Skip to content

Commit beee89f

Browse files
committed
Add TypedFields to ThreatActor
1 parent 0dd564f commit beee89f

4 files changed

Lines changed: 81 additions & 250 deletions

File tree

stix/common/related.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -204,7 +204,7 @@ class RelatedThreatActor(_BaseRelated):
204204
_namespace = "http://stix.mitre.org/common-1"
205205
_binding = common_binding
206206
_binding_class = common_binding.RelatedThreatActorType
207-
item = fields.TypedField("ThreatActor", type_="stix.threat_actor.ThreatActor")
207+
item = fields.TypedField("Threat_Actor", type_="stix.threat_actor.ThreatActor")
208208

209209

210210
class RelatedTTP(_BaseRelated):

stix/common/statement.py

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
from .confidence import Confidence
1414
from .structured_text import StructuredTextList
1515
from .vocabs import VocabField, HighMediumLow
16-
16+
import mixbox
1717

1818
class Statement(stix.Entity):
1919
_namespace = 'http://stix.mitre.org/common-1'
@@ -67,3 +67,21 @@ def add_description(self, description):
6767
6868
"""
6969
self.descriptions.add(description)
70+
71+
72+
class StatementField(mixbox.fields.TypedField):
73+
def __init__(self, *args, **kwargs):
74+
self._vocab_type = kwargs.pop("vocab_type")
75+
super(StatementField, self).__init__(*args, **kwargs)
76+
self.type_ = Statement
77+
78+
def _clean(self, value):
79+
if value is None:
80+
return None
81+
elif isinstance(value, Statement):
82+
return value
83+
elif isinstance(value, stix.common.VocabString):
84+
return Statement(value)
85+
else:
86+
vocabklass = self._vocab_type
87+
return Statement(vocabklass(value))

stix/test/threat_actor_test.py

Lines changed: 45 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,9 @@
1515

1616

1717
class TypesTests(TypedListTestCase, unittest.TestCase):
18-
klass = ta._Types
18+
klass = ta.ThreatActor
1919

20-
_full_dict = [
20+
_partial_dict = [
2121
{
2222
'value': {
2323
"value" : "Hacker",
@@ -26,58 +26,74 @@ class TypesTests(TypedListTestCase, unittest.TestCase):
2626
},
2727
]
2828

29+
_full_dict = {
30+
"types": _partial_dict
31+
}
2932

3033
class MotivationsTests(TypedListTestCase, unittest.TestCase):
31-
klass = ta._Motivations
34+
klass = ta.ThreatActor
3235

33-
_full_dict = [
34-
{
36+
_partial_dict = [{
3537
'value': {
3638
"value" : "Ego",
3739
"xsi:type" : "stixVocabs:MotivationVocab-1.1"
3840
}
39-
},
40-
]
41+
}]
42+
43+
_full_dict = {
44+
"motivations": _partial_dict
45+
}
4146

4247

4348
class SophisticationTests(TypedListTestCase, unittest.TestCase):
44-
klass = ta._Sophistications
49+
klass = ta.ThreatActor
4550

46-
_full_dict = [
51+
_partial_dict = [
4752
{
48-
'value': {
53+
'value': {
4954
"value" : "Novice",
5055
"xsi:type" : "stixVocabs:ThreatActorSophisticationVocab-1.0"
51-
}
52-
},
56+
}
57+
}
5358
]
5459

55-
60+
_full_dict = {
61+
"sophistications": _partial_dict
62+
}
63+
5664
class IntendedEffectsTests(TypedListTestCase, unittest.TestCase):
57-
klass = ta._IntendedEffects
65+
klass = ta.ThreatActor
5866

59-
_full_dict = [
67+
_partial_dict = [
6068
{
61-
'value': {
69+
'value': {
6270
"value" : "Destruction",
6371
"xsi:type" : "stixVocabs:IntendedEffectVocab-1.0"
64-
}
72+
}
6573
}
6674
]
75+
76+
_full_dict = {
77+
"intended_effects": _partial_dict
78+
}
6779

6880

6981
class PlanningAndOperationalSupportTests(TypedListTestCase, unittest.TestCase):
70-
klass = ta._PlanningAndOperationalSupports
82+
klass = ta.ThreatActor
7183

72-
_full_dict = [
84+
_partial_dict = [
7385
{
74-
'value': {
75-
"value" : "Data Exploitation",
76-
"xsi:type" : 'stixVocabs:PlanningAndOperationalSupportVocab-1.0.1'
77-
}
78-
},
86+
'value': {
87+
"value" : "Data Exploitation",
88+
"xsi:type" : 'stixVocabs:PlanningAndOperationalSupportVocab-1.0.1'
89+
}
90+
}
7991
]
8092

93+
_full_dict = {
94+
"planning_and_operational_supports": _partial_dict
95+
}
96+
8197

8298
class ObservedTTPsTests(EntityTestCase, unittest.TestCase):
8399
klass = ta.ObservedTTPs
@@ -122,11 +138,11 @@ class ThreatActorTests(EntityTestCase, unittest.TestCase):
122138
'description': "This is a long description about a threat actor.",
123139
'short_description': "A bad guy",
124140
'identity': identity_test.IdentityTests._full_dict,
125-
'types': TypesTests._full_dict,
126-
'motivations': MotivationsTests._full_dict,
127-
'sophistications': SophisticationTests._full_dict,
128-
'intended_effects': IntendedEffectsTests._full_dict,
129-
'planning_and_operational_supports': PlanningAndOperationalSupportTests._full_dict,
141+
'types': TypesTests._partial_dict,
142+
'motivations': MotivationsTests._partial_dict,
143+
'sophistications': SophisticationTests._partial_dict,
144+
'intended_effects': IntendedEffectsTests._partial_dict,
145+
'planning_and_operational_supports': PlanningAndOperationalSupportTests._partial_dict,
130146
'observed_ttps': ObservedTTPsTests._full_dict,
131147
'associated_campaigns': AssocaitedCampaignsTests._full_dict,
132148
'associated_actors': AssociatedActorsTests._full_dict,

0 commit comments

Comments
 (0)