comparison

Comparison utilities for STIX pattern comparison expressions.

bin_cmp(value1, value2)

Compare two STIX “binary” values. This decodes to bytes and compares that. It does not do a string compare on the base64 representations.

Parameters:
  • value1 – The first BinaryConstant
  • value2 – The second BinaryConstant
Returns:

<0, 0, or >0 depending on whether the first arg is less, equal or greater than the second
bool_cmp(value1, value2)

Compare two boolean constants.

Parameters:
  • value1 – The first BooleanConstant instance
  • value2 – The second BooleanConstant instance
Returns:

<0, 0, or >0 depending on whether the first arg is less, equal or greater than the second
comparison_expression_cmp(expr1, expr2)

Compare two comparison expressions. This is sensitive to the order of the expressions’ sub-components. To achieve an order-insensitive comparison, the sub-component ASTs must be ordered first.

Parameters:
  • expr1 – The first comparison expression
  • expr2 – The second comparison expression
Returns:

<0, 0, or >0 depending on whether the first arg is less, equal or greater than the second
comparison_operator_cmp(op1, op2)

Compare two comparison operators.

Parameters:
  • op1 – The first comparison operator (a string)
  • op2 – The second comparison operator (a string)
Returns:

<0, 0, or >0 depending on whether the first arg is less, equal or greater than the second
constant_cmp(value1, value2)

Compare two constants.

Parameters:
  • value1 – The first _Constant instance
  • value2 – The second _Constant instance
Returns:

<0, 0, or >0 depending on whether the first arg is less, equal or greater than the second
generic_constant_cmp(const1, const2)

Generic comparator for most _Constant instances. They must have a “value” attribute whose value supports the builtin comparison operators.

Parameters:
  • const1 – The first _Constant instance
  • const2 – The second _Constant instance
Returns:

<0, 0, or >0 depending on whether the first arg is less, equal or greater than the second
hex_cmp(value1, value2)

Compare two STIX “hex” values. This decodes to bytes and compares that. It does not do a string compare on the hex representations.

Parameters:
  • value1 – The first HexConstant
  • value2 – The second HexConstant
Returns:

<0, 0, or >0 depending on whether the first arg is less, equal or greater than the second
list_cmp(value1, value2)

Compare lists order-insensitively.

Parameters:
  • value1 – The first ListConstant
  • value2 – The second ListConstant
Returns:

<0, 0, or >0 depending on whether the first arg is less, equal or greater than the second
object_path_cmp(path1, path2)

Compare two object paths.

Parameters:
  • path1 – The first ObjectPath instance
  • path2 – The second ObjectPath instance
Returns:

<0, 0, or >0 depending on whether the first arg is less, equal or greater than the second
object_path_component_cmp(comp1, comp2)

Compare a string/int to another string/int; this induces an ordering over all strings and ints. It is used to perform a lexicographical sort on object paths.

Ints and strings compare as usual to each other; ints compare less than strings.

Parameters:
  • comp1 – An object path component (string or int)
  • comp2 – An object path component (string or int)
Returns:

<0, 0, or >0 depending on whether the first arg is less, equal or greater than the second
object_path_to_raw_values(path)

Converts the given ObjectPath instance to a list of strings and ints. All property names become strings, regardless of whether they’re _ref properties; “” index steps become that string; and numeric index steps become integers.

Parameters:path – An ObjectPath instance
Returns:A generator iterator over the values
simple_comparison_expression_cmp(expr1, expr2)

Compare “simple” comparison expressions: those which aren’t AND/OR combinations, just <path> <op> <value> comparisons.

Parameters:
  • expr1 – first _ComparisonExpression instance
  • expr2 – second _ComparisonExpression instance
Returns:

<0, 0, or >0 depending on whether the first arg is less, equal or greater than the second