ruby-stix2 0.1.1 → 0.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (63) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/build.yml +4 -3
  3. data/Gemfile +1 -1
  4. data/Gemfile.lock +48 -1
  5. data/README.md +1 -1
  6. data/lib/stix2/bundle.rb +5 -2
  7. data/lib/stix2/common.rb +47 -30
  8. data/lib/stix2/confidence_scale.rb +38 -38
  9. data/lib/stix2/custom_object.rb +5 -5
  10. data/lib/stix2/cyberobservable_objects/artifact.rb +1 -1
  11. data/lib/stix2/cyberobservable_objects/directory.rb +1 -1
  12. data/lib/stix2/cyberobservable_objects/domain_name.rb +1 -1
  13. data/lib/stix2/cyberobservable_objects/email_message.rb +7 -7
  14. data/lib/stix2/cyberobservable_objects/file.rb +2 -2
  15. data/lib/stix2/cyberobservable_objects/ipv4_addr.rb +4 -4
  16. data/lib/stix2/cyberobservable_objects/ipv6_addr.rb +4 -4
  17. data/lib/stix2/cyberobservable_objects/network_traffic.rb +3 -3
  18. data/lib/stix2/cyberobservable_objects/process.rb +3 -3
  19. data/lib/stix2/cyberobservable_objects/software.rb +1 -1
  20. data/lib/stix2/cyberobservable_objects/user_account.rb +4 -4
  21. data/lib/stix2/cyberobservable_objects/x509_certificate.rb +3 -3
  22. data/lib/stix2/domain_objects/attack_pattern.rb +3 -3
  23. data/lib/stix2/domain_objects/campaign.rb +1 -1
  24. data/lib/stix2/domain_objects/grouping.rb +1 -1
  25. data/lib/stix2/domain_objects/identity.rb +1 -1
  26. data/lib/stix2/domain_objects/indicator.rb +2 -2
  27. data/lib/stix2/domain_objects/infrastructure.rb +3 -3
  28. data/lib/stix2/domain_objects/intrusion-set.rb +3 -3
  29. data/lib/stix2/domain_objects/malware.rb +9 -9
  30. data/lib/stix2/domain_objects/malware_analysis.rb +3 -3
  31. data/lib/stix2/domain_objects/note.rb +2 -2
  32. data/lib/stix2/domain_objects/observed_data.rb +1 -1
  33. data/lib/stix2/domain_objects/opinion.rb +2 -2
  34. data/lib/stix2/domain_objects/report.rb +2 -2
  35. data/lib/stix2/domain_objects/threat_actor.rb +6 -6
  36. data/lib/stix2/domain_objects/tool.rb +3 -3
  37. data/lib/stix2/enum.rb +60 -60
  38. data/lib/stix2/extension_definition.rb +2 -2
  39. data/lib/stix2/extensions/alternate_data_stream_type.rb +1 -1
  40. data/lib/stix2/extensions/archive_file.rb +2 -2
  41. data/lib/stix2/extensions/icmp.rb +2 -2
  42. data/lib/stix2/extensions/ntfs.rb +2 -2
  43. data/lib/stix2/extensions/pdf.rb +2 -2
  44. data/lib/stix2/extensions/socket.rb +3 -3
  45. data/lib/stix2/extensions/unix_account.rb +1 -1
  46. data/lib/stix2/extensions/windows_pe_optional_header_type.rb +7 -7
  47. data/lib/stix2/extensions/windows_pe_section_type.rb +1 -1
  48. data/lib/stix2/extensions/windows_pebinary.rb +7 -7
  49. data/lib/stix2/extensions/windows_process.rb +2 -2
  50. data/lib/stix2/extensions/windows_service.rb +2 -2
  51. data/lib/stix2/external_reference.rb +1 -1
  52. data/lib/stix2/languages.rb +233 -233
  53. data/lib/stix2/meta_objects/data_markings/granular_marking.rb +1 -1
  54. data/lib/stix2/meta_objects/data_markings/marking_definition.rb +2 -2
  55. data/lib/stix2/meta_objects/data_markings/object_marking.rb +1 -1
  56. data/lib/stix2/meta_objects/language_content.rb +1 -1
  57. data/lib/stix2/ov.rb +263 -258
  58. data/lib/stix2/relationship_objects/relationship.rb +155 -2
