S?\5r"S@SA\5r "SBSC\5r!"SDSE\5r""SFSG\5r#"SHSI\5r$"SJSK\5r%"SLSM\5r&"SNSO\5r'"SPSQ\'5r("SRSS\'5r)"STSU\5r*"SVSW\5r+"SXSY\+5r,"SZS[\+5r-"S\S]\+5r."S^S_\5r/"S`Sa\5r0"SbSc\05r1"SdSe\05r2"SfSg\05r3"ShSi\5r4g)jz=Classes to aid in working with the STIX2 patterning language.N)parse_into_datetimecFURSS5RSS5$)N\z\\'z\')replace)ss H/home/james-whalen/.local/lib/python3.13/site-packages/stix2/patterns.pyescape_quotes_and_backslashesr s 99UG $ , ,T6 ::c[U[5(a3URS5S:waURS5(dSU-S-$U$)N-r) isinstancestrfind startswith)xs r quote_if_neededrsA!S 66#;" <<$$Qw}$ Hr c\rSrSrSrg) _ConstantN__name__ __module__ __qualname____firstlineno____static_attributes__rr r rrr rc(\rSrSrSrSSjrSrSrg)StringConstantz=Pattern string constant Args: value (str): string value c(U(+UlXlgNneeds_to_be_quotedvalue)selfr(from_parse_trees r __init__StringConstant.__init__"s&5"5 r cpSUR(a[UR5-$UR-$)Nz'%s')r'r r(r)s r __str__StringConstant.__str__&s.dF]F]6tzzBnncgcmcmnnr r&NFrrrr__doc__r+r/rrr r r"r"s or r"c$\rSrSrSrSrSrSrg)TimestampConstant*znPattern timestamp constant Args: value (datetime.datetime OR str): if string, must be a timestamp string cX[U5Ulg![a [S5ef=f)Nz.Must be a datetime object or timestamp string.)rr( Exception ValueErrorr)r(s r r+TimestampConstant.__init__0s1 O,U3DJ OMN N O)c2S[UR5-$)Nzt%s)reprr(r.s r r/TimestampConstant.__str__6stDJJ'''r r(Nr2rr r r5r5*s O (r r5c$\rSrSrSrSrSrSrg)IntegerConstant:z?Pattern integer constant Args: value (int): integer value cX[U5Ulg![a [S5ef=f)Nzmust be an integer.)intr(r8r9r:s r r+IntegerConstant.__init__@s- 4UDJ 423 3 4r<c SUR-$N%sr@r.s r r/IntegerConstant.__str__Fdjj  r r@Nr2rr r rBrB:s 4 !r rBc \rSrSrSrSrSrg) FloatConstantJcX[U5Ulg![a [S5ef=f)Nzmust be a float.)floatr(r8r9r:s r r+FloatConstant.__init__Ks- 1uDJ 1/0 0 1r<c SUR-$rHr@r.s r r/FloatConstant.__str__QrKr r@N)rrrrr+r/rrr r rMrMJs 1 !r rMc$\rSrSrSrSrSrSrg)BooleanConstantUzPattern boolean constant Args: value (str OR int): (str) 'true', 't' for True; 'false', 'f' for False (int) 1 for True; 0 for False c0[U[5(aXlg/SQn/SQnUR5U;aSUlgUR5U;aSUlg[ S5e![a! US:Xa SUlgUS:Xa SUlgN5f=f)N)truet1)falsef0TFrrzmust be a boolean value.)rboolr(lowerAttributeErrorr9)r)r(truesfalsess r r+BooleanConstant.__init__]s eT " "J "$ {{}%! &(" )344 z! !"   sA*A**B BBcH[UR5R5$r%)rr(r_r.s r r/BooleanConstant.__str__us4::$$&&r r@Nr2rr r rUrUUs50'r rU)z^[a-fA-F0-9]{32}$MD5)zb^[a-fA-F0-9]{32}|[a-fA-F0-9]{40}|[a-fA-F0-9]{56}|[a-fA-F0-9]{64}|[a-fA-F0-9]{96}|[a-fA-F0-9]{128}$MD6)^[a-fA-F0-9]{40}$z RIPEMD-160)rhzSHA-1)^[a-fA-F0-9]{56}$zSHA-224)^[a-fA-F0-9]{64}$zSHA-256)^[a-fA-F0-9]{96}$zSHA-384)^[a-fA-F0-9]{128}$zSHA-512)rizSHA3-224)rjzSHA3-256)rkzSHA3-384)rlzSHA3-512)z^[a-zA-Z0-9/+:.]