)z[file:hashes.'SHA-256' = 'f00']z'FAIL: 'f00' is not a valid SHA-256 hash)zY[win-registry-key:key = 'hkey_local_machine\\foo\\bar'] WITHIN 5 SECONDS WITHIN 6 SECONDSz2FAIL: Duplicate qualifier type encountered: WITHIN)zY([win-registry-key:key = 'hkey_local_machine\\foo\\bar'] REPEATS 2 TIMES REPEATS 3 TIMES)z3FAIL: Duplicate qualifier type encountered: REPEATS)z[win-registry-key:key = 'hkey_local_machine\\foo\\bar'] START t'2016-06-01T01:30:00.123Z' STOP t'2016-06-01T02:20:00.123Z' START t'2016-06-01T01:30:00.123Z' STOP t'2016-06-01T02:20:00.123Z'z5FAIL: Duplicate qualifier type encountered: STARTSTOPztest_input,test_outputcd[USSSS9up#USRU5(deUSLdeg)z* Validate that patterns fail as expected. rT)r ret_errsr rFN)r startswith)r test_outputr errorss r test_fail_patternsrAsA !%$[_`I !9   , ,, ,   r)z[file:size = 1280]z[file:size != 1280]z[file:size < 1024]z[file:size <= 1024]z[file:size > 1024]z[file:size >= 1024]z![file:file_name = 'my_file_name']z1[file:extended_properties.'ntfs-ext'.sid = '234']zY[emailaddr:value MATCHES '.+\\@ibm\\.com$' OR file:name MATCHES '^Final Report.+\\.exe$']z*[ipv4addr:value ISSUBSET '192.168.0.1/24']z.[ipv4addr:value NOT ISSUBSET '192.168.0.1/24']zt[user-account:value = 'Peter'] AND [user-account:value != 'Paul'] AND [user-account:value = 'Mary'] WITHIN 5 SECONDSz4[file:file_system_properties.file_name LIKE 'name%']z7[file:file_name IN ('test.txt', 'test2.exe', 'README')]z![file:size IN (1024, 2048, 4096)]zU[network-connection:extended_properties[0].source_payload MATCHES 'dGVzdHRlc3R0ZXN0']zH[win-registry-key:key = 'hkey_local_machine\\foo\\bar'] WITHIN 5 SECONDSz2[x_whatever:detected == t'2018-03-22T12:11:14.1Z']z0[artifact:payload_bin = b'dGhpcyBpcyBhIHRlc3Q=']zoo:bar=1] REPEATS 9 TIMESz4[network-traffic:start = '2018-04-20T12:36:24.558Z']zW( [(network-traffic:dst_port IN(443,6443,8443) AND network-traffic:src_packets != 0) ])z[([win-registry-key:key = 'hkey_local_machine\\foo\\bar']) WITHIN 5 SECONDS WITHIN 6 SECONDSzY([win-registry-key:key = 'hkey_local_machine\\foo\\bar'] REPEATS 2 TIMES) REPEATS 2 TIMESz[network-traffic:src_port = 37020 AND user-account:user_id = 'root'] START t'2016-06-01T01:30:00.123Z' STOP t'2016-06-01T02:20:00.123Z' OR [ipv4-addr:value = '192.168.122.83'] START t'2016-06-01T03:55:00.123Z' STOP t'2016-06-01T04:30:24.743Z'z5[file:hashes[*] = '8665c8d477534008b3058b72e2dae8ae']c([USSS9nUSLdeg)z* Validate that patterns pass as expected. rTrNrr s r test_pass_patternsrlrr)__doc__ospyteststix2patterns.validatorrpathjoindirname__file__TEST_CASE_FILEopenf readlinesstrip SPEC_CASESmark parametrizer FAIL_CASESr PASS_CASESr)xs0r r,s ,bggooh79LM .Q%&[[]3]'')]3Jz23& R1:>? Bz23C4sC9!C4:C94C99 D