colander_data_converter.base package
colander_data_converter.base.common module
- class colander_data_converter.base.common.Singleton[source]
Bases:
typeSingleton is a metaclass that ensures a class has only one instance.
Example
>>> class Configuration(metaclass=Singleton): ... def __init__(self, value): ... self.value = value ... >>> config1 = Configuration(value=42) >>> config2 = Configuration(value=99) >>> print(config1 is config2) # Both variables point to the same instance True >>> print(config1.value) # The value is shared across instances 42
- class colander_data_converter.base.common.TlpPapLevel(value, names=<not given>, *values, module=None, qualname=None, type=None, start=1, boundary=None)[source]
Bases:
str,EnumTlpPapLevel represents the Traffic Light Protocol (TLP) and Permissible Actions Protocol (PAP) levels.
These levels are used to classify the sensitivity of information and its sharing restrictions.
Example
>>> level = TlpPapLevel.RED >>> print(level) RED
- AMBER = 'AMBER'
Sensitive information, limited to a defined group.
- GREEN = 'GREEN'
Information that can be shared within the community.
- RED = 'RED'
Highly sensitive information, restricted to specific recipients.
- WHITE = 'WHITE'
Information that can be shared publicly.
colander_data_converter.base.models module
- pydantic model colander_data_converter.base.models.Actor[source]
Bases:
EntityActor represents an individual or group involved in an event, activity, or system.
This class extends the Entity base class and includes additional fields specific to actors.
Example
>>> actor_type = ActorTypes.enum.INDIVIDUAL.value >>> actor = Actor( ... name='John Doe', ... type=actor_type ... ) >>> print(actor.name) John Doe
Show JSON schema
{ "title": "Actor", "description": "Actor represents an individual or group involved in an event, activity, or system.\n\nThis class extends the Entity base class and includes additional fields specific to actors.\n\nExample:\n >>> actor_type = ActorTypes.enum.INDIVIDUAL.value\n >>> actor = Actor(\n ... name='John Doe',\n ... type=actor_type\n ... )\n >>> print(actor.name)\n John Doe", "type": "object", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/ActorType" }, "colander_internal_type": { "const": "actor", "default": "actor", "title": "Colander Internal Type", "type": "string" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" } }, "$defs": { "ActorType": { "description": "ActorType represents metadata for actors in Colander. Check :ref:`the list of supported types <actor_types>`.\n\nExample:\n >>> actor_type = ActorTypes.enum.INDIVIDUAL.value\n >>> print(actor_type.name)\n Individual", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "ActorType", "type": "object" }, "Case": { "description": "Case represents a collection or grouping of related entities, artifacts, or events.\n\nThis class is used to organize and manage related data, such as incidents, investigations, or projects.\n\nExample:\n >>> case = Case(\n ... name='Investigation Alpha',\n ... description='Investigation of suspicious activity'\n ... )\n >>> print(case.name)\n Investigation Alpha", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "description": { "minLength": 1, "title": "Description", "type": "string" }, "documentation": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Documentation" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "parent_case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Parent Case" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "colander_internal_type": { "const": "case", "default": "case", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "description" ], "title": "Case", "type": "object" }, "ObjectReference": { "format": "uuid4", "type": "string" }, "TlpPapLevel": { "description": "TlpPapLevel represents the Traffic Light Protocol (TLP) and Permissible Actions Protocol (PAP) levels.\n\nThese levels are used to classify the sensitivity of information and its sharing restrictions.\n\nExample:\n >>> level = TlpPapLevel.RED\n >>> print(level)\n RED", "enum": [ "RED", "AMBER", "GREEN", "WHITE" ], "title": "TlpPapLevel", "type": "string" } }, "required": [ "name", "type" ] }
- Config:
str_strip_whitespace: bool = True
arbitrary_types_allowed: bool = True
- Fields:
- field attributes: Dict[str, str] | None = None
Optional dictionary of additional attributes for the device.
- field colander_internal_type: Literal['actor'] = 'actor'
Internal type discriminator for (de)serialization.
- pydantic model colander_data_converter.base.models.ActorType[source]
Bases:
CommonEntityTypeActorType represents metadata for actors in Colander. Check the list of supported types.
Example
>>> actor_type = ActorTypes.enum.INDIVIDUAL.value >>> print(actor_type.name) Individual
Show JSON schema
{ "title": "ActorType", "description": "ActorType represents metadata for actors in Colander. Check :ref:`the list of supported types <actor_types>`.\n\nExample:\n >>> actor_type = ActorTypes.enum.INDIVIDUAL.value\n >>> print(actor_type.name)\n Individual", "type": "object", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ] }
- Fields:
- Validators:
is_supported_type»short_name
- class colander_data_converter.base.models.ActorTypes[source]
Bases:
objectActorTypes provides access to all supported actor types.
This class loads actor type definitions from the actor types JSON file and exposes them as an enum. It also provides a method to look up an actor type by its short name.
Example
>>> actor_type = ActorTypes.enum.INDIVIDUAL.value >>> print(actor_type.name) Individual >>> default_type = ActorTypes.by_short_name("nonexistent") >>> print(default_type.name) Generic
- default = ActorType(short_name='GENERIC', name='Generic', description='A generic or unspecified actor type.', svg_icon='', nf_icon='nf-cod-person', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)
- enum
alias of
EntityTypes
- pydantic model colander_data_converter.base.models.Artifact[source]
Bases:
EntityArtifact represents a file or data object, such as a document, image, or binary, within the system.
This class extends the Entity base class and includes additional fields specific to artifacts, such as type, attributes, extraction source, file metadata, and cryptographic hashes.
Example
>>> artifact_type = ArtifactTypes.enum.DOCUMENT.value >>> device_type = DeviceTypes.enum.LAPTOP.value >>> device = Device(name='Analyst Laptop', type=device_type) >>> artifact = Artifact( ... name='malware_sample.pdf', ... type=artifact_type, ... extracted_from=device, ... extension='pdf', ... original_name='invoice.pdf', ... mime_type='application/pdf', ... md5='d41d8cd98f00b204e9800998ecf8427e', ... sha1='da39a3ee5e6b4b0d3255bfef95601890afd80709', ... sha256='e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855', ... size_in_bytes=12345 ... ) >>> print(artifact.name) malware_sample.pdf
Show JSON schema
{ "title": "Artifact", "description": "Artifact represents a file or data object, such as a document, image, or binary, within the system.\n\nThis class extends the Entity base class and includes additional fields specific to artifacts,\nsuch as type, attributes, extraction source, file metadata, and cryptographic hashes.\n\nExample:\n >>> artifact_type = ArtifactTypes.enum.DOCUMENT.value\n >>> device_type = DeviceTypes.enum.LAPTOP.value\n >>> device = Device(name='Analyst Laptop', type=device_type)\n >>> artifact = Artifact(\n ... name='malware_sample.pdf',\n ... type=artifact_type,\n ... extracted_from=device,\n ... extension='pdf',\n ... original_name='invoice.pdf',\n ... mime_type='application/pdf',\n ... md5='d41d8cd98f00b204e9800998ecf8427e',\n ... sha1='da39a3ee5e6b4b0d3255bfef95601890afd80709',\n ... sha256='e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',\n ... size_in_bytes=12345\n ... )\n >>> print(artifact.name)\n malware_sample.pdf", "type": "object", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/ArtifactType" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "extracted_from": { "anyOf": [ { "$ref": "#/$defs/Device" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Extracted From" }, "extension": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Extension" }, "original_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Original Name" }, "mime_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Mime Type" }, "detached_signature": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Detached Signature" }, "md5": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Md5" }, "sha1": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Sha1" }, "sha256": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Sha256" }, "size_in_bytes": { "default": 0, "minimum": 0, "title": "Size In Bytes", "type": "integer" }, "colander_internal_type": { "const": "artifact", "default": "artifact", "title": "Colander Internal Type", "type": "string" } }, "$defs": { "Actor": { "description": "Actor represents an individual or group involved in an event, activity, or system.\n\nThis class extends the Entity base class and includes additional fields specific to actors.\n\nExample:\n >>> actor_type = ActorTypes.enum.INDIVIDUAL.value\n >>> actor = Actor(\n ... name='John Doe',\n ... type=actor_type\n ... )\n >>> print(actor.name)\n John Doe", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/ActorType" }, "colander_internal_type": { "const": "actor", "default": "actor", "title": "Colander Internal Type", "type": "string" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" } }, "required": [ "name", "type" ], "title": "Actor", "type": "object" }, "ActorType": { "description": "ActorType represents metadata for actors in Colander. Check :ref:`the list of supported types <actor_types>`.\n\nExample:\n >>> actor_type = ActorTypes.enum.INDIVIDUAL.value\n >>> print(actor_type.name)\n Individual", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "ActorType", "type": "object" }, "ArtifactType": { "description": "ArtifactType represents metadata for artifacts in Colander. Check :ref:`the list of supported\ntypes <artifact_types>`.\n\nExample:\n >>> artifact_type = ArtifactTypes.enum.REPORT.value\n >>> print(artifact_type.short_name)\n REPORT", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "additionalProperties": true, "title": "Type Hints", "type": "object" } }, "required": [ "short_name", "name" ], "title": "ArtifactType", "type": "object" }, "Case": { "description": "Case represents a collection or grouping of related entities, artifacts, or events.\n\nThis class is used to organize and manage related data, such as incidents, investigations, or projects.\n\nExample:\n >>> case = Case(\n ... name='Investigation Alpha',\n ... description='Investigation of suspicious activity'\n ... )\n >>> print(case.name)\n Investigation Alpha", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "description": { "minLength": 1, "title": "Description", "type": "string" }, "documentation": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Documentation" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "parent_case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Parent Case" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "colander_internal_type": { "const": "case", "default": "case", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "description" ], "title": "Case", "type": "object" }, "Device": { "description": "Device represents a physical or virtual device in Colander.\n\nThis class extends the Entity base class and includes additional fields specific to devices,\nsuch as their type, attributes, and the actor operating the device.\n\nExample:\n >>> device_type = DeviceTypes.enum.MOBILE.value\n >>> actor = Actor(name='John Doe', type=ActorTypes.enum.INDIVIDUAL.value)\n >>> device = Device(\n ... name=\"John's Phone\",\n ... type=device_type,\n ... operated_by=actor,\n ... attributes={'os': 'Android', 'version': '12'}\n ... )\n >>> print(device.name)\n John's Phone", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/DeviceType" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "operated_by": { "anyOf": [ { "$ref": "#/$defs/Actor" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Operated By" }, "colander_internal_type": { "const": "device", "default": "device", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type" ], "title": "Device", "type": "object" }, "DeviceType": { "description": "DeviceType represents metadata for devices in Colander. Check :ref:`the list of supported types <device_types>`.\n\nExample:\n >>> device_type = DeviceTypes.enum.MOBILE.value\n >>> print(device_type.name)\n Mobile device", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "DeviceType", "type": "object" }, "ObjectReference": { "format": "uuid4", "type": "string" }, "TlpPapLevel": { "description": "TlpPapLevel represents the Traffic Light Protocol (TLP) and Permissible Actions Protocol (PAP) levels.\n\nThese levels are used to classify the sensitivity of information and its sharing restrictions.\n\nExample:\n >>> level = TlpPapLevel.RED\n >>> print(level)\n RED", "enum": [ "RED", "AMBER", "GREEN", "WHITE" ], "title": "TlpPapLevel", "type": "string" } }, "required": [ "name", "type" ] }
- Config:
str_strip_whitespace: bool = True
arbitrary_types_allowed: bool = True
- Fields:
- field attributes: Dict[str, str] | None = None
Optional dictionary of additional attributes for the artifact.
- field colander_internal_type: Literal['artifact'] = 'artifact'
Internal type discriminator for (de)serialization.
- field detached_signature: str | None = None
Optional detached signature for the artifact.
- field extension: str | None = None
The file extension of the artifact, if applicable.
- field extracted_from: Device | None | ObjectReference = None
Reference to the device from which this artifact was extracted.
- field md5: str | None = None
MD5 hash of the artifact.
- field mime_type: str | None = None
The MIME type of the artifact.
- field original_name: str | None = None
The original name of the artifact before ingestion.
- field sha1: str | None = None
SHA1 hash of the artifact.
- field sha256: str | None = None
SHA256 hash of the artifact.
- field size_in_bytes: Annotated[int, Ge(ge=0)] = 0
The size of the artifact in bytes.
- Constraints:
ge = 0
- field type: ArtifactType [Required]
The type definition for the artifact.
- pydantic model colander_data_converter.base.models.ArtifactType[source]
Bases:
CommonEntityTypeArtifactType represents metadata for artifacts in Colander. Check the list of supported types.
Example
>>> artifact_type = ArtifactTypes.enum.REPORT.value >>> print(artifact_type.short_name) REPORT
Show JSON schema
{ "title": "ArtifactType", "description": "ArtifactType represents metadata for artifacts in Colander. Check :ref:`the list of supported\ntypes <artifact_types>`.\n\nExample:\n >>> artifact_type = ArtifactTypes.enum.REPORT.value\n >>> print(artifact_type.short_name)\n REPORT", "type": "object", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "additionalProperties": true, "title": "Type Hints", "type": "object" } }, "required": [ "short_name", "name" ] }
- Fields:
- Validators:
is_supported_type»short_name
- field type_hints: Dict[str, Any] [Optional]
Optional dictionary of type hints.
- class colander_data_converter.base.models.ArtifactTypes[source]
Bases:
objectArtifactTypes provides access to all supported artifact types.
This class loads artifact type definitions from the artifact types JSON file and exposes them as an enum. It also provides a method to look up an artifact type by its short name.
Example
>>> artifact_type = ArtifactTypes.enum.REPORT.value >>> print(artifact_type.name) Report >>> default_type = ArtifactTypes.by_short_name("nonexistent") >>> print(default_type.name) Generic
- classmethod by_mime_type(mime_type: str) ArtifactType[source]
- classmethod by_short_name(short_name: str) ArtifactType[source]
- default = ArtifactType(short_name='GENERIC', name='Generic', description='A file that does not fit into any of other predefined categories.', svg_icon='', nf_icon='nf-cod-file_binary', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints={})
- enum
alias of
EntityTypes
- pydantic model colander_data_converter.base.models.Case[source]
Bases:
ColanderTypeCase represents a collection or grouping of related entities, artifacts, or events.
This class is used to organize and manage related data, such as incidents, investigations, or projects.
Example
>>> case = Case( ... name='Investigation Alpha', ... description='Investigation of suspicious activity' ... ) >>> print(case.name) Investigation Alpha
Show JSON schema
{ "$defs": { "Case": { "description": "Case represents a collection or grouping of related entities, artifacts, or events.\n\nThis class is used to organize and manage related data, such as incidents, investigations, or projects.\n\nExample:\n >>> case = Case(\n ... name='Investigation Alpha',\n ... description='Investigation of suspicious activity'\n ... )\n >>> print(case.name)\n Investigation Alpha", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "description": { "minLength": 1, "title": "Description", "type": "string" }, "documentation": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Documentation" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "parent_case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Parent Case" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "colander_internal_type": { "const": "case", "default": "case", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "description" ], "title": "Case", "type": "object" }, "ObjectReference": { "format": "uuid4", "type": "string" }, "TlpPapLevel": { "description": "TlpPapLevel represents the Traffic Light Protocol (TLP) and Permissible Actions Protocol (PAP) levels.\n\nThese levels are used to classify the sensitivity of information and its sharing restrictions.\n\nExample:\n >>> level = TlpPapLevel.RED\n >>> print(level)\n RED", "enum": [ "RED", "AMBER", "GREEN", "WHITE" ], "title": "TlpPapLevel", "type": "string" } }, "$ref": "#/$defs/Case" }
- Config:
str_strip_whitespace: bool = True
arbitrary_types_allowed: bool = True
- Fields:
- field colander_internal_type: Literal['case'] = 'case'
Internal type discriminator for (de)serialization.
- field created_at: datetime | None = None
The timestamp when the case was created.
- field description: str [Required]
A description of the case.
- Constraints:
min_length = 1
- field documentation: str | None = None
Optional documentation or notes for the case.
- field id: Annotated[UUID, UuidVersion(uuid_version=4)] [Optional]
The unique identifier for the case.
- Constraints:
uuid_version = 4
- field name: str [Required]
The name of the case.
- Constraints:
min_length = 1
max_length = 512
- field pap: TlpPapLevel = TlpPapLevel.WHITE
The PAP (Permissible Actions Protocol) level for the case.
- field parent_case: Case | None | ObjectReference = None
Reference to a parent case, if this case is a sub-case.
- field tlp: TlpPapLevel = TlpPapLevel.WHITE
The TLP (Traffic Light Protocol) level for the case.
- field updated_at: datetime | None = None
The timestamp when the case was last updated.
- pydantic model colander_data_converter.base.models.ColanderFeed[source]
Bases:
ColanderTypeColanderFeed aggregates entities, relations, and cases for bulk operations or data exchange.
This class is used to load, manage, and resolve references for collections of model objects.
