synapse 2.192.0__py311-none-any.whl → 2.194.0__py311-none-any.whl

synapse/lib/stormlib/scrape.py

@@ -71,7 +71,7 @@ class LibScrape(s_stormtypes.Lib):
                 $form="ps:name"
 
                 function scrape(text, form) {
-                        $ret = $lib.list()
+                        $ret = ()
                         for ($valu, $info) in $lib.scrape.genMatches($text, $re) {
                             $ret.append(($form, $valu, $info))
                         }

synapse/lib/stormlib/stix.py

@@ -74,7 +74,7 @@ _DefaultConfig = {
                         'created': 'return($lib.stix.export.timestamp(.created))',
                         'modified': 'return($lib.stix.export.timestamp(.created))',
                         'sectors': '''
-                            init { $list = $lib.list() }
+                            init { $list = () }
                             -> ou:industry +:name $list.append(:name)
                             fini { if $list { return($list) } }
                         ''',
@@ -88,7 +88,7 @@ _DefaultConfig = {
                         'first_seen': '+.seen $seen=.seen return($lib.stix.export.timestamp($seen.0))',
                         'last_seen': '+.seen $seen=.seen return($lib.stix.export.timestamp($seen.1))',
                         'goals': '''
-                            init { $goals = $lib.list() }
+                            init { $goals = () }
                             -> ou:campaign:org -> ou:goal | uniq | +:name $goals.append(:name)
                             fini { if $goals { return($goals) } }
                         ''',
@@ -183,7 +183,7 @@ _DefaultConfig = {
                     'props': {
                         'value': 'return($node.repr())',
                         'resolves_to_refs': '''
-                            init { $refs = $lib.list() }
+                            init { $refs = () }
                             { -> inet:dns:a -> inet:ipv4 $refs.append($bundle.add($node)) }
                             { -> inet:dns:aaaa -> inet:ipv6 $refs.append($bundle.add($node)) }
                             { -> inet:dns:cname:fqdn :cname -> inet:fqdn $refs.append($bundle.add($node)) }
@@ -257,7 +257,7 @@ _DefaultConfig = {
                         ''',
                         'mime_type': '+:mime return(:mime)',
                         'contains_refs': '''
-                            init { $refs = $lib.list() }
+                            init { $refs = () }
                             -(refs)> *
                             $stixid = $bundle.add($node)
                             if $stixid { $refs.append($stixid) }
@@ -279,7 +279,7 @@ _DefaultConfig = {
                         'is_multipart': 'return($lib.false)',
                         'from_ref': ':from -> inet:email return($bundle.add($node))',
                         'to_refs': '''
-                            init { $refs = $lib.list() }
+                            init { $refs = () }
                             { :to -> inet:email $refs.append($bundle.add($node)) }
                             fini { if $refs { return($refs) } }
                         ''',
@@ -311,7 +311,7 @@ _DefaultConfig = {
                         'created': 'return($lib.stix.export.timestamp(.created))',
                         'modified': 'return($lib.stix.export.timestamp(.created))',
                         'sample_refs': '''
-                            init { $refs = $lib.list() }
+                            init { $refs = () }
                             -> file:bytes $refs.append($bundle.add($node))
                             fini { if $refs { return($refs) } }
                         ''',
@@ -393,7 +393,7 @@ _DefaultConfig = {
                         'description': 'if (:desc) { return (:desc) }',
                         'created': 'return($lib.stix.export.timestamp(.created))',
                         'modified': 'return($lib.stix.export.timestamp(.created))',
-                        'external_references': 'if :cve { $cve=:cve $cve=$cve.upper() $list=$lib.list(({"source_name": "cve", "external_id": $cve})) return($list) }'
+                        'external_references': 'if :cve { $cve=:cve $cve=$cve.upper() return(([{"source_name": "cve", "external_id": $cve}])) }'
                     },
                     'rels': (
 