{1,128}$SSDEEP)rl WHIRLPOOL)z^[a-fA-F0-9]{70}$TLSH)rfrg RIPEMD160SHA1SHA224SHA256SHA384SHA512SHA3224SHA3256SHA3384SHA3512rmrnroc,^\rSrSrSrU4SjrSrU=r$) HashConstantaPattern hash constant Args: value (str): hash value type (str): hash algorithm name. Supported hash algorithms: "MD5", "MD6", RIPEMD160", "SHA1", "SHA224", "SHA256", "SHA384", "SHA512", "SHA3224", "SHA3256", "SHA3384", "SHA3512", "SSDEEP", "WHIRLPOOL" c>UR5RSS5nU[;aZ[USn[R"[USU5(d[ SU<SU<S35e[ [U]#U5 gg)Nrrrrz' is not a valid z hash) upperr _HASH_REGEXrematchr9superr{r+)r)r(typekey vocab_key __class__s r r+HashConstant.__init__sqjjl""3+ + #C(+I88K,Q/77 %!STT , .u 5 r rrrrrr3r+r __classcell__rs@r r{r{s66r r{c(\rSrSrSrSSjrSrSrg)BinaryConstantzLPattern binary constant Args: value (str): base64 encoded string value cU(a/[R"SU5nU(aURS5n[R"U5 Xlg![ R[4a [S5ef=f)Nz ^b'(.+)'$rz$must contain a base64 encoded string) rrgroupbase64 b64decoder(binasciiError TypeErrorr9r)r(r*ms r r+BinaryConstant.__init__sd e,A  E   U #J * ECD D Es A&A;c SUR-$)Nzb'%s'r@r.s r r/BinaryConstant.__str__##r r@Nr1r2rr r rrs E$r rc(\rSrSrSrSSjrSrSrg) HexConstantzGPattern hexadecimal constant Args: value (str): hexadecimal value cU(d#[R"SU5(aXlg[R"SU5nU(aURS5Ulg[ S5e)Nz^([a-fA-F0-9]{2})+$z^h'(([a-fA-F0-9]{2})+)'$rz5must contain an even number of hexadecimal characters)rrr(rr9rs r r+HexConstant.__init__sJ288,A5#I#IJ3U;AWWQZ  !XYYr c SUR-$)Nzh'%s'r@r.s r r/HexConstant.__str__rr r@Nr1r2rr r rrs Z$r rc$\rSrSrSrSrSrSrg) ListConstantz>Pattern list constant Args: value (list): list of values c~UVs/sH%n[U[5(aUO [U5PM' snUlgs snfr%)rr make_constantr()r)valuesrs r r+ListConstant.__init__s3SYZSYa:a33aq9IISYZ Zs,:cvSSRURVs/sHnSU-PM sn5-S-$s snf)N(z, rI))joinr(r)rs r r/ListConstant.__str__s5TYY$**=*Qq*=>>DD=s6 r@Nr2rr r rrs [Er rc[U[5(aU$[U5$![[4a Of=f[U[ 5(a [ U5$[U[5(a [U5$[U[5(a [U5$[U[5(a [U5$[U[5(a [U5$[SU-5e)zConvert value to Pattern constant, best effort attempt at determining root value type and corresponding conversion Args: value: value to convert to Pattern constant z#Unable to create a constant from %s)rrr5r9rrr"r^rUrErBrPrMlistrr@s r rrs%##   ''  "   %e$$ E4 u%% E3  u%% E5 ! !U## E4 E"">FGGs $77c*\rSrSr\S5rSrSrg)_ObjectPathComponentc([U[5(a[URS5$UR S5(a [ U5$UR S5S:wa&URS5n[USUSSS5$[US5$)NF_ref[rrr) rr"BasicObjectPathComponentr(endswithReferenceObjectPathComponentrsplitListObjectPathComponent)component_nameparse1s r create_ObjectPathComponent/_ObjectPathComponent.create_ObjectPathComponents nn 5 5+N,@,@%H H  $ $V , ,/? ?   % +#))#.F*6!9fQinE E+NEB Br c,[UR5$r%)r property_namer.s r r/_ObjectPathComponent.__str__st1122r rN)rrrr staticmethodrr/rrr r rrs C C3r rc\rSrSrSrSrSrg)ria5Basic object path component (for an observation or expression) By "Basic", implies that the object path component is not a list, object reference or further referenced property, i.e. terminal component Args: property_name (str): object property name is_key (bool): is dictionary key, default: False cXlgr%r)r)ris_keys r r+!BasicObjectPathComponent.