Example
>>> feed_data = { ... "entities": { ... "204d4590-a3ee-4f24-8eaf-350ec2fa751b": { ... "id": "204d4590-a3ee-4f24-8eaf-350ec2fa751b", ... "name": "Example Observable", ... "type": {"name": "IPv4", "short_name": "IPV4"}, ... "super_type": {"short_name": "observable"}, ... "colander_internal_type": "observable" ... } ... }, ... "relations": {}, ... "cases": {} ... } >>> feed = ColanderFeed.load(feed_data) >>> print(list(feed.entities.keys())) ['204d4590-a3ee-4f24-8eaf-350ec2fa751b']
Show JSON schema
{ "title": "ColanderFeed", "description": "ColanderFeed aggregates entities, relations, and cases for bulk operations or data exchange.\n\nThis class is used to load, manage, and resolve references for collections of model objects.\n\nExample:\n >>> feed_data = {\n ... \"entities\": {\n ... \"204d4590-a3ee-4f24-8eaf-350ec2fa751b\": {\n ... \"id\": \"204d4590-a3ee-4f24-8eaf-350ec2fa751b\",\n ... \"name\": \"Example Observable\",\n ... \"type\": {\"name\": \"IPv4\", \"short_name\": \"IPV4\"},\n ... \"super_type\": {\"short_name\": \"observable\"},\n ... \"colander_internal_type\": \"observable\"\n ... }\n ... },\n ... \"relations\": {},\n ... \"cases\": {}\n ... }\n >>> feed = ColanderFeed.load(feed_data)\n >>> print(list(feed.entities.keys()))\n ['204d4590-a3ee-4f24-8eaf-350ec2fa751b']", "type": "object", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "name": { "default": "", "title": "Name", "type": "string" }, "description": { "default": "", "title": "Description", "type": "string" }, "entities": { "anyOf": [ { "additionalProperties": { "discriminator": { "mapping": { "actor": "#/$defs/Actor", "artifact": "#/$defs/Artifact", "datafragment": "#/$defs/DataFragment", "detectionrule": "#/$defs/DetectionRule", "device": "#/$defs/Device", "event": "#/$defs/Event", "observable": "#/$defs/Observable", "threat": "#/$defs/Threat" }, "propertyName": "colander_internal_type" }, "oneOf": [ { "$ref": "#/$defs/Actor" }, { "$ref": "#/$defs/Artifact" }, { "$ref": "#/$defs/DataFragment" }, { "$ref": "#/$defs/Observable" }, { "$ref": "#/$defs/DetectionRule" }, { "$ref": "#/$defs/Device" }, { "$ref": "#/$defs/Event" }, { "$ref": "#/$defs/Threat" } ] }, "type": "object" }, { "type": "null" } ], "default": {}, "title": "Entities" }, "relations": { "anyOf": [ { "additionalProperties": { "$ref": "#/$defs/EntityRelation" }, "type": "object" }, { "type": "null" } ], "default": {}, "title": "Relations" }, "cases": { "anyOf": [ { "additionalProperties": { "$ref": "#/$defs/Case" }, "type": "object" }, { "type": "null" } ], "default": {}, "title": "Cases" } }, "$defs": { "Actor": { "description": "Actor represents an individual or group involved in an event, activity, or system.\n\nThis class extends the Entity base class and includes additional fields specific to actors.\n\nExample:\n >>> actor_type = ActorTypes.enum.INDIVIDUAL.value\n >>> actor = Actor(\n ... name='John Doe',\n ... type=actor_type\n ... )\n >>> print(actor.name)\n John Doe", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/ActorType" }, "colander_internal_type": { "const": "actor", "default": "actor", "title": "Colander Internal Type", "type": "string" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" } }, "required": [ "name", "type" ], "title": "Actor", "type": "object" }, "ActorType": { "description": "ActorType represents metadata for actors in Colander. Check :ref:`the list of supported types <actor_types>`.\n\nExample:\n >>> actor_type = ActorTypes.enum.INDIVIDUAL.value\n >>> print(actor_type.name)\n Individual", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "ActorType", "type": "object" }, "Artifact": { "description": "Artifact represents a file or data object, such as a document, image, or binary, within the system.\n\nThis class extends the Entity base class and includes additional fields specific to artifacts,\nsuch as type, attributes, extraction source, file metadata, and cryptographic hashes.\n\nExample:\n >>> artifact_type = ArtifactTypes.enum.DOCUMENT.value\n >>> device_type = DeviceTypes.enum.LAPTOP.value\n >>> device = Device(name='Analyst Laptop', type=device_type)\n >>> artifact = Artifact(\n ... name='malware_sample.pdf',\n ... type=artifact_type,\n ... extracted_from=device,\n ... extension='pdf',\n ... original_name='invoice.pdf',\n ... mime_type='application/pdf',\n ... md5='d41d8cd98f00b204e9800998ecf8427e',\n ... sha1='da39a3ee5e6b4b0d3255bfef95601890afd80709',\n ... sha256='e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',\n ... size_in_bytes=12345\n ... )\n >>> print(artifact.name)\n malware_sample.pdf", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/ArtifactType" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "extracted_from": { "anyOf": [ { "$ref": "#/$defs/Device" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Extracted From" }, "extension": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Extension" }, "original_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Original Name" }, "mime_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Mime Type" }, "detached_signature": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Detached Signature" }, "md5": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Md5" }, "sha1": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Sha1" }, "sha256": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Sha256" }, "size_in_bytes": { "default": 0, "minimum": 0, "title": "Size In Bytes", "type": "integer" }, "colander_internal_type": { "const": "artifact", "default": "artifact", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type" ], "title": "Artifact", "type": "object" }, "ArtifactType": { "description": "ArtifactType represents metadata for artifacts in Colander. Check :ref:`the list of supported\ntypes <artifact_types>`.\n\nExample:\n >>> artifact_type = ArtifactTypes.enum.REPORT.value\n >>> print(artifact_type.short_name)\n REPORT", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "additionalProperties": true, "title": "Type Hints", "type": "object" } }, "required": [ "short_name", "name" ], "title": "ArtifactType", "type": "object" }, "Case": { "description": "Case represents a collection or grouping of related entities, artifacts, or events.\n\nThis class is used to organize and manage related data, such as incidents, investigations, or projects.\n\nExample:\n >>> case = Case(\n ... name='Investigation Alpha',\n ... description='Investigation of suspicious activity'\n ... )\n >>> print(case.name)\n Investigation Alpha", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "description": { "minLength": 1, "title": "Description", "type": "string" }, "documentation": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Documentation" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "parent_case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Parent Case" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "colander_internal_type": { "const": "case", "default": "case", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "description" ], "title": "Case", "type": "object" }, "DataFragment": { "description": "DataFragment represents a fragment of data, such as a code snippet, text, or other content.\n\nThis class extends the Entity base class and includes additional fields specific to data fragments,\nsuch as their type, content, and the artifact from which they were extracted.\n\nExample:\n >>> data_fragment_type = DataFragmentTypes.enum.CODE.value\n >>> artifact = Artifact(\n ... name='example_artifact',\n ... type=ArtifactTypes.enum.DOCUMENT.value\n ... )\n >>> data_fragment = DataFragment(\n ... name='Sample Code',\n ... type=data_fragment_type,\n ... content='print(\"Hello, World!\")',\n ... extracted_from=artifact\n ... )\n >>> print(data_fragment.content)\n print(\"Hello, World!\")", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/DataFragmentType" }, "content": { "title": "Content", "type": "string" }, "extracted_from": { "anyOf": [ { "$ref": "#/$defs/Artifact" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Extracted From" }, "colander_internal_type": { "const": "datafragment", "default": "datafragment", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type", "content" ], "title": "DataFragment", "type": "object" }, "DataFragmentType": { "description": "DataFragmentType represents metadata for data fragments in Colander. Check :ref:`the list of supported\ntypes <data_fragment_types>`.\n\nExample:\n >>> data_fragment_type = DataFragmentTypes.enum.CODE.value\n >>> print(data_fragment_type.name)\n Piece of code", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "DataFragmentType", "type": "object" }, "DetectionRule": { "description": "DetectionRule represents a rule used for detecting specific content or logic related to observables or\nobject references.\n\nThis class is designed to encapsulate detection rules that can be applied across various systems or platforms to\nidentify patterns or conditions defined by the user.\n\nExample:\n >>> drt = DetectionRuleTypes.enum.YARA.value\n >>> rule = DetectionRule(\n ... name='Detect Malicious IP',\n ... type=drt,\n ... content='rule malicious_ip { condition: true }',\n ... )\n >>> print(rule.name)\n Detect Malicious IP", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/DetectionRuleType" }, "content": { "title": "Content", "type": "string" }, "targeted_observables": { "anyOf": [ { "items": { "$ref": "#/$defs/Observable" }, "type": "array" }, { "items": { "$ref": "#/$defs/ObjectReference" }, "type": "array" }, { "type": "null" } ], "default": null, "title": "Targeted Observables" }, "colander_internal_type": { "const": "detectionrule", "default": "detectionrule", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type", "content" ], "title": "DetectionRule", "type": "object" }, "DetectionRuleType": { "description": "DetectionRuleType represents metadata for detection rules in Colander. Check :ref:`the list of supported\ntypes <detection_rule_types>`.\n\nExample:\n >>> detection_rule_type = DetectionRuleTypes.enum.YARA.value\n >>> print(detection_rule_type.name)\n Yara rule", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "DetectionRuleType", "type": "object" }, "Device": { "description": "Device represents a physical or virtual device in Colander.\n\nThis class extends the Entity base class and includes additional fields specific to devices,\nsuch as their type, attributes, and the actor operating the device.\n\nExample:\n >>> device_type = DeviceTypes.enum.MOBILE.value\n >>> actor = Actor(name='John Doe', type=ActorTypes.enum.INDIVIDUAL.value)\n >>> device = Device(\n ... name=\"John's Phone\",\n ... type=device_type,\n ... operated_by=actor,\n ... attributes={'os': 'Android', 'version': '12'}\n ... )\n >>> print(device.name)\n John's Phone", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/DeviceType" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "operated_by": { "anyOf": [ { "$ref": "#/$defs/Actor" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Operated By" }, "colander_internal_type": { "const": "device", "default": "device", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type" ], "title": "Device", "type": "object" }, "DeviceType": { "description": "DeviceType represents metadata for devices in Colander. Check :ref:`the list of supported types <device_types>`.\n\nExample:\n >>> device_type = DeviceTypes.enum.MOBILE.value\n >>> print(device_type.name)\n Mobile device", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "DeviceType", "type": "object" }, "EntityRelation": { "description": "EntityRelation represents a relationship between two entities in the model.\n\nThis class is used to define and manage relationships between objects, such as associations\nbetween observables, devices, or actors.\n\nExample:\n >>> obs1 = Observable(\n ... id=uuid4(),\n ... name='1.1.1.1',\n ... type=ObservableTypes.enum.IPV4.value\n ... )\n >>> obs2 = Observable(\n ... id=uuid4(),\n ... name='8.8.8.8',\n ... type=ObservableTypes.enum.IPV4.value\n ... )\n >>> relation = EntityRelation(\n ... id=uuid4(),\n ... name='connection',\n ... obj_from=obs1,\n ... obj_to=obs2\n ... )\n >>> print(relation.name)\n connection", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "obj_from": { "anyOf": [ { "discriminator": { "mapping": { "actor": "#/$defs/Actor", "artifact": "#/$defs/Artifact", "datafragment": "#/$defs/DataFragment", "detectionrule": "#/$defs/DetectionRule", "device": "#/$defs/Device", "event": "#/$defs/Event", "observable": "#/$defs/Observable", "threat": "#/$defs/Threat" }, "propertyName": "colander_internal_type" }, "oneOf": [ { "$ref": "#/$defs/Actor" }, { "$ref": "#/$defs/Artifact" }, { "$ref": "#/$defs/DataFragment" }, { "$ref": "#/$defs/Observable" }, { "$ref": "#/$defs/DetectionRule" }, { "$ref": "#/$defs/Device" }, { "$ref": "#/$defs/Event" }, { "$ref": "#/$defs/Threat" } ] }, { "$ref": "#/$defs/ObjectReference" } ], "title": "Obj From" }, "obj_to": { "anyOf": [ { "discriminator": { "mapping": { "actor": "#/$defs/Actor", "artifact": "#/$defs/Artifact", "datafragment": "#/$defs/DataFragment", "detectionrule": "#/$defs/DetectionRule", "device": "#/$defs/Device", "event": "#/$defs/Event", "observable": "#/$defs/Observable", "threat": "#/$defs/Threat" }, "propertyName": "colander_internal_type" }, "oneOf": [ { "$ref": "#/$defs/Actor" }, { "$ref": "#/$defs/Artifact" }, { "$ref": "#/$defs/DataFragment" }, { "$ref": "#/$defs/Observable" }, { "$ref": "#/$defs/DetectionRule" }, { "$ref": "#/$defs/Device" }, { "$ref": "#/$defs/Event" }, { "$ref": "#/$defs/Threat" } ] }, { "$ref": "#/$defs/ObjectReference" } ], "title": "Obj To" } }, "required": [ "name", "obj_from", "obj_to" ], "title": "EntityRelation", "type": "object" }, "Event": { "description": "Event represents an occurrence or activity observed within a system, such as a detection, alert, or log entry.\n\nThis class extends the Entity base class and includes additional fields specific to events,\nsuch as timestamps, count, involved observables, and references to related entities.\n\nExample:\n >>> et = EventTypes.enum.HIT.value\n >>> obs_type = ObservableTypes.enum.IPV4.value\n >>> obs = Observable(\n ... id=uuid4(),\n ... name='8.8.8.8',\n ... type=obs_type\n ... )\n >>> event = Event(\n ... name='Suspicious Connection',\n ... type=et,\n ... first_seen=datetime(2024, 6, 1, 12, 0, tzinfo=UTC),\n ... last_seen=datetime(2024, 6, 1, 12, 5, tzinfo=UTC),\n ... involved_observables=[obs]\n ... )\n >>> print(event.name)\n Suspicious Connection", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/EventType" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "first_seen": { "default": "2025-07-15T16:35:28.883476Z", "format": "date-time", "title": "First Seen", "type": "string" }, "last_seen": { "default": "2025-07-15T16:35:28.883479Z", "format": "date-time", "title": "Last Seen", "type": "string" }, "count": { "default": 1, "exclusiveMinimum": 0, "title": "Count", "type": "integer" }, "extracted_from": { "anyOf": [ { "$ref": "#/$defs/Artifact" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Extracted From" }, "observed_on": { "anyOf": [ { "$ref": "#/$defs/Device" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Observed On" }, "detected_by": { "anyOf": [ { "$ref": "#/$defs/DetectionRule" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Detected By" }, "involved_observables": { "anyOf": [ { "items": { "$ref": "#/$defs/Observable" }, "type": "array" }, { "items": { "$ref": "#/$defs/ObjectReference" }, "type": "array" }, { "type": "null" } ], "default": null, "title": "Involved Observables" }, "colander_internal_type": { "const": "event", "default": "event", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type" ], "title": "Event", "type": "object" }, "EventType": { "description": "EventType represents metadata for events in Colander. Check :ref:`the list of supported types <event_types>`.\n\nExample:\n >>> event_type = EventTypes.enum.HIT.value\n >>> print(event_type.name)\n Hit", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "EventType", "type": "object" }, "ObjectReference": { "format": "uuid4", "type": "string" }, "Observable": { "description": "Observable represents an entity that can be observed or detected within the system.\n\nThis class extends the Entity base class and includes additional fields specific to observables,\nsuch as classification, raw value, extraction source, associated threat, and operator.\n\nExample:\n >>> ot = ObservableTypes.enum.IPV4.value\n >>> obs = Observable(\n ... name='1.2.3.4',\n ... type=ot,\n ... classification='malicious',\n ... raw_value='1.2.3.4',\n ... attributes={'asn': 'AS123'}\n ... )\n >>> print(obs.name)\n 1.2.3.4", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/ObservableType" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "classification": { "anyOf": [ { "maxLength": 512, "type": "string" }, { "type": "null" } ], "default": null, "title": "Classification" }, "raw_value": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Raw Value" }, "extracted_from": { "anyOf": [ { "$ref": "#/$defs/Artifact" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Extracted From" }, "associated_threat": { "anyOf": [ { "$ref": "#/$defs/Threat" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Associated Threat" }, "operated_by": { "anyOf": [ { "$ref": "#/$defs/Actor" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Operated By" }, "colander_internal_type": { "const": "observable", "default": "observable", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type" ], "title": "Observable", "type": "object" }, "ObservableType": { "description": "ObservableType represents metadata for observables in Colander. Check :ref:`the list of supported\ntypes <observable_types>`.\n\nExample:\n >>> observable_type = ObservableType(\n ... id=uuid4(),\n ... short_name='IPV4',\n ... name='IPv4',\n ... description='An IPv4 address type'\n ... )\n >>> print(observable_type.name)\n IPv4", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "ObservableType", "type": "object" }, "Threat": { "description": "Threat represents a threat entity, such as a malware family, campaign, or adversary.\n\nThis class extends the Entity base class and includes a type field for threat classification.\n\nExample:\n >>> threat_type = ThreatTypes.enum.TROJAN.value\n >>> threat = Threat(\n ... name='Emotet',\n ... type=threat_type\n ... )\n >>> print(threat.name)\n Emotet", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/ThreatType" }, "colander_internal_type": { "const": "threat", "default": "threat", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type" ], "title": "Threat", "type": "object" }, "ThreatType": { "description": "ThreatType represents metadata for threats in Colander. Check :ref:`the list of supported types <threat_types>`.\n\nExample:\n >>> threat_type = ThreatTypes.enum.TROJAN.value\n >>> print(threat_type.name)\n Trojan", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "ThreatType", "type": "object" }, "TlpPapLevel": { "description": "TlpPapLevel represents the Traffic Light Protocol (TLP) and Permissible Actions Protocol (PAP) levels.\n\nThese levels are used to classify the sensitivity of information and its sharing restrictions.\n\nExample:\n >>> level = TlpPapLevel.RED\n >>> print(level)\n RED", "enum": [ "RED", "AMBER", "GREEN", "WHITE" ], "title": "TlpPapLevel", "type": "string" } } }
- Config:
str_strip_whitespace: bool = True
arbitrary_types_allowed: bool = True
- Fields:
- field description: str = ''
Optional description of the feed.