@@ -439,7 +439,7 @@ _DefaultConfig = {
                         'modified': 'return($lib.stix.export.timestamp(.created))',
                         'published': 'return($lib.stix.export.timestamp(:published))',
                         'object_refs': '''
-                            init { $refs = $lib.list() }
+                            init { $refs = () }
                             -(refs)> *
                             $stixid = $bundle.add($node)
                             if $stixid { $refs.append($stixid) }

synapse/lib/stormtypes.py

@@ -201,11 +201,29 @@ class StormTypesRegistry:
             raise Exception('no key!')
         self.addStormLib(path, ctor)
 
+        for info in ctor._storm_locals:
+            rtype = info.get('type')
+            if isinstance(rtype, dict) and rtype.get('type') == 'function':
+                if (fname := rtype.get('_funcname')) == '_storm_query':
+                    continue
+
+                if (func := getattr(ctor, fname, None)) is not None:
+                    funcpath = '.'.join(('lib',) + ctor._storm_lib_path + (info['name'],))
+                    func._storm_funcpath = f"${funcpath}"
+
         return ctor
 
     def registerType(self, ctor):
         '''Decorator to register a StormPrim'''
         self.addStormType(ctor.__name__, ctor)
+
+        for info in ctor._storm_locals:
+            rtype = info.get('type')
+            if isinstance(rtype, dict) and rtype.get('type') == 'function':
+                fname = rtype.get('_funcname')
+                if (func := getattr(ctor, fname, None)) is not None:
+                    func._storm_funcpath = f"{ctor._storm_typename}.{info['name']}"
+
         return ctor
 
     def iterLibs(self):
@@ -557,7 +575,7 @@ class StormType:
             raise s_exc.NoSuchName(name=name, mesg=mesg)
 
         if s_scope.get('runt').readonly and not getattr(stor, '_storm_readonly', False):
-            mesg = f'Function ({stor.__name__}) is not marked readonly safe.'
+            mesg = f'Setting {name} on {self._storm_typename} is not marked readonly safe.'
             raise s_exc.IsReadOnly(mesg=mesg, name=name, valu=valu)
 
         await s_coro.ornot(stor, valu)
@@ -628,6 +646,7 @@ class Lib(StormType):
                 if callable(v) and v.__name__ == 'realfunc':
                     v._storm_runtime_lib = self
                     v._storm_runtime_lib_func = k
+                    v._storm_funcpath = f'${".".join(("lib",) + self.name + (k,))}'
 
                 self.locls[k] = v
 
@@ -1228,7 +1247,8 @@ class LibBase(Lib):
                        'desc': 'Additional keyword arguments containing data to add to the event.', },
                   ),
                   'returns': {'type': 'null', }}},
-        {'name': 'list', 'desc': 'Get a Storm List object.',
+        {'name': 'list', 'desc': 'Get a Storm List object. This is deprecated, use ([]) to declare a list instead.',
+         'deprecated': {'eolvers': 'v3.0.0'},
          'type': {'type': 'function', '_funcname': '_list',
                   'args': (
                       {'name': '*vals', 'type': 'any', 'desc': 'Initial values to place in the list.', },
@@ -1288,7 +1308,8 @@ class LibBase(Lib):
                     cli> storm if $lib.false { $lib.print('Is True') } else { $lib.print('Is False') }
                     Is False''',
          'type': 'boolean', },
-        {'name': 'text', 'desc': 'Get a Storm Text object.',
+        {'name': 'text', 'desc': 'Get a Storm Text object. This is deprecated; please use a list to append strings to, and then use ``$lib.str.join()`` to join them on demand.',
+         'deprecated': {'eolvers': '3.0.0'},
          'type': {'type': 'function', '_funcname': '_text',
                   'args': (
                       {'name': '*args', 'type': 'str',
@@ -1644,7 +1665,7 @@ class LibBase(Lib):
         if mesg:
             mesg = await self._get_mesg(mesg, **kwargs)
             await self.runt.warn(mesg, log=False)
-            raise s_stormctrl.StormExit(mesg)
+            raise s_stormctrl.StormExit(mesg=mesg)
         raise s_stormctrl.StormExit()
 
