Models

psengine.malware_intel.models

AutoSigmaRules

Bases: RFBaseModel

created class-attribute instance-attribute

created: datetime | None = None

end_date class-attribute instance-attribute

end_date: str | None = Field(alias='endDate', default=None)

family_counts class-attribute instance-attribute

family_counts: dict[str, int] = Field(
    alias='familyCounts', default_factory=dict
)

job_id class-attribute instance-attribute

job_id: str = Field(alias='jobId')

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

modified class-attribute instance-attribute

modified: datetime | None = None

n_matched_hashes class-attribute instance-attribute

n_matched_hashes: int | None = Field(
    alias='nMatchedHashes', default=None
)

name instance-attribute

name: str

query class-attribute instance-attribute

query: str | None = None

start_date class-attribute instance-attribute

start_date: str | None = Field(
    alias='startDate', default=None
)

status class-attribute instance-attribute

status: str = 'CREATED'

__str__

__str__()

Source code in psengine/malware_intel/models.py

def __str__(self):
    created = self.created.strftime(TIMESTAMP_STR) if self.created else 'N/A'
    matched = self.n_matched_hashes if self.n_matched_hashes is not None else 0
    return (
        f'Name: {self.name}, ID: {self.job_id}, Created: {created}, Matched Hashes: {matched}'
    )

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

Coverage

Bases: RFBaseModel

covered_hashes instance-attribute

covered_hashes: list[str]

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

uncovered_hashes instance-attribute

uncovered_hashes: list[str]

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

Credential

Bases: RFBaseModel

host class-attribute instance-attribute

host: str | None = None

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

password class-attribute instance-attribute

password: str | None = None

port class-attribute instance-attribute

port: int | None = None

username class-attribute instance-attribute

username: str | None = None

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

DnsRecord

Bases: RFBaseModel

flow_id class-attribute instance-attribute

flow_id: int | None = None

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

request_domain class-attribute instance-attribute

request_domain: list[str] | None = []

request_domain_fld class-attribute instance-attribute

request_domain_fld: list[str] | None = []

request_domain_tld class-attribute instance-attribute

request_domain_tld: list[str] | None = []

request_type class-attribute instance-attribute

request_type: list[str] | None = []

response_domain class-attribute instance-attribute

response_domain: list[str] | None = []

response_domain_fld class-attribute instance-attribute

response_domain_fld: list[str] | None = []

response_domain_tld class-attribute instance-attribute

response_domain_tld: list[str] | None = []

response_type class-attribute instance-attribute

response_type: list[str] | None = []

response_value class-attribute instance-attribute

response_value: list[str] | None = []

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

Dropper

Bases: RFBaseModel

deobfuscated class-attribute instance-attribute

deobfuscated: str | None = None

family class-attribute instance-attribute

family: str | None = None

language class-attribute instance-attribute

language: str | None = None

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

source class-attribute instance-attribute

source: str | None = None

urls class-attribute instance-attribute

urls: list[DropperUrl] | None = []

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

DropperUrl

Bases: RFBaseModel

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

type class-attribute instance-attribute

type: str | None = None

url class-attribute instance-attribute

url: str | None = None

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

DumpedItem

Bases: RFBaseModel

md5 class-attribute instance-attribute

md5: str | None = None

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

name class-attribute instance-attribute

name: str | None = None

path class-attribute instance-attribute

path: str | None = None

sha1 class-attribute instance-attribute

sha1: str | None = None

sha256 class-attribute instance-attribute

sha256: str | None = None

sha512 class-attribute instance-attribute

sha512: str | None = None

size class-attribute instance-attribute

size: int | None = None

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

DynamicInfo

Bases: RFBaseModel

dumped class-attribute instance-attribute

dumped: list[DumpedItem] | None = []

dumped_count class-attribute instance-attribute

dumped_count: int | None = None

extracted class-attribute instance-attribute

extracted: list[ExtractedItem] | None = []