- field entities: Dict[str, Annotated[Actor | Artifact | DataFragment | Observable | DetectionRule | Device | Event | Threat, FieldInfo(annotation=NoneType, required=True, discriminator='colander_internal_type')]] | None = {}
Dictionary of entity objects, keyed by their IDs.
- field id: Annotated[UUID, UuidVersion(uuid_version=4)] [Optional]
The unique identifier for the feed.
- Constraints:
uuid_version = 4
- field name: str = ''
Optional name of the feed.
- field relations: Dict[str, EntityRelation] | None = {}
Dictionary of entity relations, keyed by their IDs.
- static load(raw_object: dict | list) ColanderFeed[source]
Loads an EntityFeed from a raw object, which can be either a dictionary or a list.
- Parameters:
raw_object (dict | list) – The raw data representing the entities and relations to be loaded into the EntityFeed.
- Returns:
The EntityFeed loaded from a raw object.
- Return type:
- Raises:
ValueError – If there are inconsistencies in entity IDs or relations.
- resolve_references(strict=False)[source]
Resolves references within entities, relations, and cases.
Iterates over each entity, relation, and case within the respective collections, calling their resolve_references method to update them with any referenced data. This helps in synchronizing internal state with external dependencies or updates.
- Parameters:
strict (bool) – If True, raises a ValueError when a UUID reference cannot be resolved. If False, unresolved references remain as UUIDs.
- unlink_references() None[source]
Unlinks references from all entities, relations, and cases within the current context.
This method iterates through each entity, relation, and case stored in the entities, relations, and cases dictionaries respectively, invoking their unlink_references() methods to clear any references held by these objects. This operation is useful for breaking dependencies or preparing data for deletion or modification.
- pydantic model colander_data_converter.base.models.ColanderType[source]
Bases:
BaseModelBase class for all Colander model data_types, providing common functionality for post-initialization, reference management, and type resolution.
This class extends Pydantic’s BaseModel and is intended to be subclassed by all model entities. It includes methods for linking and unlinking object references, resolving type hints, and extracting subclass information.
Show JSON schema
{ "title": "ColanderType", "description": "Base class for all Colander model data_types, providing common functionality for\npost-initialization, reference management, and type resolution.\n\nThis class extends Pydantic's BaseModel and is intended to be subclassed by\nall model entities. It includes methods for linking and unlinking object references,\nresolving type hints, and extracting subclass information.", "type": "object", "properties": {} }
- Config:
str_strip_whitespace: bool = True
arbitrary_types_allowed: bool = True
- classmethod extract_type_hints(obj: dict) str[source]
Extracts type hints from a given dictionary based on specific keys.
This class method attempts to retrieve type hints from a dictionary using a specific key (“colander_internal_type”) or nested keys (“super_type” and its “short_name” value). If the dictionary does not match the expected structure or the keys are not available, a ValueError is raised.
- Parameters:
obj (dict) – The dictionary from which type hints need to be extracted.
- Returns:
A string representing the extracted type hint.
- Return type:
str
- Raises:
ValueError – If the type hint cannot be extracted from the provided dictionary.
- get_super_type() CommonEntitySuperType[source]
- model_post_init(_ColanderType__context)[source]
Executes post-initialization logic for the model, ensuring the repository registers the current subclass instance.
- Parameters:
__context (Any) – Additional context provided for post-initialization handling.
- resolve_references(strict=False)[source]
Resolves references for the fields in the object’s model. Fields annotated with ObjectReference or List[ObjectReference] are processed to fetch and replace their UUID references with respective entities using the Repository.
This method updates the object in-place.
- Parameters:
strict (bool) – If True, raises a ValueError when a UUID reference cannot be resolved. If False, unresolved references remain as UUIDs.
- Raises:
ValueError – If strict is True and a UUID reference cannot be resolved.
- classmethod resolve_type(content_type: str) type[Annotated[Actor | Artifact | DataFragment | Observable | DetectionRule | Device | Event | Threat, FieldInfo(annotation=NoneType, required=True, discriminator='colander_internal_type')]][source]
Resolves a specific type of entity definition based on the provided content type by matching it against the available subclasses of the class. This utility ensures that the given content type is valid and matches one of the registered subclasses.
- Parameters:
content_type (str) – A string representing the type of content to be resolved. Must match the name of a subclass (in lowercase) of the current class.
- Returns:
The resolved class type corresponding to the provided content type.
- Return type:
type[‘EntityTypes’]
- classmethod subclasses() Dict[str, type[Annotated[Actor | Artifact | DataFragment | Observable | DetectionRule | Device | Event | Threat, FieldInfo(annotation=NoneType, required=True, discriminator='colander_internal_type')]]][source]
Generates a dictionary containing all subclasses of the current class.
This method collects all the direct subclasses of the current class and maps their names (converted to lowercase) to the class itself. It is primarily useful for organizing and accessing class hierarchies dynamically.
- Returns:
A dictionary where the keys are the lowercase names of the subclasses, and the values are the subclass data_types themselves.
- Return type:
Dict[str, type[‘EntityTypes’]]
- unlink_references()[source]
Unlinks object references by replacing them with their respective UUIDs.
This method updates the model fields of the class instance where fields annotated as ObjectReference or List[ObjectReference] exist. It replaces the references (of type objects) with their UUIDs if they exist.
For fields of type ObjectReference, the method retrieves the field’s value and replaces it with its id (UUID) if the current value is not already a UUID.
For fields of type List[ObjectReference], the method iterates through the list and replaces each object reference with its id (UUID) if the current value is not already a UUID. The field value is updated only if at least one replacement occurs.
- Raises:
AttributeError – If the class instance does not have the expected field or attribute.
- property super_type: CommonEntitySuperType
- pydantic model colander_data_converter.base.models.CommonEntitySuperType[source]
Bases:
BaseModelCommonEntitySuperType defines metadata for a super type of entities in the Colander data model.
This class is used to represent high-level categories of entities (such as Actor, Artifact, Device, etc.) and provides fields for the short name, display name, associated types, and the Python class implementing the entity.
Show JSON schema
{ "title": "CommonEntitySuperType", "description": "CommonEntitySuperType defines metadata for a super type of entities in the Colander data model.\n\nThis class is used to represent high-level categories of entities (such as Actor, Artifact, Device, etc.)\nand provides fields for the short name, display name, associated types, and the Python class implementing the entity.", "type": "object", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "types": { "anyOf": [ { "items": {}, "type": "array" }, { "type": "null" } ], "default": null, "title": "Types" } }, "required": [ "short_name", "name" ] }
- field name: str [Required]
The name of the model type.
- Constraints:
max_length = 512
- field short_name: str [Required]
A short name for the model type.
- Constraints:
max_length = 32
- field types: List[object] | None = None
Optional reference to the enum or collection of supported types.
- model_post_init(context: Any, /) None
This function is meant to behave like a BaseModel method to initialise private attributes.
It takes context as an argument since that’s what pydantic-core passes when calling it.
- Parameters:
self – The BaseModel instance.
context – The context.
- class colander_data_converter.base.models.CommonEntitySuperTypes(value, names=<not given>, *values, module=None, qualname=None, type=None, start=1, boundary=None)[source]
Bases:
EnumCommonEntitySuperTypes is an enumeration of all super types for entities in the Colander data model.
Each member of this enum represents a high-level entity category (such as Actor, Artifact, Device, etc.) and holds a CommonEntitySuperType instance containing metadata and references to the corresponding entity class and its supported types.
This enum is used for type resolution and validation across the model.
Example
>>> super_type = CommonEntitySuperTypes.ACTOR.value >>> print(super_type.name) Actor
- ACTOR = CommonEntitySuperType(short_name='ACTOR', name='Actor', types=[<EntityTypes.NGO: ActorType(short_name='NGO', name='NGO', description='A non-governmental organization.', svg_icon='', nf_icon='nf-fae-cc_nc', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.COMPANY: ActorType(short_name='COMPANY', name='Private company', description='A privately owned business entity, often a target or participant in cyber activities.', svg_icon='', nf_icon='nf-fa-dollar', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.APT: ActorType(short_name='APT', name='APT', description='An advanced persistent threat group, typically well-resourced and highly skilled.', svg_icon='', nf_icon='nf-fae-virus', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.THREAT_ACTOR: ActorType(short_name='THREAT_ACTOR', name='Threat actor', description='An individual or group responsible for malicious cyber activities.', svg_icon='', nf_icon='nf-fae-virus', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.INDIVIDUAL: ActorType(short_name='INDIVIDUAL', name='Individual', description='A single person involved in threat activity or as a target.', svg_icon='', nf_icon='nf-cod-person', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.PUB_INST: ActorType(short_name='PUB_INST', name='Public institution', description='A government or public sector organization.', svg_icon='', nf_icon='nf-fa-bank', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.GENERIC: ActorType(short_name='GENERIC', name='Generic', description='A generic or unspecified actor type.', svg_icon='', nf_icon='nf-cod-person', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.HACKTIVIST: ActorType(short_name='HACKTIVIST', name='Hacktivist', description='An individual or group using hacking to promote political or social agendas.', svg_icon='', nf_icon='nf-mdi-hammer_sickle', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.CYBER_CRIMINAL: ActorType(short_name='CYBER_CRIMINAL', name='Cyber criminal', description='An individual or group engaging in illegal activities for financial gain.', svg_icon='', nf_icon='nf-fa-user_secret', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.INSIDER: ActorType(short_name='INSIDER', name='Insider threat', description='An individual within an organization posing a security risk.', svg_icon='', nf_icon='nf-fa-user', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.NATION_STATE: ActorType(short_name='NATION_STATE', name='Nation-state actor', description='A government-sponsored group conducting cyber operations.', svg_icon='', nf_icon='nf-mdi-flag', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>])
- ARTIFACT = CommonEntitySuperType(short_name='ARTIFACT', name='Artifact', types=[<EntityTypes.ARCHIVE: ArtifactType(short_name='ARCHIVE', name='Archive', description='A compressed file or collection of files, such as ZIP or TAR.', svg_icon='', nf_icon='nf-fa-file_zip_o', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints={'suggested_by_mime_types': {'types': ['application/x-zip-compressed', 'application/zip', 'application/x-tar', 'application/gzip', 'application/x-compressed-tar', 'application/x-gzip', 'application/x-bzip2', 'application/x-bzip-compressed-tar', 'application/x-xz', 'application/x-xz-compressed-tar', 'application/x-7z-compressed', 'application/vnd.rar', 'application/x-iso9660-image', 'application/x-apple-diskimage', 'application/java-archive', 'application/vnd.debian.binary-package', 'application/x-rpm', 'application/vnd.ms-cab-compressed', 'application/x-compress']}})>, <EntityTypes.EMAIL: ArtifactType(short_name='EMAIL', name='Email file', description='A file containing email messages, such as EML or MSG format.', svg_icon='', nf_icon='nf-mdi-email_outline', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints={'suggested_by_mime_types': {'types': ['message/rfc822', 'application/vnd.ms-outlook', 'application/x-msmessage', 'application/mbox']}})>, <EntityTypes.BACKUP: ArtifactType(short_name='BACKUP', name='Backup image', description='A file containing a backup copy of data or a system image.', svg_icon='', nf_icon='nf-mdi-backup_restore', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints={})>, <EntityTypes.ANDROID_BACKUP: ArtifactType(short_name='ANDROID_BACKUP', name='Android backup image', description='A backup image created from an Android device.', svg_icon='', nf_icon='nf-mdi-backup_restore', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints={})>, <EntityTypes.IOS_BACKUP: ArtifactType(short_name='IOS_BACKUP', name='iOS backup image', description='A backup image created from an iOS device.', svg_icon='', nf_icon='nf-mdi-backup_restore', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints={})>, <EntityTypes.SAMPLE: ArtifactType(short_name='SAMPLE', name='Sample', description='A generic sample file, often used for malware or suspicious files.', svg_icon='', nf_icon='nf-oct-package', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints={})>, <EntityTypes.ANDROID_SAMPLE: ArtifactType(short_name='ANDROID_SAMPLE', name='Android sample', description='A sample file specific to the Android platform.', svg_icon='', nf_icon='nf-mdi-android', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints={'suggested_by_mime_types': {'types': ['application/vnd.android.package-archive', 'application/x-dex']}})>, <EntityTypes.IOS_SAMPLE: ArtifactType(short_name='IOS_SAMPLE', name='iOS sample', description='A sample file specific to the iOS platform.', svg_icon='', nf_icon='nf-mdi-apple_ios', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints={})>, <EntityTypes.F_DUMP: ArtifactType(short_name='F_DUMP', name='Forensic dump', description='A file containing a forensic image or memory dump.', svg_icon='', nf_icon='nf-mdi-harddisk', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints={})>, <EntityTypes.PCAP: ArtifactType(short_name='PCAP', name='PCAP file', description='A file capturing network traffic, typically in PCAP format.', svg_icon='', nf_icon='nf-mdi-download_network', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints={'suggested_by_mime_types': {'types': ['application/vnd.tcpdump.pcap', 'application/x-pcap', 'application/pcap', 'application/cap', 'application/x-cap', 'application/vnd.tcpdump.pcapng']}})>, <EntityTypes.HAR: ArtifactType(short_name='HAR', name='HAR file', description='A file containing HTTP Archive (HAR) data for web traffic analysis.', svg_icon='', nf_icon='nf-mdi-download_network', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints={})>, <EntityTypes.SOCKET_T: ArtifactType(short_name='SOCKET_T', name='Socket activity trace', description='A file recording socket or network connection activity.', svg_icon='', nf_icon='nf-mdi-plus_network', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints={})>, <EntityTypes.CRYPTO_T: ArtifactType(short_name='CRYPTO_T', name='Cryptographic activity trace', description='A file logging cryptographic operations or key usage.', svg_icon='', nf_icon='nf-cod-key', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints={})>, <EntityTypes.SSLKEYLOG: ArtifactType(short_name='SSLKEYLOG', name='SSL keylog file', description='A file containing SSL/TLS session keys for decrypting network traffic.', svg_icon='', nf_icon='nf-cod-key', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints={})>, <EntityTypes.DOCUMENT: ArtifactType(short_name='DOCUMENT', name='Document', description='A generic document file, such as PDF, DOCX, or ODT.', svg_icon='', nf_icon='nf-mdi-file_document', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={'content_warning': ''}, type_hints={'suggested_by_mime_types': {'types': ['application/pdf', 'application/vnd.openxmlformats-officedocument.wordprocessingml.document', 'application/msword', 'application/vnd.oasis.opendocument.text', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', 'application/vnd.ms-excel', 'application/vnd.oasis.opendocument.spreadsheet', 'application/vnd.openxmlformats-officedocument.presentationml.presentation', 'application/vnd.ms-powerpoint', 'application/vnd.oasis.opendocument.presentation', 'application/rtf', 'text/csv']}})>, <EntityTypes.IMAGE: ArtifactType(short_name='IMAGE', name='Image', description='A file containing a still image, such as JPG, PNG, or GIF.', svg_icon='', nf_icon='nf-fa-file_image_o', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={'content_warning': ''}, type_hints={'suggested_by_mime_types': {'types': ['image/*']}})>, <EntityTypes.VIDEO: ArtifactType(short_name='VIDEO', name='Video', description='A file containing video content, such as MP4, AVI, or MOV.', svg_icon='', nf_icon='nf-fa-file_video_o', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={'content_warning': ''}, type_hints={'suggested_by_mime_types': {'types': ['video/*']}})>, <EntityTypes.AUDIO: ArtifactType(short_name='AUDIO', name='Audio', description='A file containing audio content, such as MP3, WAV, or AAC.', svg_icon='', nf_icon='nf-fa-file_audio_o', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={'content_warning': ''}, type_hints={'suggested_by_mime_types': {'types': ['audio/*']}})>, <EntityTypes.WEBPAGE: ArtifactType(short_name='WEBPAGE', name='Web page', description='A file containing web page content, such as HTML or XHTML.', svg_icon='', nf_icon='nf-cod-file_code', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={'content_warning': ''}, type_hints={'suggested_by_mime_types': {'types': ['text/html', 'application/xhtml+xml']}})>, <EntityTypes.SOCIAL_POST: ArtifactType(short_name='SOCIAL_POST', name='Social media post', description='A file or record representing a post from a social media platform.', svg_icon='', nf_icon='nf-fa-comment_o', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={'content_warning': ''}, type_hints={})>, <EntityTypes.REPORT: ArtifactType(short_name='REPORT', name='Report', description='A file containing an analytical or investigative report.', svg_icon='', nf_icon='nf-mdi-file_document', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints={})>, <EntityTypes.JSON: ArtifactType(short_name='JSON', name='JSON file', description='A file in JavaScript Object Notation (JSON) format.', svg_icon='', nf_icon='nf-cod-json', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints={'suggested_by_mime_types': {'types': ['application/json']}})>, <EntityTypes.TEXT: ArtifactType(short_name='TEXT', name='Text file', description='A plain text file, such as TXT or LOG.', svg_icon='', nf_icon='nf-fa-file_text', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints={'suggested_by_mime_types': {'types': ['text/plain']}})>, <EntityTypes.BINARY: ArtifactType(short_name='BINARY', name='Binary file', description='A file containing binary data, not intended to be read as text.', svg_icon='', nf_icon='nf-cod-file_binary', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints={'suggested_by_mime_types': {'types': ['application/octet-stream', 'application/x-binary', 'application/x-executable', 'application/x-sharedlib', 'application/x-object', 'application/x-coredump']}})>, <EntityTypes.GENERIC: ArtifactType(short_name='GENERIC', name='Generic', description='A file that does not fit into any of other predefined categories.', svg_icon='', nf_icon='nf-cod-file_binary', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints={})>])
- DATA_FRAGMENT = CommonEntitySuperType(short_name='DATA_FRAGMENT', name='Data fragment', types=[<EntityTypes.CODE: DataFragmentType(short_name='CODE', name='Piece of code', description='A snippet or segment of source code from any programming language.', svg_icon='', nf_icon='nf-md-code_braces', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.PATTERN: DataFragmentType(short_name='PATTERN', name='Pattern', description='A recognizable sequence or structure, such as a regular expression or YARA rule.', svg_icon='', nf_icon='nf-fa-puzzle_piece', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.TEXT: DataFragmentType(short_name='TEXT', name='Piece of text', description='A fragment of unstructured or plain text.', svg_icon='', nf_icon='nf-fa-file_text', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.PAYLOAD: DataFragmentType(short_name='PAYLOAD', name='Raw payload', description='A block of raw binary or encoded data.', svg_icon='', nf_icon='nf-oct-file_binary', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.GENERIC: DataFragmentType(short_name='GENERIC', name='Generic', description='A general or unspecified data fragment type that does not fit other categories.', svg_icon='', nf_icon='nf-oct-file_binary', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>])
