class CourseOfAction(stix.BaseCoreComponent):
"""Implementation of the STIX Course of Action.
Args:
id_ (optional): An identifier. If ``None``, a value will be generated
via ``mixbox.idgen.create_id()``. If set, this will unset the
``idref`` property.
idref (optional): An identifier reference. If set this will unset the
``id_`` property.
timestamp (optional): A timestamp value. Can be an instance of
``datetime.datetime`` or ``str``.
description: A description of the purpose or intent of this object.
short_description: A short description of the intent
or purpose of this object.
title: The title of this object.
"""
_binding = coa_binding
_binding_class = coa_binding.CourseOfActionType
_namespace = "http://stix.mitre.org/CourseOfAction-1"
_version = "1.2"
_ALL_VERSIONS = ("1.0", "1.0.1", "1.1", "1.1.1", "1.2")
_ID_PREFIX = 'coa'
stage = VocabField("Stage", Stage)
type_ = VocabField("Type", COAType)
objective = fields.TypedField("Objective", Objective)
parameter_observables = fields.TypedField("Parameter_Observables",
Observables)
structured_coa = fields.TypedField("Structured_COA",
type_=_BaseStructuredCOA,
factory=StructuredCOAFactory)
impact = fields.TypedField("Impact", Statement)
cost = fields.TypedField("Cost", Statement)
efficacy = fields.TypedField("Efficacy", Statement)
related_coas = fields.TypedField("Related_COAs", RelatedCOAs)
related_packages = fields.TypedField("Related_Packages",
RelatedPackageRefs)
information_source = fields.TypedField("Information_Source",
InformationSource)
def __init__(self,
id_=None,
idref=None,
timestamp=None,
title=None,
description=None,
short_description=None):
super(CourseOfAction,
self).__init__(id_=id_,
idref=idref,
timestamp=timestamp,
title=title,
description=description,
short_description=short_description)
self.related_coas = RelatedCOAs()
self.related_packages = RelatedPackageRefs()
class IncidentCategories(stix.EntityList):
_namespace = "http://stix.mitre.org/Incident-1"
_binding = incident_binding
_binding_class = _binding.CategoriesType
category = VocabField(name="Category",
type_=vocabs.IncidentCategory,
multiple=True,
key_name="categories")
class Names(stix.EntityList):
_namespace = "http://stix.mitre.org/Campaign-1"
_binding = campaign_binding
_binding_class = campaign_binding.NamesType
name = VocabField("Name", multiple=True, key_name="names")
@classmethod
def _dict_as_list(cls):
return False
class Effects(stix.EntityList):
_namespace = "http://stix.mitre.org/Incident-1"
_binding = incident_binding
_binding_class = _binding.EffectsType
effects = VocabField("Effect",
VocabString,
multiple=True,
key_name="effects")
@classmethod
def _dict_as_list(cls):
return True
def _fix_value(self, value):
return vocabs.IncidentEffect(value=value)
class GenericTestMechanism(_BaseTestMechanism):
_namespace = "http://stix.mitre.org/extensions/TestMechanism#Generic-1"
_binding = generic_tm_binding
_binding_class = _binding.GenericTestMechanismType
_XSI_TYPE = "genericTM:GenericTestMechanismType"
reference_location = fields.TypedField("reference_location")
descriptions = fields.TypedField("Description", StructuredTextList)
specification = fields.TypedField("Specification", EncodedCDATA)
type_ = VocabField("Type")
def __init__(self, id_=None, idref=None):
super(GenericTestMechanism, self).__init__(id_=id_, idref=idref)
self.descriptions = StructuredTextList()
@property
def description(self):
"""A single description about the contents or purpose of this object.
Default Value: ``None``
Note:
If this object has more than one description set, this will return
the description with the lowest ordinality value.
Returns:
An instance of
:class:`.StructuredText`
"""
return next(iter(self.descriptions), None)
@description.setter
def description(self, value):
self.descriptions = StructuredTextList(value)
def add_description(self, description):
"""Adds a description to the ``descriptions`` collection.
This is the same as calling "foo.descriptions.add(bar)".
"""
if self.descriptions is None:
self.descriptions = StructuredTextList()
self.descriptions.add(description)
class Header(stix.Entity):
"""The Report Header.