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

network class-attribute instance-attribute

network: NetworkInfo = Field(default_factory=NetworkInfo)

processes class-attribute instance-attribute

processes: list[ProcessInfo] | None = []

registry class-attribute instance-attribute

registry: RegistryInfo = Field(default_factory=RegistryInfo)

registry_count class-attribute instance-attribute

registry_count: int | None = None

signatures class-attribute instance-attribute

signatures: list[Signature] | None = []

signatures_count class-attribute instance-attribute

signatures_count: int | None = None

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

ExtractedConfig

Bases: RFBaseModel

botnet class-attribute instance-attribute

botnet: str | None = None

c2 class-attribute instance-attribute

c2: list[str] | None = []

campaign class-attribute instance-attribute

campaign: str | None = None

credentials class-attribute instance-attribute

credentials: list[Credential] | None = []

decoy class-attribute instance-attribute

decoy: list[str] | None = []

dns class-attribute instance-attribute

dns: list[str] | None = []

extracted_pe class-attribute instance-attribute

extracted_pe: str | None = None

family class-attribute instance-attribute

family: str | None = None

keys class-attribute instance-attribute

keys: list[KeyItem] | None = []

listen_addr class-attribute instance-attribute

listen_addr: str | None = None

listen_for class-attribute instance-attribute

listen_for: list[str] | None = []

listen_port class-attribute instance-attribute

listen_port: int | None = None

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

mutex class-attribute instance-attribute

mutex: list[str] | None = []

rule class-attribute instance-attribute

rule: str | None = None

tags class-attribute instance-attribute

tags: list[str] | None = []

version class-attribute instance-attribute

version: str | None = None

webinject class-attribute instance-attribute

webinject: list[str] | None = []

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

ExtractedItem

Bases: RFBaseModel

config class-attribute instance-attribute

config: ExtractedConfig = Field(
    default_factory=ExtractedConfig
)

credentials class-attribute instance-attribute

credentials: Credential = Field(default_factory=Credential)

dropper class-attribute instance-attribute

dropper: Dropper = Field(default_factory=Dropper)

dumped_file class-attribute instance-attribute

dumped_file: str | None = None

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

path class-attribute instance-attribute

path: str | None = None

ransom_note class-attribute instance-attribute

ransom_note: RansomNote = Field(default_factory=RansomNote)

resource class-attribute instance-attribute

resource: str | None = None

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

Flow

Bases: RFBaseModel

dst_ip class-attribute instance-attribute

dst_ip: str | None = None

dst_port class-attribute instance-attribute

dst_port: int | None = None

id class-attribute instance-attribute

id: int | None = None

layer_7 class-attribute instance-attribute

layer_7: list[str] | None = []

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

procid class-attribute instance-attribute

procid: int | None = None

proto class-attribute instance-attribute

proto: str | None = None

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

HttpEntry

Bases: RFBaseModel

flow class-attribute instance-attribute

flow: int | None = None

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

sequence class-attribute instance-attribute

sequence: list[HttpSequenceItem] | None = []

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

HttpRequest

Bases: RFBaseModel

headers class-attribute instance-attribute

headers: list[str] | None = []

method class-attribute instance-attribute

method: str | None = None

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

request class-attribute instance-attribute

request: str | None = None

url class-attribute instance-attribute

url: str | None = None

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

HttpResponse

Bases: RFBaseModel

headers class-attribute instance-attribute

headers: list[str] | None = []

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

response class-attribute instance-attribute

response: str | None = None

status class-attribute instance-attribute

status: str | None = None

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

HttpSequenceItem

Bases: RFBaseModel

index class-attribute instance-attribute

index: int | None = None

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

request class-attribute instance-attribute

request: HttpRequest = Field(default_factory=HttpRequest)

response class-attribute instance-attribute

response: HttpResponse = Field(default_factory=HttpResponse)

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

Industry

Bases: RFBaseModel

industry_id class-attribute instance-attribute

industry_id: str | None = None

industry_name class-attribute instance-attribute

industry_name: str | None = None

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

IpInfo

Bases: RFBaseModel

asn class-attribute instance-attribute

asn: str | None = None

cc class-attribute instance-attribute

cc: str | None = None

ip class-attribute instance-attribute

ip: str | None = None

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

KeyItem

Bases: RFBaseModel

key class-attribute instance-attribute

key: str | None = None

kind class-attribute instance-attribute

kind: str | None = None

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

value class-attribute instance-attribute

value: str | None = None

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

Metadata

Bases: RFBaseModel

industries class-attribute instance-attribute

industries: list[Industry] | None = []