     @stormfunc(readonly=True)
@@ -1661,10 +1682,16 @@ class LibBase(Lib):
 
     @stormfunc(readonly=True)
     async def _list(self, *vals):
+        s_common.deprecated('$lib.list()', curv='2.194.0')
+        await self.runt.snap.warnonce('$lib.list() is deprecated. Use ([]) instead.')
         return List(list(vals))
 
     @stormfunc(readonly=True)
     async def _text(self, *args):
+        s_common.deprecated('$lib.text()', curv='2.194.0')
+        runt = s_scope.get('runt')
+        if runt:
+            await runt.snap.warnonce('$lib.text() is deprecated. Please use a list to append strings to, and then use ``$lib.str.join()`` to join them on demand.')
         valu = ''.join(args)
         return Text(valu)
 
@@ -5158,7 +5185,7 @@ class List(Prim):
             Examples:
                 Populate a list by extending it with to other lists::
 
-                    $list = $lib.list()
+                    $list = ()
 
                     $foo = (f, o, o)
                     $bar = (b, a, r)

synapse/lib/version.py

@@ -223,6 +223,6 @@ def reqVersion(valu, reqver,
 ##############################################################################
 # The following are touched during the release process by bumpversion.
 # Do not modify these directly.
-version = (2, 192, 0)
+version = (2, 194, 0)
 verstring = '.'.join([str(x) for x in version])
-commit = '8a442a534d27fff4c6189922c4b0ea85d332f18e'
+commit = 'fb479d376805f963f11c5029310325c13ef2c883'

synapse/lib/view.py

@@ -635,7 +635,6 @@ class View(s_nexus.Pusher):  # type: ignore
     async def _calcForkLayers(self):
         # recompute the proper set of layers for a forked view
         # (this may only be called from within a nexus handler)
-
         '''
         We spent a lot of time thinking/talking about this so some hefty
         comments are in order:
@@ -953,6 +952,15 @@ class View(s_nexus.Pusher):  # type: ignore
                            extra={'synapse': {'text': text, 'username': user.name, 'user': user.iden}})
             raise
 
+        except (s_stormctrl.StormLoopCtrl, s_stormctrl.StormGenrCtrl) as e:
+            if isinstance(e, s_stormctrl.StormLoopCtrl):
+                mesg = f'Loop control statement "{e.statement}" used outside of a loop.'
+            else:
+                mesg = f'Generator control statement "{e.statement}" used outside of a generator function.'
+            logmesg = f'Error during storm execution for {{ {text} }} - {mesg}'
+            logger.exception(logmesg, extra={'synapse': {'text': text, 'username': user.name, 'user': user.iden}})
+            raise s_exc.StormRuntimeError(mesg=mesg, statement=e.statement, highlight=e.get('highlight')) from e
+
         except Exception:
             logger.exception(f'Error during callStorm execution for {{ {text} }}',
                              extra={'synapse': {'text': text, 'username': user.name, 'user': user.iden}})
@@ -1055,8 +1063,17 @@ class View(s_nexus.Pusher):  # type: ignore
                 raise
 
             except Exception as e:
-                logger.exception(f'Error during storm execution for {{ {text} }}',
-                                 extra={'synapse': {'text': text, 'username': user.name, 'user': user.iden}})
+                mesg = ''
+                if isinstance(e, s_stormctrl.StormLoopCtrl):
+                    mesg = f'Loop control statement "{e.statement}" used outside of a loop.'
+                    e = s_exc.StormRuntimeError(mesg=mesg, statement=e.statement, highlight=e.get('highlight'))
+                elif isinstance(e, s_stormctrl.StormGenrCtrl):
+                    mesg = f'Generator control statement "{e.statement}" used outside of a generator function.'
+                    e = s_exc.StormRuntimeError(mesg=mesg, statement=e.statement, highlight=e.get('highlight'))
+                logmesg = f'Error during storm execution for {{ {text} }}'
+                if mesg:
+                    logmesg = f'{logmesg} - {mesg}'
+                logger.exception(logmesg, extra={'synapse': {'text': text, 'username': user.name, 'user': user.iden}})
                 enfo = s_common.err(e)
                 enfo[1].pop('esrc', None)
                 enfo[1].pop('ename', None)