Args:
handling: The data marking section of the Header.
information_source: The :class:`.InformationSource` section of the
Header.
intents: A collection of :class:`.VocabString` defining the intent
of the parent :class:`.Report`.
description: A description of the intent or purpose of the parent
:class:`.Report`.
short_description: A short description of the intent or purpose of
the parent :class:`.Report`.
title: The title of the :class:`.Report`.
Attributes:
title: The title of the parent :class:`.Report`.
"""
_binding = report_binding
_binding_class = _binding.HeaderType
_namespace = 'http://stix.mitre.org/Report-1'
title = fields.TypedField("Title")
descriptions = fields.TypedField("Description", type_=StructuredTextList)
short_descriptions = fields.TypedField("Short_Description",
type_=StructuredTextList)
intents = VocabField("Intent",
ReportIntent,
multiple=True,
key_name="intents")
handling = fields.TypedField("Handling", Marking)
information_source = fields.TypedField("Information_Source",
InformationSource)
def __init__(self,
title=None,
description=None,
short_description=None,
handling=None,
intents=None,
information_source=None):
super(Header, self).__init__()
self.intents = intents
self.title = title
self.description = StructuredTextList(description)
self.short_description = StructuredTextList(short_description)
self.handling = handling
self.information_source = information_source
@property
def description(self):
"""A single description about the contents or purpose of this object.
Default Value: ``None``
Note:
If this object has more than one description set, this will return
the description with the lowest ordinality value.
Returns:
An instance of
:class:`.StructuredText`
"""
return next(iter(self.descriptions or []), None)
@description.setter
def description(self, value):
self.descriptions = value
def add_description(self, description):
"""Adds a description to the ``descriptions`` collection.
This is the same as calling "foo.descriptions.add(bar)".
"""
self.descriptions.add(description)
@property
def short_description(self):
"""A single short description about the contents or purpose of this
object.
Default Value: ``None``
Note:
If this object has more than one short description set, this will
return the description with the lowest ordinality value.
Returns:
An instance of :class:`.StructuredText`
"""
return next(iter(self.short_descriptions or []), None)
@short_description.setter
def short_description(self, value):
self.short_descriptions = value
def add_short_description(self, description):
"""Adds a description to the ``short_descriptions`` collection.
This is the same as calling "foo.short_descriptions.add(bar)".
"""
self.short_descriptions.add(description)
def add_intent(self, intent):
"""Adds :class:`.VocabString` object to the :attr:`intents`
collection.
If the input is not an instance of :class:`.VocabString`, an effort
will be made to convert it into an instance of :class:`.ReportIntent`.
"""
self.intents.append(intent)
class Indicator(stix.BaseCoreComponent):
"""Implementation of the STIX Indicator.
Args:
id_ (optional): An identifier. If ``None``, a value will be generated
via ``mixbox.idgen.create_id()``. If set, this will unset the
``idref`` property.
idref (optional): An identifier reference. If set this will unset the
``id_`` property.
title (optional): A string title.
timestamp (optional): A timestamp value. Can be an instance of
``datetime.datetime`` or ``str``.
description (optional): A string description.
short_description (optional): A string short description.
