Implementation of the STIX Incident. Args: id_ (optional): An identifier. If ``None``, a value will be generated via ``mixbox.idgen.create_id()``. If set, this will unset the ``idref`` property. idref (optional): An identifier reference. If set this will
| 24 | |
| 25 | |
| 26 | class Incident(stix.BaseCoreComponent): |
| 27 | """Implementation of the STIX Incident. |
| 28 | |
| 29 | Args: |
| 30 | id_ (optional): An identifier. If ``None``, a value will be generated |
| 31 | via ``mixbox.idgen.create_id()``. If set, this will unset the |
| 32 | ``idref`` property. |
| 33 | idref (optional): An identifier reference. If set this will unset the |
| 34 | ``id_`` property. |
| 35 | timestamp (optional): A timestamp value. Can be an instance of |
| 36 | ``datetime.datetime`` or ``str``. |
| 37 | description: A description of the purpose or intent of this object. |
| 38 | short_description: A short description of the intent |
| 39 | or purpose of this object. |
| 40 | title: The title of this object. |
| 41 | |
| 42 | """ |
| 43 | _binding = incident_binding |
| 44 | _binding_class = _binding.IncidentType |
| 45 | _namespace = "http://docs.oasis-open.org/cti/ns/stix/incident-1" |
| 46 | _version = "1.2.1" |
| 47 | _ALL_VERSIONS = ("1.0", "1.0.1", "1.1", "1.1.1", "1.2", "1.2.1") |
| 48 | _ID_PREFIX = 'incident' |
| 49 | |
| 50 | status = vocabs.VocabField("Status", vocabs.IncidentStatus) |
| 51 | time = fields.TypedField("Time", Time) |
| 52 | victims = fields.TypedField("Victim", Identity, factory=IdentityFactory, multiple=True, key_name="victims") |
| 53 | attributed_threat_actors = fields.TypedField("Attributed_Threat_Actors", type_="stix.incident.AttributedThreatActors") |
| 54 | related_indicators = fields.TypedField("Related_Indicators", type_="stix.incident.RelatedIndicators") |
| 55 | related_observables = fields.TypedField("Related_Observables", type_="stix.incident.RelatedObservables") |
| 56 | related_incidents = fields.TypedField("Related_Incidents", type_="stix.incident.RelatedIncidents") |
| 57 | related_packages = fields.TypedField("Related_Packages", RelatedPackageRefs) |
| 58 | affected_assets = fields.TypedField("Affected_Assets", type_="stix.incident.AffectedAssets") |
| 59 | categories = fields.TypedField("Categories", type_="stix.incident.IncidentCategories") |
| 60 | intended_effects = StatementField("Intended_Effect", Statement, vocab_type=vocabs.IntendedEffect, multiple=True, key_name="intended_effects") |
| 61 | leveraged_ttps = fields.TypedField("Leveraged_TTPs", type_="stix.incident.LeveragedTTPs") |
| 62 | discovery_methods = vocabs.VocabField("Discovery_Method", vocabs.DiscoveryMethod, multiple=True, key_name="discovery_methods") |
| 63 | reporter = fields.TypedField("Reporter", InformationSource) |
| 64 | responders = fields.TypedField("Responder", InformationSource, multiple=True, key_name="responders") |
| 65 | coordinators = fields.TypedField("Coordinator", InformationSource, multiple=True, key_name="coordinators") |
| 66 | external_ids = fields.TypedField("External_ID", ExternalID, multiple=True, key_name="external_ids") |
| 67 | impact_assessment = fields.TypedField("Impact_Assessment", ImpactAssessment) |
| 68 | security_compromise = vocabs.VocabField("Security_Compromise", vocabs.SecurityCompromise) |
| 69 | confidence = fields.TypedField("Confidence", Confidence) |
| 70 | coa_taken = fields.TypedField("COA_Taken", COATaken, multiple=True) |
| 71 | coa_requested = fields.TypedField("COA_Requested", COARequested, multiple=True) |
| 72 | history = fields.TypedField("History", History) |
| 73 | information_source = fields.TypedField("Information_Source", InformationSource) |
| 74 | url = fields.TypedField("URL") |
| 75 | contacts = fields.TypedField("Contact", InformationSource, multiple=True, key_name="contacts") |
| 76 | |
| 77 | def __init__(self, id_=None, idref=None, timestamp=None, title=None, description=None, short_description=None): |
| 78 | super(Incident, self).__init__( |
| 79 | id_=id_, |
| 80 | idref=idref, |
| 81 | timestamp=timestamp, |
| 82 | title=title, |
| 83 | description=description, |