synapse/models/geopol.py

@@ -69,6 +69,7 @@ class PolModule(s_module.CoreModule):
                         ('tld', ('inet:fqdn', {}), {}),
 
                         ('name', ('geo:name', {}), {
+                            'alts': ('names',),
                             'doc': 'The name of the country.'}),
 
                         ('names', ('array', {'type': 'geo:name', 'uniq': True, 'sorted': True}), {

synapse/models/geospace.py

@@ -495,6 +495,7 @@ class GeoModule(s_module.CoreModule):
                     ('geo:place', {}, (
 
                         ('name', ('geo:name', {}), {
+                            'alts': ('names',),
                             'doc': 'The name of the place.'}),
 
                         ('type', ('geo:place:taxonomy', {}), {

synapse/models/inet.py

@@ -1442,7 +1442,11 @@ class InetModule(s_module.CoreModule):
                         'doc': 'A channel within a web service or instance such as slack or discord.'
                     }),
 
-                    ('inet:web:hashtag', ('str', {'lower': True, 'regex': r'^#\w[\w·]*(?<!·)$'}), {
+                    ('inet:web:hashtag', ('str', {'lower': True, 'strip': True, 'regex': r'^#[^\p{Z}#]+$'}), {
+                        # regex explanation:
+                        # - starts with pound
+                        # - one or more non-whitespace/non-pound character
+                        # The minimum hashtag is a pound with a single non-whitespace character
                         'doc': 'A hashtag used in a web post.',
                     }),
 
@@ -1728,6 +1732,9 @@ class InetModule(s_module.CoreModule):
                         'template': {'service:base': 'object'},
                         'props': (
 
+                            ('url', ('inet:url', {}), {
+                                'doc': 'The primary URL associated with the {service:base}.'}),
+
                             ('status', ('inet:service:object:status', {}), {
                                 'doc': 'The status of the {service:base}.'}),
 
@@ -1811,6 +1818,9 @@ class InetModule(s_module.CoreModule):
 
                     ('inet:email:message', {}, (
 
+                        ('id', ('str', {'strip': True}), {
+                            'doc': 'The ID parsed from the "message-id" header.'}),
+
                         ('to', ('inet:email', {}), {
                             'doc': 'The email address of the recipient.'}),
 
@@ -2171,6 +2181,9 @@ class InetModule(s_module.CoreModule):
                         ('dst:ssh:key', ('crypto:key', {}), {
                             'doc': 'The key sent by the server as part of an SSH session setup.'}),
 
+                        ('capture:host', ('it:host', {}), {
+                            'doc': 'The host which captured the flow.'}),
+
                         ('raw', ('data', {}), {
                             'doc': 'A raw record used to create the flow which may contain additional protocol details.'}),
                     )),
@@ -2194,6 +2207,9 @@ class InetModule(s_module.CoreModule):
                         ('host', ('it:host', {}), {
                             'doc': 'The host that used the network egress.'}),
 
+                        ('host:iface', ('inet:iface', {}), {
+                            'doc': 'The interface which the host used to connect out via the egress.'}),
+
                         ('account', ('inet:service:account', {}), {
                             'doc': 'The service account which used the client address to egress.'}),
 
@@ -3769,6 +3785,9 @@ class InetModule(s_module.CoreModule):
                         ('replyto', ('inet:service:message', {}), {
                             'doc': 'The message that this message was sent in reply to. Used for message threading.'}),
 
