ruby-stix2 0.1.0 → 0.1.2

Sign up to get free protection for your applications and to get access to all the features.
Files changed (72) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/build.yml +4 -3
  3. data/Gemfile +1 -1
  4. data/Gemfile.lock +54 -1
  5. data/README.md +49 -3
  6. data/lib/stix2/base.rb +7 -0
  7. data/lib/stix2/bundle.rb +1 -2
  8. data/lib/stix2/common.rb +104 -22
  9. data/lib/stix2/confidence_scale.rb +106 -0
  10. data/lib/stix2/custom_object.rb +20 -0
  11. data/lib/stix2/cyberobservable_objects/artifact.rb +1 -1
  12. data/lib/stix2/cyberobservable_objects/directory.rb +1 -1
  13. data/lib/stix2/cyberobservable_objects/domain_name.rb +1 -1
  14. data/lib/stix2/cyberobservable_objects/email_message.rb +7 -7
  15. data/lib/stix2/cyberobservable_objects/file.rb +2 -2
  16. data/lib/stix2/cyberobservable_objects/ipv4_addr.rb +4 -4
  17. data/lib/stix2/cyberobservable_objects/ipv6_addr.rb +4 -4
  18. data/lib/stix2/cyberobservable_objects/network_traffic.rb +3 -3
  19. data/lib/stix2/cyberobservable_objects/process.rb +17 -0
  20. data/lib/stix2/cyberobservable_objects/software.rb +1 -1
  21. data/lib/stix2/cyberobservable_objects/user_account.rb +4 -4
  22. data/lib/stix2/cyberobservable_objects/x509_certificate.rb +4 -2
  23. data/lib/stix2/domain_objects/attack_pattern.rb +3 -3
  24. data/lib/stix2/domain_objects/campaign.rb +1 -1
  25. data/lib/stix2/domain_objects/grouping.rb +1 -1
  26. data/lib/stix2/domain_objects/identity.rb +1 -1
  27. data/lib/stix2/domain_objects/indicator.rb +2 -2
  28. data/lib/stix2/domain_objects/infrastructure.rb +3 -3
  29. data/lib/stix2/domain_objects/intrusion-set.rb +3 -3
  30. data/lib/stix2/domain_objects/malware.rb +9 -9
  31. data/lib/stix2/domain_objects/malware_analysis.rb +3 -3
  32. data/lib/stix2/domain_objects/note.rb +2 -2
  33. data/lib/stix2/domain_objects/observed_data.rb +1 -1
  34. data/lib/stix2/domain_objects/opinion.rb +2 -2
  35. data/lib/stix2/domain_objects/report.rb +2 -2
  36. data/lib/stix2/domain_objects/threat_actor.rb +6 -6
  37. data/lib/stix2/domain_objects/tool.rb +3 -3
  38. data/lib/stix2/enum.rb +81 -22
  39. data/lib/stix2/extension_definition.rb +10 -0
  40. data/lib/stix2/extensions/alternate_data_stream_type.rb +9 -0
  41. data/lib/stix2/extensions/archive_file.rb +8 -0
  42. data/lib/stix2/extensions/http_request.rb +12 -0
  43. data/lib/stix2/extensions/icmp.rb +8 -0
  44. data/lib/stix2/extensions/ntfs.rb +10 -0
  45. data/lib/stix2/extensions/pdf.rb +11 -0
  46. data/lib/stix2/extensions/raster_image.rb +10 -0
  47. data/lib/stix2/extensions/socket.rb +13 -0
  48. data/lib/stix2/extensions/tcp.rb +8 -0