- DETECTION_RULE = CommonEntitySuperType(short_name='DETECTION_RULE', name='Detection rule', types=[<EntityTypes.YARA: DetectionRuleType(short_name='YARA', name='Yara rule', description='A rule used to identify and classify malware or files based on patterns.', svg_icon='', nf_icon='nf-cod-server_process', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.SURICATA: DetectionRuleType(short_name='SURICATA', name='Suricata rule', description='A rule for the Suricata engine to detect network threats and suspicious traffic.', svg_icon='', nf_icon='nf-cod-server_process', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.GENERIC: DetectionRuleType(short_name='GENERIC', name='Generic', description='A general or unspecified detection rule type that does not fit other categories.', svg_icon='', nf_icon='nf-cod-server_process', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>])
- DEVICE = CommonEntitySuperType(short_name='DEVICE', name='Device', types=[<EntityTypes.SERVER: DeviceType(short_name='SERVER', name='Server', description='A computer or system that provides resources, data, or services to other computers over a network.', svg_icon='', nf_icon='nf-mdi-server_network', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.LAPTOP: DeviceType(short_name='LAPTOP', name='Laptop', description='A portable personal computer designed for mobile use.', svg_icon='', nf_icon='nf-fa-laptop', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.DESKTOP: DeviceType(short_name='DESKTOP', name='Desktop', description='A personal computer intended for regular use at a single location.', svg_icon='', nf_icon='nf-fa-desktop', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.MOBILE: DeviceType(short_name='MOBILE', name='Mobile device', description='A handheld device such as a smartphone or tablet.', svg_icon='', nf_icon='nf-fa-mobile_phone', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.IOT: DeviceType(short_name='IOT', name='Internet of Things', description='A device connected to the internet, often embedded and used for specific functions (e.g., smart home devices).', svg_icon='', nf_icon='nf-fa-plug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.ROUTER: DeviceType(short_name='ROUTER', name='Router', description='A network device that forwards data packets between computer networks.', svg_icon='', nf_icon='nf-mdi-router_wireless', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.GENERIC: DeviceType(short_name='GENERIC', name='Generic', description='A general or unspecified device type that does not fit other categories.', svg_icon='', nf_icon='nf-fa-desktop', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>])
- EVENT = CommonEntitySuperType(short_name='EVENT', name='Event', types=[<EntityTypes.COMMUNICATION: EventType(short_name='COMMUNICATION', name='Communication', description='An event involving the exchange of information between entities, such as emails or messages.', svg_icon='', nf_icon='nf-mdi-lan_connect', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.RESOLVE: EventType(short_name='RESOLVE', name='Resolution', description='An event where a domain or hostname is resolved to an IP address.', svg_icon='', nf_icon='nf-mdi-search_web', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.COMPROMISE: EventType(short_name='COMPROMISE', name='Compromise', description='An event indicating that a system, account, or data has been breached or compromised.', svg_icon='', nf_icon='nf-mdi-disk_alert', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.INFECTION: EventType(short_name='INFECTION', name='Infection', description='An event where a system or device is infected by malware or a similar threat.', svg_icon='', nf_icon='nf-mdi-disk_alert', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.ALERT: EventType(short_name='ALERT', name='Alert', description='A notification or warning about a detected security event or anomaly.', svg_icon='', nf_icon='nf-oct-alert', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.AV_DETECTION: EventType(short_name='AV_DETECTION', name='AntiVirus detection', description='An event where antivirus software detects malicious or suspicious activity.', svg_icon='', nf_icon='nf-oct-alert', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.HIT: EventType(short_name='HIT', name='Hit', description='An event indicating a match or detection by a rule, signature, or indicator.', svg_icon='', nf_icon='nf-mdi-white_balance_sunny', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.PASSIVE_DNS: EventType(short_name='PASSIVE_DNS', name='Passive DNS', description='An event recording historical DNS resolution data observed passively.', svg_icon='', nf_icon='nf-mdi-white_balance_sunny', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.GENERIC: EventType(short_name='GENERIC', name='Generic', description='An event that does not fit into any of the predefined categories.', svg_icon='', nf_icon='nf-mdi-white_balance_sunny', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>])
- OBSERVABLE = CommonEntitySuperType(short_name='OBSERVABLE', name='Observable', types=[<EntityTypes.IPV4: ObservableType(short_name='IPV4', name='IPv4', description='An IPv4 address, a 32-bit numeric address used for identifying devices on a network.', svg_icon='', nf_icon='nf-mdi-ethernet', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={'address_block': '', 'subnet': '', 'routable': '', 'ASN': ''}, type_hints=None)>, <EntityTypes.IPV6: ObservableType(short_name='IPV6', name='IPv6', description='An IPv6 address, a 128-bit alphanumeric address for identifying devices on a network.', svg_icon='', nf_icon='nf-mdi-ethernet', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={'address_block': '', 'subnet': '', 'routable': '', 'ASN': ''}, type_hints=None)>, <EntityTypes.MAC: ObservableType(short_name='MAC', name='MAC address', description='A unique hardware identifier assigned to a network interface card (NIC).', svg_icon='', nf_icon='nf-mdi-ethernet', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={'manufacturer': ''}, type_hints=None)>, <EntityTypes.DOMAIN: ObservableType(short_name='DOMAIN', name='Domain name', description='A human-readable address used to identify resources on the internet.', svg_icon='', nf_icon='nf-mdi-web', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={'root_domain': '', 'registration_date': ''}, type_hints=None)>, <EntityTypes.DOMAIN_REGISTRAR: ObservableType(short_name='DOMAIN_REGISTRAR', name='Domain registrar', description='The organization or entity responsible for registering domain names.', svg_icon='', nf_icon='nf-mdi-web', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={'name': '', 'organization': '', 'street': '', 'city': '', 'state': '', 'postal_code': '', 'country': '', 'phone': '', 'fax': '', 'email': ''}, type_hints=None)>, <EntityTypes.DOMAIN_REGISTRANT: ObservableType(short_name='DOMAIN_REGISTRANT', name='Domain registrant', description='The individual or organization that owns or controls a domain name.', svg_icon='', nf_icon='nf-mdi-web', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={'name': '', 'organization': '', 'street': '', 'city': '', 'state': '', 'postal_code': '', 'country': '', 'phone': '', 'fax': '', 'email': ''}, type_hints=None)>, <EntityTypes.HOSTNAME: ObservableType(short_name='HOSTNAME', name='Hostname', description='A label assigned to a device on a network, used to identify it in various forms.', svg_icon='', nf_icon='nf-mdi-web', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={}, type_hints=None)>, <EntityTypes.EMAIL: ObservableType(short_name='EMAIL', name='Email address', description='An address used to send and receive electronic mail.', svg_icon='', nf_icon='nf-mdi-email_outline', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={}, type_hints=None)>, <EntityTypes.PHONE: ObservableType(short_name='PHONE', name='Phone number', description='A numeric identifier used to reach a telephone endpoint.', svg_icon='', nf_icon='nf-fa-phone', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={'prefix': '', 'country_code': '', 'country_name': ''}, type_hints=None)>, <EntityTypes.SOCIAL_ACCOUNT: ObservableType(short_name='SOCIAL_ACCOUNT', name='Social account identifier', description='A unique identifier for a user account on a social media platform.', svg_icon='', nf_icon='nf-mdi-account_card_details', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={'platform': ''}, type_hints=None)>, <EntityTypes.URL: ObservableType(short_name='URL', name='URL', description='A Uniform Resource Locator, specifying the address of a resource on the internet.', svg_icon='', nf_icon='nf-mdi-web', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={}, type_hints=None)>, <EntityTypes.URI: ObservableType(short_name='URI', name='URI', description='A Uniform Resource Identifier, a string used to identify a resource.', svg_icon='', nf_icon='nf-mdi-web', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={}, type_hints=None)>, <EntityTypes.MD5: ObservableType(short_name='MD5', name='MD5', description='A 128-bit hash value, commonly used to verify file integrity.', svg_icon='', nf_icon='nf-fa-hashtag', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={}, type_hints=None)>, <EntityTypes.COMMUNITY_ID: ObservableType(short_name='COMMUNITY_ID', name='Community id', description='A hash value used to uniquely identify network flows across tools.', svg_icon='', nf_icon='nf-fa-hashtag', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={}, type_hints=None)>, <EntityTypes.SHA1: ObservableType(short_name='SHA1', name='SHA1', description='A 160-bit hash value, used for data integrity and file identification.', svg_icon='', nf_icon='nf-fa-hashtag', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={}, type_hints=None)>, <EntityTypes.SHA256: ObservableType(short_name='SHA256', name='SHA256', description='A 256-bit hash value, widely used for file and data integrity verification.', svg_icon='', nf_icon='nf-fa-hashtag', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={}, type_hints=None)>, <EntityTypes.PEHASH: ObservableType(short_name='PEHASH', name='PE hash', description='A hash value calculated from the structure of a Portable Executable (PE) file.', svg_icon='', nf_icon='nf-fa-hashtag', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={}, type_hints=None)>, <EntityTypes.IMPHASH: ObservableType(short_name='IMPHASH', name='Import hash', description='A hash of the import table of a PE file, used to identify similar binaries.', svg_icon='', nf_icon='nf-fa-hashtag', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={}, type_hints=None)>, <EntityTypes.DEXOFUZZY: ObservableType(short_name='DEXOFUZZY', name='Dexofuzzy hash', description='A fuzzy hash value used to compare Android DEX files for similarity.', svg_icon='', nf_icon='nf-fa-hashtag', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={}, type_hints=None)>, <EntityTypes.CIDR: ObservableType(short_name='CIDR', name='CIDR', description='A Classless Inter-Domain Routing block, representing a range of IP addresses.', svg_icon='', nf_icon='nf-mdi-ethernet', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={}, type_hints=None)>, <EntityTypes.PATH: ObservableType(short_name='PATH', name='File path', description='A string specifying the location of a file or directory in a filesystem.', svg_icon='', nf_icon='nf-mdi-file_tree', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={}, type_hints=None)>, <EntityTypes.MUTEX: ObservableType(short_name='MUTEX', name='Mutex', description='A mutual exclusion object used for process synchronization.', svg_icon='', nf_icon='nf-mdi-pencil_lock', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={}, type_hints=None)>, <EntityTypes.CVE: ObservableType(short_name='CVE', name='CVE', description='A Common Vulnerabilities and Exposures identifier for publicly known security flaws.', svg_icon='', nf_icon='nf-cod-debug_console', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={}, type_hints=None)>, <EntityTypes.OS_QUERY: ObservableType(short_name='OS_QUERY', name='Os query', description='A query or result from an operating system instrumentation framework.', svg_icon='', nf_icon='nf-cod-inspect', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={}, type_hints=None)>, <EntityTypes.SSL_CERT_F: ObservableType(short_name='SSL_CERT_F', name='SSL certificate fingerprint', description='A hash value uniquely identifying an SSL/TLS certificate.', svg_icon='', nf_icon='nf-mdi-certificate', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={'subject': '', 'md5': '', 'sha1': '', 'sha256': '', 'issuer': '', 'organization': '', 'not_before': '', 'not_after': ''}, type_hints=None)>, <EntityTypes.DNS_RECORD: ObservableType(short_name='DNS_RECORD', name='DNS record', description='A record containing information about a domain name in the DNS system.', svg_icon='', nf_icon='nf-mdi-web', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={'resolver': ''}, type_hints=None)>, <EntityTypes.ASN: ObservableType(short_name='ASN', name='Autonomous system number', description='A unique number assigned to a group of IP networks operated by one or more network operators.', svg_icon='', nf_icon='nf-mdi-web', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={'organization': ''}, type_hints=None)>, <EntityTypes.PROCESS: ObservableType(short_name='PROCESS', name='Process name', description='The name of a running process on a computer system.', svg_icon='', nf_icon='nf-cod-debug_console', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={'executable': '', 'path': ''}, type_hints=None)>, <EntityTypes.SERVICE: ObservableType(short_name='SERVICE', name='Running service', description='A network or system service that is currently active or listening.', svg_icon='', nf_icon='nf-mdi-web', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={'ip_address': '', 'technology': '', 'port': ''}, type_hints=None)>, <EntityTypes.NAMESPACE: ObservableType(short_name='NAMESPACE', name='Namespace', description='A container that holds a set of identifiers, such as classes or functions, to avoid naming conflicts.', svg_icon='', nf_icon='nf-md-code_tags', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={'fully_qualified_name': ''}, type_hints=None)>, <EntityTypes.LOCATION: ObservableType(short_name='LOCATION', name='Location', description='A physical or geographical place, specified by coordinates or address.', svg_icon='', nf_icon='nf-fa-globe', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes={'latitude': '', 'longitude': '', 'altitude': '', 'country': '', 'state': '', 'city': '', 'address': ''}, type_hints=None)>, <EntityTypes.GENERIC: ObservableType(short_name='GENERIC', name='Generic', description='A general or unspecified observable type that does not fit other categories.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>])
- THREAT = CommonEntitySuperType(short_name='THREAT', name='Threat', types=[<EntityTypes.ADWARE: ThreatType(short_name='ADWARE', name='Adware', description='Software that automatically displays or downloads advertising material, often unwanted.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.APT: ThreatType(short_name='APT', name='APT', description='Advanced Persistent Threat; a prolonged and targeted cyberattack by a well-resourced adversary.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.BACKDOOR: ThreatType(short_name='BACKDOOR', name='Backdoor', description='Malware that allows unauthorized remote access to a compromised system.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.BOTNET: ThreatType(short_name='BOTNET', name='Botnet', description='A network of compromised computers controlled by an attacker to perform coordinated tasks.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.BROWSER_HIJACKER: ThreatType(short_name='BROWSER_HIJACKER', name='Browser Hijacker', description='Malware that alters browser settings, redirects traffic, or injects unwanted ads.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.CRYPTOJACKING: ThreatType(short_name='CRYPTOJACKING', name='Cryptojacking', description='Unauthorized use of a device to mine cryptocurrency.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.DROPPER: ThreatType(short_name='DROPPER', name='Dropper', description='A type of malware designed to deliver and install other malicious software.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.EXPLOIT_KIT: ThreatType(short_name='EXPLOIT_KIT', name='Exploit Kit', description='A toolkit used to exploit vulnerabilities in software to deliver malware.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.FF_BOTNET: ThreatType(short_name='FF_BOTNET', name='Fast Flux Botnet', description='A botnet that rapidly changes DNS records to hide malicious activities.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.INFO_STEALER: ThreatType(short_name='INFO_STEALER', name='Information Stealer', description='Malware designed to steal sensitive information such as credentials or financial data.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.LOADER: ThreatType(short_name='LOADER', name='Loader', description='Malware that loads and executes other malicious payloads on a system.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.MALVERTISING: ThreatType(short_name='MALVERTISING', name='Malvertising', description='The use of online advertising to spread malware.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.MOBILE_TROJAN: ThreatType(short_name='MOBILE_TROJAN', name='Mobile Trojan', description='A trojan specifically targeting mobile devices to steal data or perform malicious actions.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.POS_MALWARE: ThreatType(short_name='POS_MALWARE', name='Point-of-sale Malware', description='Malware targeting point-of-sale systems to steal payment card data.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.RANSOMWARE: ThreatType(short_name='RANSOMWARE', name='Ransomware', description='Malware that encrypts data and demands payment for decryption.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.PHISHING: ThreatType(short_name='PHISHING', name='Phishing', description='A technique to trick users into revealing sensitive information, often via fake emails or websites.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.STALKERWARE: ThreatType(short_name='STALKERWARE', name='Stalkerware', description='Software used to secretly monitor and track user activity, often for surveillance.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.WATCHWARE: ThreatType(short_name='WATCHWARE', name='Watchware', description='Malware designed to monitor user activity, similar to spyware or stalkerware.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.MALWARE: ThreatType(short_name='MALWARE', name='Malware', description='A general term for any software intentionally designed to cause damage or unauthorized actions.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.RAT: ThreatType(short_name='RAT', name='Remote Access Trojan (RAT)', description='Malware that provides remote control over an infected system.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.ROOTKIT: ThreatType(short_name='ROOTKIT', name='Rootkit', description='Malware designed to hide its presence and provide privileged access to a system.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.SCAREWARE: ThreatType(short_name='SCAREWARE', name='Scareware', description='Malware that tricks users into buying unnecessary or harmful software by scaring them.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.SINKHOLE: ThreatType(short_name='SINKHOLE', name='Sinkhole', description='A technique or system used to redirect malicious traffic for analysis or mitigation.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.SPAM: ThreatType(short_name='SPAM', name='Spam', description='Unsolicited or bulk messages, often used to deliver malware or phishing attempts.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.DIALER: ThreatType(short_name='DIALER', name='Dialer', description='Malware that makes unauthorized calls or connections, often to premium-rate numbers.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.CVE: ThreatType(short_name='CVE', name='CVE', description='A Common Vulnerabilities and Exposures identifier for a known security flaw.', svg_icon='', nf_icon='nf nf-cod-debug_console', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.GENERIC: ThreatType(short_name='GENERIC', name='Generic', description='A general or unspecified threat type that does not fit other categories.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.SPYWARE: ThreatType(short_name='SPYWARE', name='Spyware', description='Malware that secretly gathers user information without consent.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.TROJAN: ThreatType(short_name='TROJAN', name='Trojan', description='Malware disguised as legitimate software to trick users into installing it.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>, <EntityTypes.WORM: ThreatType(short_name='WORM', name='Worm', description='Self-replicating malware that spreads across networks without user intervention.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)>])
- classmethod by_short_name(short_name: str) CommonEntitySuperType[source]
- pydantic model colander_data_converter.base.models.CommonEntityType[source]
Bases:
BaseModel,ABCCommonEntityType is an abstract base class for defining shared attributes across various entity data types.
