Helpers

psengine.stix2.helpers

SIMPLE_ENTITY_MAP module-attribute

SIMPLE_ENTITY_MAP = {
    'MitreAttackIdentifier': TTP,
    'Company': Identity,
    'Person': Identity,
    'Organization': Identity,
    'Malware': Malware,
    'CyberVulnerability': Vulnerability,
}

convert_entity

convert_entity(
    name: str,
    entity_type: str,
    create_indicator: bool = True,
    create_obs: bool = False,
    **kwargs,
) -> (
    IndicatorEntity
    | Identity
    | Malware
    | Vulnerability
    | TTP
)

Convert an RF entity to STIX2.

PARAMETER	DESCRIPTION
name	The name of the entity. TYPE: str
entity_type	The Recorded Future type of entity. TYPE: str
create_indicator	A flag to determine if an indicator should be created. TYPE: bool DEFAULT: True
create_obs	A flag to determine if an observable should be created. TYPE: bool DEFAULT: False

RAISES	DESCRIPTION
STIX2TransformError	If an invalid keyword argument is passed in kwargs.
UnsupportedConversionTypeError	If the provided entity type is unsupported for conversion.

RETURNS	DESCRIPTION
IndicatorEntity | Identity | Malware | Vulnerability | TTP	An instance of a corresponding STIX2 entity based on the provided entity type.

Source code in psengine/stix2/helpers.py

def convert_entity(
    name: Annotated[str, Doc('The name of the entity.')],
    entity_type: Annotated[str, Doc('The Recorded Future type of entity.')],
    create_indicator: Annotated[
        bool, Doc('A flag to determine if an indicator should be created.')
    ] = True,
    create_obs: Annotated[
        bool, Doc('A flag to determine if an observable should be created.')
    ] = False,
    **kwargs,
) -> Annotated[
    IndicatorEntity | Identity | Malware | Vulnerability | TTP,
    Doc('An instance of a corresponding STIX2 entity based on the provided entity type.'),
]:
    """Convert an RF entity to STIX2.

    Raises:
        STIX2TransformError: If an invalid keyword argument is passed in `kwargs`.
        UnsupportedConversionTypeError: If the provided entity type is unsupported for conversion.
    """
    for key in kwargs:
        if key not in CONVERT_ENTITY_KWARGS:
            msg = f'{key} is invalid keyword argument for convert_entity. Only {CONVERT_ENTITY_KWARGS} are accepted'  # noqa: E501
            raise STIX2TransformError(msg)
    if entity_type in INDICATOR_TYPES:
        return IndicatorEntity(
            name=name,
            type_=entity_type,
            create_indicator=create_indicator,
            create_obs=create_obs,
        )
    if entity_type in SIMPLE_ENTITY_MAP:
        ent = SIMPLE_ENTITY_MAP[entity_type]
        if ent == Identity:
            return ent(name, rf_type=entity_type)
        return SIMPLE_ENTITY_MAP[entity_type](name, **kwargs)
    raise UnsupportedConversionTypeError(
        f'Could not convert entity {name} because type {entity_type} is not supported',
    )