__init__s*r rNrrrrr3r+rrr r rrs  +r rc$\rSrSrSrSrSrSrg)rizList object path component (for an observation or expression) Args: property_name (str): list object property name index (int): index of the list property's value that is specified cXlX lgr%)rindex)r)rrs r r+ ListObjectPathComponent.__init__ s * r cP[UR5<SUR<S3$)Nr])rrrr.s r r/ListObjectPathComponent.__str__$s*4+=+=> KKr )rrNr2rr r rrs Lr rc\rSrSrSrSrSrg)ri(zReference object path component (for an observation or expression) Args: reference_property_name (str): reference object property name cXlgr%r)r)reference_property_names r r+%ReferenceObjectPathComponent.__init__.s4r rNrrr r rr(s  5r rc:\rSrSrSrSrSrSr\S5r Sr g) ObjectPathi2zPattern operand object (property) path Args: object_type_name (str): name of object type for corresponding object path component property_path (_ObjectPathComponent OR str): object path cXlUVs/sH/n[U[5(aUO[RU5PM1 snUlgs snfr%)object_type_namerrr property_path)r)rrrs r r+ObjectPath.__init__9sQ 0# #A344A ; ;A > ?"  s6A c UR<SSRURVs/sHnS[U5-PM sn5<3$s snf)N:.rI)rrrrrs r r/ObjectPath.__str__AsC//^b^p^p:q^pYZ4/RSBT;T^p:q1rss:qsA cPURRUR5 U$)zIExtend the object property with that of the supplied object property path)rextend)r)others r mergeObjectPath.mergeDs! !!%"5"56 r cfURS5n[USUSRS55$)z~Create ObjectPath from string encoded object path Args: lhs (str): object path of left-hand-side component of expression rrrr)rr)lhs path_as_partss r make_object_pathObjectPath.make_object_pathIs3 # -*M!,<,B,B3,GHHr )rrN) rrrrr3r+r/rrrrrr r rr2s-  t IIr rc\rSrSrSrg)_PatternExpressioniTrNrrr r rrTr r rc(\rSrSrSrSSjrSrSrg)_ComparisonExpressioniXaDPattern Comparison Expression Args: operator (str): operator of comparison expression lhs (ObjectPath OR str): object path of left-hand-side component of expression rhs (ObjectPath OR str): object path of right-hand-side component of expression negated (bool): comparison expression negated. Default: False cjUS:Xa#[U[[45(aSUlOXl[U[5(aX lO[R U5Ul[U[5(aX0lO[U5UlX@l UR R1Ul g)N=IN) rrroperatorrrrrrhsrnegatedr root_types)r)rrrrs r r+_ComparisonExpression.__init__as s?z# d/CDD DM$M c: & &H!2237DH c9 % %H$S)DH 88445r cUR(a+UR<SUR<SUR<3$UR<SUR<SUR<3$)Nz NOT  )rrrrr.s r r/_ComparisonExpression.__str__qs; <<%)XXt}}dhhG G!%4==$((C Cr )rrrrrNr1r2rr r rrXs6 Dr rc0^\rSrSrSrSU4SjjrSrU=r$)EqualityComparisonExpressionixaPattern Equality Comparison Expression Args: lhs (ObjectPath OR str): object path of left-hand-side component of expression rhs (ObjectPath OR str): object path of right-hand-side component of expression negated (bool): comparison expression negated. Default: False c0>[[U] SXU5 g)Nr)rrr+r)rrrrs r r+%EqualityComparisonExpression.