stix.threat_actor Module¶

Overview¶

The stix.threat_actor module implements ThreatActor.

ThreatActors are characterizations of malicious actors (or adversaries) representing a cyber attack threat including presumed intent and historically observed behavior.

Classes¶

class stix.threat_actor.ThreatActor(id_=None, idref=None, timestamp=None, title=None, description=None, short_description=None)¶

Bases: stix.base.BaseCoreComponent

Implementation of the STIX Threat Actor.

Parameters:

id (optional) – An identifier. If None, a value will be generated via mixbox.idgen.create_id(). If set, this will unset the idref property. idref (optional) – An identifier reference. If set this will unset the id_ property. timestamp (optional) – A timestamp value. Can be an instance of datetime.datetime or str. description – A description of the purpose or intent of this object. short_description – A short description of the intent or purpose of this object. title – The title of this object.

add_description(description)¶

Adds a description to the descriptions collection.

This is the same as calling “foo.descriptions.add(bar)”.

add_intended_effect(value)¶

Adds a Statement object to the intended_effects collection.

If value is a string, an attempt will be made to convert it into an instance of Statement.

add_motivation(value)¶

Adds a Motivation object to the motivations collection.

add_planning_and_operational_support(value)¶

Adds a VocabString object to the planning_and_operational_supports collection.

If value is a string, an attempt will be made to convert it to an instance of PlanningAndOperationalSupport.

add_short_description(description)¶

Adds a description to the short_descriptions collection.

This is the same as calling “foo.short_descriptions.add(bar)”.

add_sophistication(value)¶

Adds a VocabString object to the sophistications collection.

If value is a string, an attempt will be made to convert it to an instance of ThreatActorSophistication.

add_type(value)¶

Adds a VocabString object to the types collection.

If set to a string, an attempt will be made to convert it into an instance of ThreatActorType.

description¶

A single description about the contents or purpose of this object.

Default Value: None

Note

If this object has more than one description set, this will return the description with the lowest ordinality value.

Returns:	An instance of StructuredText

find(id_)¶

Searches the children of a Entity implementation for an object with an id_ property that matches id_.

short_description¶

A single short description about the contents or purpose of this object.

Default Value: None

Note

If this object has more than one short description set, this will return the description with the lowest ordinality value.

Returns:	An instance of StructuredText

to_dict()¶

Convert to a dict

Subclasses can override this function.

Returns:	Python dict with keys set from this Entity.

to_json()¶

Export an object as a JSON String.

to_obj(ns_info=None)¶

Convert to a GenerateDS binding object.

Subclasses can override this function.

Returns:	An instance of this Entity’s _binding_class with properties set from this Entity.

class stix.threat_actor.AssociatedActors(scope=None, *args)¶

Bases: stix.common.related.GenericRelationshipList

class stix.threat_actor.AssociatedCampaigns(scope=None, *args)¶

Bases: stix.common.related.GenericRelationshipList

class stix.threat_actor.ObservedTTPs(scope=None, *args)¶

Bases: stix.common.related.GenericRelationshipList