
    <iJ                        S r SSKJr  SSKJr  SSKrSSKJr  SSKJ	r	  SSK
JrJrJr  SS	KJrJrJrJrJrJrJrJrJrJrJrJrJrJr  SS
KJr  SSKJ r   SSK!J"r"J#r#J$r$J%r%  SSK&J'r'J(r(J)r)J*r*J+r+J,r,J-r-J.r.J/r/J0r0J1r1J2r2J3r3J4r4J5r5J6r6J7r7J8r8J9r9J:r:   " S S\ 5      r; " S S\ 5      r< " S S\ 5      r= " S S\ 5      r> " S S\ 5      r? " S S\ 5      r@ " S S\ 5      rA " S S\ 5      rB " S S \ 5      rC " S! S"\ 5      rD " S# S$\ 5      rE " S% S&\ 5      rF " S' S(\ 5      rG " S) S*\ 5      rH " S+ S,\ 5      rI " S- S.\ 5      rJ " S/ S0\ 5      rK " S1 S2\ 5      rL " S3 S4\ 5      rMS6S5 jrNg)7zSTIX 2.1 Domain Objects.    )OrderedDict)
quote_plusN)run_validator   )_custom_object_builder)InvalidValueErrorPropertyPresenceErrorSTIXDeprecationWarning)BooleanPropertyEnumPropertyExtensionsPropertyFloatProperty
IDPropertyIntegerPropertyListPropertyObservablePropertyOpenVocabPropertyPatternPropertyReferencePropertyStringPropertyTimestampPropertyTypePropertyNOW   )_DomainObject)CustomExtensionExternalReferenceGranularMarkingKillChainPhase)ATTACK_MOTIVATIONATTACK_RESOURCE_LEVELGROUPING_CONTEXTIDENTITY_CLASSIMPLEMENTATION_LANGUAGEINDICATOR_TYPEINDUSTRY_SECTORINFRASTRUCTURE_TYPEMALWARE_CAPABILITIESMALWARE_RESULTMALWARE_TYPEOPINIONPATTERN_TYPEPROCESSOR_ARCHITECTUREREGIONREPORT_TYPETHREAT_ACTOR_ROLETHREAT_ACTOR_SOPHISTICATIONTHREAT_ACTOR_TYPE	TOOL_TYPEc                   d   \ rS rSrSrSr\" S\" \SS94S\" SS94S	\	" \SS94S
\
" SSS94S\" S SSS94S\" S SSS94S\" SS94S\" 5       4S\" \5      4S\" \5      4S\" S S94S\" \5      4S\" 5       4S\" 5       4S \" \5      4S!\" \
" S"SS95      4S#\" \5      4S$\" SS94/5      rS%rg&)'AttackPattern"   zFor more detailed information on this object's properties, see
`the STIX 2.1 specification <https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_axjijf603msy>`__.
zattack-patterntype2.1spec_versionr;   fixedidcreated_by_refidentityvalid_typesr;   createdc                      [         $ Nr        G/home/james-whalen/.local/lib/python3.13/site-packages/stix2/v21/sdo.py<lambda>AttackPattern.<lambda>-       crG   millisecondmindefault	precisionprecision_constraintmodifiedc                      [         $ rE   r   rF   rG   rH   rI   rJ   .       srG   nameTrequireddescriptionaliaseskill_chain_phasesrevokedc                      gNFrF   rF   rG   rH   rI   rJ   3       ErG   rO   labels
confidencelangexternal_referencesobject_marking_refsmarking-definitiongranular_markings
extensionsrF   N__name__
__module____qualname____firstlineno____doc___typer   r   r   r   r   r   r   r    r   r   r   r   r   _properties__static_attributes__rF   rG   rH   r6   r6   "   s!    E	e%89	e45	z%e45	,RWXY	%k]inop	&{mjopq	./	()	L01	l>:;	OM:;	</0	()	!"	-> ?@	->K_ns-t uv	l?;<	)u=>% KrG   r6   c                     ^  \ rS rSrSrSr\" S\" \SS94S\" SS94S	\	" \SS94S
\
" SSS94S\" S SSS94S\" S SSS94S\" SS94S\" 5       4S\" \5      4S\" 5       4S\" 5       4S\" 5       4S\" S S94S\" \5      4S \" 5       4S!\" 5       4S"\" \5      4S#\" \
" S$SS95      4S%\" \5      4S&\" SS94/5      rU 4S' jrS(rU =r$ ))Campaign>   zFor more detailed information on this object's properties, see
`the STIX 2.1 specification <https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_pcpvfz4ik6d6>`__.
campaignr8   r9   r:   r;   r<   r>   r?   r@   rA   rC   c                      [         $ rE   r   rF   rG   rH   rI   Campaign.<lambda>I   rK   rG   rL   rM   rN   rR   c                      [         $ rE   r   rF   rG   rH   rI   rv   J   rT   rG   rU   TrV   rX   rY   
first_seen	last_seen	objectiver[   c                      gr]   rF   rF   rG   rH   rI   rv   Q   r^   rG   r_   r`   ra   rb   rc   rd   re   rf   rg   c                    > [         [        U ]  5         U R                  S5      nU R                  S5      nU(       a*  U(       a"  X!:  a  Sn[	        UR                  U 5      5      eg g g Nrx   ry   @{0.id} 'last_seen' must be greater than or equal to 'first_seen')superrr   _check_object_constraintsget
ValueErrorformatselfrx   ry   msg	__class__s       rH   r   "Campaign._check_object_constraints[   sX    h79XXl+
HH[)	)	(>TCSZZ-.. )?):rG   rF   )ri   rj   rk   rl   rm   rn   r   r   r   r   r   r   r   r   r   r   r   r   ro   r   rp   __classcell__r   s   @rH   rr   rr   >   sB    E	e%89	e45	z%e45	,RWXY	%k]inop	&{mjopq	./	()	L01	(*+	')*	n&'	OM:;	</0	()	!"	-> ?@	->K_ns-t uv	l?;<	)u=>) K./ /rG   rr   c                   @   \ rS rSrSrSr\" S\" \SS94S\" SS94S	\	" \SS94S
\
" SSS94S\" S SSS94S\" S SSS94S\" SS94S\" 5       4S\" S S94S\" \5      4S\" 5       4S\" 5       4S\" \5      4S\" \
" S SS95      4S!\" \5      4S"\" SS94/5      rS#rg$)%CourseOfActionf   zFor more detailed information on this object's properties, see
`the STIX 2.1 specification <https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_a925mpw39txn>`__.