This class provides fields for identifiers, names, descriptions, and other metadata.
Show JSON schema
{ "title": "CommonEntityType", "description": "CommonEntityType is an abstract base class for defining shared attributes across various entity data types.\n\nThis class provides fields for identifiers, names, descriptions, and other metadata.", "type": "object", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ] }
- Fields:
- field default_attributes: Dict[str, str] | None = None
Optional dictionary of default attributes.
- field description: str | None = None
An optional description of the model type.
- field name: str [Required]
The name of the model type.
- Constraints:
max_length = 512
- field nf_icon: str | None = None
Optional NF icon for the model type.
- field short_name: str [Required]
A short name for the model type.
- Constraints:
max_length = 32
- field stix2_pattern: str | None = None
Optional STIX 2.0 pattern.
- field stix2_pattern_type: str | None = None
Optional STIX 2.0 pattern type.
- field stix2_type: str | None = None
Optional STIX 2.0 type for the model type.
- field stix2_value_field_name: str | None = None
Optional STIX 2.0 value field name.
- field svg_icon: str | None = None
Optional SVG icon for the model type.
- field type_hints: Dict[Any, Any] | None = None
Optional dictionary of type hints.
- pydantic model colander_data_converter.base.models.DataFragment[source]
Bases:
EntityDataFragment represents a fragment of data, such as a code snippet, text, or other content.
This class extends the Entity base class and includes additional fields specific to data fragments, such as their type, content, and the artifact from which they were extracted.
Example
>>> data_fragment_type = DataFragmentTypes.enum.CODE.value >>> artifact = Artifact( ... name='example_artifact', ... type=ArtifactTypes.enum.DOCUMENT.value ... ) >>> data_fragment = DataFragment( ... name='Sample Code', ... type=data_fragment_type, ... content='print("Hello, World!")', ... extracted_from=artifact ... ) >>> print(data_fragment.content) print("Hello, World!")
Show JSON schema
{ "title": "DataFragment", "description": "DataFragment represents a fragment of data, such as a code snippet, text, or other content.\n\nThis class extends the Entity base class and includes additional fields specific to data fragments,\nsuch as their type, content, and the artifact from which they were extracted.\n\nExample:\n >>> data_fragment_type = DataFragmentTypes.enum.CODE.value\n >>> artifact = Artifact(\n ... name='example_artifact',\n ... type=ArtifactTypes.enum.DOCUMENT.value\n ... )\n >>> data_fragment = DataFragment(\n ... name='Sample Code',\n ... type=data_fragment_type,\n ... content='print(\"Hello, World!\")',\n ... extracted_from=artifact\n ... )\n >>> print(data_fragment.content)\n print(\"Hello, World!\")", "type": "object", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/DataFragmentType" }, "content": { "title": "Content", "type": "string" }, "extracted_from": { "anyOf": [ { "$ref": "#/$defs/Artifact" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Extracted From" }, "colander_internal_type": { "const": "datafragment", "default": "datafragment", "title": "Colander Internal Type", "type": "string" } }, "$defs": { "Actor": { "description": "Actor represents an individual or group involved in an event, activity, or system.\n\nThis class extends the Entity base class and includes additional fields specific to actors.\n\nExample:\n >>> actor_type = ActorTypes.enum.INDIVIDUAL.value\n >>> actor = Actor(\n ... name='John Doe',\n ... type=actor_type\n ... )\n >>> print(actor.name)\n John Doe", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/ActorType" }, "colander_internal_type": { "const": "actor", "default": "actor", "title": "Colander Internal Type", "type": "string" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" } }, "required": [ "name", "type" ], "title": "Actor", "type": "object" }, "ActorType": { "description": "ActorType represents metadata for actors in Colander. Check :ref:`the list of supported types <actor_types>`.\n\nExample:\n >>> actor_type = ActorTypes.enum.INDIVIDUAL.value\n >>> print(actor_type.name)\n Individual", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "ActorType", "type": "object" }, "Artifact": { "description": "Artifact represents a file or data object, such as a document, image, or binary, within the system.\n\nThis class extends the Entity base class and includes additional fields specific to artifacts,\nsuch as type, attributes, extraction source, file metadata, and cryptographic hashes.\n\nExample:\n >>> artifact_type = ArtifactTypes.enum.DOCUMENT.value\n >>> device_type = DeviceTypes.enum.LAPTOP.value\n >>> device = Device(name='Analyst Laptop', type=device_type)\n >>> artifact = Artifact(\n ... name='malware_sample.pdf',\n ... type=artifact_type,\n ... extracted_from=device,\n ... extension='pdf',\n ... original_name='invoice.pdf',\n ... mime_type='application/pdf',\n ... md5='d41d8cd98f00b204e9800998ecf8427e',\n ... sha1='da39a3ee5e6b4b0d3255bfef95601890afd80709',\n ... sha256='e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',\n ... size_in_bytes=12345\n ... )\n >>> print(artifact.name)\n malware_sample.pdf", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/ArtifactType" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "extracted_from": { "anyOf": [ { "$ref": "#/$defs/Device" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Extracted From" }, "extension": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Extension" }, "original_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Original Name" }, "mime_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Mime Type" }, "detached_signature": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Detached Signature" }, "md5": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Md5" }, "sha1": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Sha1" }, "sha256": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Sha256" }, "size_in_bytes": { "default": 0, "minimum": 0, "title": "Size In Bytes", "type": "integer" }, "colander_internal_type": { "const": "artifact", "default": "artifact", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type" ], "title": "Artifact", "type": "object" }, "ArtifactType": { "description": "ArtifactType represents metadata for artifacts in Colander. Check :ref:`the list of supported\ntypes <artifact_types>`.\n\nExample:\n >>> artifact_type = ArtifactTypes.enum.REPORT.value\n >>> print(artifact_type.short_name)\n REPORT", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "additionalProperties": true, "title": "Type Hints", "type": "object" } }, "required": [ "short_name", "name" ], "title": "ArtifactType", "type": "object" }, "Case": { "description": "Case represents a collection or grouping of related entities, artifacts, or events.\n\nThis class is used to organize and manage related data, such as incidents, investigations, or projects.\n\nExample:\n >>> case = Case(\n ... name='Investigation Alpha',\n ... description='Investigation of suspicious activity'\n ... )\n >>> print(case.name)\n Investigation Alpha", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "description": { "minLength": 1, "title": "Description", "type": "string" }, "documentation": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Documentation" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "parent_case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Parent Case" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "colander_internal_type": { "const": "case", "default": "case", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "description" ], "title": "Case", "type": "object" }, "DataFragmentType": { "description": "DataFragmentType represents metadata for data fragments in Colander. Check :ref:`the list of supported\ntypes <data_fragment_types>`.\n\nExample:\n >>> data_fragment_type = DataFragmentTypes.enum.CODE.value\n >>> print(data_fragment_type.name)\n Piece of code", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "DataFragmentType", "type": "object" }, "Device": { "description": "Device represents a physical or virtual device in Colander.\n\nThis class extends the Entity base class and includes additional fields specific to devices,\nsuch as their type, attributes, and the actor operating the device.\n\nExample:\n >>> device_type = DeviceTypes.enum.MOBILE.value\n >>> actor = Actor(name='John Doe', type=ActorTypes.enum.INDIVIDUAL.value)\n >>> device = Device(\n ... name=\"John's Phone\",\n ... type=device_type,\n ... operated_by=actor,\n ... attributes={'os': 'Android', 'version': '12'}\n ... )\n >>> print(device.name)\n John's Phone", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/DeviceType" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "operated_by": { "anyOf": [ { "$ref": "#/$defs/Actor" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Operated By" }, "colander_internal_type": { "const": "device", "default": "device", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type" ], "title": "Device", "type": "object" }, "DeviceType": { "description": "DeviceType represents metadata for devices in Colander. Check :ref:`the list of supported types <device_types>`.\n\nExample:\n >>> device_type = DeviceTypes.enum.MOBILE.value\n >>> print(device_type.name)\n Mobile device", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "DeviceType", "type": "object" }, "ObjectReference": { "format": "uuid4", "type": "string" }, "TlpPapLevel": { "description": "TlpPapLevel represents the Traffic Light Protocol (TLP) and Permissible Actions Protocol (PAP) levels.\n\nThese levels are used to classify the sensitivity of information and its sharing restrictions.\n\nExample:\n >>> level = TlpPapLevel.RED\n >>> print(level)\n RED", "enum": [ "RED", "AMBER", "GREEN", "WHITE" ], "title": "TlpPapLevel", "type": "string" } }, "required": [ "name", "type", "content" ] }
- Config:
str_strip_whitespace: bool = True
arbitrary_types_allowed: bool = True
- Fields:
- field colander_internal_type: Literal['datafragment'] = 'datafragment'
Internal type discriminator for (de)serialization.
- field content: str [Required]
The content of the data fragment.
- field extracted_from: Artifact | None | ObjectReference = None
Reference to the artifact from which this data fragment was extracted.
- field type: DataFragmentType [Required]
The type definition for the data fragment.
- pydantic model colander_data_converter.base.models.DataFragmentType[source]
Bases:
CommonEntityTypeDataFragmentType represents metadata for data fragments in Colander. Check the list of supported types.
Example
>>> data_fragment_type = DataFragmentTypes.enum.CODE.value >>> print(data_fragment_type.name) Piece of code
Show JSON schema
{ "title": "DataFragmentType", "description": "DataFragmentType represents metadata for data fragments in Colander. Check :ref:`the list of supported\ntypes <data_fragment_types>`.\n\nExample:\n >>> data_fragment_type = DataFragmentTypes.enum.CODE.value\n >>> print(data_fragment_type.name)\n Piece of code", "type": "object", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ] }
- Fields:
- Validators:
is_supported_type»short_name
- class colander_data_converter.base.models.DataFragmentTypes[source]
Bases:
objectDataFragmentTypes provides access to all supported data fragment types.
This class loads data fragment type definitions from the data fragment types JSON file and exposes them as an enum. It also provides a method to look up a data fragment type by its short name.
Example
>>> data_fragment_type = DataFragmentTypes.enum.CODE.value >>> print(data_fragment_type.name) Piece of code >>> default_type = DataFragmentTypes.by_short_name("nonexistent") >>> print(default_type.name) Generic
- classmethod by_short_name(short_name: str) DataFragmentType[source]
- default = DataFragmentType(short_name='GENERIC', name='Generic', description='A general or unspecified data fragment type that does not fit other categories.', svg_icon='', nf_icon='nf-oct-file_binary', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)
- enum
alias of
EntityTypes
- pydantic model colander_data_converter.base.models.DetectionRule[source]
Bases:
EntityDetectionRule represents a rule used for detecting specific content or logic related to observables or object references.
This class is designed to encapsulate detection rules that can be applied across various systems or platforms to identify patterns or conditions defined by the user.