"""
_binding = indicator_binding
_binding_class = indicator_binding.IndicatorType
_namespace = 'http://stix.mitre.org/Indicator-2'
_version = "2.2"
_ALL_VERSIONS = ("2.0", "2.0.1", "2.1", "2.1.1", "2.2")
_ALLOWED_COMPOSITION_OPERATORS = ('AND', 'OR')
_ID_PREFIX = "indicator"
_try_cast = False
producer = fields.TypedField("Producer", InformationSource)
observable = fields.TypedField("Observable", Observable)
indicator_types = VocabField("Type",
IndicatorType,
multiple=True,
key_name="indicator_types")
confidence = fields.TypedField("Confidence", Confidence)
indicated_ttps = fields.TypedField("Indicated_TTP",
RelatedTTP,
multiple=True,
key_name="indicated_ttps")
test_mechanisms = fields.TypedField("Test_Mechanisms", TestMechanisms)
alternative_id = fields.TypedField("Alternative_ID", multiple=True)
suggested_coas = fields.TypedField("Suggested_COAs", SuggestedCOAs)
sightings = fields.TypedField("Sightings", Sightings)
composite_indicator_expression = fields.TypedField(
"Composite_Indicator_Expression",
"stix.indicator.CompositeIndicatorExpression")
kill_chain_phases = fields.TypedField("Kill_Chain_Phases",
KillChainPhasesReference)
valid_time_positions = fields.TypedField("Valid_Time_Position",
ValidTime,
multiple=True,
key_name="valid_time_positions")
related_indicators = fields.TypedField("Related_Indicators",
RelatedIndicators)
related_campaigns = fields.TypedField(
"Related_Campaigns", type_="stix.indicator.RelatedCampaignRefs")
likely_impact = fields.TypedField("Likely_Impact", Statement)
negate = fields.TypedField("negate")
related_packages = fields.TypedField("Related_Packages",
RelatedPackageRefs)
def __init__(self,
id_=None,
idref=None,
timestamp=None,
title=None,
description=None,
short_description=None):
super(Indicator, self).__init__(id_=id_,
idref=idref,
timestamp=timestamp,
title=title,
description=description,
short_description=short_description)
self.observable = None
self.indicator_types = IndicatorTypes()
self.test_mechanisms = TestMechanisms()
self.alternative_id = None
self.suggested_coas = SuggestedCOAs()
self.sightings = Sightings()
self.composite_indicator_expression = None
self.kill_chain_phases = KillChainPhasesReference()
self.related_indicators = RelatedIndicators()
self.related_campaigns = RelatedCampaignRefs()
self.observable_composition_operator = "OR"
self.related_packages = RelatedPackageRefs()
@property
def observables(self):
"""A list of ``cybox.core.Observable`` instances. This can be set to
a single object instance or a list of objects.
Note:
If only one Observable is set, this property will return a list
with the ``observable`` property.
If multiple ``cybox.core.Observable`` this property will return
Observables under the ``cybox.core.ObservableComposition``.
Access to the top level ``cybox.core.Observable`` is made via
``observable`` property.
Default Value:
Empty ``list``.
Returns:
A ``list`` of ``cybox.core.Observable`` instances.
"""
if not self.observable:
return []
elif self.observable.observable_composition:
return self.observable.observable_composition.observables
return []
@observables.setter
def observables(self, value):
"""
The method will automatically create a top ``cybox.core.Observable`` and
append all ``cybox.core.Observable`` using ``observable_composition``
property when a ``list`` is given with length greater than 1.
Note:
The top level ``cybox.core.Observable`` will set the ``operator``
property for the ``cybox.core.ObservableComposition`` via the
``observable_composition_operator`` property. The value of
``operator`` can be changed via ``observable_composition_operator``
property. By default, the composition layer will be set to ``"OR"``.
Args:
value: A ``list`` of ``cybox.core.Observable`` instances or a single
``cybox.core.Observable`` instance.
Raises:
ValueError: If set to a value that cannot be converted to an
instance of ``cybox.core.Observable``.
"""
if not value:
return
if isinstance(value, Observable):
self.observable = value
elif utils.is_sequence(value):
if len(value) == 1:
self.observable = value
return
observable_comp = ObservableComposition()
observable_comp.operator = self.observable_composition_operator
for element in value:
observable_comp.add(element)
self.observable = Observable()
self.observable.observable_composition = observable_comp
def set_observables(self, value):
self.observables = value
def add_observable(self, observable):
"""Adds an observable to the ``observable`` property of the
:class:`Indicator`.
If the `observable` parameter is ``None``, no item will be added
to the ``observable`` property.
Note:
The STIX Language dictates that an :class:`Indicator` can have only
one ``Observable`` under it. Because of this, when a user adds
another ``Observable`` a new, empty ``Observable`` will be crated
and append the existing and new ``observable`` using the
``ObservableComposition`` property. To access the top level
``Observable`` can be achieved by the ``observable`` property .By
default, the ``operator`` of the composition layer will be set to
``"OR"``. The ``operator`` value can be changed via the
``observable_composition_operator`` property.
Setting ``observable`` or ``observables`` with re-initialize the
property and lose all ``Observable`` in the composition layer.
Args:
observable: An instance of ``cybox.core.Observable`` or an object
type that can be converted into one.
Raises:
ValueError: If the `observable` param cannot be converted into an
instance of ``cybox.core.Observable``.