zcourse-of-actionr8   r9   r:   r;   r<   r>   r?   r@   rA   rC   c                      [         $ rE   r   rF   rG   rH   rI   CourseOfAction.<lambda>q   rK   rG   rL   rM   rN   rR   c                      [         $ rE   r   rF   rG   rH   rI   r   r   rT   rG   rU   TrV   rX   r[   c                      gr]   rF   rF   rG   rH   rI   r   u   r^   rG   r_   r`   ra   rb   rc   rd   re   rf   rg   rF   Nri   rj   rk   rl   rm   rn   r   r   r   r   r   r   r   r   r   r   r   r   ro   rp   rF   rG   rH   r   r   f   s    E	e%89	e45	z%e45	,RWXY	%k]inop	&{mjopq	./	()	OM:;	</0	()	!"	-> ?@	->K_ns-t uv	l?;<	)u=>! KrG   r   c                   p   \ rS rSrSrSr\" S\" \SS94S\" SS94S	\	" \SS94S
\
" SSS94S\" S SSS94S\" S SSS94S\" 5       4S\" 5       4S\" \SS94S\" \
" / SQSS9SS94S\" S S94S\" \5      4S\" 5       4S \" 5       4S!\" \5      4S"\" \
" S#SS95      4S$\" \5      4S%\" SS94/5      rS&rg')(Grouping   zFor more detailed information on this object's properties, see
`the STIX 2.1 specification <https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_t56pn7elv6u7>`__.
groupingr8   r9   r:   r;   r<   r>   r?   r@   rA   rC   c                      [         $ rE   r   rF   rG   rH   rI   Grouping.<lambda>   rK   rG   rL   rM   rN   rR   c                      [         $ rE   r   rF   rG   rH   rI   r      rT   rG   rU   rX   contextTrV   object_refsSCOSDOSROr[   c                      gr]   rF   rF   rG   rH   rI   r      r^   rG   r_   r`   ra   rb   rc   rd   re   rf   rg   rF   N)ri   rj   rk   rl   rm   rn   r   r   r   r   r   r   r   r#   r   r   r   r   r   r   ro   rp   rF   rG   rH   r   r      s0    E	e%89	e45	z%e45	,RWXY	%k]inop	&{mjopq	!"	()	%&6FG	%6CXgl%mx|}~	OM:;	</0	()	!"	-> ?@	->K_ns-t uv	l?;<	)u=>% KrG   r   c                      \ rS rSrSrSr\" S\" \SS94S\" SS94S	\	" \SS94S
\
" SSS94S\" S SSS94S\" S SSS94S\" SS94S\" 5       4S\" \5      4S\" \5      4S\" \" \5      5      4S\" 5       4S\" S S94S\" \5      4S\" 5       4S \" 5       4S!\" \5      4S"\" \
" S#SS95      4S$\" \5      4S%\" SS94/5      rS&rg')(Identity   zFor more detailed information on this object's properties, see
`the STIX 2.1 specification <https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_wh296fiwpklp>`__.
r@   r8   r9   r:   r;   r<   r>   r?   rA   rC   c                      [         $ rE   r   rF   rG   rH   rI   Identity.<lambda>   rK   rG   rL   rM   rN   rR   c                      [         $ rE   r   rF   rG   rH   rI   r      rT   rG   rU   TrV   rX   rolesidentity_classsectorscontact_informationr[   c                      gr]   rF   rF   rG   rH   rI   r      r^   rG   r_   r`   ra   rb   rc   rd   re   rf   rg   rF   N)ri   rj   rk   rl   rm   rn   r   r   r   r   r   r   r   r   r$   r'   r   r   r   r   r   ro   rp   rF   rG   rH   r   r      s@    E	e%89	e45	z%e45	,RWXY	%k]inop	&{mjopq	./	()	,~./	,^<=	L!2?!CDE	 01	OM:;	</0	()	!"	-> ?@	->K_ns-t uv	l?;<	)u=>) KrG   r   c                   R   \ rS rSrSrSr\" S\" \SS94S\" SS94S	\	" \SS94S
\
" SSS94S\" S SSS94S\" S SSS94S\" SS94S\" 5       4S\" \5      4S\" S S94S\" \5      4S\" 5       4S\" 5       4S\" \5      4S \" \
" S!SS95      4S"\" \5      4S#\" SS94/5      rS$rg%)&Incident   zFor more detailed information on this object's properties, see
`the STIX 2.1 specification <https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_sczfhw64pjxt>`__.