Example
>>> drt = DetectionRuleTypes.enum.YARA.value >>> rule = DetectionRule( ... name='Detect Malicious IP', ... type=drt, ... content='rule malicious_ip { condition: true }', ... ) >>> print(rule.name) Detect Malicious IP
Show JSON schema
{ "title": "DetectionRule", "description": "DetectionRule represents a rule used for detecting specific content or logic related to observables or\nobject references.\n\nThis class is designed to encapsulate detection rules that can be applied across various systems or platforms to\nidentify patterns or conditions defined by the user.\n\nExample:\n >>> drt = DetectionRuleTypes.enum.YARA.value\n >>> rule = DetectionRule(\n ... name='Detect Malicious IP',\n ... type=drt,\n ... content='rule malicious_ip { condition: true }',\n ... )\n >>> print(rule.name)\n Detect Malicious IP", "type": "object", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/DetectionRuleType" }, "content": { "title": "Content", "type": "string" }, "targeted_observables": { "anyOf": [ { "items": { "$ref": "#/$defs/Observable" }, "type": "array" }, { "items": { "$ref": "#/$defs/ObjectReference" }, "type": "array" }, { "type": "null" } ], "default": null, "title": "Targeted Observables" }, "colander_internal_type": { "const": "detectionrule", "default": "detectionrule", "title": "Colander Internal Type", "type": "string" } }, "$defs": { "Actor": { "description": "Actor represents an individual or group involved in an event, activity, or system.\n\nThis class extends the Entity base class and includes additional fields specific to actors.\n\nExample:\n >>> actor_type = ActorTypes.enum.INDIVIDUAL.value\n >>> actor = Actor(\n ... name='John Doe',\n ... type=actor_type\n ... )\n >>> print(actor.name)\n John Doe", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/ActorType" }, "colander_internal_type": { "const": "actor", "default": "actor", "title": "Colander Internal Type", "type": "string" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" } }, "required": [ "name", "type" ], "title": "Actor", "type": "object" }, "ActorType": { "description": "ActorType represents metadata for actors in Colander. Check :ref:`the list of supported types <actor_types>`.\n\nExample:\n >>> actor_type = ActorTypes.enum.INDIVIDUAL.value\n >>> print(actor_type.name)\n Individual", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "ActorType", "type": "object" }, "Artifact": { "description": "Artifact represents a file or data object, such as a document, image, or binary, within the system.\n\nThis class extends the Entity base class and includes additional fields specific to artifacts,\nsuch as type, attributes, extraction source, file metadata, and cryptographic hashes.\n\nExample:\n >>> artifact_type = ArtifactTypes.enum.DOCUMENT.value\n >>> device_type = DeviceTypes.enum.LAPTOP.value\n >>> device = Device(name='Analyst Laptop', type=device_type)\n >>> artifact = Artifact(\n ... name='malware_sample.pdf',\n ... type=artifact_type,\n ... extracted_from=device,\n ... extension='pdf',\n ... original_name='invoice.pdf',\n ... mime_type='application/pdf',\n ... md5='d41d8cd98f00b204e9800998ecf8427e',\n ... sha1='da39a3ee5e6b4b0d3255bfef95601890afd80709',\n ... sha256='e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',\n ... size_in_bytes=12345\n ... )\n >>> print(artifact.name)\n malware_sample.pdf", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/ArtifactType" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "extracted_from": { "anyOf": [ { "$ref": "#/$defs/Device" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Extracted From" }, "extension": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Extension" }, "original_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Original Name" }, "mime_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Mime Type" }, "detached_signature": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Detached Signature" }, "md5": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Md5" }, "sha1": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Sha1" }, "sha256": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Sha256" }, "size_in_bytes": { "default": 0, "minimum": 0, "title": "Size In Bytes", "type": "integer" }, "colander_internal_type": { "const": "artifact", "default": "artifact", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type" ], "title": "Artifact", "type": "object" }, "ArtifactType": { "description": "ArtifactType represents metadata for artifacts in Colander. Check :ref:`the list of supported\ntypes <artifact_types>`.\n\nExample:\n >>> artifact_type = ArtifactTypes.enum.REPORT.value\n >>> print(artifact_type.short_name)\n REPORT", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "additionalProperties": true, "title": "Type Hints", "type": "object" } }, "required": [ "short_name", "name" ], "title": "ArtifactType", "type": "object" }, "Case": { "description": "Case represents a collection or grouping of related entities, artifacts, or events.\n\nThis class is used to organize and manage related data, such as incidents, investigations, or projects.\n\nExample:\n >>> case = Case(\n ... name='Investigation Alpha',\n ... description='Investigation of suspicious activity'\n ... )\n >>> print(case.name)\n Investigation Alpha", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "description": { "minLength": 1, "title": "Description", "type": "string" }, "documentation": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Documentation" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "parent_case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Parent Case" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "colander_internal_type": { "const": "case", "default": "case", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "description" ], "title": "Case", "type": "object" }, "DetectionRuleType": { "description": "DetectionRuleType represents metadata for detection rules in Colander. Check :ref:`the list of supported\ntypes <detection_rule_types>`.\n\nExample:\n >>> detection_rule_type = DetectionRuleTypes.enum.YARA.value\n >>> print(detection_rule_type.name)\n Yara rule", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "DetectionRuleType", "type": "object" }, "Device": { "description": "Device represents a physical or virtual device in Colander.\n\nThis class extends the Entity base class and includes additional fields specific to devices,\nsuch as their type, attributes, and the actor operating the device.\n\nExample:\n >>> device_type = DeviceTypes.enum.MOBILE.value\n >>> actor = Actor(name='John Doe', type=ActorTypes.enum.INDIVIDUAL.value)\n >>> device = Device(\n ... name=\"John's Phone\",\n ... type=device_type,\n ... operated_by=actor,\n ... attributes={'os': 'Android', 'version': '12'}\n ... )\n >>> print(device.name)\n John's Phone", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/DeviceType" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "operated_by": { "anyOf": [ { "$ref": "#/$defs/Actor" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Operated By" }, "colander_internal_type": { "const": "device", "default": "device", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type" ], "title": "Device", "type": "object" }, "DeviceType": { "description": "DeviceType represents metadata for devices in Colander. Check :ref:`the list of supported types <device_types>`.\n\nExample:\n >>> device_type = DeviceTypes.enum.MOBILE.value\n >>> print(device_type.name)\n Mobile device", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "DeviceType", "type": "object" }, "ObjectReference": { "format": "uuid4", "type": "string" }, "Observable": { "description": "Observable represents an entity that can be observed or detected within the system.\n\nThis class extends the Entity base class and includes additional fields specific to observables,\nsuch as classification, raw value, extraction source, associated threat, and operator.\n\nExample:\n >>> ot = ObservableTypes.enum.IPV4.value\n >>> obs = Observable(\n ... name='1.2.3.4',\n ... type=ot,\n ... classification='malicious',\n ... raw_value='1.2.3.4',\n ... attributes={'asn': 'AS123'}\n ... )\n >>> print(obs.name)\n 1.2.3.4", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/ObservableType" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "classification": { "anyOf": [ { "maxLength": 512, "type": "string" }, { "type": "null" } ], "default": null, "title": "Classification" }, "raw_value": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Raw Value" }, "extracted_from": { "anyOf": [ { "$ref": "#/$defs/Artifact" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Extracted From" }, "associated_threat": { "anyOf": [ { "$ref": "#/$defs/Threat" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Associated Threat" }, "operated_by": { "anyOf": [ { "$ref": "#/$defs/Actor" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Operated By" }, "colander_internal_type": { "const": "observable", "default": "observable", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type" ], "title": "Observable", "type": "object" }, "ObservableType": { "description": "ObservableType represents metadata for observables in Colander. Check :ref:`the list of supported\ntypes <observable_types>`.\n\nExample:\n >>> observable_type = ObservableType(\n ... id=uuid4(),\n ... short_name='IPV4',\n ... name='IPv4',\n ... description='An IPv4 address type'\n ... )\n >>> print(observable_type.name)\n IPv4", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "ObservableType", "type": "object" }, "Threat": { "description": "Threat represents a threat entity, such as a malware family, campaign, or adversary.\n\nThis class extends the Entity base class and includes a type field for threat classification.\n\nExample:\n >>> threat_type = ThreatTypes.enum.TROJAN.value\n >>> threat = Threat(\n ... name='Emotet',\n ... type=threat_type\n ... )\n >>> print(threat.name)\n Emotet", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/ThreatType" }, "colander_internal_type": { "const": "threat", "default": "threat", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type" ], "title": "Threat", "type": "object" }, "ThreatType": { "description": "ThreatType represents metadata for threats in Colander. Check :ref:`the list of supported types <threat_types>`.\n\nExample:\n >>> threat_type = ThreatTypes.enum.TROJAN.value\n >>> print(threat_type.name)\n Trojan", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "ThreatType", "type": "object" }, "TlpPapLevel": { "description": "TlpPapLevel represents the Traffic Light Protocol (TLP) and Permissible Actions Protocol (PAP) levels.\n\nThese levels are used to classify the sensitivity of information and its sharing restrictions.\n\nExample:\n >>> level = TlpPapLevel.RED\n >>> print(level)\n RED", "enum": [ "RED", "AMBER", "GREEN", "WHITE" ], "title": "TlpPapLevel", "type": "string" } }, "required": [ "name", "type", "content" ] }
- Config:
str_strip_whitespace: bool = True
arbitrary_types_allowed: bool = True
- Fields:
- field colander_internal_type: Literal['detectionrule'] = 'detectionrule'
Internal type discriminator for (de)serialization.
- field content: str [Required]
The content or logic of the detection rule.
- field targeted_observables: List[Observable] | None | List[ObjectReference] = None
List of observables or references targeted by this detection rule.
- field type: DetectionRuleType [Required]
The type definition for the detection rule.
- pydantic model colander_data_converter.base.models.DetectionRuleType[source]
Bases:
CommonEntityTypeDetectionRuleType represents metadata for detection rules in Colander. Check the list of supported types.
Example
>>> detection_rule_type = DetectionRuleTypes.enum.YARA.value >>> print(detection_rule_type.name) Yara rule
Show JSON schema
{ "title": "DetectionRuleType", "description": "DetectionRuleType represents metadata for detection rules in Colander. Check :ref:`the list of supported\ntypes <detection_rule_types>`.\n\nExample:\n >>> detection_rule_type = DetectionRuleTypes.enum.YARA.value\n >>> print(detection_rule_type.name)\n Yara rule", "type": "object", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ] }
- Fields:
- Validators:
is_supported_type»short_name
- class colander_data_converter.base.models.DetectionRuleTypes[source]
Bases:
objectDetectionRuleTypes provides access to all supported detection rule types.
This class loads detection rule type definitions from the detection rule types JSON file and exposes them as an enum. It also provides a method to look up a detection rule type by its short name.
Example
>>> detection_rule_type = DetectionRuleTypes.enum.YARA.value >>> print(detection_rule_type.name) Yara rule >>> default_type = DetectionRuleTypes.by_short_name("nonexistent") >>> print(default_type.name) Generic
- classmethod by_short_name(short_name: str) DetectionRuleType[source]
- default = DetectionRuleType(short_name='GENERIC', name='Generic', description='A general or unspecified detection rule type that does not fit other categories.', svg_icon='', nf_icon='nf-cod-server_process', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)
- enum
alias of
EntityTypes
- pydantic model colander_data_converter.base.models.Device[source]
Bases:
EntityDevice represents a physical or virtual device in Colander.
This class extends the Entity base class and includes additional fields specific to devices, such as their type, attributes, and the actor operating the device.
Example
>>> device_type = DeviceTypes.enum.MOBILE.value >>> actor = Actor(name='John Doe', type=ActorTypes.enum.INDIVIDUAL.value) >>> device = Device( ... name="John's Phone", ... type=device_type, ... operated_by=actor, ... attributes={'os': 'Android', 'version': '12'} ... ) >>> print(device.name) John's Phone
Show JSON schema
{ "title": "Device", "description": "Device represents a physical or virtual device in Colander.\n\nThis class extends the Entity base class and includes additional fields specific to devices,\nsuch as their type, attributes, and the actor operating the device.\n\nExample:\n >>> device_type = DeviceTypes.enum.MOBILE.value\n >>> actor = Actor(name='John Doe', type=ActorTypes.enum.INDIVIDUAL.value)\n >>> device = Device(\n ... name=\"John's Phone\",\n ... type=device_type,\n ... operated_by=actor,\n ... attributes={'os': 'Android', 'version': '12'}\n ... )\n >>> print(device.name)\n John's Phone", "type": "object", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/DeviceType" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "operated_by": { "anyOf": [ { "$ref": "#/$defs/Actor" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Operated By" }, "colander_internal_type": { "const": "device", "default": "device", "title": "Colander Internal Type", "type": "string" } }, "$defs": { "Actor": { "description": "Actor represents an individual or group involved in an event, activity, or system.\n\nThis class extends the Entity base class and includes additional fields specific to actors.\n\nExample:\n >>> actor_type = ActorTypes.enum.INDIVIDUAL.value\n >>> actor = Actor(\n ... name='John Doe',\n ... type=actor_type\n ... )\n >>> print(actor.name)\n John Doe", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/ActorType" }, "colander_internal_type": { "const": "actor", "default": "actor", "title": "Colander Internal Type", "type": "string" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" } }, "required": [ "name", "type" ], "title": "Actor", "type": "object" }, "ActorType": { "description": "ActorType represents metadata for actors in Colander. Check :ref:`the list of supported types <actor_types>`.\n\nExample:\n >>> actor_type = ActorTypes.enum.INDIVIDUAL.value\n >>> print(actor_type.name)\n Individual", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "ActorType", "type": "object" }, "Case": { "description": "Case represents a collection or grouping of related entities, artifacts, or events.\n\nThis class is used to organize and manage related data, such as incidents, investigations, or projects.\n\nExample:\n >>> case = Case(\n ... name='Investigation Alpha',\n ... description='Investigation of suspicious activity'\n ... )\n >>> print(case.name)\n Investigation Alpha", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "description": { "minLength": 1, "title": "Description", "type": "string" }, "documentation": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Documentation" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "parent_case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Parent Case" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "colander_internal_type": { "const": "case", "default": "case", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "description" ], "title": "Case", "type": "object" }, "DeviceType": { "description": "DeviceType represents metadata for devices in Colander. Check :ref:`the list of supported types <device_types>`.\n\nExample:\n >>> device_type = DeviceTypes.enum.MOBILE.value\n >>> print(device_type.name)\n Mobile device", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "DeviceType", "type": "object" }, "ObjectReference": { "format": "uuid4", "type": "string" }, "TlpPapLevel": { "description": "TlpPapLevel represents the Traffic Light Protocol (TLP) and Permissible Actions Protocol (PAP) levels.\n\nThese levels are used to classify the sensitivity of information and its sharing restrictions.\n\nExample:\n >>> level = TlpPapLevel.RED\n >>> print(level)\n RED", "enum": [ "RED", "AMBER", "GREEN", "WHITE" ], "title": "TlpPapLevel", "type": "string" } }, "required": [ "name", "type" ] }
- Config:
str_strip_whitespace: bool = True
arbitrary_types_allowed: bool = True
- Fields:
- field attributes: Dict[str, str] | None = None
Optional dictionary of additional attributes for the device.
- field colander_internal_type: Literal['device'] = 'device'
Internal type discriminator for (de)serialization.
- field operated_by: Actor | None | ObjectReference = None
Reference to the actor operating the device.
- field type: DeviceType [Required]
The type definition for the device.
- pydantic model colander_data_converter.base.models.DeviceType[source]
Bases:
CommonEntityTypeDeviceType represents metadata for devices in Colander. Check the list of supported types.
Example
>>> device_type = DeviceTypes.enum.MOBILE.value >>> print(device_type.name) Mobile device
Show JSON schema
{ "title": "DeviceType", "description": "DeviceType represents metadata for devices in Colander. Check :ref:`the list of supported types <device_types>`.\n\nExample:\n >>> device_type = DeviceTypes.enum.MOBILE.value\n >>> print(device_type.name)\n Mobile device", "type": "object", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ] }
- Fields:
- Validators:
is_supported_type»short_name
- class colander_data_converter.base.models.DeviceTypes[source]
Bases:
objectDeviceTypes provides access to all supported device types.
This class loads device type definitions from the device types JSON file and exposes them as an enum. It also provides a method to look up a device type by its short name.
Example
>>> device_type = DeviceTypes.enum.LAPTOP.value >>> print(device_type.name) Laptop >>> default_type = DeviceTypes.by_short_name("nonexistent") >>> print(default_type.name) Generic
- classmethod by_short_name(short_name: str) DeviceType[source]
- default = DeviceType(short_name='GENERIC', name='Generic', description='A general or unspecified device type that does not fit other categories.', svg_icon='', nf_icon='nf-fa-desktop', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)
- enum
alias of
EntityTypes
- pydantic model colander_data_converter.base.models.Entity[source]
Bases:
ColanderType,ABCEntity is an abstract base class representing a core object in the model, such as an actor, artifact, device, etc.
This class provides common fields for all entities, including identifiers, timestamps, descriptive fields, and references to cases.
Show JSON schema
{ "title": "Entity", "description": "Entity is an abstract base class representing a core object in the model, such as an actor, artifact, device, etc.\n\nThis class provides common fields for all entities, including identifiers, timestamps, descriptive fields,\nand references to cases.", "type": "object", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" } }, "$defs": { "Case": { "description": "Case represents a collection or grouping of related entities, artifacts, or events.\n\nThis class is used to organize and manage related data, such as incidents, investigations, or projects.\n\nExample:\n >>> case = Case(\n ... name='Investigation Alpha',\n ... description='Investigation of suspicious activity'\n ... )\n >>> print(case.name)\n Investigation Alpha", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "description": { "minLength": 1, "title": "Description", "type": "string" }, "documentation": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Documentation" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "parent_case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Parent Case" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "colander_internal_type": { "const": "case", "default": "case", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "description" ], "title": "Case", "type": "object" }, "ObjectReference": { "format": "uuid4", "type": "string" }, "TlpPapLevel": { "description": "TlpPapLevel represents the Traffic Light Protocol (TLP) and Permissible Actions Protocol (PAP) levels.\n\nThese levels are used to classify the sensitivity of information and its sharing restrictions.\n\nExample:\n >>> level = TlpPapLevel.RED\n >>> print(level)\n RED", "enum": [ "RED", "AMBER", "GREEN", "WHITE" ], "title": "TlpPapLevel", "type": "string" } }, "required": [ "name" ] }
- Config:
str_strip_whitespace: bool = True
arbitrary_types_allowed: bool = True
- Fields:
- field created_at: datetime | None = None
The timestamp when the entity was created.
- field description: str | None = None
A description of the entity.
- field id: Annotated[UUID, UuidVersion(uuid_version=4)] [Optional]
The unique identifier for the entity.
- Constraints:
uuid_version = 4
- field name: str [Required]
The name of the entity.
- Constraints:
min_length = 1
max_length = 512
- field pap: TlpPapLevel = TlpPapLevel.WHITE
The PAP (Permissible Actions Protocol) level for the entity.
- field tlp: TlpPapLevel = TlpPapLevel.WHITE
The TLP (Traffic Light Protocol) level for the entity.
- field updated_at: datetime | None = None
The timestamp when the entity was last updated.
- pydantic model colander_data_converter.base.models.EntityRelation[source]
Bases:
ColanderTypeEntityRelation represents a relationship between two entities in the model.
This class is used to define and manage relationships between objects, such as associations between observables, devices, or actors.
