-
Notifications
You must be signed in to change notification settings - Fork 89
Expand file tree
/
Copy pathmalware_instance.py
More file actions
124 lines (92 loc) · 3.84 KB
/
Copy pathmalware_instance.py
File metadata and controls
124 lines (92 loc) · 3.84 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
# Copyright (c) 2017, The MITRE Corporation. All rights reserved.
# See LICENSE.txt for complete terms.
# internal
import stix
from stix.common import vocabs
from stix.common import StructuredTextList, VocabString
# bindings
import stix.bindings.ttp as ttp_binding
from mixbox import fields, entities
class MalwareInstance(stix.Entity):
_binding = ttp_binding
_binding_class = _binding.MalwareInstanceType
_namespace = "http://stix.mitre.org/TTP-1"
_XSI_TYPE = None # defined by subclasses
id_ = fields.IdField("id")
idref = fields.IdrefField("idref")
title = fields.TypedField("Title")
descriptions = fields.TypedField("Description", type_="stix.common.StructuredTextList")
short_descriptions = fields.TypedField("Short_Description", type_="stix.common.StructuredTextList")
names = vocabs.VocabField("Name", type_=VocabString, multiple=True, key_name="names")
types = vocabs.VocabField("Type", type_=vocabs.MalwareType, multiple=True, key_name="types")
def __init__(self, id_=None, idref=None, title=None, description=None, short_description=None):
super(MalwareInstance, self).__init__()
self.id_ = id_
self.idref = idref
self.title = title
self.description = StructuredTextList(description)
self.short_description = StructuredTextList(short_description)
@property
def description(self):
"""A single description about the contents or purpose of this object.
Default Value: ``None``
Note:
If this object has more than one description set, this will return
the description with the lowest ordinality value.
Returns:
An instance of :class:`.StructuredText`
"""
if self.descriptions is None:
self.descriptions = StructuredTextList()
return next(iter(self.descriptions), None)
@description.setter
def description(self, value):
self.descriptions = value
def add_description(self, description):
"""Adds a description to the ``descriptions`` collection.
This is the same as calling "foo.descriptions.add(bar)".
"""
self.descriptions.add(description)
@property
def short_description(self):
"""A single short description about the contents or purpose of this
object.
Default Value: ``None``
Note:
If this object has more than one short description set, this will
return the description with the lowest ordinality value.
Returns:
An instance of :class:`.StructuredText`
"""
if self.short_descriptions is None:
self.short_descriptions = []
return next(iter(self.short_descriptions), None)
@short_description.setter
def short_description(self, value):
self.short_descriptions = value
def add_short_description(self, description):
"""Adds a description to the ``short_descriptions`` collection.
This is the same as calling "foo.short_descriptions.add(bar)".
"""
self.short_descriptions.add(description)
def add_name(self, name):
self.names.append(name)
def add_type(self, type_):
self.types.append(type_)
@staticmethod
def lookup_class(xsi_type):
if not xsi_type:
raise ValueError("xsi:type is required")
return stix.lookup_extension(xsi_type)
def to_dict(self):
d = super(MalwareInstance, self).to_dict()
if self._XSI_TYPE:
d["xsi:type"] = self._XSI_TYPE
return d
class MalwareInstanceFactory(entities.EntityFactory):
@classmethod
def entity_class(cls, key):
from stix.extensions.malware.maec_4_1_malware import MAECInstance # noqa
return stix.lookup_extension(key, default=MalwareInstance)
# Backwards compatibility
add_extension = stix.add_extension