incidentr8   r9   r:   r;   r<   r>   r?   r@   rA   rC   c                      [         $ rE   r   rF   rG   rH   rI   Incident.<lambda>   rK   rG   rL   rM   rN   rR   c                      [         $ rE   r   rF   rG   rH   rI   r      rT   rG   rU   TrV   rX   rZ   r[   c                      gr]   rF   rF   rG   rH   rI   r      r^   rG   r_   r`   ra   rb   rc   rd   re   rf   rg   rF   Nrh   rF   rG   rH   r   r      s    E	e%89	e45	z%e45	,RWXY	%k]inop	&{mjopq	./	()	l>:;	OM:;	</0	()	!"	-> ?@	->K_ns-t uv	l?;<	)u=># KrG   r   c                     ^  \ rS rSrSrSr\" S\" \SS94S\" SS94S	\	" \SS94S
\
" SSS94S\" S SSS94S\" S SSS94S\" 5       4S\" 5       4S\" \" \5      5      4S\" SS94S\" \SS94S\" 5       4S\" S S94S\" 5       4S \" \5      4S!\" S" S94S#\" \5      4S$\" 5       4S%\" 5       4S&\" \5      4S'\" \
" S(SS95      4S)\" \5      4S*\" SS94/5      rU 4S+ jrU 4S, jrS-rU =r$ ).	Indicator   zFor more detailed information on this object's properties, see
`the STIX 2.1 specification <https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_muftrcpnf89v>`__.
	indicatorr8   r9   r:   r;   r<   r>   r?   r@   rA   rC   c                      [         $ rE   r   rF   rG   rH   rI   Indicator.<lambda>   rK   rG   rL   rM   rN   rR   c                      [         $ rE   r   rF   rG   rH   rI   r      rT   rG   rU   rX   indicator_typespatternTrV   pattern_typepattern_version
valid_fromc                      [         $ rE   r   rF   rG   rH   rI   r      s    rG   r_   valid_untilrZ   r[   c                      gr]   rF   rF   rG   rH   rI   r      r^   rG   r`   ra   rb   rc   rd   re   rf   rg   c                    > UR                  S5      (       a0  UR                  S5      S:X  a  UR                  S5      (       d  SUS'   [        [        U ]  " U0 UD6  g )Nr   r   stixr   r9   )r   r   r   __init__r   argskwargsr   s      rH   r   Indicator.__init__   sS    ::i  VZZ%?6%IRXR\R\]nRoRo(-F$%i'88rG   c                   > [         [        U ]  5         U R                  S5      nU R                  S5      nU(       a(  U(       a!  X!::  a  Sn[	        UR                  U 5      5      eU R                  S5      S:X  aX   U R                  S5      n[        U R                  S5      U5      nU(       a#  [        U R                  S[        US	   5      5      eg g ! [         a    Sn NUf = f)
Nr   r   z6{0.id} 'valid_until' must be greater than 'valid_from'r   r   r   r9   r   r   )r   r   r   r   r   r   AttributeErrorr   r   r   str)r   r   r   r   pat_vererrorsr   s         rH   r   #Indicator._check_object_constraints   s    i8:XXl+
hh}-++*CJCSZZ-..88N#v- ((#45 #488I#6@F'	3vay>RR  . "   s   ;C C"!C"rF   )ri   rj   rk   rl   rm   rn   r   r   r   r   r   r   r   r   r&   r   r-   r    r   r   r   r   r   ro   r   r   rp   r   r   s   @rH   r   r      sy    E	e%89	e45	z%e45	,RWXY	%k]inop	&{mjopq	!"	()	L):>)JKL	OT23	*<$GH	N,-	(=>	)+,	l>:;	OM:;	</0	()	!"	-> ?@	->K_ns-t uv	l?;<	)u=>/ K49S SrG   r   c                     ^  \ rS rSrSrSr\" S\" \SS94S\" SS94S	\	" \SS94S
\
" SSS94S\" S SSS94S\" S SSS94S\" SS94S\" 5       4S\" \" \5      5      4S\" \5      4S\" \5      4S\" 5       4S\" 5       4S\" S S94S \" \5      4S!\" 5       4S"\" 5       4S#\" \5      4S$\" \
" S%SS95      4S&\" \5      4S'\" SS94/5      rU 4S( jrS)rU =r$ )*Infrastructurei  zFor more detailed information on this object's properties, see
`the STIX 2.1 specification <https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_jo3k1o6lr9>`__.
infrastructurer8   r9   r:   r;   r<   r>   r?   r@   rA   rC   c                      [         $ rE   r   rF   rG   rH   rI   Infrastructure.<lambda>  rK   rG   rL   rM   rN   rR   c                      [         $ rE   r   rF   rG   rH   rI   r     rT   rG   rU   TrV   rX   infrastructure_typesrY   rZ   rx   ry   r[   c                      gr]   rF   rF   rG   rH   rI   r   %  r^   rG   r_   r`   ra   rb   rc   rd   re   rf   rg   c                    > [         [        U ]  5         U R                  S5      nU R                  S5      nU(       a*  U(       a"  X!:  a  Sn[	        UR                  U 5      5      eg g g r}   )r   r   r   r   r   r   r   s       rH   r   (Infrastructure._check_object_constraints/  sX    nd=?XXl+
HH[)	)	(>TCSZZ-.. )?):rG   rF   )ri   rj   rk   rl   rm   rn   r   r   r   r   r   r   r   r   r(   r    r   r   r   r   r   ro   r   rp   r   r   s   @rH   r   r     sX    E	e%89	e45	z%e45	,RWXY	%k]inop	&{mjopq	./	()	.?@S.T!UV	L01	l>:;	(*+	')*	OM:;	</0	()	!"	-> ?@	->K_ns-t uv	l?;<	)u=>+ K0/ /rG   r   c                     ^  \ rS rSrSrSr\" S\" \SS94S\" SS94S	\	" \SS94S
\
" SSS94S\" S SSS94S\" S SSS94S\" SS94S\" 5       4S\" \5      4S\" 5       4S\" 5       4S\" \5      4S\" \5      4S\" \5      4S\" \" \5      5      4S\" S  S!94S"\" \5      4S#\" 5       4S$\" 5       4S%\" \5      4S&\" \
" S'SS95      4S(\" \5      4S)\" SS94/5      rU 4S* jrS+rU =r$ ),IntrusionSeti:  zFor more detailed information on this object's properties, see
`the STIX 2.1 specification <https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_5ol9xlbbnrdn>`__.