  59. data/lib/stix2/relationship_objects/sighting.rb +3 -3
  60. data/lib/stix2/version.rb +1 -1
  61. data/lib/stix2.rb +90 -90
  62. data/ruby-stix2.gemspec +23 -23
  63. metadata +32 -4
@@ -2,11 +2,11 @@ module Stix2
2
2
  module DomainObject
3
3
  class AttackPattern < Base
4
4
  property :type, required: true, coerce: String
5
- property :external_references, coerce: Array[Stix2::ExternalReference]
5
+ property :external_references, coerce: [Stix2::ExternalReference]
6
6
  property :name, coerce: String
7
7
  property :description, coerce: String
8
- property :aliases, coerce: Array[String]
9
- property :kill_chain_phases, coerce: Array[Stix2::KillChainPhase]
8
+ property :aliases, coerce: [String]
9
+ property :kill_chain_phases, coerce: [Stix2::KillChainPhase]
10
10
  end
11
11
  end
12
12
  end
@@ -3,7 +3,7 @@ module Stix2
3
3
  class Campaign < Base
4
4
  property :name, coerce: String
5
5
  property :description, coerce: String
6
- property :aliases, coerce: Array[String]
6
+ property :aliases, coerce: [String]
7
7
  property :first_seen, coerce: Time
8
8
  property :last_seen, coerce: Time
9
9
  property :objective, coerce: String
@@ -4,7 +4,7 @@ module Stix2
4
4
  property :name, coerce: String
5
5
  property :description, coerce: String
6
6
  property :context, values: Stix2::GROUPING_CONTEXT_OV
7
- property :object_refs, coerce: Array[Identifier]
7
+ property :object_refs, coerce: [Identifier]
8
8
  end
9
9
  end
10
10
  end
@@ -3,7 +3,7 @@ module Stix2
3
3
  class Identity < Base
4
4
  property :name, required: true, coerce: String
5
5
  property :description, coerce: String
6
- property :roles, coerce: Array[String]
6
+ property :roles, coerce: [String]
7
7
  property :identity_class, coerce: String, values: IDENTITY_CLASS_OV
8
8
  property :sectors, coerce: String, values: INDUSTRY_SECTOR_OV
9
9
  property :contact_information, coerce: String
@@ -3,13 +3,13 @@ module Stix2
3
3
  class Indicator < Base
4
4
  property :name, coerce: String
5
5
  property :description, coerce: String
6
- property :indicator_types, coerce: ->(v){ validate_array(v, Stix2::INDICATOR_TYPE_OV) }
6
+ property :indicator_types, coerce: ->(v) { validate_array(v, Stix2::INDICATOR_TYPE_OV) }
7
7
  property :pattern, coerce: String
8
8
  property :pattern_type, coerce: String, values: PATTERN_TYPE_OV
9
9
  property :pattern_version, coerce: String
10
10
  property :valid_from, coerce: Time
11
11
  property :valid_until, coerce: Time
12
- property :kill_chain_phases, coerce: Array[KillChainPhase]
12
+ property :kill_chain_phases, coerce: [KillChainPhase]
13
13
  end
14
14
  end
15
15
  end
@@ -3,9 +3,9 @@ module Stix2
3
3
  class Infrastructure < Base
4
4
  property :name, required: true, coerce: String
5
5
  property :description, coerce: String
6
- property :infrastructure_types, coerce: ->(v){ validate_array(v, Stix2::INFRASTRUCTURE_TYPE_OV) }
7
- property :aliases, coerce: Array[String]
8
- property :kill_chain_phases, coerce: Array[KillChainPhase]
6
+ property :infrastructure_types, coerce: ->(v) { validate_array(v, Stix2::INFRASTRUCTURE_TYPE_OV) }
7
+ property :aliases, coerce: [String]
8
+ property :kill_chain_phases, coerce: [KillChainPhase]
9
9
  property :first_seen, coerce: Time
10
