ruby-stix2 0.1.0

data/lib/stix2/common.rb

@@ -0,0 +1,62 @@
+module Stix2
+  class Common < Hashie::Dash
+    include Hashie::Extensions::Dash::PredefinedValues
+    include Hashie::Extensions::IndifferentAccess
+    include Hashie::Extensions::Dash::Coercion
+
+    property :type, required: true, coerce: String
+    property :spec_version, coerce: String, values: ['2.1']
+    property :id, coerce: Identifier
+    property :created_by_ref, coerce: Identifier
+    property :created, coerce: Time
+    property :modified, coerce: Time
+    property :revoked, coerce: Stix2::Boolean
+    property :labels, coerce: Array[String]
+    property :confidence, coerce: Integer
+    property :lang, coerce: String
+    property :external_references, coerce: Array[ExternalReference]
+    property :object_marking_refs, coerce: Array[Stix2::MetaObject::DataMarking::ObjectMarking]
+    property :granular_markings, coerce: Array[MetaObject::DataMarking::GranularMarking]
+    property :defanged, coerce: Stix2::Boolean
+    property :extensions, coerce: Hash
+
+    def initialize(options = {})
+      Hashie.symbolize_keys!(options)
+      type = to_dash(self.class.name.split('::').last)
+      if options[:type]
+        raise("Property 'type' must be '#{type}'") if options[:type] != type
+      else
+        options[:type] = type
+      end
+      super(options)
+      Stix2.storage_add(self)
+    end
+
+    def method_missing(m, *args, &block)
+      super(m, args, block) if !m.to_s.end_with?('_instance')
+      # Retrieve the original method
+      ref_method = m.to_s.gsub(/_instance$/, '')
+      obj = send(ref_method)
+      raise("Can't get a Stix2::Identifier from #{ref_method}") if !obj.is_a?(Stix2::Identifier)
+      Stix2.storage_find(obj)
+    end
+
+    private
+
+    def to_dash(string)
+      string.gsub(/[[:upper:]]/) { "-#{$&.downcase}" }[1..]
+    end
+
+    def self.validate_array(list, valid_values)
+      excess = (Array(list) - valid_values)
+      excess.empty? || raise("Invalid values: #{excess}")
+      list
+    end
+
+    def self.hash_dict(hsh)
+      invalids = hsh.keys.map(&:to_s) - HASH_ALGORITHM_OV
+      invalids.empty? || raise("Invalid values: #{invalids}")
+      hsh
+    end
+  end
+end

data/lib/stix2/cyberobservable_objects/artifact.rb

@@ -0,0 +1,12 @@
+module Stix2
+  module CyberobservableObject
+    class Artifact < Base
+      property :mime_type, coerce: String
+      property :payload_bin, coerce: String
+      property :url, coerce: String
+      property :hashes, coerce: ->(hsh){ hash_dict(hsh) }
+      property :encryption_algorithm, values: ENCRYPTION_ALGORITHM_ENUM
+      property :decryption_key, coerce: String
+    end
+  end
+end

data/lib/stix2/cyberobservable_objects/autonomous_system.rb

@@ -0,0 +1,9 @@
+module Stix2
+  module CyberobservableObject
+    class AutonomousSystem < Base
+      property :number, required: true, coerce: Integer
+      property :name, coerce: String
+      property :rir, coerce: String
+    end
+  end
+end

data/lib/stix2/cyberobservable_objects/base.rb

@@ -0,0 +1,6 @@
+module Stix2
+  module CyberobservableObject
+    class Base < Stix2::Common
+    end
+  end
+end

data/lib/stix2/cyberobservable_objects/directory.rb

@@ -0,0 +1,12 @@
+module Stix2
+  module CyberobservableObject
+    class Directory < Base
+      property :path, required: true, coerce: String
+      property :path, required: true, coerce: String
+      property :ctime, coerce: Time
+      property :mtime, coerce: Time
+      property :atime, coerce: Time
+      property :contains_refs, coerce: Array[Identifier]
+    end
+  end
+end