__init__ *D:3'Rr rr1rrs@r rrxSSr rc0^\rSrSrSrSU4SjjrSrU=r$)GreaterThanComparisonExpressioniaPattern Greater-than Comparison Expression Args: lhs (ObjectPath OR str): object path of left-hand-side component of expression rhs (ObjectPath OR str): object path of right-hand-side component of expression negated (bool): comparison expression negated. Default: False c0>[[U] SXU5 g)N>)rrr+rs r r+(GreaterThanComparisonExpression.__init__s -t=c3WUr rr1rrs@r rrsVVr rc0^\rSrSrSrSU4SjjrSrU=r$)LessThanComparisonExpressioniaPattern Less-than Comparison Expression Args: lhs (ObjectPath OR str): object path of left-hand-side component of expression rhs (ObjectPath OR str): object path of right-hand-side component of expression negated (bool): comparison expression negated. Default: False c0>[[U] SXU5 g)N<)rrr+rs r r+%LessThanComparisonExpression.__init__rr rr1rrs@r rrrr rc0^\rSrSrSrSU4SjjrSrU=r$)$GreaterThanEqualComparisonExpressionia'Pattern Greater-Than-or-Equal-to Comparison Expression Args: lhs (ObjectPath OR str): object path of left-hand-side component of expression rhs (ObjectPath OR str): object path of right-hand-side component of expression negated (bool): comparison expression negated. Default: False c0>[[U] SXU5 g)Nz>=)rr r+rs r r+-GreaterThanEqualComparisonExpression.__init__s 2DB4SZ[r rr1rrs@r r r s\\r r c0^\rSrSrSrSU4SjjrSrU=r$)!LessThanEqualComparisonExpressionia$Pattern Less-Than-or-Equal-to Comparison Expression Args: lhs (ObjectPath OR str): object path of left-hand-side component of expression rhs (ObjectPath OR str): object path of right-hand-side component of expression negated (bool): comparison expression negated. Default: False c0>[[U] SXU5 g)Nz<=)rrr+rs r r+*LessThanEqualComparisonExpression.__init__s /?cPWXr rr1rrs@r rrsYYr rc0^\rSrSrSrSU4SjjrSrU=r$)InComparisonExpressionia 'in' Comparison Expression Args: lhs (ObjectPath OR str): object path of left-hand-side component of expression rhs (ObjectPath OR str): object path of right-hand-side component of expression negated (bool): comparison expression negated. Default: False c0>[[U] SXU5 g)Nr)rrr+rs r r+InComparisonExpression.__init__s $d4T3WMr rr1rrs@r rrsNNr rc0^\rSrSrSrSU4SjjrSrU=r$)LikeComparisonExpressionia 'like' Comparison Expression Args: lhs (ObjectPath OR str): object path of left-hand-side component of expression rhs (ObjectPath OR str): object path of right-hand-side component of expression negated (bool): comparison expression negated. Default: False c0>[[U] SXU5 g)NLIKE)rrr+rs r r+!LikeComparisonExpression.__init__s &6vsQr rr1rrs@r rrsRRr rc0^\rSrSrSrSU4SjjrSrU=r$)MatchesComparisonExpressionia'Matches' Comparison Expression Args: lhs (ObjectPath OR str): object path of left-hand-side component of expression rhs (ObjectPath OR str): object path of right-hand-side component of expression negated (bool): comparison expression negated. Default: False c0>[[U] SXU5 g)NMATCHES)rrr+rs r r+$MatchesComparisonExpression.