zintrusion-setr8   r9   r:   r;   r<   r>   r?   r@   rA   rC   c                      [         $ rE   r   rF   rG   rH   rI   IntrusionSet.<lambda>E  rK   rG   rL   rM   rN   rR   c                      [         $ rE   r   rF   rG   rH   rI   r   F  rT   rG   rU   TrV   rX   rY   rx   ry   goalsresource_levelprimary_motivationsecondary_motivationsr[   c                      gr]   rF   rF   rG   rH   rI   r   P  r^   rG   r_   r`   ra   rb   rc   rd   re   rf   rg   c                    > [         [        U ]  5         U R                  S5      nU R                  S5      nU(       a*  U(       a"  X!:  a  Sn[	        UR                  U 5      5      eg g g r}   )r   r   r   r   r   r   r   s       rH   r   &IntrusionSet._check_object_constraintsZ  sX    lD;=XXl+
HH[)	)	(>TCSZZ-.. )?):rG   rF   )ri   rj   rk   rl   rm   rn   r   r   r   r   r   r   r   r   r"   r!   r   r   r   r   r   ro   r   rp   r   r   s   @rH   r   r   :  sv    E	e%89	e45	z%e45	,RWXY	%k]inop	&{mjopq	./	()	L01	(*+	')*	,~./	,-BCD	01BCD	 ,/@AR/S"TU	OM:;	</0	()	!"	-> ?@	->K_ns-t uv	l?;<	)u=>/ K4/ /rG   r   c                      ^  \ rS rSrSrSr\" S\" \SS94S\" SS94S	\	" \SS94S
\
" SSS94S\" S SSS94S\" S SSS94S\" 5       4S\" 5       4S\" SSS94S\" SSS94S\" SS94S \" \5      4S!\" 5       4S"\" 5       4S#\" 5       4S$\" 5       4S%\" 5       4S&\" S' S(94S)\" \5      4S*\" 5       4S+\" 5       4S,\" \5      4S-\" \
" S.SS95      4S/\" \5      4S0\" SS94/5      rU 4S1 jrS7S2 jrS3 rS4 rS5 rS6rU =r$ )8Locationie  zFor more detailed information on this object's properties, see
`the STIX 2.1 specification <https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_th8nitr8jb4k>`__.
locationr8   r9   r:   r;   r<   r>   r?   r@   rA   rC   c                      [         $ rE   r   rF   rG   rH   rI   Location.<lambda>p  rK   rG   rL   rM   rN   rR   c                      [         $ rE   r   rF   rG   rH   rI   r   q  rT   rG   rU   rX   latitudeg     Vg     V@)rM   max	longitudeg     fg     f@rP   g        )rM   regioncountryadministrative_areacitystreet_addresspostal_coder[   c                      gr]   rF   rF   rG   rH   rI   r   }  r^   rG   r_   r`   ra   rb   rc   rd   re   rf   rg   c                   > [         [        U ]  5         U R                  S5      b  U R	                  SS/S/5        U R	                  S/S/5        U R	                  S/S/5        SU ;   d$  SU ;   d  SU ;   a  SU ;   d  [        S[        5      eg g g )NrP   r   r   r   r   z\Location objects must have the properties 'region', 'country', or 'latitude' and 'longitude')r   r   r   r   _check_properties_dependencyr	   r   r   s    rH   r   "Location._check_object_constraints  s    h7988K ,--{J.G+W)):,F));-*F D d"4' (;  ( ! rG   c                 B   / nU R                  SS5      nU R                  SS5      nUb)  Ub&  UR                  [        U5      [        U5      /5        O8/ SQnU Vs/ s H'  o`R                  U5      c  M  U R                  U5      PM)     nnU R                  X5      $ s  snf )zReturn URL to this location in an online map engine.

Google Maps is the default, but Bing maps are also supported.

Args:
    map_engine (str): Which map engine to find the location in

Returns:
    The URL of the location in the given map engine.