+                        ('repost', ('inet:service:message', {}), {
+                            'doc': 'The original message reposted by this message.'}),
+
                         ('links', ('array', {'type': 'inet:service:message:link', 'uniq': True, 'sorted': True}), {
                             'doc': 'An array of links contained within the message.'}),
 

synapse/models/infotech.py

@@ -655,6 +655,7 @@ class ItModule(s_module.CoreModule):
 
                 ('it:host', ('guid', {}), {
                     'interfaces': ('inet:service:object',),
+                    'template': {'service:base': 'host'},
                     'doc': 'A GUID that represents a host or system.'}),
 
                 ('it:log:event:type:taxonomy', ('taxonomy', {}), {
@@ -784,6 +785,7 @@ class ItModule(s_module.CoreModule):
                 }),
                 ('it:dev:repo', ('guid', {}), {
                     'interfaces': ('inet:service:object',),
+                    'template': {'service:base': 'repository'},
                     'doc': 'A version control system instance.',
                 }),
                 ('it:dev:repo:remote', ('guid', {}), {
@@ -791,10 +793,12 @@ class ItModule(s_module.CoreModule):
                 }),
                 ('it:dev:repo:branch', ('guid', {}), {
                     'interfaces': ('inet:service:object',),
+                    'template': {'service:base': 'repository branch'},
                     'doc': 'A branch in a version control system instance.',
                 }),
                 ('it:dev:repo:commit', ('guid', {}), {
                     'interfaces': ('inet:service:object',),
+                    'template': {'service:base': 'repository commit'},
                     'doc': 'A commit to a repository.',
                 }),
                 ('it:dev:repo:diff', ('guid', {}), {
@@ -802,18 +806,22 @@ class ItModule(s_module.CoreModule):
                 }),
                 ('it:dev:repo:issue:label', ('guid', {}), {
                     'interfaces': ('inet:service:object',),
+                    'template': {'service:base': 'repository issue label'},
                     'doc': 'A label applied to a repository issue.',
                 }),
                 ('it:dev:repo:issue', ('guid', {}), {
                     'interfaces': ('inet:service:object',),
+                    'template': {'service:base': 'repository issue'},
                     'doc': 'An issue raised in a repository.',
                 }),
                 ('it:dev:repo:issue:comment', ('guid', {}), {
                     'interfaces': ('inet:service:object',),
+                    'template': {'service:base': 'repository issue comment'},
                     'doc': 'A comment on an issue in a repository.',
                 }),
                 ('it:dev:repo:diff:comment', ('guid', {}), {
                     'interfaces': ('inet:service:object',),
+                    'template': {'service:base': 'repository diff comment'},
                     'doc': 'A comment on a diff in a repository.',
                 }),
                 ('it:prod:soft', ('guid', {}), {
@@ -849,10 +857,12 @@ class ItModule(s_module.CoreModule):
                 }),
 
                 ('it:os:ios:idfa', ('it:adid', {}), {
-                    'doc': 'An iOS advertising identification string.'}),
+                    'deprecated': True,
+                    'doc': 'Deprecated. Please use it:adid.'}),
 
                 ('it:os:android:aaid', ('it:adid', {}), {
-                    'doc': 'An android advertising identification string.'}),
+                    'deprecated': True,
+                    'doc': 'Deprecated. Please use it:adid.'}),
 
                 ('it:os:android:perm', ('str', {}), {
                     'doc': 'An android permission string.'}),
@@ -963,12 +973,12 @@ class ItModule(s_module.CoreModule):
                 }),
                 ('it:exec:pipe', ('guid', {}), {
                     'interfaces': ('it:host:activity',),
-                    'doc': 'A named pipe created by a process at runtime.',
-                }),
+                    'doc': 'A named pipe created by a process at runtime.'}),
+
                 ('it:exec:url', ('guid', {}), {
                     'interfaces': ('it:host:activity',),
-                    'doc': 'An instance of a host requesting a URL.',
-                }),
+                    'doc': 'An instance of a host requesting a URL using any protocol scheme.'}),
+
                 ('it:exec:bind', ('guid', {}), {
                     'interfaces': ('it:host:activity',),
                     'doc': 'An instance of a host binding a listening port.',
@@ -1046,6 +1056,7 @@ class ItModule(s_module.CoreModule):
 