"""
if not observable:
return
# Sets the first observable.
elif not self.observable:
self.observable = observable
# When another is inserted. A "root" Observable is created and the
# user's Observables are appended to the composition.
elif not self.observable.observable_composition:
observable_comp = ObservableComposition()
observable_comp.operator = self.observable_composition_operator
observable_comp.add(self.observable)
observable_comp.add(observable)
self.observable = Observable()
self.observable.observable_composition = observable_comp
# Keep appending to "root" Observable.
else:
self.observable.observable_composition.add(observable)
def add_alternative_id(self, value):
"""Adds an alternative id to the ``alternative_id`` list property.
Note:
If ``None`` is passed in no value is added to the
``alternative_id`` list property.
Args:
value: An identifier value.
"""
if not value:
return
self.alternative_id.append(value)
def add_valid_time_position(self, value):
"""Adds an valid time position to the ``valid_time_positions`` property
list.
If `value` is ``None``, no item is added to the ``value_time_positions``
list.
Args:
value: An instance of :class:`stix.indicator.valid_time.ValidTime`.
Raises:
ValueError: If the `value` argument is not an instance of
:class:`stix.indicator.valid_time.ValidTime`.
"""
self.valid_time_positions.append(value)
def add_indicator_type(self, value):
"""Adds a value to the ``indicator_types`` list property.
The `value` parameter can be a ``str`` or an instance of
:class:`stix.common.vocabs.VocabString`.
Note:
If the `value` parameter is a ``str`` instance, an attempt will be
made to convert it into an instance of
:class:`stix.common.vocabs.IndicatorType`
Args:
value: An instance of :class:`stix.common.vocabs.VocabString`
or ``str``.
Raises:
ValueError: If the `value` param is a ``str`` instance that cannot
be converted into an instance of
:class:`stix.common.vocabs.IndicatorType`.
"""
self.indicator_types.append(value)
def add_indicated_ttp(self, v):
"""Adds an Indicated TTP to the ``indicated_ttps`` list property
of this :class:`Indicator`.
The `v` parameter must be an instance of
:class:`stix.common.related.RelatedTTP` or :class:`stix.ttp.TTP`.
If the `v` parameter is ``None``, no item wil be added to the
``indicated_ttps`` list property.
Note:
If the `v` parameter is not an instance of
:class:`stix.common.related.RelatedTTP` an attempt will be made
to convert it to one.
Args:
v: An instance of :class:`stix.common.related.RelatedTTP` or
:class:`stix.ttp.TTP`.
Raises:
ValueError: If the `v` parameter cannot be converted into an
instance of :class:`stix.common.related.RelatedTTP`
"""
self.indicated_ttps.append(v)
def add_test_mechanism(self, tm):
"""Adds an Test Mechanism to the ``test_mechanisms`` list property
of this :class:`Indicator`.
The `tm` parameter must be an instance of a
:class:`stix.indicator.test_mechanism._BaseTestMechanism`
implementation.
If the `tm` parameter is ``None``, no item will be added to the
``test_mechanisms`` list property.
See Also:
Test Mechanism implementations are found under the
:mod:`stix.extensions.test_mechanism` package.
Args:
tm: An instance of a
:class:`stix.indicator.test_mechanism._BaseTestMechanism`
implementation.
Raises:
ValueError: If the `tm` parameter is not an instance of
:class:`stix.indicator.test_mechanism._BaseTestMechanism`
"""
self.test_mechanisms.append(tm)
def add_related_indicator(self, indicator):
"""Adds an Related Indicator to the ``related_indicators`` list
property of this :class:`Indicator`.
The `indicator` parameter must be an instance of
:class:`stix.common.related.RelatedIndicator` or
:class:`Indicator`.
If the `indicator` parameter is ``None``, no item wil be added to the
``related_indicators`` list property.
Calling this method is the same as calling ``append()`` on the
``related_indicators`` proeprty.
See Also:
The :class:`RelatedIndicators` documentation.
Note:
If the `tm` parameter is not an instance of
:class:`stix.common.related.RelatedIndicator` an attempt will be
made to convert it to one.
Args:
indicator: An instance of :class:`Indicator` or
:class:`stix.common.related.RelatedIndicator`.
Raises:
ValueError: If the `indicator` parameter cannot be converted into
an instance of :class:`stix.common.related.RelatedIndicator`
"""
self.related_indicators.append(indicator)
def add_related_campaign(self, value):
"""Adds a Related Campaign to this Indicator.