r   Nr   )r   r   r   r   r   r   )r   extendr   _to_maps_url_dispatcher)r   
map_engineparamsr   r   
propertiesprops          rH   to_maps_urlLocation.to_maps_url  s     88J-HH[$/	I$9MM3x=#i.9:nJ1;Zxx~ndhhtnFZ++J?? [s   B4Bc                 z    US:X  a  U R                  U5      $ US:X  a  U R                  U5      $ [        US-   5      e)NGoogle Mapsz	Bing Mapsz1 is not a valid or currently-supported map engine)_to_google_maps_url_to_bing_maps_urlr   )r   r   r   s      rH   r    Location._to_maps_url_dispatcher  sE    &++F33;&))&11Z*]]^^rG   c                 |    SnUS   n[        S[        U5      5       H  nUS-   X   -   nM     U[        U5      -   nU$ )Nz0https://www.google.com/maps/search/?api=1&query=r   r   ,rangelenr   r   r   url_base
url_endingi	final_urls         rH   r  Location._to_google_maps_url  sM    EAY
q#f+&A#c)FI5J ' z*55	rG   c                     SnUS   n[        S[        U5      5       H  nUS-   X   -   nM     U[        U5      -   S-   nU$ )Nz*https://bing.com/maps/default.aspx?where1=r   r   r	  z&lvl=16r
  r  s         rH   r  Location._to_bing_maps_url  sR    ?AY
q#f+&A#c)FI5J ' z*55	A	rG   rF   )r  )ri   rj   rk   rl   rm   rn   r   r   r   r   r   r   r   r   r/   r   r   r   r   r   r   ro   r   r  r   r  r  rp   r   r   s   @rH   r   r   e  s    E	e%89	e45	z%e45	,RWXY	%k]inop	&{mjopq	!"	()	]u$78	mE:;	m,-	$V,-	N$%	 01	!"	>+,	()	OM:;	</0	()	!"	-> ?@	->K_ns-t uv	l?;<	)u=>3 K8.@0_ rG   r   c            "       \  ^  \ rS rSrSrSr\" S\" \SS94S\" SS94S	\	" \SS94S
\
" SSS94S\" S SSS94S\" S SSS94S\" 5       4S\" 5       4S\" \" \5      5      4S\" SS94S\" \5      4S\" \5      4S\" 5       4S\" 5       4S\" \
" SSS95      4S \" \" \5      5      4S!\" \" \5      5      4S"\" \" \5      5      4S#\" \
" S$S%/SS95      4S&\" S' S(94S)\" \5      4S*\" 5       4S+\" 5       4S,\" \5      4S-\" \
" S.SS95      4S/\" \5      4S0\" SS94/5      rU 4S1 jrS2rU =r$ )3Malwarei  zFor more detailed information on this object's properties, see
`the STIX 2.1 specification <https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_s5l7katgbp09>`__.
malwarer8   r9   r:   r;   r<   r>   r?   r@   rA   rC   c                      [         $ rE   r   rF   rG   rH   rI   Malware.<lambda>  rK   rG   rL   rM   rN   rR   c                      [         $ rE   r   rF   rG   rH   rI   r    rT   rG   rU   rX   malware_types	is_familyTrV   rY   rZ   rx   ry   operating_system_refssoftwarearchitecture_execution_envsimplementation_languagescapabilitiessample_refsartifactfiler[   c                      gr]   rF   rF   rG   rH   rI   r    r^   rG   r_   r`   ra   rb   rc   rd   re   rf   rg   c                   > [         [        U ]  5         U R                  S5      nU R                  S5      nU(       a(  U(       a!  X!:  a  Sn[	        UR                  U 5      5      eU R                  (       a  SU ;  a  [        S[        5      eg g )Nrx   ry   r~   rU   z2'name' is a required property for malware families)r   r  r   r   r   r   r  r	   r   s       rH   r   !Malware._check_object_constraints  sw    gt68XXl+
HH[)	)	(>TCSZZ-..>>fD0'D  1>rG   rF   )ri   rj   rk   rl   rm   rn   r   r   r   r   r   r   r   r   r+   r   r    r.   r%   r)   r   r   r   r   ro   r   rp   r   r   s   @rH   r  r    s    E	e%89	e45	z%e45	,RWXY	%k]inop	&{mjopq	!"	()	,'8'FGH	ot45	L01	l>:;	(*+	')*	 ,/@Zfk/l"mn	&5FG]5^(_`	#\2CD[2\%]^	&78L&MNO	%6JPVCWfk%lmn	OM:;	</0	()	!"	-> ?@	->K_ns-t uv	l?;<	)u=>7 K< rG   r  c            %       P  ^  \ rS rSrSrSr\" S\" \SS94S\" SS94S	\	" \SS94S
\
" SSS94S\" S SSS94S\" S SSS94S\" SS94S\" 5       4S\
" SSS94S\
" SSS94S\" \
" SSS95      4S\" 5       4S\" \5      4S\" 5       4S\" 5       4S \" 5       4S!\" 5       4S"\" 5       4S#\" 5       4S$\" \5      4S%\" \
" S&SS95      4S'\
" S&SS94S(\" S) S*94S+\" \5      4S,\" 5       4S-\" 5       4S.\" \5      4S/\" \
" S0SS95      4S1\" \5      4S2\" SS94/5      rU 4S3 jrS4rU =r$ )5MalwareAnalysisi  zFor more detailed information on this object's properties, see
`the STIX 2.1 specification <https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_6hdrixb3ua4j>`__.
zmalware-analysisr8   r9   r:   r;   r<   r>   r?   r@   rA   rC   c                      [         $ rE   r   rF   rG   rH   rI   MalwareAnalysis.<lambda>  rK   rG   rL   rM   rN   rR   c                      [         $ rE   r   rF   rG   rH   rI   r+    rT   rG   productTrV   versionhost_vm_refr  operating_system_refinstalled_software_refsconfiguration_versionmodulesanalysis_engine_versionanalysis_definition_version	submittedanalysis_startedanalysis_endedresult_nameresultanalysis_sco_refsr   
sample_refr[   c                      gr]   rF   rF   rG   rH   rI   r+  #  r^   rG   r_   r`   ra   rb   rc   rd   re   rf   rg   c                 P   > [         [        U ]  5         U R                  SS/5        g )Nr:  r;  )r   r)  r   _check_at_least_one_propertyr   s    rH   r   )MalwareAnalysis._check_object_constraints-  s$    ot>@))85H*IJrG   rF   )ri   rj   rk   rl   rm   rn   r   r   r   r   r   r   r   r   r*   r   r   r   r   r   ro   r   rp   r   r   s   @rH   r)  r)    s    E	e%89	e45	z%e45	,RWXY	%k]inop	&{mjopq	ND12	N$%	)juUV	!2zX]!^_	"L1Bzhm1n$op	 ."23	L01	"N$45	&(89	')*	.01	,./	()	$^45	l+<]b+cde	(UOP	OM:;	</0	()	!"	-> ?@	->K_ns-t uv	l?;<	)u=>= KBK KrG   r)  c                   p   \ rS rSrSrSr\" S\" \SS94S\" SS94S	\	" \SS94S
\
" SSS94S\" S SSS94S\" S SSS94S\" 5       4S\" SS94S\" \5      4S\" \
" / SQSS9SS94S\" S S94S\" \5      4S\" 5       4S \" 5       4S!\" \5      4S"\" \
" S#SS95      4S$\" \5      4S%\" SS94/5      rS&rg')(Notei3  zFor more detailed information on this object's properties, see
`the STIX 2.1 specification <https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_gudodcg1sbb9>`__.
