_type.description = v
ta.add_type(ta_type)
notes_item = internal_item.get('notes')
if notes_item:
ta.description = "Notes: " + escape(notes_item)
pkg.add_threat_actor(ta)