The `value` parameter must be an instance of :class:`.RelatedCampaignRef`
or :class:`.CampaignRef`.
If the `value` parameter is ``None``, no item wil be added to the
``related_campaigns`` collection.
Calling this method is the same as calling ``append()`` on the
``related_campaigns`` property.
See Also:
The :class:`.RelatedCampaignRef` documentation.
Note:
If the `value` parameter is not an instance of
:class:`.RelatedCampaignRef` an attempt will be made to convert it
to one.
Args:
value: An instance of :class:`.RelatedCampaignRef` or
:class:`.Campaign`.
Raises:
ValueError: If the `value` parameter cannot be converted into
an instance of :class:`.RelatedCampaignRef`
"""
self.related_campaigns.append(value)
@property
def observable_composition_operator(self):
return self._observable_composition_operator
@observable_composition_operator.setter
def observable_composition_operator(self, value):
if value in self._ALLOWED_COMPOSITION_OPERATORS:
self._observable_composition_operator = value
if self.observable and self.observable.observable_composition:
self.observable.observable_composition.operator = value
return
error = "observable_composition_operator must one of {0}"
error = error.format(self._ALLOWED_COMPOSITION_OPERATORS)
raise ValueError(error)
def add_kill_chain_phase(self, value):
"""Add a new Kill Chain Phase reference to this Indicator.
Args:
value: a :class:`stix.common.kill_chains.KillChainPhase` or a `str`
representing the phase_id of. Note that you if you are defining
a custom Kill Chain, you need to add it to the STIX package
separately.
"""
self.kill_chain_phases.append(value)
def add_related_package(self, value):
self.related_packages.append(value)
def set_producer_identity(self, identity):
"""Sets the name of the producer of this indicator.
This is the same as calling
``indicator.producer.identity.name = identity``.
If the ``producer`` property is ``None``, it will be initialized to
an instance of
:class:`stix.common.information_source.InformationSource`.
If the ``identity`` property of the ``producer`` instance is ``None``,
it will be initialized to an instance of
:class:`stix.common.identity.Identity`.
Note:
if the `identity` parameter is not an instance
:class:`stix.common.identity.Identity` an attempt will be made
to convert it to one.
Args:
identity: An instance of ``str`` or
``stix.common.identity.Identity``.
"""
def unset_producer_identity():
try:
self.producer.identity.name = None
except AttributeError:
pass
if not identity:
unset_producer_identity()
return
if not self.producer:
self.producer = InformationSource()
if isinstance(identity, Identity):
self.producer.identity = identity
return
if not self.producer.identity:
self.producer.identity = Identity()
self.producer.identity.name = str(identity)
def set_produced_time(self, produced_time):
"""Sets the ``produced_time`` property of the ``producer`` property
instance fo `produced_time`.
This is the same as calling
``indicator.producer.time.produced_time = produced_time``.
The `produced_time` parameter must be an instance of ``str``,
``datetime.datetime``, or ``cybox.common.DateTimeWithPrecision``.
Note:
If `produced_time` is a ``str`` or ``datetime.datetime`` instance
an attempt will be made to convert it into an instance of
``cybox.common.DateTimeWithPrecision``.
Args:
produced_time: An instance of ``str``,
``datetime.datetime``, or ``cybox.common.DateTimeWithPrecision``.
"""
if not self.producer:
self.producer = InformationSource()
if not self.producer.time:
self.producer.time = Time()
self.producer.time.produced_time = produced_time
def get_produced_time(self):
"""Gets the produced time for this :class:`Indicator`.
This is the same as calling
``produced_time = indicator.producer.time.produced_time``.
Returns:
``None`` or an instance of ``cybox.common.DateTimeWithPrecision``.
"""
try:
return self.producer.time.produced_time
except AttributeError:
return None
def set_received_time(self, received_time):
"""Sets the received time for this :class:`Indicator`.
This is the same as calling
``indicator.producer.time.produced_time = produced_time``.
The `received_time` parameter must be an instance of ``str``,
``datetime.datetime``, or ``cybox.common.DateTimeWithPrecision``.
Args:
received_time: An instance of ``str``,
``datetime.datetime``, or ``cybox.common.DateTimeWithPrecision``.