noter8   r9   r:   r;   r<   r>   r?   r@   rA   rC   c                      [         $ rE   r   rF   rG   rH   rI   Note.<lambda>>  rK   rG   rL   rM   rN   rR   c                      [         $ rE   r   rF   rG   rH   rI   rE  ?  rT   rG   abstractcontentTrV   authorsr   r   r[   c                      gr]   rF   rF   rG   rH   rI   rE  D  r^   rG   r_   r`   ra   rb   rc   rd   re   rf   rg   rF   N)ri   rj   rk   rl   rm   rn   r   r   r   r   r   r   r   r   r   r   r   r   ro   rp   rF   rG   rH   rB  rB  3  s.    E	e%89	e45	z%e45	,RWXY	%k]inop	&{mjopq	^%&	ND12	L01	%6CXgl%mx|}~	OM:;	</0	()	!"	-> ?@	->K_ns-t uv	l?;<	)u=>% KrG   rB  c                     ^  \ rS rSrSrSr\" S\" \SS94S\" SS94S	\	" \SS94S
\
" SSS94S\" S SSS94S\" S SSS94S\" SS94S\" SS94S\" SSSS94S\" SS94S\" \
" SS/SS95      4S \" S! S"94S#\" \5      4S$\" 5       4S%\" 5       4S&\" \5      4S'\" \
" S(SS95      4S)\" \5      4S*\" SS94/5      rU 4S+ jrU 4S, jrS-rU =r$ ).ObservedDataiO  zFor more detailed information on this object's properties, see
`the STIX 2.1 specification <https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_p49j1fwoxldc>`__.
zobserved-datar8   r9   r:   r;   r<   r>   r?   r@   rA   rC   c                      [         $ rE   r   rF   rG   rH   rI   ObservedData.<lambda>Z  rK   rG   rL   rM   rN   rR   c                      [         $ rE   r   rF   rG   rH   rI   rN  [  rT   rG   first_observedTrV   last_observednumber_observedr   iɚ;)rM   r   rW   objectsr   r   r   r[   c                      gr]   rF   rF   rG   rH   rI   rN  a  r^   rG   r_   r`   ra   rb   rc   rd   re   rf   rg   c                 p   > SU;   a  [         R                  " S[        5        [        [        U ]  " U0 UD6  g )NrS  zBThe 'objects' property of observed-data is deprecated in STIX 2.1.)warningswarnr
   r   rL  r   r   s      rH   r   ObservedData.__init__k  s5    MM& 	lD*D;F;rG   c                    > [         [        U ]  5         U R                  S5      nU R                  S5      nU(       a(  U(       a!  X!:  a  Sn[	        UR                  U 5      5      eU R                  SS/5        g )NrP  rQ  zH{0.id} 'last_observed' must be greater than or equal to 'first_observed'rS  r   )r   rL  r   r   r   r   $_check_mutually_exclusive_propertiesr   rP  rQ  r   r   s       rH   r   &ObservedData._check_object_constraintsv  sf    lD;="231m0N\CSZZ-..11&	
rG   rF   )ri   rj   rk   rl   rm   rn   r   r   r   r   r   r   r   r   r   r   r   r   r   ro   r   r   rp   r   r   s   @rH   rL  rL  O  sT    E	e%89	e45	z%e45	,RWXY	%k]inop	&{mjopq	,d;<	+T:;	Oy4PQ	&E:;	%6E5>`e%fgh	OM:;	</0	()	!"	-> ?@	->K_ns-t uv	l?;<	)u=>' K,	<
 
rG   rL  c                   r   \ rS rSrSrSr\" S\" \SS94S\" SS94S	\	" \SS94S
\
" SSS94S\" S SSS94S\" S SSS94S\" 5       4S\" \5      4S\" \SS94S\" \
" / SQSS9SS94S\" S S94S\" \5      4S\" 5       4S\" 5       4S \" \5      4S!\" \
" S"SS95      4S#\" \5      4S$\" SS94/5      rS%rg&)'Opinioni  zFor more detailed information on this object's properties, see
`the STIX 2.1 specification <https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_ht1vtzfbtzda>`__.