  49. data/lib/stix2/extensions/unix_account.rb +10 -0
  50. data/lib/stix2/extensions/windows_pe_optional_header_type.rb +37 -0
  51. data/lib/stix2/extensions/windows_pe_section_type.rb +10 -0
  52. data/lib/stix2/extensions/windows_pebinary.rb +21 -0
  53. data/lib/stix2/extensions/windows_process.rb +13 -0
  54. data/lib/stix2/extensions/windows_service.rb +14 -0
  55. data/lib/stix2/external_reference.rb +2 -6
  56. data/lib/stix2/identifier.rb +2 -12
  57. data/lib/stix2/kill_chain_phase.rb +3 -7
  58. data/lib/stix2/languages.rb +236 -0
  59. data/lib/stix2/meta_objects/data_markings/base.rb +1 -4
  60. data/lib/stix2/meta_objects/data_markings/granular_marking.rb +2 -6
  61. data/lib/stix2/meta_objects/data_markings/marking_definition.rb +2 -2
  62. data/lib/stix2/meta_objects/data_markings/object_marking.rb +3 -13
  63. data/lib/stix2/meta_objects/language_content.rb +1 -1
  64. data/lib/stix2/ov.rb +266 -255
  65. data/lib/stix2/relationship_objects/relationship.rb +155 -2
  66. data/lib/stix2/relationship_objects/sighting.rb +3 -3
  67. data/lib/stix2/storage.rb +21 -15
  68. data/lib/stix2/version.rb +1 -1
  69. data/lib/stix2.rb +100 -72
  70. data/ruby-stix2.gemspec +25 -21
  71. metadata +73 -11
  72. data/lib/stix2/boolean.rb +0 -18
@@ -1,13 +1,9 @@
1
1
  module Stix2
2
- class ExternalReference < Hashie::Dash
3
- include Hashie::Extensions::Dash::PredefinedValues
4
- include Hashie::Extensions::IndifferentAccess
5
- include Hashie::Extensions::Dash::Coercion
6
-
2
+ class ExternalReference < Stix2::Base
7
3
  property :source_name, coerce: String, required: true
8
4
  property :description, coerce: String
9
5
  property :url, coerce: String
10
- property :hashes, coerce: ->(hsh){ hash_dict(hsh) }
6
+ property :hashes, coerce: ->(hsh) { hash_dict(hsh) }
11
7
  property :external_id, coerce: String
12
8
  end
13
9
  end
@@ -1,18 +1,8 @@
1
1
  module Stix2
2
- class Identifier
2
+ class Identifier < String
3
3
  def initialize(value)
4
4
  value.match(/.*--.*/) || raise("Invalid identifier: #{value}")
5
- @value = value
6
- end
7
-
8
- def to_s
9
- @value
10
- end
11
-
12
- def pretty_print(pp)
13
- # :nocov:
14
- pp.text(@value.inspect)
15
- # :nocov
5
+ super(value)
16
6
  end
17
7
  end
18
8
  end
@@ -1,10 +1,6 @@
1
1
  module Stix2
2
- class KillChainPhase < Hashie::Dash
3
- include Hashie::Extensions::Dash::PredefinedValues
4
- include Hashie::Extensions::IndifferentAccess
5
- include Hashie::Extensions::Dash::Coercion
6
-
7
- property :kill_chain_name, coerce: String
8
- property :phase_name, coerce: String
2
+ class KillChainPhase < Stix2::Base
3
+ property :kill_chain_name, required: true, coerce: String
