Classes for representing properties of STIX Objects and Cyber Observables.

class BinaryProperty(required=False, fixed=None, default=None)
clean(value, allow_custom=False)
class BooleanProperty(required=False, fixed=None, default=None)
clean(value, allow_custom=False)
class DictionaryProperty(spec_version='2.1', **kwargs)
clean(value, allow_custom=False)
class EmbeddedObjectProperty(type, **kwargs)
clean(value, allow_custom)
class EnumProperty(allowed, **kwargs)

Used for enumeration type properties. Properties of this type do not allow customization.

clean(value, allow_custom)
class ExtensionsProperty(spec_version='2.1', required=False)

Property for representing extensions on Observable objects.

clean(value, allow_custom)
class FloatProperty(min=None, max=None, **kwargs)
clean(value, allow_custom=False)
class HashesProperty(spec_hash_names, spec_version='2.1', **kwargs)
clean(value, allow_custom)
class HexProperty(required=False, fixed=None, default=None)
clean(value, allow_custom=False)
class IDProperty(type, spec_version='2.1')
clean(value, allow_custom=False)
class IntegerProperty(min=None, max=None, **kwargs)
clean(value, allow_custom=False)
class ListProperty(contained, **kwargs)
clean(value, allow_custom)
class ObjectReferenceProperty(valid_types=None, **kwargs)
class ObservableProperty(spec_version='2.1', *args, **kwargs)

Property for holding Cyber Observable Objects.

clean(value, allow_custom)
class OpenVocabProperty(allowed, **kwargs)

Used for open vocab type properties.

clean(value, allow_custom)
class PatternProperty(**kwargs)
class Property(required=False, fixed=None, default=None)

Represent a property of STIX data type.

Subclasses can define the following attributes as keyword arguments to __init__().

  • required (bool) – If True, the property must be provided when creating an object with that property. No default value exists for these properties. (Default: False)
  • fixed

    This provides a constant default value. Users are free to provide this value explicitly when constructing an object (which allows you to copy all values from an existing object to a new object), but if the user provides a value other than the fixed value, it will raise an error. This is semantically equivalent to defining both:

    • a clean() function that checks if the value matches the fixed value, and
    • a default() function that returns the fixed value.

Subclasses can also define the following functions:

  • def clean(self, value, allow_custom) -> (any, has_custom):
    • Return a value that is valid for this property, and enforce and detect value customization. If value is not valid for this property, you may attempt to transform it first. If value is not valid and no such transformation is possible, it must raise an exception. The method is also responsible for enforcing and detecting customizations. If allow_custom is False, no customizations must be allowed. If any are encountered, an exception must be raised (e.g. CustomContentError). If none are encountered, False must be returned for has_custom. If allow_custom is True, then the clean() method is responsible for detecting any customizations in the value (just because the user has elected to allow customizations doesn’t mean there actually are any). The method must return an appropriate value for has_custom. Customization may not be applicable/possible for a property. In that case, allow_custom can be ignored, and has_custom must be returned as False.
  • def default(self):
    • provide a default value for this property.
    • default() can return the special value NOW to use the current
      time. This is useful when several timestamps in the same object need to use the same default value, so calling now() for each property– likely several microseconds apart– does not work.

Subclasses can instead provide a lambda function for default as a keyword argument. clean should not be provided as a lambda since lambdas cannot raise their own exceptions.

When instantiating Properties, required and default should not be used together. default implies that the property is required in the specification so this function will be used to supply a value if none is provided. required means that the user must provide this; it is required in the specification and we can’t or don’t want to create a default value.

clean(value, allow_custom=False)
class ReferenceProperty(valid_types=None, invalid_types=None, spec_version='2.1', **kwargs)
clean(value, allow_custom)
class STIXObjectProperty(spec_version='2.1', *args, **kwargs)
clean(value, allow_custom)
class SelectorProperty(required=False, fixed=None, default=None)
clean(value, allow_custom=False)
class StringProperty(**kwargs)
clean(value, allow_custom=False)
class TimestampProperty(precision='any', precision_constraint='exact', **kwargs)
clean(value, allow_custom=False)
class TypeProperty(type, spec_version='2.1')