                 ('it:host:tenancy', ('guid', {}), {
                     'interfaces': ('inet:service:object',),
+                    'template': {'service:base': 'host tenancy'},
                     'doc': 'A time window where a host was a tenant run by another host.'}),
 
                 ('it:software:image:type:taxonomy', ('taxonomy', {}), {
@@ -1054,6 +1065,7 @@ class ItModule(s_module.CoreModule):
 
                 ('it:software:image', ('guid', {}), {
                     'interfaces': ('inet:service:object',),
+                    'template': {'service:base': 'software image'},
                     'doc': 'The base image used to create a container or OS.'}),
 
                 ('it:storage:mount', ('guid', {}), {
@@ -2084,7 +2096,12 @@ class ItModule(s_module.CoreModule):
                 )),
                 ('it:prod:soft:taxonomy', {}, ()),
                 ('it:prod:soft', {}, (
+
+                    ('id', ('str', {'strip': True}), {
+                        'doc': 'An ID for the software.'}),
+
                     ('name', ('it:prod:softname', {}), {
+                        'alts': ('names',),
                         'doc': 'Name of the software.',
                     }),
                     ('type', ('it:prod:soft:taxonomy', {}), {
@@ -2206,6 +2223,7 @@ class ItModule(s_module.CoreModule):
                         'doc': 'Deprecated. Please use it:prod:softver:name.',
                     }),
                     ('name', ('it:prod:softname', {}), {
+                        'alts': ('names',),
                         'doc': 'Name of the software version.',
                     }),
                     ('names', ('array', {'type': 'it:prod:softname', 'uniq': True, 'sorted': True}), {

synapse/models/orgs.py

@@ -493,10 +493,10 @@ class OuModule(s_module.CoreModule):
                 ('ou:id:number', {}, (
 
                     ('type', ('ou:id:type', {}), {
-                        'doc': 'The type of org id', 'ro': True}),
+                        'doc': 'The type of org ID.', 'ro': True}),
 
                     ('value', ('ou:id:value', {}), {
-                        'doc': 'The value of org id', 'ro': True}),
+                        'doc': 'The value of the org ID.', 'ro': True}),
 
                     ('status', ('str', {'lower': True, 'strip': True}), {
                         'doc': 'A freeform status such as valid, suspended, expired.'}),
@@ -526,6 +526,7 @@ class OuModule(s_module.CoreModule):
                 ('ou:goal', {}, (
 
                     ('name', ('ou:goalname', {}), {
+                        'alts': ('names',),
                         'doc': 'A terse name for the goal.'}),
 
                     ('names', ('array', {'type': 'ou:goalname', 'sorted': True, 'uniq': True}), {
@@ -570,6 +571,7 @@ class OuModule(s_module.CoreModule):
                         'doc': 'The FQDN of the org responsible for the campaign. Used for entity resolution.'}),
 
                     ('goal', ('ou:goal', {}), {
+                        'alts': ('goals',),
                         'doc': 'The assessed primary goal of the campaign.'}),
 
                     ('slogan', ('lang:phrase', {}), {
@@ -585,6 +587,7 @@ class OuModule(s_module.CoreModule):
                         'doc': 'Records the success/failure status of the campaign if known.'}),
 
                     ('name', ('ou:campname', {}), {
+                        'alts': ('names',),
                         'ex': 'operation overlord',
                         'doc': 'A terse name of the campaign.'}),
 
@@ -924,6 +927,7 @@ class OuModule(s_module.CoreModule):
                 ('ou:industry', {}, (
 