10
  property :last_seen, coerce: Time
11
11
  end
@@ -3,13 +3,13 @@ module Stix2
3
3
  class IntrusionSet < Base
4
4
  property :name, required: true, coerce: String
5
5
  property :description, coerce: String
6
- property :aliases, coerce: Array[String]
6
+ property :aliases, coerce: [String]
7
7
  property :first_seen, coerce: Time
8
8
  property :last_seen, coerce: Time
9
- property :goals, coerce: Array[String]
9
+ property :goals, coerce: [String]
10
10
  property :resource_level, values: ATTACK_RESOURCE_LEVEL_OV
11
11
  property :primary_motivation, values: ATTACK_MOTIVATION_OV
12
- property :secondary_motivations, coerce: ->(v){ validate_array(v, Stix2::ATTACK_MOTIVATION_OV) }
12
+ property :secondary_motivations, coerce: ->(v) { validate_array(v, Stix2::ATTACK_MOTIVATION_OV) }
13
13
  end
14
14
  end
15
15
  end
@@ -3,17 +3,17 @@ module Stix2
3
3
  class Malware < Base
4
4
  property :name, coerce: String
5
5
  property :description, coerce: String
6
- property :malware_types, coerce: ->(v){ validate_array(v, Stix2::MALWARE_TYPE_OV) }
7
- property :is_family, coerce: ->(v){ Stix2.to_bool(v) }
8
- property :aliases, coerce: Array[String]
9
- property :kill_chain_phases, coerce: Array[KillChainPhase]
6
+ property :malware_types, coerce: ->(v) { validate_array(v, Stix2::MALWARE_TYPE_OV) }
7
+ property :is_family, coerce: ->(v) { Stix2.to_bool(v) }
8
+ property :aliases, coerce: [String]
9
+ property :kill_chain_phases, coerce: [KillChainPhase]
10
10
  property :first_seen, coerce: Time
11
11
  property :last_seen, coerce: Time
12
- property :operating_system_refs, coerce: Array[Identifier]
13
- property :architecture_execution_envs, coerce: ->(v){ validate_array(v, Stix2::PROCESSOR_ARCHITECTURE_OV) }
14
- property :implementation_languages, coerce: ->(v){ validate_array(v, Stix2::IMPLEMENTATION_LANGUAGE_OV) }
15
- property :capabilities, coerce: ->(v){ validate_array(v, Stix2::IMPLEMENTATION_CAPABILITIES_OV) }
16
- property :sample_refs, coerce: Array[Identifier]
12
+ property :operating_system_refs, coerce: [Identifier]
13
+ property :architecture_execution_envs, coerce: ->(v) { validate_array(v, Stix2::PROCESSOR_ARCHITECTURE_OV) }
14
+ property :implementation_languages, coerce: ->(v) { validate_array(v, Stix2::IMPLEMENTATION_LANGUAGE_OV) }
15
+ property :capabilities, coerce: ->(v) { validate_array(v, Stix2::IMPLEMENTATION_CAPABILITIES_OV) }
16
+ property :sample_refs, coerce: [Identifier]
17
17
  end
18
18
  end
19
19
  end
@@ -5,9 +5,9 @@ module Stix2
5
5
  property :version, coerce: String
6
6
  property :host_vm_ref, coerce: Identifier
7
7
  property :operating_system_ref, coerce: Identifier
8
- property :installed_software_refs, coerce: Array[Identifier]
8
+ property :installed_software_refs, coerce: [Identifier]
9
9
  property :configuration_version, coerce: String
10
- property :modules, coerce: Array[String]
10
+ property :modules, coerce: [String]
11
11
  property :analysis_engine_version, coerce: String
12
12
  property :analysis_definition_version, coerce: String
13
13
  property :submitted, coerce: Time
@@ -15,7 +15,7 @@ module Stix2
15
15
  property :analysis_ended, coerce: Time
16
16
  property :result_name, coerce: String
17
17
  property :result, values: MALWARE_RESULT_OV