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

sectors class-attribute instance-attribute

sectors: list[Industry] | None = []

source class-attribute instance-attribute

source: str | None = None

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

NetworkInfo

Bases: RFBaseModel

dns class-attribute instance-attribute

dns: list[DnsRecord] | None = []

dns_count class-attribute instance-attribute

dns_count: int | None = None

flows class-attribute instance-attribute

flows: list[Flow] | None = []

flows_count class-attribute instance-attribute

flows_count: int | None = None

http class-attribute instance-attribute

http: list[HttpEntry] | None = []

ips class-attribute instance-attribute

ips: list[IpInfo] | None = []

ips_count class-attribute instance-attribute

ips_count: int | None = None

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

PEHeader

Bases: RFBaseModel

dll_characteristics class-attribute instance-attribute

dll_characteristics: list[str] | None = []

file_characteristics class-attribute instance-attribute

file_characteristics: list[str] | None = []

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

PEImport

Bases: RFBaseModel

dll_name class-attribute instance-attribute

dll_name: str | None = None

imports class-attribute instance-attribute

imports: list[str] | None = []

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

PEInfo

Bases: RFBaseModel

exports class-attribute instance-attribute

exports: list[str] | None = []

header class-attribute instance-attribute

header: PEHeader = Field(default_factory=PEHeader)

imphash class-attribute instance-attribute

imphash: str | None = None

imports class-attribute instance-attribute

imports: list[PEImport] | None = []

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

sections class-attribute instance-attribute

sections: list[PESection] | None = []

signatures class-attribute instance-attribute

signatures: list[PESignature] | None = []

timestamp class-attribute instance-attribute

timestamp: int | None = None

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

PESection

Bases: RFBaseModel

characteristics class-attribute instance-attribute

characteristics: list[str] | None = []

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

name class-attribute instance-attribute

name: str | None = None

raw_data_offset class-attribute instance-attribute

raw_data_offset: int | None = None

raw_data_size class-attribute instance-attribute

raw_data_size: int | None = None

virtual_size class-attribute instance-attribute

virtual_size: int | None = None

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

PESignature

Bases: RFBaseModel

issuer class-attribute instance-attribute

issuer: str | None = None

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

not_after class-attribute instance-attribute

not_after: str | None = None

not_before class-attribute instance-attribute

not_before: str | None = None

serial class-attribute instance-attribute

serial: str | None = None

subject class-attribute instance-attribute

subject: str | None = None

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

Pattern

Bases: RFBaseModel

ascii class-attribute instance-attribute

ascii: list[str] = []

matching_hashes instance-attribute

matching_hashes: list[str]

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

pattern instance-attribute

pattern: str

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

ProcessInfo

Bases: RFBaseModel

cmd class-attribute instance-attribute

cmd: str | None = None

image class-attribute instance-attribute

image: str | None = None

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

pid class-attribute instance-attribute

pid: int | None = None

ppid class-attribute instance-attribute

ppid: int | None = None

procid class-attribute instance-attribute

procid: int | None = None

procid_parent class-attribute instance-attribute

procid_parent: int | None = None

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

RansomNote

Bases: RFBaseModel

contact class-attribute instance-attribute

contact: list[str] | None = []

emails class-attribute instance-attribute

emails: list[str] | None = []

family class-attribute instance-attribute

family: str | None = None

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

note class-attribute instance-attribute

note: str | None = None

target class-attribute instance-attribute

target: str | None = None

urls class-attribute instance-attribute

urls: list[str] | None = []

wallets class-attribute instance-attribute

wallets: list[str] | None = []

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

RegistryEntry

Bases: RFBaseModel

key class-attribute instance-attribute

key: str | None = None

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

RegistryInfo

Bases: RFBaseModel

create class-attribute instance-attribute

create: list[RegistryEntry] | None = []

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

read class-attribute instance-attribute

read: list[RegistryEntry] | None = []

write class-attribute instance-attribute

write: list[RegistryEntry] | None = []