data/lib/stix2/cyberobservable_objects/domain_name.rb

@@ -0,0 +1,8 @@
+module Stix2
+  module CyberobservableObject
+    class DomainName < Base
+      property :value, required: true, coerce: String
+      property :resolves_to_refs, coerce: Array[Identifier]
+    end
+  end
+end

data/lib/stix2/cyberobservable_objects/email_addr.rb

@@ -0,0 +1,9 @@
+module Stix2
+  module CyberobservableObject
+    class EmailAddr < Base
+      property :value, required: true, coerce: String
+      property :display_name, coerce: String
+      property :belongs_to_ref, coerce: Identifier
+    end
+  end
+end

data/lib/stix2/cyberobservable_objects/email_message.rb

@@ -0,0 +1,21 @@
+module Stix2
+  module CyberobservableObject
+    class EmailMessage < Base
+      property :is_multipart, required: true, coerce: Stix2::Boolean
+      property :date, coerce: Time
+      property :content_type, coerce: String
+      property :from_ref, coerce: Identifier
+      property :sender_ref, coerce: Identifier
+      property :to_refs, coerce: Array[Identifier]
+      property :cc_refs, coerce: Array[Identifier]
+      property :bcc_refs, coerce: Array[Identifier]
+      property :message_id, coerce: String
+      property :subject, coerce: String
+      property :received_lines, coerce: Array[String]
+      property :additional_header_fields, coerce: Hash[String => String]
+      property :body, coerce: String
+      property :body_multipart, coerce: Array[EmailMimePartType]
+      property :raw_email_ref, coerce: Identifier
+    end
+  end
+end

data/lib/stix2/cyberobservable_objects/email_mime_part_type.rb

@@ -0,0 +1,10 @@
+module Stix2
+  module CyberobservableObject
+    class EmailMimePartType < Base
+      property :body, coerce: String
+      property :body_raw_ref, coerce: Identifier
+      property :content_type, coerce: String
+      property :content_disposition, coerce: String
+    end
+  end
+end

data/lib/stix2/cyberobservable_objects/file.rb

@@ -0,0 +1,18 @@
+module Stix2
+  module CyberobservableObject
+    class File < Base
+      property :hashes, coerce: ->(hsh){ hash_dict(hsh) }
+      property :size, coerce: Integer
+      property :name, coerce: String
+      property :name_enc, coerce: String
+      property :magic_number_hex, coerce: String
+      property :mime_type, coerce: String
+      property :ctime, coerce: String
+      property :mtime, coerce: String
+      property :atime, coerce: String
+      property :parent_directory_ref, coerce: Identifier
+      property :contains_refs, coerce: Array[Identifier]
+      property :content_ref, coerce: Identifier
+    end
+  end
+end

data/lib/stix2/cyberobservable_objects/ipv4_addr.rb

@@ -0,0 +1,11 @@
+require 'ipaddr'
+
+module Stix2
+  module CyberobservableObject
+    class Ipv4Addr < Base
+      property :value, required: true, coerce: ->(v){ IPAddr.new(v, Socket::AF_INET).to_s }
+      property :resolves_to_refs, coerce: Array[Identifier]
+      property :resolves_to_refs, coerce: Array[Identifier]
+    end
+  end
+end

data/lib/stix2/cyberobservable_objects/ipv6_addr.rb

@@ -0,0 +1,11 @@
+require 'ipaddr'
+
+module Stix2
+  module CyberobservableObject
+    class Ipv6Addr < Base
+      property :value, required: true, coerce: ->(v){ IPAddr.new(v, Socket::AF_INET6).to_s }
+      property :resolves_to_refs, coerce: Array[Identifier]
+      property :resolves_to_refs, coerce: Array[Identifier]
+    end
+  end
+end

data/lib/stix2/cyberobservable_objects/mac_addr.rb

@@ -0,0 +1,7 @@
+module Stix2
+  module CyberobservableObject
+    class MacAddr < Base
+      property :value, required: true, coerce: String
+    end
+  end
+end