__init__s )49)SwWr rr1rrs@r rrsXXr rc0^\rSrSrSrSU4SjjrSrU=r$)IsSubsetComparisonExpressionia'is subset' Comparison Expression Args: lhs (ObjectPath OR str): object path of left-hand-side component of expression rhs (ObjectPath OR str): object path of right-hand-side component of expression negated (bool): comparison expression negated. Default: False c0>[[U] SXU5 g)NISSUBSET)rr!r+rs r r+%IsSubsetComparisonExpression.__init__s *D::sQXYr rr1rrs@r r!r!sZZr r!c0^\rSrSrSrSU4SjjrSrU=r$)IsSupersetComparisonExpressionia'is super set' Comparison Expression Args: lhs (ObjectPath OR str): object path of left-hand-side component of expression rhs (ObjectPath OR str): object path of right-hand-side component of expression negated (bool): comparison expression negated. Default: False c0>[[U] SXU5 g)N ISSUPERSET)rr&r+rs r r+'IsSupersetComparisonExpression.__init__s ,d<\3U\]r rr1rrs@r r&r&s^^r r&c$\rSrSrSrSrSrSrg)_BooleanExpressionizmBoolean Pattern Expression Args: operator (str): boolean operator operands (list): boolean operands cJXl[U5UlUHn[US5(dURUlOEUS:Xa U=RUR-slOU=RUR-slUR(aM~[ S5e g)NrANDzQAll operands to an 'AND' expression must be satisfiable with the same object type)rroperandshasattrrr9)r)rr.args r r+_BooleanExpression.__init__su X C4.."%..U"3>>13>>1??? !tuur c/nURHnUR[U55 M SUR-S-R U5$Nr)r.appendrrrr) sub_exprsos r r/_BooleanExpression.__str__sF A   SV $dmm#c)// ::r )r.rrNr2rr r r+r+s v;r r+c,^\rSrSrSrU4SjrSrU=r$)AndBooleanExpressioniz'AND' Boolean Pattern Expression. Only use if both operands are of the same root object. Args: operands (list): AND operands c.>[[U] SU5 gNr-)rr:r+r)r.rs r r+AndBooleanExpression.__init__s "D25(Cr rrrs@r r:r:s DDr r:c,^\rSrSrSrU4SjrSrU=r$)OrBooleanExpressioniz'OR' Boolean Pattern Expression. Only use if both operands are of the same root object Args: operands (list): OR operands c.>[[U] SU5 gNOR)rr@r+r=s r r+OrBooleanExpression.__init__s !41$Ar rrrs@r r@r@s BBr r@c$\rSrSrSrSrSrSrg)ObservationExpressioni#zPObservation Expression Args: operand (str): observation expression operand cXlgr%operand)r)rIs r r+ObservationExpression.__init__)s r c[UR[[45(aSUR-$SUR-$)NrIz[%s])rrIrF_CompoundObservationExpressionr.s r r/ObservationExpression.__str__,sT&0@UWu?v&w&wtdll" S~DGKGSGS~S Sr rHNr2rr r rFrF#s Sr rFc$\rSrSrSrSrSrSrg)rLi0zCompound Observation Expression Args: operator (str): compound observation operator operands (str): compound observation operands cXlX lgr%)rr.)r)rr.s r r+'_CompoundObservationExpression.__init__7s   r c/nURHnURSU-5 M SUR-S-RU5$)NrIr)r.r4rrr5s r r/&_CompoundObservationExpression.__str__;sF A   TAX &dmm#c)// ::r )r.rNr2rr r rLrL0s !;r rLc,^\rSrSrSrU4SjrSrU=r$)AndObservationExpressioniBzg'AND' Compound Observation Pattern Expression Args: operands (str): compound observation operands c.>[[U] SU5 gr<)rrTr+r=s r r+!AndObservationExpression.