Example
>>> obs1 = Observable( ... id=uuid4(), ... name='1.1.1.1', ... type=ObservableTypes.enum.IPV4.value ... ) >>> obs2 = Observable( ... id=uuid4(), ... name='8.8.8.8', ... type=ObservableTypes.enum.IPV4.value ... ) >>> relation = EntityRelation( ... id=uuid4(), ... name='connection', ... obj_from=obs1, ... obj_to=obs2 ... ) >>> print(relation.name) connection
Show JSON schema
{ "title": "EntityRelation", "description": "EntityRelation represents a relationship between two entities in the model.\n\nThis class is used to define and manage relationships between objects, such as associations\nbetween observables, devices, or actors.\n\nExample:\n >>> obs1 = Observable(\n ... id=uuid4(),\n ... name='1.1.1.1',\n ... type=ObservableTypes.enum.IPV4.value\n ... )\n >>> obs2 = Observable(\n ... id=uuid4(),\n ... name='8.8.8.8',\n ... type=ObservableTypes.enum.IPV4.value\n ... )\n >>> relation = EntityRelation(\n ... id=uuid4(),\n ... name='connection',\n ... obj_from=obs1,\n ... obj_to=obs2\n ... )\n >>> print(relation.name)\n connection", "type": "object", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "obj_from": { "anyOf": [ { "discriminator": { "mapping": { "actor": "#/$defs/Actor", "artifact": "#/$defs/Artifact", "datafragment": "#/$defs/DataFragment", "detectionrule": "#/$defs/DetectionRule", "device": "#/$defs/Device", "event": "#/$defs/Event", "observable": "#/$defs/Observable", "threat": "#/$defs/Threat" }, "propertyName": "colander_internal_type" }, "oneOf": [ { "$ref": "#/$defs/Actor" }, { "$ref": "#/$defs/Artifact" }, { "$ref": "#/$defs/DataFragment" }, { "$ref": "#/$defs/Observable" }, { "$ref": "#/$defs/DetectionRule" }, { "$ref": "#/$defs/Device" }, { "$ref": "#/$defs/Event" }, { "$ref": "#/$defs/Threat" } ] }, { "$ref": "#/$defs/ObjectReference" } ], "title": "Obj From" }, "obj_to": { "anyOf": [ { "discriminator": { "mapping": { "actor": "#/$defs/Actor", "artifact": "#/$defs/Artifact", "datafragment": "#/$defs/DataFragment", "detectionrule": "#/$defs/DetectionRule", "device": "#/$defs/Device", "event": "#/$defs/Event", "observable": "#/$defs/Observable", "threat": "#/$defs/Threat" }, "propertyName": "colander_internal_type" }, "oneOf": [ { "$ref": "#/$defs/Actor" }, { "$ref": "#/$defs/Artifact" }, { "$ref": "#/$defs/DataFragment" }, { "$ref": "#/$defs/Observable" }, { "$ref": "#/$defs/DetectionRule" }, { "$ref": "#/$defs/Device" }, { "$ref": "#/$defs/Event" }, { "$ref": "#/$defs/Threat" } ] }, { "$ref": "#/$defs/ObjectReference" } ], "title": "Obj To" } }, "$defs": { "Actor": { "description": "Actor represents an individual or group involved in an event, activity, or system.\n\nThis class extends the Entity base class and includes additional fields specific to actors.\n\nExample:\n >>> actor_type = ActorTypes.enum.INDIVIDUAL.value\n >>> actor = Actor(\n ... name='John Doe',\n ... type=actor_type\n ... )\n >>> print(actor.name)\n John Doe", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/ActorType" }, "colander_internal_type": { "const": "actor", "default": "actor", "title": "Colander Internal Type", "type": "string" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" } }, "required": [ "name", "type" ], "title": "Actor", "type": "object" }, "ActorType": { "description": "ActorType represents metadata for actors in Colander. Check :ref:`the list of supported types <actor_types>`.\n\nExample:\n >>> actor_type = ActorTypes.enum.INDIVIDUAL.value\n >>> print(actor_type.name)\n Individual", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "ActorType", "type": "object" }, "Artifact": { "description": "Artifact represents a file or data object, such as a document, image, or binary, within the system.\n\nThis class extends the Entity base class and includes additional fields specific to artifacts,\nsuch as type, attributes, extraction source, file metadata, and cryptographic hashes.\n\nExample:\n >>> artifact_type = ArtifactTypes.enum.DOCUMENT.value\n >>> device_type = DeviceTypes.enum.LAPTOP.value\n >>> device = Device(name='Analyst Laptop', type=device_type)\n >>> artifact = Artifact(\n ... name='malware_sample.pdf',\n ... type=artifact_type,\n ... extracted_from=device,\n ... extension='pdf',\n ... original_name='invoice.pdf',\n ... mime_type='application/pdf',\n ... md5='d41d8cd98f00b204e9800998ecf8427e',\n ... sha1='da39a3ee5e6b4b0d3255bfef95601890afd80709',\n ... sha256='e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',\n ... size_in_bytes=12345\n ... )\n >>> print(artifact.name)\n malware_sample.pdf", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/ArtifactType" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "extracted_from": { "anyOf": [ { "$ref": "#/$defs/Device" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Extracted From" }, "extension": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Extension" }, "original_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Original Name" }, "mime_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Mime Type" }, "detached_signature": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Detached Signature" }, "md5": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Md5" }, "sha1": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Sha1" }, "sha256": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Sha256" }, "size_in_bytes": { "default": 0, "minimum": 0, "title": "Size In Bytes", "type": "integer" }, "colander_internal_type": { "const": "artifact", "default": "artifact", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type" ], "title": "Artifact", "type": "object" }, "ArtifactType": { "description": "ArtifactType represents metadata for artifacts in Colander. Check :ref:`the list of supported\ntypes <artifact_types>`.\n\nExample:\n >>> artifact_type = ArtifactTypes.enum.REPORT.value\n >>> print(artifact_type.short_name)\n REPORT", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "additionalProperties": true, "title": "Type Hints", "type": "object" } }, "required": [ "short_name", "name" ], "title": "ArtifactType", "type": "object" }, "Case": { "description": "Case represents a collection or grouping of related entities, artifacts, or events.\n\nThis class is used to organize and manage related data, such as incidents, investigations, or projects.\n\nExample:\n >>> case = Case(\n ... name='Investigation Alpha',\n ... description='Investigation of suspicious activity'\n ... )\n >>> print(case.name)\n Investigation Alpha", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "description": { "minLength": 1, "title": "Description", "type": "string" }, "documentation": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Documentation" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "parent_case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Parent Case" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "colander_internal_type": { "const": "case", "default": "case", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "description" ], "title": "Case", "type": "object" }, "DataFragment": { "description": "DataFragment represents a fragment of data, such as a code snippet, text, or other content.\n\nThis class extends the Entity base class and includes additional fields specific to data fragments,\nsuch as their type, content, and the artifact from which they were extracted.\n\nExample:\n >>> data_fragment_type = DataFragmentTypes.enum.CODE.value\n >>> artifact = Artifact(\n ... name='example_artifact',\n ... type=ArtifactTypes.enum.DOCUMENT.value\n ... )\n >>> data_fragment = DataFragment(\n ... name='Sample Code',\n ... type=data_fragment_type,\n ... content='print(\"Hello, World!\")',\n ... extracted_from=artifact\n ... )\n >>> print(data_fragment.content)\n print(\"Hello, World!\")", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/DataFragmentType" }, "content": { "title": "Content", "type": "string" }, "extracted_from": { "anyOf": [ { "$ref": "#/$defs/Artifact" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Extracted From" }, "colander_internal_type": { "const": "datafragment", "default": "datafragment", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type", "content" ], "title": "DataFragment", "type": "object" }, "DataFragmentType": { "description": "DataFragmentType represents metadata for data fragments in Colander. Check :ref:`the list of supported\ntypes <data_fragment_types>`.\n\nExample:\n >>> data_fragment_type = DataFragmentTypes.enum.CODE.value\n >>> print(data_fragment_type.name)\n Piece of code", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "DataFragmentType", "type": "object" }, "DetectionRule": { "description": "DetectionRule represents a rule used for detecting specific content or logic related to observables or\nobject references.\n\nThis class is designed to encapsulate detection rules that can be applied across various systems or platforms to\nidentify patterns or conditions defined by the user.\n\nExample:\n >>> drt = DetectionRuleTypes.enum.YARA.value\n >>> rule = DetectionRule(\n ... name='Detect Malicious IP',\n ... type=drt,\n ... content='rule malicious_ip { condition: true }',\n ... )\n >>> print(rule.name)\n Detect Malicious IP", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/DetectionRuleType" }, "content": { "title": "Content", "type": "string" }, "targeted_observables": { "anyOf": [ { "items": { "$ref": "#/$defs/Observable" }, "type": "array" }, { "items": { "$ref": "#/$defs/ObjectReference" }, "type": "array" }, { "type": "null" } ], "default": null, "title": "Targeted Observables" }, "colander_internal_type": { "const": "detectionrule", "default": "detectionrule", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type", "content" ], "title": "DetectionRule", "type": "object" }, "DetectionRuleType": { "description": "DetectionRuleType represents metadata for detection rules in Colander. Check :ref:`the list of supported\ntypes <detection_rule_types>`.\n\nExample:\n >>> detection_rule_type = DetectionRuleTypes.enum.YARA.value\n >>> print(detection_rule_type.name)\n Yara rule", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "DetectionRuleType", "type": "object" }, "Device": { "description": "Device represents a physical or virtual device in Colander.\n\nThis class extends the Entity base class and includes additional fields specific to devices,\nsuch as their type, attributes, and the actor operating the device.\n\nExample:\n >>> device_type = DeviceTypes.enum.MOBILE.value\n >>> actor = Actor(name='John Doe', type=ActorTypes.enum.INDIVIDUAL.value)\n >>> device = Device(\n ... name=\"John's Phone\",\n ... type=device_type,\n ... operated_by=actor,\n ... attributes={'os': 'Android', 'version': '12'}\n ... )\n >>> print(device.name)\n John's Phone", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/DeviceType" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "operated_by": { "anyOf": [ { "$ref": "#/$defs/Actor" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Operated By" }, "colander_internal_type": { "const": "device", "default": "device", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type" ], "title": "Device", "type": "object" }, "DeviceType": { "description": "DeviceType represents metadata for devices in Colander. Check :ref:`the list of supported types <device_types>`.\n\nExample:\n >>> device_type = DeviceTypes.enum.MOBILE.value\n >>> print(device_type.name)\n Mobile device", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "DeviceType", "type": "object" }, "Event": { "description": "Event represents an occurrence or activity observed within a system, such as a detection, alert, or log entry.\n\nThis class extends the Entity base class and includes additional fields specific to events,\nsuch as timestamps, count, involved observables, and references to related entities.\n\nExample:\n >>> et = EventTypes.enum.HIT.value\n >>> obs_type = ObservableTypes.enum.IPV4.value\n >>> obs = Observable(\n ... id=uuid4(),\n ... name='8.8.8.8',\n ... type=obs_type\n ... )\n >>> event = Event(\n ... name='Suspicious Connection',\n ... type=et,\n ... first_seen=datetime(2024, 6, 1, 12, 0, tzinfo=UTC),\n ... last_seen=datetime(2024, 6, 1, 12, 5, tzinfo=UTC),\n ... involved_observables=[obs]\n ... )\n >>> print(event.name)\n Suspicious Connection", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/EventType" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "first_seen": { "default": "2025-07-15T16:35:28.883476Z", "format": "date-time", "title": "First Seen", "type": "string" }, "last_seen": { "default": "2025-07-15T16:35:28.883479Z", "format": "date-time", "title": "Last Seen", "type": "string" }, "count": { "default": 1, "exclusiveMinimum": 0, "title": "Count", "type": "integer" }, "extracted_from": { "anyOf": [ { "$ref": "#/$defs/Artifact" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Extracted From" }, "observed_on": { "anyOf": [ { "$ref": "#/$defs/Device" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Observed On" }, "detected_by": { "anyOf": [ { "$ref": "#/$defs/DetectionRule" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Detected By" }, "involved_observables": { "anyOf": [ { "items": { "$ref": "#/$defs/Observable" }, "type": "array" }, { "items": { "$ref": "#/$defs/ObjectReference" }, "type": "array" }, { "type": "null" } ], "default": null, "title": "Involved Observables" }, "colander_internal_type": { "const": "event", "default": "event", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type" ], "title": "Event", "type": "object" }, "EventType": { "description": "EventType represents metadata for events in Colander. Check :ref:`the list of supported types <event_types>`.\n\nExample:\n >>> event_type = EventTypes.enum.HIT.value\n >>> print(event_type.name)\n Hit", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "EventType", "type": "object" }, "ObjectReference": { "format": "uuid4", "type": "string" }, "Observable": { "description": "Observable represents an entity that can be observed or detected within the system.\n\nThis class extends the Entity base class and includes additional fields specific to observables,\nsuch as classification, raw value, extraction source, associated threat, and operator.\n\nExample:\n >>> ot = ObservableTypes.enum.IPV4.value\n >>> obs = Observable(\n ... name='1.2.3.4',\n ... type=ot,\n ... classification='malicious',\n ... raw_value='1.2.3.4',\n ... attributes={'asn': 'AS123'}\n ... )\n >>> print(obs.name)\n 1.2.3.4", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/ObservableType" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "classification": { "anyOf": [ { "maxLength": 512, "type": "string" }, { "type": "null" } ], "default": null, "title": "Classification" }, "raw_value": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Raw Value" }, "extracted_from": { "anyOf": [ { "$ref": "#/$defs/Artifact" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Extracted From" }, "associated_threat": { "anyOf": [ { "$ref": "#/$defs/Threat" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Associated Threat" }, "operated_by": { "anyOf": [ { "$ref": "#/$defs/Actor" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Operated By" }, "colander_internal_type": { "const": "observable", "default": "observable", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type" ], "title": "Observable", "type": "object" }, "ObservableType": { "description": "ObservableType represents metadata for observables in Colander. Check :ref:`the list of supported\ntypes <observable_types>`.\n\nExample:\n >>> observable_type = ObservableType(\n ... id=uuid4(),\n ... short_name='IPV4',\n ... name='IPv4',\n ... description='An IPv4 address type'\n ... )\n >>> print(observable_type.name)\n IPv4", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "ObservableType", "type": "object" }, "Threat": { "description": "Threat represents a threat entity, such as a malware family, campaign, or adversary.\n\nThis class extends the Entity base class and includes a type field for threat classification.\n\nExample:\n >>> threat_type = ThreatTypes.enum.TROJAN.value\n >>> threat = Threat(\n ... name='Emotet',\n ... type=threat_type\n ... )\n >>> print(threat.name)\n Emotet", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/ThreatType" }, "colander_internal_type": { "const": "threat", "default": "threat", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type" ], "title": "Threat", "type": "object" }, "ThreatType": { "description": "ThreatType represents metadata for threats in Colander. Check :ref:`the list of supported types <threat_types>`.\n\nExample:\n >>> threat_type = ThreatTypes.enum.TROJAN.value\n >>> print(threat_type.name)\n Trojan", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "ThreatType", "type": "object" }, "TlpPapLevel": { "description": "TlpPapLevel represents the Traffic Light Protocol (TLP) and Permissible Actions Protocol (PAP) levels.\n\nThese levels are used to classify the sensitivity of information and its sharing restrictions.\n\nExample:\n >>> level = TlpPapLevel.RED\n >>> print(level)\n RED", "enum": [ "RED", "AMBER", "GREEN", "WHITE" ], "title": "TlpPapLevel", "type": "string" } }, "required": [ "name", "obj_from", "obj_to" ] }
- Config:
str_strip_whitespace: bool = True
arbitrary_types_allowed: bool = True
- Fields:
- field attributes: Dict[str, str] | None = None
Optional dictionary of additional attributes for the relation.
- field created_at: datetime | None = None
The timestamp when the entity relation was created.
- field id: Annotated[UUID, UuidVersion(uuid_version=4)] [Optional]
The unique identifier for the entity relation.
- Constraints:
uuid_version = 4
- field name: str [Required]
The name of the entity relation.
- Constraints:
min_length = 1
max_length = 512
- field obj_from: Annotated[Actor | Artifact | DataFragment | Observable | DetectionRule | Device | Event | Threat, FieldInfo(annotation=NoneType, required=True, discriminator='colander_internal_type')] | ObjectReference [Required]
The source entity or reference in the relation.
- field obj_to: Annotated[Actor | Artifact | DataFragment | Observable | DetectionRule | Device | Event | Threat, FieldInfo(annotation=NoneType, required=True, discriminator='colander_internal_type')] | ObjectReference [Required]
The target entity or reference in the relation.
- field updated_at: datetime | None = None
The timestamp when the entity relation was last updated.
- pydantic model colander_data_converter.base.models.Event[source]
Bases:
EntityEvent represents an occurrence or activity observed within a system, such as a detection, alert, or log entry.
This class extends the Entity base class and includes additional fields specific to events, such as timestamps, count, involved observables, and references to related entities.