data/lib/stix2/cyberobservable_objects/mutex.rb

@@ -0,0 +1,7 @@
+module Stix2
+  module CyberobservableObject
+    class Mutex < Base
+      property :name, required: true, coerce: String
+    end
+  end
+end

data/lib/stix2/cyberobservable_objects/network_traffic.rb

@@ -0,0 +1,23 @@
+module Stix2
+  module CyberobservableObject
+    class NetworkTraffic < Base
+      property :start, coerce: Time
+      property :end, coerce: Time
+      property :is_active, coerce: ->(v){ boolean(v) }
+      property :src_ref, coerce: Identifier
+      property :dst_ref, coerce: Identifier
+      property :src_port, coerce: Integer
+      property :dst_port, coerce: Integer
+      property :protocols, required: true, coerce: Array[String]
+      property :src_byte_count, coerce: Integer
+      property :dst_byte_count, coerce: Integer
+      property :src_packets, coerce: Integer
+      property :dst_packets, coerce: Integer
+      property :ipfix, coerce: Hash
+      property :src_payload_ref, coerce: Identifier
+      property :dst_payload_ref, coerce: Identifier
+      property :encapsulates_refs, coerce: Array[Identifier]
+      property :encapsulated_by_ref, coerce: Identifier
+    end
+  end
+end

data/lib/stix2/cyberobservable_objects/software.rb

@@ -0,0 +1,12 @@
+module Stix2
+  module CyberobservableObject
+    class Software < Base
+      property :name, required: true, coerce: String
+      property :cpe, coerce: String
+      property :swid, coerce: String
+      property :languages, coerce: Array[String]
+      property :vendor, coerce: String
+      property :version, coerce: String
+    end
+  end
+end

data/lib/stix2/cyberobservable_objects/url.rb

@@ -0,0 +1,7 @@
+module Stix2
+  module CyberobservableObject
+    class Url < Base
+      property :value, required: true, coerce: String
+    end
+  end
+end

data/lib/stix2/cyberobservable_objects/user_account.rb

@@ -0,0 +1,20 @@
+module Stix2
+  module CyberobservableObject
+    class UserAccount < Base
+      property :user_id, coerce: String
+      property :credential, coerce: String
+      property :account_login, coerce: String
+      property :account_type, values: ACCOUNT_TYPE_OV
+      property :display_name, coerce: String
+      property :is_service_account, coerce: Stix2::Boolean
+      property :is_privileged, coerce: Stix2::Boolean
+      property :can_escalate_privs, coerce: Stix2::Boolean
+      property :is_disabled, coerce: Stix2::Boolean
+      property :account_created, coerce: Time
+      property :account_expires, coerce: Time
+      property :credential_last_changed, coerce: Time
+      property :account_first_login, coerce: Time
+      property :account_last_login, coerce: Time
+    end
+  end
+end

data/lib/stix2/cyberobservable_objects/windows_registry_key.rb

@@ -0,0 +1,11 @@
+module Stix2
+  module CyberobservableObject
+    class WindowsRegistryKey < Base
+      property :key, coerce: String
+      property :values, coerce: [WindowsRegistryValue]
+      property :modified_time, coerce: Time
+      property :creator_user_ref, coerce: Identifier
+      property :number_of_subkeys, coerce: Integer
+    end
+  end
+end

data/lib/stix2/cyberobservable_objects/windows_registry_value.rb

@@ -0,0 +1,9 @@
+module Stix2
+  module CyberobservableObject
+    class WindowsRegistryValue < Base
+      property :name, coerce: String
+      property :data, coerce: String
+      property :data_type, values: WINDOWS_REGISTRY_DATATYPE_ENUM
+    end
+  end
+end