__init__Hs &6uhGr rrrs@r rTrTBs HHr rTc,^\rSrSrSrU4SjrSrU=r$)OrObservationExpressioniLzfPattern 'OR' Compound Observation Expression Args: operands (str): compound observation operands c.>[[U] SU5 grB)rrXr+r=s r r+ OrObservationExpression.__init__Rs %t5dHEr rrrs@r rXrXLs FFr rXc,^\rSrSrSrU4SjrSrU=r$)FollowedByObservationExpressioniVzoPattern 'Followed by' Compound Observation Expression Args: operands (str): compound observation operands c.>[[U] SU5 g)N FOLLOWEDBY)rr\r+r=s r r+(FollowedByObservationExpression.__init__\s -t=lHUr rrrs@r r\r\Vs VVr r\c$\rSrSrSrSrSrSrg)ParentheticalExpressioni`zYPattern Parenthetical Observation Expression Args: exp (str): observation expression cVXl[US5(aURUlgg)Nr) expressionr/r)r)exps r r+ ParentheticalExpression.__init__fs$ 3 % %!nnDO &r c SUR-$)Nz(%s))rcr.s r r/ParentheticalExpression.__str__ks''r )rcrNr2rr r rara`s - (r rac\rSrSrSrg)_ExpressionQualifieriorNrrr r ririor r ric$\rSrSrSrSrSrSrg)RepeatQualifierisz\Pattern Repeat Qualifier Args: times_to_repeat (int): times the qualifiers is repeated c[U[5(aXlg[U[5(a[U5Ulg[ SU-5e)Nz1%s is not a valid argument for a Repeat Qualifier)rrBtimes_to_repeatrEr9)r)rms r r+RepeatQualifier.__init__ysA o 7 7#2  - -#2?#CD PSbbc cr c SUR-$)NzREPEATS %s TIMESrmr.s r r/RepeatQualifier.__str__s!D$8$888r rpNr2rr r rkrkss d9r rkc$\rSrSrSrSrSrSrg)WithinQualifierizdPattern 'Within' Qualifier Args: number_of_seconds (int): seconds value for 'within' qualifier c[U[5(aXlg[U[5(a[U5Ulg[ SU-5e)Nz1%s is not a valid argument for a Within Qualifier)rrBnumber_of_secondsrEr9)r)rus r r+WithinQualifier.__init__sD ' 9 9%6 " )3 / /%45F%GD "PSdde er c SUR-$)NzWITHIN %s SECONDSrur.s r r/WithinQualifier.__str__s"T%;%;;;r rxNr2rr r rsrss f[U[ 5(a[ UR 5UlO[SU-5e[U[5(aX lg[U[R5(a[U5Ulg[U[ 5(a[ UR 5Ulg[SU-5e)Nz5%s is not a valid argument for a Start/Stop Qualifier) rr5 start_timedatetimedater"r(r9 stop_time)r)r}rs r r+StartStopQualifier.__init__s j"3 4 4(O  HMM 2 2/ ;DO  N 3 3,Z-=-=>DOTWaab b i!2 3 3&N  8== 1 1.y9DN  > 2 2+IOOSUR<SUR<3$)NzSTART z STOP r}rr.s r r/StartStopQualifier.__str__s%)__dnnEEr rNr2rr r r{r{s b$Fr r{c$\rSrSrSrSrSrSrg)QualifiedObservationExpressionizPattern Qualified Observation Expression Args: observation_expression (PatternExpression OR _CompoundObservationExpression OR ): pattern expression qualifier (_ExpressionQualifier): pattern expression qualifier cXlX lgr%observation_expression qualifier)r)rrs r r+'QualifiedObservationExpression.__init__s &<#"r c<UR<SUR<3$r3rr.s r r/&QualifiedObservationExpression.__str__s55t~~FFr rNr2rr r rrs #Gr r)5r3rrr~rutilsrr robjectrr"r5rBrMrUrr{rrrrrrrrrrrrrrr rrrrr!r&r+r:r@rFrLrTrXr\rarirkrsr{rrr r rsC  &;    oY o ( ( !i ! !I!!'i!'J ) y5 +///0111255 * &6>6&$Y$.$)$* E9 EH:363$ +3 +" L2 L5#75IID  D.D@ S#8 S V&; V S#8 S \+@ \ Y(= Y N2 N R4 R X"7 X Z#8 Z ^%: ^;+;8D-DB,B S. S;%7;$H=HF<FV&DV (0 ( - 9*9$<*<$F-F: G%7 Gr