18
- property :analysis_sco_refs, coerce: Array[Identifier]
18
+ property :analysis_sco_refs, coerce: [Identifier]
19
19
  property :sample_ref, coerce: Identifier
20
20
  end
21
21
  end
@@ -3,8 +3,8 @@ module Stix2
3
3
  class Note < Base
4
4
  property :abstract, coerce: String
5
5
  property :content, coerce: String
6
- property :authors, coerce: Array[String]
7
- property :object_refs, coerce: Array[Identifier]
6
+ property :authors, coerce: [String]
7
+ property :object_refs, coerce: [Identifier]
8
8
  end
9
9
  end
10
10
  end
@@ -5,7 +5,7 @@ module Stix2
5
5
  property :last_observed, required: true, coerce: Time
6
6
  property :number_observed, required: true, coerce: Integer
7
7
  property :objects, coerce: Hash
8
- property :object_refs, coerce: Array[Identifier]
8
+ property :object_refs, coerce: [Identifier]
9
9
  end
10
10
  end
11
11
  end
@@ -2,9 +2,9 @@ module Stix2
2
2
  module DomainObject
3
3
  class Opinion < Base
4
4
  property :explanation, coerce: String
5
- property :authors, coerce: Array[String]
5
+ property :authors, coerce: [String]
6
6
  property :opinion, values: OPINION_ENUM
7
- property :object_refs, coerce: Array[Identifier]
7
+ property :object_refs, coerce: [Identifier]
8
8
  end
9
9
  end
10
10
  end
@@ -3,9 +3,9 @@ module Stix2
3
3
  class Report < Base
4
4
  property :name, required: true, coerce: String
5
5
  property :description, coerce: String
6
- property :report_types, coerce: ->(v){ validate_array(v, Stix2::REPORT_TYPE_OV) }
6
+ property :report_types, coerce: ->(v) { validate_array(v, Stix2::REPORT_TYPE_OV) }
7
7
  property :published, coerce: Time
8
- property :object_refs, coerce: Array[Identifier]
8
+ property :object_refs, coerce: [Identifier]
9
9
  end
10
10
  end
11
11
  end
@@ -3,17 +3,17 @@ module Stix2
3
3
  class ThreatActor < Base
4
4
  property :name, required: true, coerce: String
5
5
  property :description, coerce: String
6
- property :threat_actor_types, coerce: ->(v){ validate_array(v, THREAT_ACTOR_TYPE_OV) }
7
- property :aliases, coerce: Array[String]
6
+ property :threat_actor_types, coerce: ->(v) { validate_array(v, THREAT_ACTOR_TYPE_OV) }
7
+ property :aliases, coerce: [String]
8
8
  property :first_seen, coerce: Time
9
9
  property :last_seen, coerce: Time
10
- property :roles, coerce: ->(v){ validate_array(v, THREAT_ACTOR_ROLE_OV) }
11
- property :goals, coerce: Array[String]
10
+ property :roles, coerce: ->(v) { validate_array(v, THREAT_ACTOR_ROLE_OV) }
11
+ property :goals, coerce: [String]
12
12
  property :sophistication, values: THREAT_ACTOR_SOPHISTICATION_OV
13
13
  property :resource_level, values: ATTACK_RESOURCE_LEVEL_OV
14
14
  property :primary_motivation, values: ATTACK_MOTIVATION_OV
15
- property :secondary_motivations, coerce: ->(v){ validate_array(v, ATTACK_MOTIVATION_OV) }
16
- property :personal_motivations, coerce: ->(v){ validate_array(v, ATTACK_MOTIVATION_OV) }
15
+ property :secondary_motivations, coerce: ->(v) { validate_array(v, ATTACK_MOTIVATION_OV) }
16
+ property :personal_motivations, coerce: ->(v) { validate_array(v, ATTACK_MOTIVATION_OV) }
17
17
  end
18
18
  end
19
19
  end
@@ -3,9 +3,9 @@ module Stix2
3
3
  class Tool < Base
4
4
  property :name, required: true, coerce: String
