Models

psengine.risklists.models

DefaultRiskList

Bases: RFBaseModel

algorithm class-attribute instance-attribute

algorithm: Optional[str] = Field(
    validation_alias='Algorithm', default=None
)

evidence_details class-attribute instance-attribute

evidence_details: list[EvidenceDetail] = Field(
    validation_alias='EvidenceDetails'
)

ioc class-attribute instance-attribute

ioc: str = Field(validation_alias='Name')

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

risk_score class-attribute instance-attribute

risk_score: int = Field(validation_alias='Risk')

risk_string class-attribute instance-attribute

risk_string: str = Field(validation_alias='RiskString')

__repr__

__repr__()

Source code in psengine/risklists/models.py

def __repr__(self):
    return f'{self.ioc}: {self.risk_score} {self.evidence_details}'

__str__

__str__()

Source code in psengine/risklists/models.py

def __str__(self):
    return f'{self.ioc}: {self.risk_score} {self.evidence_details}'

evidence_to_dict classmethod

evidence_to_dict(v: Any) -> Any

Convert the EvidenceDetails block from a JSON string to a dictionary, if possible.

If the input is a string, is expected to be a JSON containing an EvidenceDetails key.

PARAMETER	DESCRIPTION
v	Input value expected to be a JSON string or dictionary. TYPE: Any

RAISES	DESCRIPTION
ValueError	If the input string cannot be parsed as JSON If the EvidenceDetails key is missing.

RETURNS	DESCRIPTION
Any	Parsed EvidenceDetails dictionary or original value.

Source code in psengine/risklists/models.py

@field_validator('evidence_details', mode='before')
@classmethod
def evidence_to_dict(
    cls, v: Annotated[Any, Doc('Input value expected to be a JSON string or dictionary.')]
) -> Annotated[Any, Doc('Parsed EvidenceDetails dictionary or original value.')]:
    """Convert the EvidenceDetails block from a JSON string to a dictionary, if possible.

    If the input is a string, is expected to be a JSON containing an `EvidenceDetails` key.

    Raises:
        ValueError:
            - If the input string cannot be parsed as JSON
            - If the `EvidenceDetails` key is missing.
    """
    if isinstance(v, str):
        try:
            return json.loads(v)['EvidenceDetails']
        except (json.JSONDecodeError, KeyError) as err:
            raise ValueError(
                'Evidence details cannot be converted to json or key not found'
            ) from err
    return v

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

EvidenceDetail

Bases: RFBaseModel

criticality class-attribute instance-attribute

criticality: int = Field(alias='Criticality')

criticality_label class-attribute instance-attribute

criticality_label: str = Field(alias='CriticalityLabel')

evidence_string class-attribute instance-attribute

evidence_string: str = Field(alias='EvidenceString')

mitigation_string class-attribute instance-attribute

mitigation_string: str = Field(alias='MitigationString')

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

name class-attribute instance-attribute

name: str = Field(alias='Name')

rule class-attribute instance-attribute

rule: str = Field(alias='Rule')

sightings_count class-attribute instance-attribute

sightings_count: float = Field(alias='SightingsCount')

source_count class-attribute instance-attribute

source_count: Optional[int] = Field(
    alias='SourceCount', default=None
)

sources class-attribute instance-attribute

sources: list[str] = Field(alias='Sources')

timestamp class-attribute instance-attribute

timestamp: datetime = Field(alias='Timestamp')

__repr__

__repr__()

Source code in psengine/risklists/models.py

def __repr__(self):
    return f'Evidence Details: {self.name}, {self.timestamp}'

__str__

__str__()

Source code in psengine/risklists/models.py

def __str__(self):
    return f'Evidence Details: {self.name}, {self.timestamp}'

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)