4
+ property :phase_name, required: true, coerce: String
9
5
  end
10
6
  end
@@ -0,0 +1,236 @@
1
+ module Stix2
2
+ RFC5646_LANGUAGE_TAGS = {
3
+ "af" => "Afrikaans",
4
+ "af-ZA" => "Afrikaans (South Africa)",
5
+ "ar" => "Arabic",
6
+ "ar-AE" => "Arabic (U.A.E.)",
7
+ "ar-BH" => "Arabic (Bahrain)",
8
+ "ar-DZ" => "Arabic (Algeria)",
9
+ "ar-EG" => "Arabic (Egypt)",
10
+ "ar-IQ" => "Arabic (Iraq)",
11
+ "ar-JO" => "Arabic (Jordan)",
12
+ "ar-KW" => "Arabic (Kuwait)",
13
+ "ar-LB" => "Arabic (Lebanon)",
14
+ "ar-LY" => "Arabic (Libya)",
15
+ "ar-MA" => "Arabic (Morocco)",
16
+ "ar-OM" => "Arabic (Oman)",
17
+ "ar-QA" => "Arabic (Qatar)",
18
+ "ar-SA" => "Arabic (Saudi Arabia)",
19
+ "ar-SY" => "Arabic (Syria)",
20
+ "ar-TN" => "Arabic (Tunisia)",
21
+ "ar-YE" => "Arabic (Yemen)",
22
+ "az" => "Azeri (Latin)",
23
+ "az-AZ" => "Azeri (Latin) (Azerbaijan)",
24
+ "az-Cyrl-AZ" => "Azeri (Cyrillic) (Azerbaijan)",
25
+ "be" => "Belarusian",
26
+ "be-BY" => "Belarusian (Belarus)",
27
+ "bg" => "Bulgarian",
28
+ "bg-BG" => "Bulgarian (Bulgaria)",
29
+ "bs-BA" => "Bosnian (Bosnia and Herzegovina)",
30
+ "ca" => "Catalan",
31
+ "ca-ES" => "Catalan (Spain)",
32
+ "cs" => "Czech",
33
+ "cs-CZ" => "Czech (Czech Republic)",
34
+ "cy" => "Welsh",
35
+ "cy-GB" => "Welsh (United Kingdom)",
36
+ "da" => "Danish",
37
+ "da-DK" => "Danish (Denmark)",
38
+ "de" => "German",
39
+ "de-AT" => "German (Austria)",
40
+ "de-CH" => "German (Switzerland)",
41
+ "de-DE" => "German (Germany)",
42
+ "de-LI" => "German (Liechtenstein)",
43
+ "de-LU" => "German (Luxembourg)",
44
+ "dv" => "Divehi",
45
+ "dv-MV" => "Divehi (Maldives)",
46
+ "el" => "Greek",
47
+ "el-GR" => "Greek (Greece)",
48
+ "en" => "English",
49
+ "en-AU" => "English (Australia)",
50
+ "en-BZ" => "English (Belize)",
51
+ "en-CA" => "English (Canada)",
52
+ "en-CB" => "English (Caribbean)",
53
+ "en-GB" => "English (United Kingdom)",
54
+ "en-IE" => "English (Ireland)",
55
+ "en-JM" => "English (Jamaica)",
56
+ "en-NZ" => "English (New Zealand)",
57
+ "en-PH" => "English (Republic of the Philippines)",
58
+ "en-TT" => "English (Trinidad and Tobago)",
59
+ "en-US" => "English (United States)",
60
+ "en-ZA" => "English (South Africa)",
61
+ "en-ZW" => "English (Zimbabwe)",
62
+ "eo" => "Esperanto",
63
+ "es" => "Spanish",
64
+ "es-AR" => "Spanish (Argentina)",
65
+ "es-BO" => "Spanish (Bolivia)",
66
+ "es-CL" => "Spanish (Chile)",
67
+ "es-CO" => "Spanish (Colombia)",
68
+ "es-CR" => "Spanish (Costa Rica)",
69
+ "es-DO" => "Spanish (Dominican Republic)",
70
+ "es-EC" => "Spanish (Ecuador)",
71
+ "es-ES" => "Spanish (Spain)",
72
+ "es-GT" => "Spanish (Guatemala)",
73