5
5
  property :description, coerce: String
6
- property :tool_types, coerce: ->(v){ validate_array(v, TOOL_TYPES_OV) }
7
- property :aliases, coerce: Array[String]
8
- property :kill_chain_phases, coerce: Array[KillChainPhase]
6
+ property :tool_types, coerce: ->(v) { validate_array(v, TOOL_TYPES_OV) }
7
+ property :aliases, coerce: [String]
8
+ property :kill_chain_phases, coerce: [KillChainPhase]
9
9
  property :tool_version, coerce: String
10
10
  end
11
11
  end
data/lib/stix2/enum.rb CHANGED
@@ -1,91 +1,91 @@
1
1
  module Stix2
2
2
  OPINION_ENUM = [
3
- 'strongly-disagree',
4
- 'disagree',
5
- 'neutral',
6
- 'agree',
7
- 'strongly-agree'
3
+ "strongly-disagree",
4
+ "disagree",
5
+ "neutral",
6
+ "agree",
7
+ "strongly-agree"
8
8
  ].freeze
9
9
 
10
10
  ENCRYPTION_ALGORITHM_ENUM = [
11
- 'AES-256-GCM',
12
- 'ChaCha20-Poly1305',
13
- 'mime-type-indicated'
11
+ "AES-256-GCM",
12
+ "ChaCha20-Poly1305",
13
+ "mime-type-indicated"
14
14
  ].freeze
15
15
 
16
16
  WINDOWS_REGISTRY_DATATYPE_ENUM = [
17
- 'REG_NONE',
18
- 'REG_SZ',
19
- 'REG_EXPAND_SZ',
20
- 'REG_BINARY',
21
- 'REG_DWORD',
22
- 'REG_DWORD_BIG_ENDIAN',
23
- 'REG_DWORD_LITTLE_ENDIAN',
24
- 'REG_LINK',
25
- 'REG_MULTI_SZ',
26
- 'REG_RESOURCE_LIST',
27
- 'REG_FULL_RESOURCE_DESCRIPTION',
28
- 'REG_RESOURCE_REQUIREMENTS_LIST',
29
- 'REG_QWORD',
30
- 'REG_INVALID_TYPE'
17
+ "REG_NONE",
18
+ "REG_SZ",
19
+ "REG_EXPAND_SZ",
20
+ "REG_BINARY",
21
+ "REG_DWORD",
22
+ "REG_DWORD_BIG_ENDIAN",
23
+ "REG_DWORD_LITTLE_ENDIAN",
24
+ "REG_LINK",
25
+ "REG_MULTI_SZ",
26
+ "REG_RESOURCE_LIST",
27
+ "REG_FULL_RESOURCE_DESCRIPTION",
28
+ "REG_RESOURCE_REQUIREMENTS_LIST",
29
+ "REG_QWORD",
30
+ "REG_INVALID_TYPE"
31
31
  ].freeze
32
32
 
33
33
  EXTENSION_TYPE_ENUM = [
34
- 'new-sdo',
35
- 'new-sco',
36
- 'new-sro',
37
- 'property-extension',
38
- 'toplevel-property-extension'
34
+ "new-sdo",
35
+ "new-sco",
36
+ "new-sro",
37
+ "property-extension",
38
+ "toplevel-property-extension"
39
39
  ].freeze
40
40
 
41
41
  NETWORK_SOCKET_ADDRESS_FAMILY_ENUM = [
42
- 'AF_UNSPEC',
43
- 'AF_INET',
44
- 'AF_IPX',
45
- 'AF_APPLETALK',
46
- 'AF_NETBIOS',
47
- 'AF_INET6',
48
- 'AF_IRDA',
49
- 'AF_BTH'
42
+ "AF_UNSPEC",
43
+ "AF_INET",
44
+ "AF_IPX",
45
+ "AF_APPLETALK",
46
+ "AF_NETBIOS",
47
+ "AF_INET6",
48
+ "AF_IRDA",
49
+ "AF_BTH"
50
50
  ].freeze
51
51
 
52
52
  NETWORK_SOCKET_TYPE_ENUM = [
53
- 'SOCK_STREAM',
54
- 'AF_ISOCK_DGRAMNET',
55
- 'SOCK_RAW',
56
- 'SOCK_RDM',
57
- 'SOCK_SEQPACKET'
53
+ "SOCK_STREAM",
54
+ "AF_ISOCK_DGRAMNET",
55
+ "SOCK_RAW",
56
+ "SOCK_RDM",
57
+ "SOCK_SEQPACKET"
58
58
  ].freeze
59
59
 
60
60
  WINDOWS_INTEGRITY_LEVEL_ENUM = [
61
- 'low',
62
- 'medium',
63
- 'high',
64
- 'system'
61
+ "low",
62
+ "medium",
63
+ "high",
64
+ "system"
65
65
  ].freeze
66
66
 
67
67
  WINDOWS_SERVICE_START_TYPE_ENUM = [
68
- 'SERVICE_AUTO_START',
69
- 'SERVICE_BOOT_START',
70
- 'SERVICE_DEMAND_START',
71
- 'SERVICE_DISABLED',
72
- 'SERVICE_SYSTEM_ALERT'
68
+ "SERVICE_AUTO_START",
69
+ "SERVICE_BOOT_START",
70
+ "SERVICE_DEMAND_START",
71
+ "SERVICE_DISABLED",
72
+ "SERVICE_SYSTEM_ALERT"
73
73
  ].freeze
74
74
 
75
75
  WINDOWS_SERVICE_TYPE_ENUM = [
76
- 'SERVICE_KERNEL_DRIVER',
77
- 'SERVICE_FILE_SYSTEM_DRIVER',
78
