ADT

psengine.risk_rules.risk_rule

RiskRule

Bases: RFBaseModel

Validate data received from the /v2/{entity_type}/riskrules endpoint.

A Recorded Future risk rule is a scoring rule that contributes to the overall risk score of an entity of a given IOC type (ip, domain, hash, url, vulnerability). Each rule has a criticality level (1-3), a human readable label, a description of what it detects, and a count of entities currently matching the rule.

This class supports hashing, equality comparison, string representation, and total ordering of RiskRule instances.

Hashing

Returns a hash value based on the tuple (name, criticality).

Equality

Two RiskRule instances are equal if they share the same name and criticality.

Greater-than Comparison

A rule is "greater" than another if its criticality is higher. When two rules share the same criticality, the one whose name sorts later alphabetically is considered greater. Combined with @total_ordering, this yields most-critical-first when using sorted() in reverse (or sorted(rules, reverse=True)).

String Representation

Returns a compact one-line summary of the rule.

>>> print(risk_rule)
Risk Rule: bogusBgp, Criticality: 1 (Unusual), Count: 24590

categories class-attribute instance-attribute

categories: list[RiskRuleCategory] = []

count instance-attribute

count: int

criticality instance-attribute

criticality: int

criticality_label class-attribute instance-attribute

criticality_label: str = Field(alias='criticalityLabel')

description instance-attribute

description: str

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra=get('RF_MODEL_EXTRA', 'ignore')
)

name instance-attribute

name: str

related_entities class-attribute instance-attribute

related_entities: list[Any] = Field(
    alias='relatedEntities', default=[]
)

__eq__

__eq__(other: RiskRule)

Source code in psengine/risk_rules/risk_rule.py

def __eq__(self, other: 'RiskRule'):
    return (self.name, self.criticality) == (other.name, other.criticality)

__gt__

__gt__(other: RiskRule)

Source code in psengine/risk_rules/risk_rule.py

def __gt__(self, other: 'RiskRule'):
    return (self.criticality, self.name) > (other.criticality, other.name)

__hash__

__hash__()

Source code in psengine/risk_rules/risk_rule.py

def __hash__(self):
    return hash((self.name, self.criticality))

__str__

__str__()

Source code in psengine/risk_rules/risk_rule.py

def __str__(self):
    return (
        f'Risk Rule: {self.name}, '
        f'Criticality: {self.criticality} ({self.criticality_label}), '
        f'Count: {self.count}'
    )

json

json(
    by_alias: bool = True,
    exclude_none: bool = True,
    auto_exclude_unset: bool = True,
    **kwargs,
)

JSON representation of models. It is inherited by every model.

PARAMETER	DESCRIPTION
by_alias	Alias flag: If True, writes fields with their API alias (e.g., IpAddress) If False uses the Python attribute name alias. TYPE: bool DEFAULT: True
exclude_none	Whether to exclude fields equal to None. TYPE: bool DEFAULT: True
auto_exclude_unset	Whether to auto exclude values not set. If True, uses RF_EXTRA_MODEL config to decide inclusion of unmapped fields. If False, you must specify exclude_unset manually. TYPE: bool DEFAULT: True

Source code in psengine/common_models.py

def json(
    self,
    by_alias: Annotated[
        bool,
        Doc(
            """
            Alias flag:

            - If `True`, writes fields with their API alias (e.g., `IpAddress`)
            - If `False` uses the Python attribute name alias.
            """
        ),
    ] = True,
    exclude_none: Annotated[bool, Doc('Whether to exclude fields equal to None.')] = True,
    auto_exclude_unset: Annotated[
        bool,
        Doc("""
            Whether to auto exclude values not set.

            - If `True`, uses `RF_EXTRA_MODEL` config to decide inclusion of unmapped fields.
            - If `False`, you must specify `exclude_unset` manually.
            """),
    ] = True,
    **kwargs,
):
    """JSON representation of models. It is inherited by every model."""
    if not auto_exclude_unset and kwargs.get('exclude_unset') is None:
        raise ValueError('`auto_exclude_unset` is False, `exclude_unset has to be provided`')

    exclude_unset = (
        bool(self.model_config['extra'] != 'allow')
        if auto_exclude_unset
        else kwargs['exclude_unset']
    )
    kwargs['exclude_unset'] = exclude_unset
    return self.model_dump(mode='json', by_alias=by_alias, exclude_none=exclude_none, **kwargs)