+ "es-HN" => "Spanish (Honduras)",
74
+ "es-MX" => "Spanish (Mexico)",
75
+ "es-NI" => "Spanish (Nicaragua)",
76
+ "es-PA" => "Spanish (Panama)",
77
+ "es-PE" => "Spanish (Peru)",
78
+ "es-PR" => "Spanish (Puerto Rico)",
79
+ "es-PY" => "Spanish (Paraguay)",
80
+ "es-SV" => "Spanish (El Salvador)",
81
+ "es-UY" => "Spanish (Uruguay)",
82
+ "es-VE" => "Spanish (Venezuela)",
83
+ "et" => "Estonian",
84
+ "et-EE" => "Estonian (Estonia)",
85
+ "eu" => "Basque",
86
+ "eu-ES" => "Basque (Spain)",
87
+ "fa" => "Farsi",
88
+ "fa-IR" => "Farsi (Iran)",
89
+ "fi" => "Finnish",
90
+ "fi-FI" => "Finnish (Finland)",
91
+ "fo" => "Faroese",
92
+ "fo-FO" => "Faroese (Faroe Islands)",
93
+ "fr" => "French",
94
+ "fr-BE" => "French (Belgium)",
95
+ "fr-CA" => "French (Canada)",
96
+ "fr-CH" => "French (Switzerland)",
97
+ "fr-FR" => "French (France)",
98
+ "fr-LU" => "French (Luxembourg)",
99
+ "fr-MC" => "French (Principality of Monaco)",
100
+ "gl" => "Galician",
101
+ "gl-ES" => "Galician (Spain)",
102
+ "gu" => "Gujarati",
103
+ "gu-IN" => "Gujarati (India)",
104
+ "he" => "Hebrew",
105
+ "he-IL" => "Hebrew (Israel)",
106
+ "hi" => "Hindi",
107
+ "hi-IN" => "Hindi (India)",
108
+ "hr" => "Croatian",
109
+ "hr-BA" => "Croatian (Bosnia and Herzegovina)",
110
+ "hr-HR" => "Croatian (Croatia)",
111
+ "hu" => "Hungarian",
112
+ "hu-HU" => "Hungarian (Hungary)",
113
+ "hy" => "Armenian",
114
+ "hy-AM" => "Armenian (Armenia)",
115
+ "id" => "Indonesian",
116
+ "id-ID" => "Indonesian (Indonesia)",
117
+ "is" => "Icelandic",
118
+ "is-IS" => "Icelandic (Iceland)",
119
+ "it" => "Italian",
120
+ "it-CH" => "Italian (Switzerland)",
121
+ "it-IT" => "Italian (Italy)",
122
+ "ja" => "Japanese",
123
+ "ja-JP" => "Japanese (Japan)",
124
+ "ka" => "Georgian",
125
+ "ka-GE" => "Georgian (Georgia)",
126
+ "kk" => "Kazakh",
127
+ "kk-KZ" => "Kazakh (Kazakhstan)",
128
+ "kn" => "Kannada",
129
+ "kn-IN" => "Kannada (India)",
130
+ "ko" => "Korean",
131
+ "ko-KR" => "Korean (Korea)",
132
+ "kok" => "Konkani",
133
+ "kok-IN" => "Konkani (India)",
134
+ "ky" => "Kyrgyz",
135
+ "ky-KG" => "Kyrgyz (Kyrgyzstan)",
136
+ "lt" => "Lithuanian",
137
+ "lt-LT" => "Lithuanian (Lithuania)",
138
+ "lv" => "Latvian",
139
+ "lv-LV" => "Latvian (Latvia)",
140
+ "mi" => "Maori",
141
+ "mi-NZ" => "Maori (New Zealand)",
142
+ "mk" => "FYRO Macedonian",
143
+ "mk-MK" => "FYRO Macedonian (Former Yugoslav Republic of Macedonia)",
144
+ "mn" => "Mongolian",
145
+ "mn-MN" => "Mongolian (Mongolia)",
146
+ "mr" => "Marathi",
147
+ "mr-IN" => "Marathi (India)",
148
+ "ms" => "Malay",
149
+ "ms-BN" => "Malay (Brunei Darussalam)",
150
+ "ms-MY" => "Malay (Malaysia)",
151
+ "mt" => "Maltese",