opinionr8   r9   r:   r;   r<   r>   r?   r@   rA   rC   c                      [         $ rE   r   rF   rG   rH   rI   Opinion.<lambda>  rK   rG   rL   rM   rN   rR   c                      [         $ rE   r   rF   rG   rH   rI   ra    rT   rG   explanationrI  TrV   r   r   r[   c                      gr]   rF   rF   rG   rH   rI   ra    r^   rG   r_   r`   ra   rb   rc   rd   re   rf   rg   rF   N)ri   rj   rk   rl   rm   rn   r   r   r   r   r   r   r   r   r,   r   r   r   r   r   ro   rp   rF   rG   rH   r^  r^    s0    E	e%89	e45	z%e45	,RWXY	%k]inop	&{mjopq	()	L01	L489	%6CXgl%mx|}~	OM:;	</0	()	!"	-> ?@	->K_ns-t uv	l?;<	)u=>% KrG   r^  c                      \ rS rSrSrSr\" S\" \SS94S\" SS94S	\	" \SS94S
\
" SSS94S\" S SSS94S\" S SSS94S\" SS94S\" 5       4S\" \" \5      5      4S\" SS94S\" \
" / SQSS9SS94S\" S S94S\" \5      4S \" 5       4S!\" 5       4S"\" \5      4S#\" \
" S$SS95      4S%\" \5      4S&\" SS94/5      rS'rg())Reporti  zFor more detailed information on this object's properties, see
`the STIX 2.1 specification <https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_n8bjzg1ysgdq>`__.
reportr8   r9   r:   r;   r<   r>   r?   r@   rA   rC   c                      [         $ rE   r   rF   rG   rH   rI   Report.<lambda>  rK   rG   rL   rM   rN   rR   c                      [         $ rE   r   rF   rG   rH   rI   ri    rT   rG   rU   TrV   rX   report_types	publishedr   r   r[   c                      gr]   rF   rF   rG   rH   rI   ri    r^   rG   r_   r`   ra   rb   rc   rd   re   rf   rg   rF   N)ri   rj   rk   rl   rm   rn   r   r   r   r   r   r   r   r   r0   r   r   r   r   r   ro   rp   rF   rG   rH   rf  rf    sB    E	e%89	e45	z%e45	,RWXY	%k]inop	&{mjopq	./	()	&7&DEF	'67	%6CXgl%mx|}~	OM:;	</0	()	!"	-> ?@	->K_ns-t uv	l?;<	)u=>' KrG   rf  c            "       F  ^  \ rS rSrSrSr\" S\" \SS94S\" SS94S	\	" \SS94S
\
" SSS94S\" S SSS94S\" S SSS94S\" SS94S\" 5       4S\" \" \5      5      4S\" \5      4S\" 5       4S\" 5       4S\" \" \5      5      4S\" \5      4S\" \5      4S\" \5      4S \" \5      4S!\" \" \5      5      4S"\" \" \5      5      4S#\" S$ S%94S&\" \5      4S'\" 5       4S(\" 5       4S)\" \5      4S*\" \
" S+SS95      4S,\" \5      4S-\" SS94/5      rU 4S. jrS/rU =r$ )0ThreatActori  zFor more detailed information on this object's properties, see
`the STIX 2.1 specification <https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_k017w16zutw>`__.
zthreat-actorr8   r9   r:   r;   r<   r>   r?   r@   rA   rC   c                      [         $ rE   r   rF   rG   rH   rI   ThreatActor.<lambda>  rK   rG   rL   rM   rN   rR   c                      [         $ rE   r   rF   rG   rH   rI   rq    rT   rG   rU   TrV   rX   threat_actor_typesrY   rx   ry   r   r   sophisticationr   r   r   personal_motivationsr[   c                      gr]   rF   rF   rG   rH   rI   rq    r^   rG   r_   r`   ra   rb   rc   rd   re   rf   rg   c                    > [         [        U ]  5         U R                  S5      nU R                  S5      nU(       a*  U(       a"  X!:  a  Sn[	        UR                  U 5      5      eg g g r}   )r   ro  r   r   r   r   r[  s       rH   r   %ThreatActor._check_object_constraints  sY    k4:<,/-m0NTCSZZ-.. 1Om>rG   rF   )ri   rj   rk   rl   rm   rn   r   r   r   r   r   r   r   r   r3   r1   r2   r"   r!   r   r   r   r   r   ro   r   rp   r   r   s   @rH   ro  ro    s    E	e%89	e45	z%e45	,RWXY	%k]inop	&{mjopq	./	()	|,=>O,PQR	L01	(*+	')*	,01BCDE	,~./	,-HIJ	,-BCD	01BCD	 ,/@AR/S"TU	.?@Q.R!ST	OM:;	</0	()	!"	-> ?@	->K_ns-t uv	l?;<	)u=>7 K</ /rG   ro  c                      \ rS rSrSrSr\" S\" \SS94S\" SS94S	\	" \SS94S
\
" SSS94S\" S SSS94S\" S SSS94S\" SS94S\" 5       4S\" \" \5      5      4S\" \5      4S\" \5      4S\" 5       4S\" S S94S\" \5      4S \" 5       4S!\" 5       4S"\" \5      4S#\" \
" S$SS95      4S%\" \5      4S&\" SS94/5      rS'rg())Tooli  zFor more detailed information on this object's properties, see
`the STIX 2.1 specification <https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_z4voa9ndw8v>`__.
toolr8   r9   r:   r;   r<   r>   r?   r@   rA   rC   c                      [         $ rE   r   rF   rG   rH   rI   Tool.<lambda>  rK   rG   rL   rM   rN   rR   c                      [         $ rE   r   rF   rG   rH   rI   r}    rT   rG   rU   TrV   rX   
tool_typesrY   rZ   tool_versionr[   c                      gr]   rF   rF   rG   rH   rI   r}     r^   rG   r_   r`   ra   rb   rc   rd   re   rf   rg   rF   N)ri   rj   rk   rl   rm   rn   r   r   r   r   r   r   r   r   r4   r    r   r   r   r   r   ro   rp   rF   rG   rH   rz  rz    s?    E	e%89	e45	z%e45	,RWXY	%k]inop	&{mjopq	./	()	|$5i$@AB	L01	l>:;	)*	OM:;	</0	()	!"	-> ?@	->K_ns-t uv	l?;<	)u=>) KrG   rz  c                   @   \ rS rSrSrSr\" S\" \SS94S\" SS94S	\	" \SS94S
\
" SSS94S\" S SSS94S\" S SSS94S\" SS94S\" 5       4S\" S S94S\" \5      4S\" 5       4S\" 5       4S\" \5      4S\" \
" S SS95      4S!\" \5      4S"\" SS94/5      rS#rg$)%Vulnerabilityi  zFor more detailed information on this object's properties, see
`the STIX 2.1 specification <https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_q5ytzmajn6re>`__.