data/lib/stix2/cyberobservable_objects/x509_certificate.rb

@@ -0,0 +1,19 @@
+module Stix2
+  module CyberobservableObject
+    class X509Certificate < Base
+      property :is_self_signed, coerce: ->(v){ boolean(v) }
+      property :hashes, coerce: ->(hsh){ hash_dict(hsh) }
+      property :version, coerce: String
+      property :serial_number, coerce: String
+      property :signature_algorithm, coerce: String
+      property :issuer, coerce: String
+      property :validity_not_before, coerce: Time
+      property :validity_not_after, coerce: Time
+      property :subject, coerce: String
+      property :subject_public_key_algorithm, coerce: String
+      property :subject_public_key_modulus, coerce: String
+      property :subject_public_key_exponent, coerce: String
+      property :x509_v3_extensions, coerce: X509V3ExtensionType
+    end
+  end
+end

data/lib/stix2/cyberobservable_objects/x509_v3_extension_type.rb

@@ -0,0 +1,22 @@
+module Stix2
+  module CyberobservableObject
+    class X509V3ExtensionType < Base
+      property :basic_constraints, coerce: String
+      property :name_constraints, coerce: String
+      property :policy_constraints, coerce: String
+      property :key_usage, coerce: String
+      property :extended_key_usage, coerce: String
+      property :subject_key_identifier, coerce: String
+      property :authority_key_identifier, coerce: String
+      property :subject_alternative_name, coerce: String
+      property :issuer_alternative_name, coerce: String
+      property :subject_directory_attributes, coerce: String
+      property :crl_distribution_points, coerce: String
+      property :inhibit_any_policy, coerce: String
+      property :private_key_usage_period_not_before, coerce: Time
+      property :private_key_usage_period_not_after, coerce: Time
+      property :certificate_policies, coerce: String
+      property :policy_mappings, coerce: String
+    end
+  end
+end

data/lib/stix2/domain_objects/attack_pattern.rb

@@ -0,0 +1,12 @@
+module Stix2
+  module DomainObject
+    class AttackPattern < Base
+      property :type, required: true, coerce: String
+      property :external_references, coerce: Array[Stix2::ExternalReference]
+      property :name, coerce: String
+      property :description, coerce: String
+      property :aliases, coerce: Array[String]
+      property :kill_chain_phases, coerce: Array[Stix2::KillChainPhase]
+    end
+  end
+end

data/lib/stix2/domain_objects/base.rb

@@ -0,0 +1,6 @@
+module Stix2
+  module DomainObject
+    class Base < Stix2::Common
+    end
+  end
+end

data/lib/stix2/domain_objects/campaign.rb

@@ -0,0 +1,12 @@
+module Stix2
+  module DomainObject
+    class Campaign < Base
+      property :name, coerce: String
+      property :description, coerce: String
+      property :aliases, coerce: Array[String]
+      property :first_seen, coerce: Time
+      property :last_seen, coerce: Time
+      property :objective, coerce: String
+    end
+  end
+end

data/lib/stix2/domain_objects/course_of_action.rb

@@ -0,0 +1,9 @@
+module Stix2
+  module DomainObject
+    class CourseOfAction < Base
+      property :name, coerce: String
+      property :description, coerce: String
+      property :action
+    end
+  end
+end

data/lib/stix2/domain_objects/grouping.rb

@@ -0,0 +1,10 @@
+module Stix2
+  module DomainObject
+    class Grouping < Base
+      property :name, coerce: String
+      property :description, coerce: String
+      property :context, values: Stix2::GROUPING_CONTEXT_OV
+      property :object_refs, coerce: Array[Identifier]
+    end
+  end
+end

data/lib/stix2/domain_objects/identity.rb

@@ -0,0 +1,12 @@
+module Stix2
+  module DomainObject
+    class Identity < Base
+      property :name, required: true, coerce: String
+      property :description, coerce: String
+      property :roles, coerce: Array[String]
+      property :identity_class, coerce: String, values: IDENTITY_CLASS_OV
+      property :sectors, coerce: String, values: INDUSTRY_SECTOR_OV
+      property :contact_information, coerce: String
+    end
+  end
+end