                     ('name', ('ou:industryname', {}), {
+                        'alts': ('names',),
                         'doc': 'The name of the industry.'}),
 
                     ('type', ('ou:industry:type:taxonomy', {}), {
@@ -1176,6 +1180,7 @@ class OuModule(s_module.CoreModule):
                         'doc': 'An array of contacts which sponsored the conference.',
                     }),
                     ('name', ('entity:name', {}), {
+                        'alts': ('names',),
                         'doc': 'The full name of the conference.',
                         'ex': 'defcon 2017'}),
 

synapse/models/person.py

@@ -254,6 +254,7 @@ class PsModule(s_module.CoreModule):
                         'doc': 'The most recent known vitals for the person.',
                     }),
                     ('name', ('ps:name', {}), {
+                        'alts': ('names',),
                         'doc': 'The localized name for the person.',
                     }),
                     ('name:sur', ('ps:tokn', {}), {
@@ -350,12 +351,17 @@ class PsModule(s_module.CoreModule):
                         'doc': 'The most recent known vitals for the contact.',
                     }),
                     ('name', ('ps:name', {}), {
-                        'doc': 'The person name listed for the contact.',
-                    }),
+                        'alts': ('names',),
+                        'doc': 'The person name listed for the contact.'}),
+
+                    ('bio', ('str', {}), {
+                        'doc': 'A brief bio provided for the contact.'}),
+
                     ('desc', ('str', {}), {
-                        'doc': 'A description of this contact.',
-                    }),
+                        'doc': 'A description of this contact.'}),
+
                     ('title', ('ou:jobtitle', {}), {
+                        'alts': ('titles',),
                         'doc': 'The job/org title listed for this contact.'}),
 
                     ('titles', ('array', {'type': 'ou:jobtitle', 'sorted': True, 'uniq': True}), {
@@ -365,12 +371,14 @@ class PsModule(s_module.CoreModule):
                         'doc': 'The photo listed for this contact.',
                     }),
                     ('orgname', ('ou:name', {}), {
+                        'alts': ('orgnames',),
                         'doc': 'The listed org/company name for this contact.',
                     }),
                     ('orgfqdn', ('inet:fqdn', {}), {
                         'doc': 'The listed org/company FQDN for this contact.',
                     }),
                     ('user', ('inet:user', {}), {
+                        'alts': ('users',),
                         'doc': 'The username or handle for this contact.'}),
 
                     ('service:accounts', ('array', {'type': 'inet:service:account', 'sorted': True, 'uniq': True}), {
@@ -412,6 +420,7 @@ class PsModule(s_module.CoreModule):
                         'doc': 'The home or main site for this contact.',
                     }),
                     ('email', ('inet:email', {}), {
+                        'alts': ('emails',),
                         'doc': 'The main email address for this contact.',
                     }),
                     ('email:work', ('inet:email', {}), {
@@ -440,6 +449,7 @@ class PsModule(s_module.CoreModule):
                         'doc': 'The work phone number for this contact.',
                     }),
                     ('id:number', ('ou:id:number', {}), {
+                        'alts': ('id:numbers',),
                         'doc': 'An ID number issued by an org and associated with this contact.',
                     }),
                     ('adid', ('it:adid', {}), {
@@ -479,6 +489,7 @@ class PsModule(s_module.CoreModule):
                     }),
 
                     ('lang', ('lang:language', {}), {
+                        'alts': ('langs',),
                         'doc': 'The language specified for the contact.'}),
 
                     ('langs', ('array', {'type': 'lang:language'}), {

synapse/models/risk.py

@@ -242,9 +242,18 @@ class RiskModule(s_module.CoreModule):
                 (('risk:mitigation', 'uses', 'inet:service:rule'), {
                     'doc': 'The mitigation uses the service rule.'}),
 