vulnerabilityr8   r9   r:   r;   r<   r>   r?   r@   rA   rC   c                      [         $ rE   r   rF   rG   rH   rI   Vulnerability.<lambda>  rK   rG   rL   rM   rN   rR   c                      [         $ rE   r   rF   rG   rH   rI   r    rT   rG   rU   TrV   rX   r[   c                      gr]   rF   rF   rG   rH   rI   r    r^   rG   r_   r`   ra   rb   rc   rd   re   rf   rg   rF   Nr   rF   rG   rH   r  r    s    E	e%89	e45	z%e45	,RWXY	%k]inop	&{mjopq	./	()	OM:;	</0	()	!"	-> ?@	->K_ns-t uv	l?;<	)u=>! KrG   r  c                     ^ ^^^ UUUU 4S jnU$ )a  Custom STIX Object type decorator.

Example:
    >>> from stix2.v21 import CustomObject
    >>> from stix2.properties import IntegerProperty, StringProperty
    >>> @CustomObject('x-type-name', [
    ...     ('property1', StringProperty(required=True)),
    ...     ('property2', IntegerProperty()),
    ... ])
    ... class MyNewObjectType():
    ...     pass

Supply an ``__init__()`` function to add any special validations to the custom
type. Don't call ``super().__init__()`` though - doing so will cause an error.

Example:
    >>> from stix2.v21 import CustomObject
    >>> from stix2.properties import IntegerProperty, StringProperty
    >>> @CustomObject('x-type-name', [
    ...     ('property1', StringProperty(required=True)),
    ...     ('property2', IntegerProperty()),
    ... ])
    ... class MyNewObjectType():
    ...     def __init__(self, property2=None, **kwargs):
    ...         if property2 and property2 < 10:
    ...             raise ValueError("'property2' is too small.")

c                   > T Vs/ s H  oS   R                  S5      (       a  M  UPM!     nnS[        T	SS94S[        SS94S[        T	SS94S	[	        S
SS94S[        S SSS94S[        S SSS94/U-   S[        S S94S[        [        5      4S[        5       4S[        5       4S[        [        5      4S[        [	        SSS95      4S[        [        5      4S[        SS94/-   [        S T 5       S S 9-   nT(       aQ  [        T0 S!9 " U4S" jS#5      5       nTR                  S$5      S%   nUR                  S&S'5      nS(U-   Ul        TU l        [%        U T	US[&        5      $ s  snf ))Nr   x_r8   r9   r:   r;   r<   r>   r?   r@   rA   rC   c                      [         $ rE   r   rF   rG   rH   rI   /CustomObject.<locals>.wrapper.<locals>.<lambda>J  s    crG   rL   rM   rN   rR   c                      [         $ rE   r   rF   rG   rH   rI   r  K  s    srG   r[   c                      gr]   rF   rF   rG   rH   rI   r  O  s    ErG   r_   r`   ra   rb   rc   rd   re   rf   rg   c              3   Z   #    U  H!  oS    R                  S5      (       d  M  Uv   M#     g7f)r   r  N)
startswith).0xs     rH   	<genexpr>0CustomObject.<locals>.wrapper.<locals>.<genexpr>X  s     EAtt/Daas   +	+c                     U S   $ )Nr   rF   )r  s    rH   rI   r  X  s    UVWXUYrG   )key)r8   r   c                   4   > \ rS rSr Y (       a  SrSrgSrSrg)4CustomObject.<locals>.wrapper.<locals>.NameExtensioni\  znew-sdoznew-srorF   N)ri   rj   rk   rl   extension_typerp   )is_sdos   rH   NameExtensionr  \  s    %.N%.NrG   r  z--r   - ExtensionDefinition)r  r   r   r   r   r   r   r   r   r   r   r   sortedr   splitreplaceri   with_extensionr   r   )
clsr  extension_propertiesro   r  	extensionextension_namer  r   r8   s
         rH   wrapperCustomObject.<locals>.wrapperB  s   +5S:aqT__T=R:S d?@e!<=z$U;<!#4Z_#`a-k]qvwx.{mrwxy ## OMBC<7801)*&5F(GH&5FSgv{5|(}~$l?&CD1uEF	& EE>Z'[ 	. .R@/ / A/ ',,T215I!))#r2I%:Y%FM"!/C%c4e]SSI  Ts
   E(E(rF   )r8   r   r  r  r  s   ```` rH   CustomObjectr  %  s    :%T %TN NrG   )zx-custom-typeNNT)Orm   collectionsr   urllib.parser   rV  stix2patterns.validatorr   customr   
exceptionsr   r	   r
   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   utilsr   baser   commonr   r   r   r    vocabr!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   r,   r-   r.   r/   r0   r1   r2   r3   r4   r6   rr   r   r   r   r   r   r   r   r   r  r)  rB  rL  r^  rf  ro  rz  r  r  rF   rG   rH   <module>r     s^    # #  1 +            M 8%/} %/P] 4} 8} <} 69S 9Sx&/] &/R(/= (/Vi} iX2m 2j*Km *KZ= 83
= 3
lm 8] :,/- ,/^= <M 4DrG   