data/lib/stix2/domain_objects/indicator.rb

@@ -0,0 +1,15 @@
+module Stix2
+  module DomainObject
+    class Indicator < Base
+      property :name, coerce: String
+      property :description, coerce: String
+      property :indicator_types, coerce: ->(v){ validate_array(v, Stix2::INDICATOR_TYPE_OV) }
+      property :pattern, coerce: String
+      property :pattern_type, coerce: String, values: PATTERN_TYPE_OV
+      property :pattern_version, coerce: String
+      property :valid_from, coerce: Time
+      property :valid_until, coerce: Time
+      property :kill_chain_phases, coerce: Array[KillChainPhase]
+    end
+  end
+end

data/lib/stix2/domain_objects/infrastructure.rb

@@ -0,0 +1,13 @@
+module Stix2
+  module DomainObject
+    class Infrastructure < Base
+      property :name, required: true, coerce: String
+      property :description, coerce: String
+      property :infrastructure_types, coerce: ->(v){ validate_array(v, Stix2::INFRASTRUCTURE_TYPE_OV) }
+      property :aliases, coerce: Array[String]
+      property :kill_chain_phases, coerce: Array[KillChainPhase]
+      property :first_seen, coerce: Time
+      property :last_seen, coerce: Time
+    end
+  end
+end

data/lib/stix2/domain_objects/intrusion-set.rb

@@ -0,0 +1,15 @@
+module Stix2
+  module DomainObject
+    class IntrusionSet < Base
+      property :name, required: true, coerce: String
+      property :description, coerce: String
+      property :aliases, coerce: Array[String]
+      property :first_seen, coerce: Time
+      property :last_seen, coerce: Time
+      property :goals, coerce: Array[String]
+      property :resource_level, values: ATTACK_RESOURCE_LEVEL_OV
+      property :primary_motivation, values: ATTACK_MOTIVATION_OV
+      property :secondary_motivations, coerce: ->(v){ validate_array(v, Stix2::ATTACK_MOTIVATION_OV) }
+    end
+  end
+end

data/lib/stix2/domain_objects/location.rb

@@ -0,0 +1,17 @@
+module Stix2
+  module DomainObject
+    class Location < Base
+      property :name, coerce: String
+      property :description, coerce: String
+      property :latitude, coerce: Float
+      property :longitude, coerce: Float
+      property :precision, coerce: Float
+      property :region, values: REGION_OV
+      property :country, coerce: String
+      property :administrative_area, coerce: String
+      property :city, coerce: String
+      property :street_address, coerce: String
+      property :postal_code, coerce: String
+    end
+  end
+end

data/lib/stix2/domain_objects/malware.rb

@@ -0,0 +1,19 @@
+module Stix2
+  module DomainObject
+    class Malware < Base
+      property :name, coerce: String
+      property :description, coerce: String
+      property :malware_types, coerce: ->(v){ validate_array(v, Stix2::MALWARE_TYPE_OV) }
+      property :is_family, coerce: ->(v){ is_boolean?(v) }
+      property :aliases, coerce: Array[String]
+      property :kill_chain_phases, coerce: Array[KillChainPhase]
+      property :first_seen, coerce: Time
+      property :last_seen, coerce: Time
+      property :operating_system_refs, coerce: Array[Identifier]
+      property :architecture_execution_envs, coerce: ->(v){ validate_array(v, Stix2::PROCESSOR_ARCHITECTURE_OV) }
+      property :implementation_languages, coerce: ->(v){ validate_array(v, Stix2::IMPLEMENTATION_LANGUAGE_OV) }
+      property :capabilities, coerce: ->(v){ validate_array(v, Stix2::IMPLEMENTATION_CAPABILITIES_OV) }
+      property :sample_refs, coerce: Array[Identifier]
+    end
+  end
+end

data/lib/stix2/domain_objects/malware_analysis.rb

@@ -0,0 +1,22 @@
+module Stix2
+  module DomainObject
+    class MalwareAnalysis < Base
+      property :product, coerce: String
+      property :version, coerce: String
+      property :host_vm_ref, coerce: Identifier
+      property :operating_system_ref, coerce: Identifier
+      property :installed_software_refs, coerce: Array[Identifier]
+      property :configuration_version, coerce: String
+      property :modules, coerce: Array[String]
+      property :analysis_engine_version, coerce: String
+      property :analysis_definition_version, coerce: String
+      property :submitted, coerce: Time
+      property :analysis_started, coerce: Time
+      property :analysis_ended, coerce: Time
+      property :result_name, coerce: String
+      property :result, values: MALWARE_RESULT_OV
+      property :analysis_sco_refs, coerce: Array[Identifier]
+      property :sample_ref, coerce: Identifier
+    end
+  end
+end