- 'SERVICE_WIN32_OWN_PROCESS',
79
- 'SERVICE_WIN32_SHARE_PROCESS'
76
+ "SERVICE_KERNEL_DRIVER",
77
+ "SERVICE_FILE_SYSTEM_DRIVER",
78
+ "SERVICE_WIN32_OWN_PROCESS",
79
+ "SERVICE_WIN32_SHARE_PROCESS"
80
80
  ].freeze
81
81
 
82
82
  WINDOWS_SERVICE_STATUS_ENUM = [
83
- 'SERVICE_CONTINUE_PENDING',
84
- 'SERVICE_PAUSE_PENDING',
85
- 'SERVICE_PAUSED',
86
- 'SERVICE_RUNNING',
87
- 'SERVICE_START_PENDING',
88
- 'SERVICE_STOP_PENDING',
89
- 'SERVICE_STOPPED'
83
+ "SERVICE_CONTINUE_PENDING",
84
+ "SERVICE_PAUSE_PENDING",
85
+ "SERVICE_PAUSED",
86
+ "SERVICE_RUNNING",
87
+ "SERVICE_START_PENDING",
88
+ "SERVICE_STOP_PENDING",
89
+ "SERVICE_STOPPED"
90
90
  ].freeze
91
91
  end
@@ -4,7 +4,7 @@ module Stix2
4
4
  property :description, coerce: String
5
5
  property :schema, required: true, coerce: String
6
6
  property :version, required: true, coerce: String
7
- property :extension_types, required: true, coerce: ->(values){ validate_array(values, EXTENSION_TYPE_ENUM) }
8
- property :extension_properties, coerce: Array[String]
7
+ property :extension_types, required: true, coerce: ->(values) { validate_array(values, EXTENSION_TYPE_ENUM) }
8
+ property :extension_properties, coerce: [String]
9
9
  end
10
10
  end
@@ -2,7 +2,7 @@ module Stix2
2
2
  module Extensions
3
3
  class AlternateDataStreamType < Stix2::Base
4
4
  property :name, required: true, coerce: String
5
- property :hashes, coerce: ->(hsh){ hash_dict(hsh) }
5
+ property :hashes, coerce: ->(hsh) { hash_dict(hsh) }
6
6
  property :size, coerce: Integer
7
7
  end
8
8
  end
@@ -1,8 +1,8 @@
1
1
  module Stix2
2
2
  module Extensions
3
3
  class ArchiveFile < Stix2::Base
4
- property :contains_refs, required: true, coerce: Array[Identifier]
4
+ property :contains_refs, required: true, coerce: [Identifier]
5
5
  property :comment, coerce: String
6
6
  end
7
7
  end
8
- end
8
+ end
@@ -1,8 +1,8 @@
1
1
  module Stix2
2
2
  module Extensions
3
3
  class Icmp < Stix2::Base
4
- property :icmp_type_hex, required: true, coerce: ->(value){ Stix2.is_hex?(value) && value }
5
- property :icmp_code_hex, required: true, coerce: ->(value){ Stix2.is_hex?(value) && value }
4
+ property :icmp_type_hex, required: true, coerce: ->(value) { Stix2.is_hex?(value) && value }
5
+ property :icmp_code_hex, required: true, coerce: ->(value) { Stix2.is_hex?(value) && value }
6
6
  end
7
7
  end
8
8
  end
@@ -1,10 +1,10 @@
1
- require 'stix2/extensions/alternate_data_stream_type'
1
+ require "stix2/extensions/alternate_data_stream_type"
2
2
 
3
3
  module Stix2
4
4
  module Extensions
5
5
  class Ntfs < Stix2::Base
6
6
  property :sid, coerce: String
7
- property :alternate_data_streams, coerce: Array[AlternateDataStreamType]
7
+ property :alternate_data_streams, coerce: [AlternateDataStreamType]
8
8
  end
9
9
  end
10
10
  end
@@ -2,8 +2,8 @@ module Stix2
2
2
  module Extensions
3
3
  class Pdf < Stix2::Base
4
4
  property :version, coerce: String
5
- property :is_optimized, coerce: ->(value){ Stix2.to_bool(value) }
6
- property :document_info_dict, Hash[String => String]
5
+ property :is_optimized, coerce: ->(value) { Stix2.to_bool(value) }
6
+ property :document_info_dict, {String => String}
7
7
  property :pdfid0, coerce: String
8
8
  property :pdfid1, coerce: String
9
9
