observation

Comparison utilities for STIX pattern observation expressions.

observation_expression_cmp(expr1, expr2)

Compare two observation expression ASTs. This is sensitive to the order of the expressions’ sub-components. To achieve an order-insensitive comparison, the sub-component ASTs must be ordered first.

Parameters:

• expr1 – The first observation expression
• expr2 – The second observation expression

Returns:

<0, 0, or >0 depending on whether the first arg is less, equal or greater than the second

repeats_cmp(qual1, qual2)

Compare REPEATS qualifiers. This orders by repeat count.

startstop_cmp(qual1, qual2)

Compare START/STOP qualifiers. This lexicographically orders by start time, then stop time.

within_cmp(qual1, qual2)

Compare WITHIN qualifiers. This orders by number of seconds.