Note:
If `received_time` is a ``str`` or ``datetime.datetime`` instance
an attempt will be made to convert it into an instance of
``cybox.common.DateTimeWithPrecision``.
"""
if not self.producer:
self.producer = InformationSource()
if not self.producer.time:
self.producer.time = Time()
self.producer.time.received_time = received_time
def get_received_time(self):
"""Gets the received time for this :class:`Indicator`.
This is the same as calling
``received_time = indicator.producer.time.received_time``.
Returns:
``None`` or an instance of ``cybox.common.DateTimeWithPrecision``.
"""
try:
return self.producer.time.received_time
except AttributeError:
return None
def _merge_observables(self, observables):
observable_composition = ObservableComposition()
observable_composition.operator = self.observable_composition_operator
for observable in observables:
observable_composition.add(observable)
root_observable = Observable()
root_observable.observable_composition = observable_composition
return root_observable
def add_object(self, object_):
"""Adds a python-cybox Object instance to the ``observables`` list
property.
This is the same as calling ``indicator.add_observable(object_)``.
Note:
If the `object` param is not an instance of ``cybox.core.Object``
an attempt will be made to to convert it into one before wrapping
it in an ``cybox.core.Observable`` layer.
Args:
object_: An instance of ``cybox.core.Object`` or an object
that can be converted into an instance of
``cybox.core.Observable``
Raises:
ValueError: if the `object_` param cannot be converted to an
instance of ``cybox.core.Observable``.
"""
if not object_:
return
observable = Observable(object_)
self.add_observable(observable)
def _finalize_obj(self, entity_obj):
"""Omits the `negate` field if it is not equal to True.
"""
if self.negate:
entity_obj.negate = True
elif hasattr(entity_obj, 'negate'):
entity_obj.negate = None
def _finalize_dict(self, entity_dict):
"""Omits the `negate` field if it is not equal to True.
"""
if self.negate:
entity_dict['negate'] = True
elif 'negate' in entity_dict:
del entity_dict['negate']
class STIXHeader(stix.Entity):
"""The STIX Package Header.
Args:
handling: The data marking section of the Header.
information_source: The :class:`.InformationSource` section of the
Header.
package_intents: **DEPRECATED**. A collection of :class:`.VocabString`
defining the intent of the parent :class:`.STIXPackage`.
description: **DEPRECATED**. A description of the intent or purpose
of the parent :class:`.STIXPackage`.
short_description: **DEPRECATED**. A short description of the intent
or purpose of the parent :class:`.STIXPackage`.
title: **DEPRECATED**. The title of the :class:`.STIXPackage`.
Attributes:
profiles: A collection of STIX Profiles the parent
:class:`.STIXPackage` conforms to.
title: **DEPRECATED**. The title of the parent :class:`.STIXPackage`.
"""
_binding = stix_core_binding
_binding_class = _binding.STIXHeaderType
_namespace = 'http://stix.mitre.org/stix-1'
title = fields.TypedField("Title", preset_hook=deprecated.field)
package_intents = VocabField("Package_Intent", PackageIntent, multiple=True, preset_hook=deprecated.field)
descriptions = fields.TypedField("Description", type_=StructuredTextList, preset_hook=deprecated.field)
short_descriptions = fields.TypedField("Short_Description", type_=StructuredTextList, preset_hook=deprecated.field)
handling = fields.TypedField("Handling", Marking)
information_source = fields.TypedField("Information_Source", InformationSource)
profiles = fields.TypedField("Profiles", Profiles)
def __init__(self, package_intents=None, description=None, handling=None,
information_source=None, title=None, short_description=None):
super(STIXHeader, self).__init__()
self.package_intents = package_intents
self.title = title
self.description = StructuredTextList(description)
self.short_description = StructuredTextList(short_description)
self.handling = handling
self.information_source = information_source
self.profiles = None
@property
def description(self):
"""**DEPRECATED**. A single description about the contents or
purpose of this object.
Default Value: ``None``
Note:
If this object has more than one description set, this will return
the description with the lowest ordinality value.
Returns:
An instance of
:class:`.StructuredText`
"""
return next(iter(self.descriptions), None)
@description.setter
def description(self, value):
self.descriptions = StructuredTextList(value)
def add_description(self, description):
"""**DEPRECATED**. Adds a description to the ``descriptions``
collection.
This is the same as calling "foo.descriptions.add(bar)".