152
+ "mt-MT" => "Maltese (Malta)",
153
+ "nb" => "Norwegian (Bokm?l)",
154
+ "nb-NO" => "Norwegian (Bokm?l) (Norway)",
155
+ "nl" => "Dutch",
156
+ "nl-BE" => "Dutch (Belgium)",
157
+ "nl-NL" => "Dutch (Netherlands)",
158
+ "nn-NO" => "Norwegian (Nynorsk) (Norway)",
159
+ "ns" => "Northern Sotho",
160
+ "ns-ZA" => "Northern Sotho (South Africa)",
161
+ "pa" => "Punjabi",
162
+ "pa-IN" => "Punjabi (India)",
163
+ "pl" => "Polish",
164
+ "pl-PL" => "Polish (Poland)",
165
+ "ps" => "Pashto",
166
+ "ps-AR" => "Pashto (Afghanistan)",
167
+ "pt" => "Portuguese",
168
+ "pt-BR" => "Portuguese (Brazil)",
169
+ "pt-PT" => "Portuguese (Portugal)",
170
+ "qu" => "Quechua",
171
+ "qu-BO" => "Quechua (Bolivia)",
172
+ "qu-EC" => "Quechua (Ecuador)",
173
+ "qu-PE" => "Quechua (Peru)",
174
+ "ro" => "Romanian",
175
+ "ro-RO" => "Romanian (Romania)",
176
+ "ru" => "Russian",
177
+ "ru-RU" => "Russian (Russia)",
178
+ "sa" => "Sanskrit",
179
+ "sa-IN" => "Sanskrit (India)",
180
+ "se" => "Sami",
181
+ "se-FI" => "Sami (Finland)",
182
+ "se-NO" => "Sami (Norway)",
183
+ "se-SE" => "Sami (Sweden)",
184
+ "sk" => "Slovak",
185
+ "sk-SK" => "Slovak (Slovakia)",
186
+ "sl" => "Slovenian",
187
+ "sl-SI" => "Slovenian (Slovenia)",
188
+ "sq" => "Albanian",
189
+ "sq-AL" => "Albanian (Albania)",
190
+ "sr-BA" => "Serbian (Latin) (Bosnia and Herzegovina)",
191
+ "sr-Cyrl-BA" => "Serbian (Cyrillic) (Bosnia and Herzegovina)",
192
+ "sr-SP" => "Serbian (Latin) (Serbia and Montenegro)",
193
+ "sr-Cyrl-SP" => "Serbian (Cyrillic) (Serbia and Montenegro)",
194
+ "sv" => "Swedish",
195
+ "sv-FI" => "Swedish (Finland)",
196
+ "sv-SE" => "Swedish (Sweden)",
197
+ "sw" => "Swahili",
198
+ "sw-KE" => "Swahili (Kenya)",
199
+ "syr" => "Syriac",
200
+ "syr-SY" => "Syriac (Syria)",
201
+ "ta" => "Tamil",
202
+ "ta-IN" => "Tamil (India)",
203
+ "te" => "Telugu",
204
+ "te-IN" => "Telugu (India)",
205
+ "th" => "Thai",
206
+ "th-TH" => "Thai (Thailand)",
207
+ "tl" => "Tagalog",
208
+ "tl-PH" => "Tagalog (Philippines)",
209
+ "tn" => "Tswana",
210
+ "tn-ZA" => "Tswana (South Africa)",
211
+ "tr" => "Turkish",
212
+ "tr-TR" => "Turkish (Turkey)",
213
+ "tt" => "Tatar",
214
+ "tt-RU" => "Tatar (Russia)",
215
+ "ts" => "Tsonga",
216
+ "uk" => "Ukrainian",
217
+ "uk-UA" => "Ukrainian (Ukraine)",
218
+ "ur" => "Urdu",
219
+ "ur-PK" => "Urdu (Islamic Republic of Pakistan)",
220
+ "uz" => "Uzbek (Latin)",
221
+ "uz-UZ" => "Uzbek (Latin) (Uzbekistan)",
222
+ "uz-Cyrl-UZ" => "Uzbek (Cyrillic) (Uzbekistan)",
223
+ "vi" => "Vietnamese",
224
+ "vi-VN" => "Vietnamese (Viet Nam)",
225
+ "xh" => "Xhosa",
226
+ "xh-ZA" => "Xhosa (South Africa)",
227
+ "zh" => "Chinese",