data/lib/stix2/domain_objects/note.rb

@@ -0,0 +1,10 @@
+module Stix2
+  module DomainObject
+    class Note < Base
+      property :abstract, coerce: String
+      property :content, coerce: String
+      property :authors, coerce: Array[String]
+      property :object_refs, coerce: Array[Identifier]
+    end
+  end
+end

data/lib/stix2/domain_objects/observed_data.rb

@@ -0,0 +1,11 @@
+module Stix2
+  module DomainObject
+    class ObservedData < Base
+      property :first_observed, required: true, coerce: Time
+      property :last_observed, required: true, coerce: Time
+      property :number_observed, required: true, coerce: Integer
+      property :objects, coerce: Hash
+      property :object_refs, coerce: Array[Identifier]
+    end
+  end
+end

data/lib/stix2/domain_objects/opinion.rb

@@ -0,0 +1,10 @@
+module Stix2
+  module DomainObject
+    class Opinion < Base
+      property :explanation, coerce: String
+      property :authors, coerce: Array[String]
+      property :opinion, values: OPINION_ENUM
+      property :object_refs, coerce: Array[Identifier]
+    end
+  end
+end

data/lib/stix2/domain_objects/report.rb

@@ -0,0 +1,11 @@
+module Stix2
+  module DomainObject
+    class Report < Base
+      property :name, required: true, coerce: String
+      property :description, coerce: String
+      property :report_types, coerce: ->(v){ validate_array(v, Stix2::REPORT_TYPE_OV) }
+      property :published, coerce: Time
+      property :object_refs, coerce: Array[Identifier]
+    end
+  end
+end

data/lib/stix2/domain_objects/threat_actor.rb

@@ -0,0 +1,19 @@
+module Stix2
+  module DomainObject
+    class ThreatActor < Base
+      property :name, required: true, coerce: String
+      property :description, coerce: String
+      property :threat_actor_types, coerce: ->(v){ validate_array(v, THREAT_ACTOR_TYPE_OV) }
+      property :aliases, coerce: Array[String]
+      property :first_seen, coerce: Time
+      property :last_seen, coerce: Time
+      property :roles, coerce: ->(v){ validate_array(v, THREAT_ACTOR_ROLE_OV) }
+      property :goals, coerce: Array[String]
+      property :sophistication, values: THREAT_ACTOR_SOPHISTICATION_OV
+      property :resource_level, values: ATTACK_RESOURCE_LEVEL_OV
+      property :primary_motivation, values: ATTACK_MOTIVATION_OV
+      property :secondary_motivations, coerce: ->(v){ validate_array(v, ATTACK_MOTIVATION_OV) }
+      property :personal_motivations, coerce: ->(v){ validate_array(v, ATTACK_MOTIVATION_OV) }
+    end
+  end
+end

data/lib/stix2/domain_objects/tool.rb

@@ -0,0 +1,12 @@
+module Stix2
+  module DomainObject
+    class Tool < Base
+      property :name, required: true, coerce: String
+      property :description, coerce: String
+      property :tool_types, coerce: ->(v){ validate_array(v, TOOL_TYPES_OV) }
+      property :aliases, coerce: Array[String]
+      property :kill_chain_phases, coerce: Array[KillChainPhase]
+      property :tool_version, coerce: String
+    end
+  end
+end

data/lib/stix2/domain_objects/vulnerability.rb

@@ -0,0 +1,8 @@
+module Stix2
+  module DomainObject
+    class Vulnerability < Base
+      property :name, coerce: String
+      property :description, coerce: String
+    end
+  end
+end