"""
deprecated.warn(description)
self.descriptions.add(description)
@property
def short_description(self):
"""**DEPRECATED**. A single short description about the contents or
purpose of this object.
Default Value: ``None``
Note:
If this object has more than one short description set, this will
return the description with the lowest ordinality value.
Returns:
An instance of :class:`.StructuredText`
"""
return next(iter(self.short_descriptions), None)
@short_description.setter
def short_description(self, value):
self.short_descriptions = StructuredTextList(value)
def add_short_description(self, description):
"""**DEPRECATED**. Adds a description to the ``short_descriptions``
collection.
This is the same as calling "foo.short_descriptions.add(bar)".
"""
deprecated.warn(description)
self.short_descriptions.add(description)
def add_package_intent(self, package_intent):
"""**DEPRECATED**. Adds :class:`.VocabString` object to the
:attr:`package_intents` collection.
If the input is not an instance of :class:`.VocabString`, an effort
will be made to convert it into an instance of :class:`.PackageIntent`.
"""
deprecated.warn(package_intent)
self.package_intents.append(package_intent)
def add_profile(self, profile):
"""Adds a profile to the STIX Header. A Profile is represented by a
string URI.
"""
self.profiles.append(profile)
class Campaign(stix.BaseCoreComponent):
"""Implementation of the STIX Campaign.
Args:
id_ (optional): An identifier. If ``None``, a value will be generated
via ``mixbox.idgen.create_id()``. If set, this will unset the
``idref`` property.
idref (optional): An identifier reference. If set this will unset the
``id_`` property.
timestamp (optional): A timestamp value. Can be an instance of
``datetime.datetime`` or ``str``.
description: A description of the purpose or intent of this object.
short_description: A short description of the intent
or purpose of this object.
title: The title of this object.
"""
_binding = campaign_binding
_binding_class = _binding.CampaignType
_namespace = "http://stix.mitre.org/Campaign-1"
_version = "1.2"
_ALL_VERSIONS = ("1.0", "1.0.1", "1.1", "1.1.1", "1.2")
_ID_PREFIX = 'campaign'
descriptions = fields.TypedField("Description", StructuredTextList)
activity = fields.TypedField("Activity", Activity, multiple=True)
associated_campaigns = fields.TypedField("Associated_Campaigns", AssociatedCampaigns)
attribution = fields.TypedField("Attribution", Attribution, multiple=True)
confidence = fields.TypedField("Confidence", Confidence)
# references = fields.TypedField("Reference", multiple=True)
status = VocabField("Status", CampaignStatus)
intended_effects = StatementField("Intended_Effect", Statement, vocab_type=vocabs.IntendedEffect, multiple=True, key_name="intended_effects")
names = fields.TypedField("Names", Names)
related_incidents = fields.TypedField("Related_Incidents", RelatedIncidents)
related_indicators = fields.TypedField("Related_Indicators", RelatedIndicators)
related_packages = fields.TypedField("Related_Packages", RelatedPackageRefs)
related_ttps = fields.TypedField("Related_TTPs", RelatedTTPs)
information_source = fields.TypedField("Information_Source", InformationSource)
def __init__(self, id_=None, idref=None, timestamp=None, title=None,
description=None, short_description=None):
super(Campaign, self).__init__(
id_=id_,
idref=idref,
timestamp=timestamp,
title=title,
description=description,
short_description=short_description
)
self.related_ttps = RelatedTTPs()
self.related_incidents = RelatedIncidents()
self.related_indicators = RelatedIndicators()
self.related_packages = RelatedPackageRefs()
def add_intended_effect(self, value):
self.intended_effects.append(value)
def add_activity(self, value):
"""Adds an :class:`.Activity` object to the :attr:`activity`
collection.
"""
self.activity.append(value)
@property
def description(self):
"""A single description about the contents or purpose of this object.
Default Value: ``None``
Note:
If this object has more than one description set, this will return
the description with the lowest ordinality value.
Returns:
An instance of :class:`.StructuredText`
"""
return next(iter(self.descriptions), None)
@description.setter
def description(self, value):
self.descriptions = StructuredTextList(value)
def add_description(self, description):
"""Adds a description to the ``descriptions`` collection.
This is the same as calling "foo.descriptions.add(bar)".
"""
self.descriptions.add(description)