  end
@@ -2,9 +2,9 @@ module Stix2
2
2
  module Extensions
3
3
  class Socket < Stix2::Base
4
4
  property :address_family, required: true, values: NETWORK_SOCKET_ADDRESS_FAMILY_ENUM
5
- property :is_blocking, coerce: ->(value){ Stix2.to_bool(value) }
6
- property :is_listening, coerce: ->(value){ Stix2.to_bool(value) }
7
- property :options, coerce: ->(hsh){ hsh.keys.all?{ |k| k.is_a?(Integer) } && hsh }
5
+ property :is_blocking, coerce: ->(value) { Stix2.to_bool(value) }
6
+ property :is_listening, coerce: ->(value) { Stix2.to_bool(value) }
7
+ property :options, coerce: ->(hsh) { hsh.keys.all? { |k| k.is_a?(Integer) } && hsh }
8
8
  property :socket_type, values: NETWORK_SOCKET_TYPE_ENUM
9
9
  property :socket_descriptor, coerce: Integer
10
10
  property :socket_handle, coerce: Integer
@@ -2,7 +2,7 @@ module Stix2
2
2
  module Extensions
3
3
  class UnixAccount < Stix2::Base
4
4
  property :gid, coerce: Integer
5
- property :groups, coerce: Array[String]
5
+ property :groups, coerce: [String]
6
6
  property :home_dir, coerce: String
7
7
  property :shell, coerce: String
8
8
  end
@@ -1,7 +1,7 @@
1
1
  module Stix2
2
2
  module Extensions
3
3
  class WindowsPeOptionalHeaderType < Stix2::Base
4
- property :magic_hex, coerce: ->(value){ Stix2.is_hex?(value) && value }
4
+ property :magic_hex, coerce: ->(value) { Stix2.is_hex?(value) && value }
5
5
  property :major_linker_version, coerce: Integer
6
6
  property :minor_linker_version, coerce: Integer
7
7
  property :size_of_code, coerce: Integer
@@ -19,19 +19,19 @@ module Stix2
19
19
  property :minor_image_version, coerce: Integer
20
20
  property :major_subsystem_version, coerce: Integer
21
21
  property :minor_subsystem_version, coerce: Integer
22
- property :win32_version_value_hex, coerce: ->(value){ Stix2.is_hex?(value) && value }
22
+ property :win32_version_value_hex, coerce: ->(value) { Stix2.is_hex?(value) && value }
23
23
  property :size_of_image, coerce: Integer
24
24
  property :size_of_headers, coerce: Integer
25
- property :checksum_hex, coerce: ->(value){ Stix2.is_hex?(value) && value }
26
- property :subsystem_hex, coerce: ->(value){ Stix2.is_hex?(value) && value }
27
- property :dll_characteristics_hex, coerce: ->(value){ Stix2.is_hex?(value) && value }
25
+ property :checksum_hex, coerce: ->(value) { Stix2.is_hex?(value) && value }
26
+ property :subsystem_hex, coerce: ->(value) { Stix2.is_hex?(value) && value }
27
+ property :dll_characteristics_hex, coerce: ->(value) { Stix2.is_hex?(value) && value }
28
28
  property :size_of_stack_reserve, coerce: Integer
29
29
  property :size_of_stack_commit, coerce: Integer
30
30
  property :size_of_heap_reserve, coerce: Integer
31
31
  property :size_of_heap_commit, coerce: Integer
32
- property :loader_flags_hex, coerce: ->(value){ Stix2.is_hex?(value) && value }
32
+ property :loader_flags_hex, coerce: ->(value) { Stix2.is_hex?(value) && value }
33
33
  property :number_of_rva_and_sizes, coerce: Integer
34
- property :hashes, coerce: ->(hsh){ hash_dict(hsh) }
34
+ property :hashes, coerce: ->(hsh) { hash_dict(hsh) }
35
35
  end
36
36
  end
37
37
  end
@@ -4,7 +4,7 @@ module Stix2
4
4
  property :name, required: true, coerce: String
5
5
  property :size, coerce: Integer
6
6