+                (('risk:mitigation', 'uses', 'it:prod:softver'), {
+                    'doc': 'The mitigation uses the software version.'}),
+
+                (('risk:mitigation', 'uses', 'it:prod:hardware'), {
+                    'doc': 'The mitigation uses the hardware.'}),
+
                 (('risk:leak', 'leaked', None), {
                     'doc': 'The leak included the disclosure of the target node.'}),
 
+                (('risk:leak', 'enabled', 'risk:leak'), {
+                    'doc': 'The source leak enabled the target leak to occur.'}),
+
                 (('risk:extortion', 'leveraged', None), {
                     'doc': 'The extortion event was based on attacker access to the target node.'}),
 
@@ -301,6 +310,7 @@ class RiskModule(s_module.CoreModule):
                         'doc': "The reporting organization's assessed location of the threat cluster."}),
 
                     ('org:name', ('ou:name', {}), {
+                        'alts': ('org:names',),
                         'ex': 'apt1',
                         'doc': "The reporting organization's name for the threat cluster."}),
 
@@ -374,6 +384,7 @@ class RiskModule(s_module.CoreModule):
                         'doc': 'The authoritative software family for the tool.'}),
 
                     ('soft:name', ('it:prod:softname', {}), {
+                        'alts': ('soft:names',),
                         'doc': 'The reporting organization\'s name for the tool.'}),
 
                     ('soft:names', ('array', {'type': 'it:prod:softname', 'uniq': True, 'sorted': True}), {
@@ -407,10 +418,12 @@ class RiskModule(s_module.CoreModule):
                         'doc': 'A description of the mitigation approach for the vulnerability.'}),
 
                     ('software', ('it:prod:softver', {}), {
-                        'doc': 'A software version which implements a fix for the vulnerability.'}),
+                        'deprecated': True,
+                        'doc': 'Deprecated. Please use risk:mitigation -(uses)> it:prod:softver.'}),
 
                     ('hardware', ('it:prod:hardware', {}), {
-                        'doc': 'A hardware version which implements a fix for the vulnerability.'}),
+                        'deprecated': True,
+                        'doc': 'Deprecated. Please use risk:mitigation -(uses)> it:prod:hardware.'}),
 
                     ('reporter', ('ou:org', {}), {
                         'doc': 'The organization reporting on the mitigation.'}),
@@ -430,6 +443,7 @@ class RiskModule(s_module.CoreModule):
                 ('risk:vuln', {}, (
 
                     ('name', ('risk:vulnname', {}), {
+                        'alts': ('names',),
                         'doc': 'A user specified name for the vulnerability.'}),
 
                     ('names', ('array', {'type': 'risk:vulnname', 'sorted': True, 'uniq': True}), {
@@ -1034,6 +1048,9 @@ class RiskModule(s_module.CoreModule):
                     ('leaker', ('ps:contact', {}), {
                         'doc': 'The identity which leaked the information.'}),
 
+                    ('recipient', ('ps:contact', {}), {
+                        'doc': 'The identity which received the leaked information.'}),
+
                     ('type', ('risk:leak:type:taxonomy', {}), {
                         'doc': 'A type taxonomy for the leak.'}),
 

synapse/models/telco.py

@@ -369,9 +369,16 @@ class TelcoModule(s_module.CoreModule):
                     ('wifi:bssid', ('inet:mac', {}), {}),
 
                     # host specific data
-                    ('adid', ('it:adid', {}), {}),
-                    ('aaid', ('it:os:android:aaid', {}), {}),
-                    ('idfa', ('it:os:ios:idfa', {}), {}),
+                    ('adid', ('it:adid', {}), {
+                        'doc': 'The advertising ID of the mobile telemetry sample.'}),
+
+                    ('aaid', ('it:os:android:aaid', {}), {
+                        'deprecated': True,
+                        'doc': 'Deprecated. Please use :adid.'}),
+
+                    ('idfa', ('it:os:ios:idfa', {}), {
+                        'deprecated': True,
+                        'doc': 'Deprecated. Please use :adid.'}),
 
                     # User related data
                     ('name', ('ps:name', {}), {}),