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

SampleInfo

Bases: RFBaseModel

completed class-attribute instance-attribute

completed: str | None = None

created class-attribute instance-attribute

created: str | None = None

id class-attribute instance-attribute

id: str | None = None

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

score class-attribute instance-attribute

score: int | None = None

tags class-attribute instance-attribute

tags: list[str] | None = []

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

SigmaPatternItem

Bases: RFBaseModel

cmd_pattern class-attribute instance-attribute

cmd_pattern: str | None = None

image class-attribute instance-attribute

image: str | None = None

matched_cmds class-attribute instance-attribute

matched_cmds: list[str] = Field(default_factory=list)

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

stats class-attribute instance-attribute

stats: SigmaPatternStats | None = None

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

SigmaPatternStats

Bases: RFBaseModel

family_counts class-attribute instance-attribute

family_counts: dict[str, int | float] = Field(
    default_factory=dict
)

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

n_hashes class-attribute instance-attribute

n_hashes: int | float | None = None

overlap class-attribute instance-attribute

overlap: int | float | None = None

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

SigmaRuleItem

Bases: RFBaseModel

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

modified class-attribute instance-attribute

modified: datetime | None = None

rule instance-attribute

rule: str

rule_id instance-attribute

rule_id: str

stats class-attribute instance-attribute

stats: SigmaPatternStats | None = None

status instance-attribute

status: str

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

Signature

Bases: RFBaseModel

desc class-attribute instance-attribute

desc: str | None = None

indicators class-attribute instance-attribute

indicators: list[SignatureIndicator] | None = []

label class-attribute instance-attribute

label: str | None = None

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

name class-attribute instance-attribute

name: str | None = None

score class-attribute instance-attribute

score: int | None = None

tags class-attribute instance-attribute

tags: list[str] | None = []

ttp class-attribute instance-attribute

ttp: list[str] | None = []

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

SignatureIndicator

Bases: RFBaseModel

description class-attribute instance-attribute

description: str | None = None

ioc class-attribute instance-attribute

ioc: str | None = None

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

procid class-attribute instance-attribute

procid: int | None = None

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

StaticInfo

Bases: RFBaseModel

extracted class-attribute instance-attribute

extracted: list[ExtractedItem] | None = []

exts class-attribute instance-attribute

exts: list[str] | None = None

md5 class-attribute instance-attribute

md5: str | None = None

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

registry class-attribute instance-attribute

registry: RegistryInfo = Field(default_factory=RegistryInfo)

registry_count class-attribute instance-attribute

registry_count: int | None = None

sha1 class-attribute instance-attribute

sha1: str | None = None

sha256 class-attribute instance-attribute

sha256: str | None = None

sha512 class-attribute instance-attribute

sha512: str | None = None

signatures class-attribute instance-attribute

signatures: list[Signature] | None = []

signatures_count class-attribute instance-attribute

signatures_count: int | None = None

size class-attribute instance-attribute

size: int | None = None

ssdeep class-attribute instance-attribute

ssdeep: str | None = None

tags class-attribute instance-attribute

tags: list[str] | None = []

target class-attribute instance-attribute

target: str | None = None

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)

YaraJob

Bases: RFBaseModel

coverage class-attribute instance-attribute

coverage: Coverage | None = None

created class-attribute instance-attribute

created: datetime | None = None

job_id instance-attribute

job_id: str

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

name instance-attribute

name: str

patterns class-attribute instance-attribute

patterns: list[Pattern] = []

query class-attribute instance-attribute

query: str | None = None

status class-attribute instance-attribute

status: str = 'CREATED'

yara_rule_str class-attribute instance-attribute

yara_rule_str: str | None = None

__str__

__str__()

Source code in psengine/malware_intel/models.py

def __str__(self):
    covered = len(self.coverage.covered_hashes) if self.coverage else 0
    uncovered = len(self.coverage.uncovered_hashes) if self.coverage else 0
    created = self.created.strftime(TIMESTAMP_STR) if self.created else 'N/A'
    msg = 'ID: {}, Status: {}, Name: {}, Created: {}, Covered Hashes: {}, Uncovered Hashes: {}'
    return msg.format(self.job_id, self.status, self.name, created, covered, uncovered)

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)