228
+ "zh-CN" => "Chinese (S)",
229
+ "zh-HK" => "Chinese (Hong Kong)",
230
+ "zh-MO" => "Chinese (Macau)",
231
+ "zh-SG" => "Chinese (Singapore)",
232
+ "zh-TW" => "Chinese (T)",
233
+ "zu" => "Zulu",
234
+ "zu-ZA" => "Zulu (South Africa)"
235
+ }
236
+ end
@@ -1,10 +1,7 @@
1
1
  module Stix2
2
2
  module MetaObject
3
3
  module DataMarking
4
- class Base < Hashie::Dash
5
- include Hashie::Extensions::Dash::PredefinedValues
6
- include Hashie::Extensions::IndifferentAccess
7
- include Hashie::Extensions::Dash::Coercion
4
+ class Base < Stix2::Base
8
5
  end
9
6
  end
10
7
  end
@@ -1,14 +1,10 @@
1
1
  module Stix2
2
2
  module MetaObject
3
3
  module DataMarking
4
- class GranularMarking < Hashie::Dash
5
- include Hashie::Extensions::Dash::PredefinedValues
6
- include Hashie::Extensions::IndifferentAccess
7
- include Hashie::Extensions::Dash::Coercion
8
-
4
+ class GranularMarking < Stix2::Base
9
5
  property :lang, coerce: String
10
6
  property :marking_ref, coerce: Identifier
11
- property :selectors, coerce: Array[String]
7
+ property :selectors, coerce: [String]
12
8
  end
13
9
  end
14
10
  end
@@ -4,13 +4,13 @@ module Stix2
4
4
  class MarkingDefinition < Stix2::Common
5
5
  property :name, coerce: String
6
6
  property :definition_type, required: true, coerce: String
7
- property :definition, required: true, coerce: Hash[String => String]
7
+ property :definition, required: true, coerce: {String => String}
8
8
 
9
9
  def initialize(args)
10
10
  super(args)
11
11
  raise("Property 'definition' must contain a single key") if definition.size > 1
12
12
  if definition_type != definition.keys.first
13
- raise("Property 'definition_type' and 'definition' must have a matching key")
13
+ raise("Property 'definition_type' and 'definition' must have a matching key")
14
14
  end
15
15
  end
16
16
  end
@@ -1,22 +1,12 @@
1
1
  module Stix2
2
2
  module MetaObject
3
3
  module DataMarking
4
- class ObjectMarking
4
+ class ObjectMarking < String
5
5
  def initialize(value)
6
6
  value.match(/marking-definition--.*/) || raise("Invalid value: #{value}")
7
- @value = value
8
- end
9
-
10
- def to_s
11
- @value
12
- end
13
-
14
- def pretty_print(pp)
15
- # :nocov:
16
- pp.text(@value.inspect)
17
- # :nocov
7
+ super(value)
18
8
  end
19
9
  end
20
10
  end
21
11
  end
22
- end
12
+ end
@@ -3,7 +3,7 @@ module Stix2
3
3
  class LanguageContent < Base
4
4
  property :object_ref, coerce: Identifier
5
5
  property :object_modified, coerce: Time
6
- property :contents, coerce: Hash # TODO
6
+ property :contents, coerce: ->(hsh) { validate_array(hsh.keys, Stix2::RFC5646_LANGUAGE_TAGS.keys) && hsh }
7
7
  end
8
8
  end
9
9
  end