  property :entropy, coerce: Float
7
- property :hashes, coerce: ->(hsh){ hash_dict(hsh) }
7
+ property :hashes, coerce: ->(hsh) { hash_dict(hsh) }
8
8
  end
9
9
  end
10
10
  end
@@ -1,21 +1,21 @@
1
- require 'stix2/extensions/windows_pe_optional_header_type'
2
- require 'stix2/extensions/windows_pe_section_type'
1
+ require "stix2/extensions/windows_pe_optional_header_type"
2
+ require "stix2/extensions/windows_pe_section_type"
3
3
 
4
4
  module Stix2
5
5
  module Extensions
6
6
  class WindowsPebinary < Stix2::Base
7
7
  property :pe_type, required: true, values: WINDOWS_PEBINARY_TYPE_OV
8
8
  property :imphash, coerce: String
9
- property :machine_hex, coerce: ->(value){ Stix2.is_hex?(value) && value }
9
+ property :machine_hex, coerce: ->(value) { Stix2.is_hex?(value) && value }
10
10
  property :number_of_sections, coerce: Integer
11
11
  property :time_date_stamp, coerce: Time
12
- property :pointer_to_symbol_table_hex, coerce: ->(value){ Stix2.is_hex?(value) && value }
12
+ property :pointer_to_symbol_table_hex, coerce: ->(value) { Stix2.is_hex?(value) && value }
13
13
  property :number_of_symbols, coerce: Integer
14
14
  property :size_of_optional_header, coerce: Integer
15
- property :characteristics_hex, coerce: ->(value){ Stix2.is_hex?(value) && value }
16
- property :file_header_hashes, coerce: ->(hsh){ hash_dict(hsh) }
15
+ property :characteristics_hex, coerce: ->(value) { Stix2.is_hex?(value) && value }
16
+ property :file_header_hashes, coerce: ->(hsh) { hash_dict(hsh) }
17
17
  property :optional_header, coerce: WindowsPeOptionalHeaderType
18
- property :sections, coerce: Array[WindowsPeSectionType]
18
+ property :sections, coerce: [WindowsPeSectionType]
19
19
  end
20
20
  end
21
21
  end
@@ -1,8 +1,8 @@
1
1
  module Stix2
2
2
  module Extensions
3
3
  class WindowsProcess < Stix2::Base
4
- property :aslr_enabled, coerce: ->(value){ Stix2.to_bool(value) }
5
- property :dep_enabled, coerce: ->(value){ Stix2.to_bool(value) }
4
+ property :aslr_enabled, coerce: ->(value) { Stix2.to_bool(value) }
5
+ property :dep_enabled, coerce: ->(value) { Stix2.to_bool(value) }
6
6
  property :priority, coerce: String
7
7
  property :owner_sid, coerce: String
8
8
  property :window_title, coerce: String
@@ -2,11 +2,11 @@ module Stix2
2
2
  module Extensions
3
3
  class WindowsService < Stix2::Base
4
4
  property :service_name, coerce: String
5
- property :description, coerce: Array[String]
5
+ property :description, coerce: [String]
6
6
  property :display_name, coerce: String
7
7
  property :group_name, coerce: String
8
8
  property :start_type, values: WINDOWS_SERVICE_START_TYPE_ENUM
9
- property :service_dll_refs, coerce: Array[Identifier]
9
+ property :service_dll_refs, coerce: [Identifier]
10
10
  property :service_type, values: WINDOWS_SERVICE_TYPE_ENUM
11
11
  property :service_status, values: WINDOWS_SERVICE_STATUS_ENUM
12
12
  end
@@ -3,7 +3,7 @@ module Stix2
3
3
  property :source_name, coerce: String, required: true
4
4
  property :description, coerce: String
5
5
  property :url, coerce: String
6
- property :hashes, coerce: ->(hsh){ hash_dict(hsh) }
6
+ property :hashes, coerce: ->(hsh) { hash_dict(hsh) }
7
7
  property :external_id, coerce: String
8
8
  end
9
9
  end