Example
>>> et = EventTypes.enum.HIT.value >>> obs_type = ObservableTypes.enum.IPV4.value >>> obs = Observable( ... id=uuid4(), ... name='8.8.8.8', ... type=obs_type ... ) >>> event = Event( ... name='Suspicious Connection', ... type=et, ... first_seen=datetime(2024, 6, 1, 12, 0, tzinfo=UTC), ... last_seen=datetime(2024, 6, 1, 12, 5, tzinfo=UTC), ... involved_observables=[obs] ... ) >>> print(event.name) Suspicious Connection
Show JSON schema
{ "title": "Event", "description": "Event represents an occurrence or activity observed within a system, such as a detection, alert, or log entry.\n\nThis class extends the Entity base class and includes additional fields specific to events,\nsuch as timestamps, count, involved observables, and references to related entities.\n\nExample:\n >>> et = EventTypes.enum.HIT.value\n >>> obs_type = ObservableTypes.enum.IPV4.value\n >>> obs = Observable(\n ... id=uuid4(),\n ... name='8.8.8.8',\n ... type=obs_type\n ... )\n >>> event = Event(\n ... name='Suspicious Connection',\n ... type=et,\n ... first_seen=datetime(2024, 6, 1, 12, 0, tzinfo=UTC),\n ... last_seen=datetime(2024, 6, 1, 12, 5, tzinfo=UTC),\n ... involved_observables=[obs]\n ... )\n >>> print(event.name)\n Suspicious Connection", "type": "object", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/EventType" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "first_seen": { "default": "2025-07-15T16:35:28.883476Z", "format": "date-time", "title": "First Seen", "type": "string" }, "last_seen": { "default": "2025-07-15T16:35:28.883479Z", "format": "date-time", "title": "Last Seen", "type": "string" }, "count": { "default": 1, "exclusiveMinimum": 0, "title": "Count", "type": "integer" }, "extracted_from": { "anyOf": [ { "$ref": "#/$defs/Artifact" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Extracted From" }, "observed_on": { "anyOf": [ { "$ref": "#/$defs/Device" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Observed On" }, "detected_by": { "anyOf": [ { "$ref": "#/$defs/DetectionRule" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Detected By" }, "involved_observables": { "anyOf": [ { "items": { "$ref": "#/$defs/Observable" }, "type": "array" }, { "items": { "$ref": "#/$defs/ObjectReference" }, "type": "array" }, { "type": "null" } ], "default": null, "title": "Involved Observables" }, "colander_internal_type": { "const": "event", "default": "event", "title": "Colander Internal Type", "type": "string" } }, "$defs": { "Actor": { "description": "Actor represents an individual or group involved in an event, activity, or system.\n\nThis class extends the Entity base class and includes additional fields specific to actors.\n\nExample:\n >>> actor_type = ActorTypes.enum.INDIVIDUAL.value\n >>> actor = Actor(\n ... name='John Doe',\n ... type=actor_type\n ... )\n >>> print(actor.name)\n John Doe", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/ActorType" }, "colander_internal_type": { "const": "actor", "default": "actor", "title": "Colander Internal Type", "type": "string" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" } }, "required": [ "name", "type" ], "title": "Actor", "type": "object" }, "ActorType": { "description": "ActorType represents metadata for actors in Colander. Check :ref:`the list of supported types <actor_types>`.\n\nExample:\n >>> actor_type = ActorTypes.enum.INDIVIDUAL.value\n >>> print(actor_type.name)\n Individual", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "ActorType", "type": "object" }, "Artifact": { "description": "Artifact represents a file or data object, such as a document, image, or binary, within the system.\n\nThis class extends the Entity base class and includes additional fields specific to artifacts,\nsuch as type, attributes, extraction source, file metadata, and cryptographic hashes.\n\nExample:\n >>> artifact_type = ArtifactTypes.enum.DOCUMENT.value\n >>> device_type = DeviceTypes.enum.LAPTOP.value\n >>> device = Device(name='Analyst Laptop', type=device_type)\n >>> artifact = Artifact(\n ... name='malware_sample.pdf',\n ... type=artifact_type,\n ... extracted_from=device,\n ... extension='pdf',\n ... original_name='invoice.pdf',\n ... mime_type='application/pdf',\n ... md5='d41d8cd98f00b204e9800998ecf8427e',\n ... sha1='da39a3ee5e6b4b0d3255bfef95601890afd80709',\n ... sha256='e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',\n ... size_in_bytes=12345\n ... )\n >>> print(artifact.name)\n malware_sample.pdf", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/ArtifactType" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "extracted_from": { "anyOf": [ { "$ref": "#/$defs/Device" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Extracted From" }, "extension": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Extension" }, "original_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Original Name" }, "mime_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Mime Type" }, "detached_signature": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Detached Signature" }, "md5": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Md5" }, "sha1": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Sha1" }, "sha256": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Sha256" }, "size_in_bytes": { "default": 0, "minimum": 0, "title": "Size In Bytes", "type": "integer" }, "colander_internal_type": { "const": "artifact", "default": "artifact", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type" ], "title": "Artifact", "type": "object" }, "ArtifactType": { "description": "ArtifactType represents metadata for artifacts in Colander. Check :ref:`the list of supported\ntypes <artifact_types>`.\n\nExample:\n >>> artifact_type = ArtifactTypes.enum.REPORT.value\n >>> print(artifact_type.short_name)\n REPORT", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "additionalProperties": true, "title": "Type Hints", "type": "object" } }, "required": [ "short_name", "name" ], "title": "ArtifactType", "type": "object" }, "Case": { "description": "Case represents a collection or grouping of related entities, artifacts, or events.\n\nThis class is used to organize and manage related data, such as incidents, investigations, or projects.\n\nExample:\n >>> case = Case(\n ... name='Investigation Alpha',\n ... description='Investigation of suspicious activity'\n ... )\n >>> print(case.name)\n Investigation Alpha", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "description": { "minLength": 1, "title": "Description", "type": "string" }, "documentation": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Documentation" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "parent_case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Parent Case" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "colander_internal_type": { "const": "case", "default": "case", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "description" ], "title": "Case", "type": "object" }, "DetectionRule": { "description": "DetectionRule represents a rule used for detecting specific content or logic related to observables or\nobject references.\n\nThis class is designed to encapsulate detection rules that can be applied across various systems or platforms to\nidentify patterns or conditions defined by the user.\n\nExample:\n >>> drt = DetectionRuleTypes.enum.YARA.value\n >>> rule = DetectionRule(\n ... name='Detect Malicious IP',\n ... type=drt,\n ... content='rule malicious_ip { condition: true }',\n ... )\n >>> print(rule.name)\n Detect Malicious IP", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/DetectionRuleType" }, "content": { "title": "Content", "type": "string" }, "targeted_observables": { "anyOf": [ { "items": { "$ref": "#/$defs/Observable" }, "type": "array" }, { "items": { "$ref": "#/$defs/ObjectReference" }, "type": "array" }, { "type": "null" } ], "default": null, "title": "Targeted Observables" }, "colander_internal_type": { "const": "detectionrule", "default": "detectionrule", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type", "content" ], "title": "DetectionRule", "type": "object" }, "DetectionRuleType": { "description": "DetectionRuleType represents metadata for detection rules in Colander. Check :ref:`the list of supported\ntypes <detection_rule_types>`.\n\nExample:\n >>> detection_rule_type = DetectionRuleTypes.enum.YARA.value\n >>> print(detection_rule_type.name)\n Yara rule", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "DetectionRuleType", "type": "object" }, "Device": { "description": "Device represents a physical or virtual device in Colander.\n\nThis class extends the Entity base class and includes additional fields specific to devices,\nsuch as their type, attributes, and the actor operating the device.\n\nExample:\n >>> device_type = DeviceTypes.enum.MOBILE.value\n >>> actor = Actor(name='John Doe', type=ActorTypes.enum.INDIVIDUAL.value)\n >>> device = Device(\n ... name=\"John's Phone\",\n ... type=device_type,\n ... operated_by=actor,\n ... attributes={'os': 'Android', 'version': '12'}\n ... )\n >>> print(device.name)\n John's Phone", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/DeviceType" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "operated_by": { "anyOf": [ { "$ref": "#/$defs/Actor" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Operated By" }, "colander_internal_type": { "const": "device", "default": "device", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type" ], "title": "Device", "type": "object" }, "DeviceType": { "description": "DeviceType represents metadata for devices in Colander. Check :ref:`the list of supported types <device_types>`.\n\nExample:\n >>> device_type = DeviceTypes.enum.MOBILE.value\n >>> print(device_type.name)\n Mobile device", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "DeviceType", "type": "object" }, "EventType": { "description": "EventType represents metadata for events in Colander. Check :ref:`the list of supported types <event_types>`.\n\nExample:\n >>> event_type = EventTypes.enum.HIT.value\n >>> print(event_type.name)\n Hit", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "EventType", "type": "object" }, "ObjectReference": { "format": "uuid4", "type": "string" }, "Observable": { "description": "Observable represents an entity that can be observed or detected within the system.\n\nThis class extends the Entity base class and includes additional fields specific to observables,\nsuch as classification, raw value, extraction source, associated threat, and operator.\n\nExample:\n >>> ot = ObservableTypes.enum.IPV4.value\n >>> obs = Observable(\n ... name='1.2.3.4',\n ... type=ot,\n ... classification='malicious',\n ... raw_value='1.2.3.4',\n ... attributes={'asn': 'AS123'}\n ... )\n >>> print(obs.name)\n 1.2.3.4", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/ObservableType" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "classification": { "anyOf": [ { "maxLength": 512, "type": "string" }, { "type": "null" } ], "default": null, "title": "Classification" }, "raw_value": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Raw Value" }, "extracted_from": { "anyOf": [ { "$ref": "#/$defs/Artifact" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Extracted From" }, "associated_threat": { "anyOf": [ { "$ref": "#/$defs/Threat" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Associated Threat" }, "operated_by": { "anyOf": [ { "$ref": "#/$defs/Actor" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Operated By" }, "colander_internal_type": { "const": "observable", "default": "observable", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type" ], "title": "Observable", "type": "object" }, "ObservableType": { "description": "ObservableType represents metadata for observables in Colander. Check :ref:`the list of supported\ntypes <observable_types>`.\n\nExample:\n >>> observable_type = ObservableType(\n ... id=uuid4(),\n ... short_name='IPV4',\n ... name='IPv4',\n ... description='An IPv4 address type'\n ... )\n >>> print(observable_type.name)\n IPv4", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "ObservableType", "type": "object" }, "Threat": { "description": "Threat represents a threat entity, such as a malware family, campaign, or adversary.\n\nThis class extends the Entity base class and includes a type field for threat classification.\n\nExample:\n >>> threat_type = ThreatTypes.enum.TROJAN.value\n >>> threat = Threat(\n ... name='Emotet',\n ... type=threat_type\n ... )\n >>> print(threat.name)\n Emotet", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/ThreatType" }, "colander_internal_type": { "const": "threat", "default": "threat", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type" ], "title": "Threat", "type": "object" }, "ThreatType": { "description": "ThreatType represents metadata for threats in Colander. Check :ref:`the list of supported types <threat_types>`.\n\nExample:\n >>> threat_type = ThreatTypes.enum.TROJAN.value\n >>> print(threat_type.name)\n Trojan", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "ThreatType", "type": "object" }, "TlpPapLevel": { "description": "TlpPapLevel represents the Traffic Light Protocol (TLP) and Permissible Actions Protocol (PAP) levels.\n\nThese levels are used to classify the sensitivity of information and its sharing restrictions.\n\nExample:\n >>> level = TlpPapLevel.RED\n >>> print(level)\n RED", "enum": [ "RED", "AMBER", "GREEN", "WHITE" ], "title": "TlpPapLevel", "type": "string" } }, "required": [ "name", "type" ] }
- Config:
str_strip_whitespace: bool = True
arbitrary_types_allowed: bool = True
- Fields:
- Validators:
_check_dates»all fields
- field attributes: Dict[str, str] | None = None
Optional dictionary of additional attributes for the event.
- Validated by:
_check_dates
- field colander_internal_type: Literal['event'] = 'event'
Internal type discriminator for (de)serialization.
- Validated by:
_check_dates
- field count: Annotated[int, Gt(gt=0)] = 1
The number of times this event was observed.
- Constraints:
gt = 0
- Validated by:
_check_dates
- field detected_by: DetectionRule | None | ObjectReference = None
Reference to the detection rule that detected this event.
- Validated by:
_check_dates
- field extracted_from: Artifact | None | ObjectReference = None
Reference to the artifact from which this event was extracted.
- Validated by:
_check_dates
- field first_seen: datetime = datetime.datetime(2025, 7, 15, 16, 35, 28, 883476, tzinfo=datetime.timezone.utc)
The timestamp when the event was first observed.
- Validated by:
_check_dates
- field involved_observables: List[Observable] | None | List[ObjectReference] = None
List of observables or references involved in this event.
- Validated by:
_check_dates
- field last_seen: datetime = datetime.datetime(2025, 7, 15, 16, 35, 28, 883479, tzinfo=datetime.timezone.utc)
The timestamp when the event was last observed.
- Validated by:
_check_dates
- pydantic model colander_data_converter.base.models.EventType[source]
Bases:
CommonEntityTypeEventType represents metadata for events in Colander. Check the list of supported types.
Example
>>> event_type = EventTypes.enum.HIT.value >>> print(event_type.name) Hit
Show JSON schema
{ "title": "EventType", "description": "EventType represents metadata for events in Colander. Check :ref:`the list of supported types <event_types>`.\n\nExample:\n >>> event_type = EventTypes.enum.HIT.value\n >>> print(event_type.name)\n Hit", "type": "object", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ] }
- Fields:
- Validators:
is_supported_type»short_name
- class colander_data_converter.base.models.EventTypes[source]
Bases:
objectEventTypes provides access to all supported event types.
This class loads event type definitions from the event types JSON file and exposes them as an enum. It also provides a method to look up an event type by its short name.
Example
>>> event_type = EventTypes.enum.HIT.value >>> print(event_type.name) Hit >>> default_type = EventTypes.by_short_name("nonexistent") >>> print(default_type.name) Generic
- default = EventType(short_name='GENERIC', name='Generic', description='An event that does not fit into any of the predefined categories.', svg_icon='', nf_icon='nf-mdi-white_balance_sunny', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)
- enum
alias of
EntityTypes
- pydantic model colander_data_converter.base.models.Observable[source]
Bases:
EntityObservable represents an entity that can be observed or detected within the system.
This class extends the Entity base class and includes additional fields specific to observables, such as classification, raw value, extraction source, associated threat, and operator.
Example
>>> ot = ObservableTypes.enum.IPV4.value >>> obs = Observable( ... name='1.2.3.4', ... type=ot, ... classification='malicious', ... raw_value='1.2.3.4', ... attributes={'asn': 'AS123'} ... ) >>> print(obs.name) 1.2.3.4
Show JSON schema
{ "title": "Observable", "description": "Observable represents an entity that can be observed or detected within the system.\n\nThis class extends the Entity base class and includes additional fields specific to observables,\nsuch as classification, raw value, extraction source, associated threat, and operator.\n\nExample:\n >>> ot = ObservableTypes.enum.IPV4.value\n >>> obs = Observable(\n ... name='1.2.3.4',\n ... type=ot,\n ... classification='malicious',\n ... raw_value='1.2.3.4',\n ... attributes={'asn': 'AS123'}\n ... )\n >>> print(obs.name)\n 1.2.3.4", "type": "object", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/ObservableType" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "classification": { "anyOf": [ { "maxLength": 512, "type": "string" }, { "type": "null" } ], "default": null, "title": "Classification" }, "raw_value": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Raw Value" }, "extracted_from": { "anyOf": [ { "$ref": "#/$defs/Artifact" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Extracted From" }, "associated_threat": { "anyOf": [ { "$ref": "#/$defs/Threat" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Associated Threat" }, "operated_by": { "anyOf": [ { "$ref": "#/$defs/Actor" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Operated By" }, "colander_internal_type": { "const": "observable", "default": "observable", "title": "Colander Internal Type", "type": "string" } }, "$defs": { "Actor": { "description": "Actor represents an individual or group involved in an event, activity, or system.\n\nThis class extends the Entity base class and includes additional fields specific to actors.\n\nExample:\n >>> actor_type = ActorTypes.enum.INDIVIDUAL.value\n >>> actor = Actor(\n ... name='John Doe',\n ... type=actor_type\n ... )\n >>> print(actor.name)\n John Doe", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/ActorType" }, "colander_internal_type": { "const": "actor", "default": "actor", "title": "Colander Internal Type", "type": "string" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" } }, "required": [ "name", "type" ], "title": "Actor", "type": "object" }, "ActorType": { "description": "ActorType represents metadata for actors in Colander. Check :ref:`the list of supported types <actor_types>`.\n\nExample:\n >>> actor_type = ActorTypes.enum.INDIVIDUAL.value\n >>> print(actor_type.name)\n Individual", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "ActorType", "type": "object" }, "Artifact": { "description": "Artifact represents a file or data object, such as a document, image, or binary, within the system.\n\nThis class extends the Entity base class and includes additional fields specific to artifacts,\nsuch as type, attributes, extraction source, file metadata, and cryptographic hashes.\n\nExample:\n >>> artifact_type = ArtifactTypes.enum.DOCUMENT.value\n >>> device_type = DeviceTypes.enum.LAPTOP.value\n >>> device = Device(name='Analyst Laptop', type=device_type)\n >>> artifact = Artifact(\n ... name='malware_sample.pdf',\n ... type=artifact_type,\n ... extracted_from=device,\n ... extension='pdf',\n ... original_name='invoice.pdf',\n ... mime_type='application/pdf',\n ... md5='d41d8cd98f00b204e9800998ecf8427e',\n ... sha1='da39a3ee5e6b4b0d3255bfef95601890afd80709',\n ... sha256='e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',\n ... size_in_bytes=12345\n ... )\n >>> print(artifact.name)\n malware_sample.pdf", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/ArtifactType" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "extracted_from": { "anyOf": [ { "$ref": "#/$defs/Device" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Extracted From" }, "extension": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Extension" }, "original_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Original Name" }, "mime_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Mime Type" }, "detached_signature": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Detached Signature" }, "md5": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Md5" }, "sha1": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Sha1" }, "sha256": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Sha256" }, "size_in_bytes": { "default": 0, "minimum": 0, "title": "Size In Bytes", "type": "integer" }, "colander_internal_type": { "const": "artifact", "default": "artifact", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type" ], "title": "Artifact", "type": "object" }, "ArtifactType": { "description": "ArtifactType represents metadata for artifacts in Colander. Check :ref:`the list of supported\ntypes <artifact_types>`.\n\nExample:\n >>> artifact_type = ArtifactTypes.enum.REPORT.value\n >>> print(artifact_type.short_name)\n REPORT", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "additionalProperties": true, "title": "Type Hints", "type": "object" } }, "required": [ "short_name", "name" ], "title": "ArtifactType", "type": "object" }, "Case": { "description": "Case represents a collection or grouping of related entities, artifacts, or events.\n\nThis class is used to organize and manage related data, such as incidents, investigations, or projects.\n\nExample:\n >>> case = Case(\n ... name='Investigation Alpha',\n ... description='Investigation of suspicious activity'\n ... )\n >>> print(case.name)\n Investigation Alpha", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "description": { "minLength": 1, "title": "Description", "type": "string" }, "documentation": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Documentation" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "parent_case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Parent Case" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "colander_internal_type": { "const": "case", "default": "case", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "description" ], "title": "Case", "type": "object" }, "Device": { "description": "Device represents a physical or virtual device in Colander.\n\nThis class extends the Entity base class and includes additional fields specific to devices,\nsuch as their type, attributes, and the actor operating the device.\n\nExample:\n >>> device_type = DeviceTypes.enum.MOBILE.value\n >>> actor = Actor(name='John Doe', type=ActorTypes.enum.INDIVIDUAL.value)\n >>> device = Device(\n ... name=\"John's Phone\",\n ... type=device_type,\n ... operated_by=actor,\n ... attributes={'os': 'Android', 'version': '12'}\n ... )\n >>> print(device.name)\n John's Phone", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/DeviceType" }, "attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "operated_by": { "anyOf": [ { "$ref": "#/$defs/Actor" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Operated By" }, "colander_internal_type": { "const": "device", "default": "device", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type" ], "title": "Device", "type": "object" }, "DeviceType": { "description": "DeviceType represents metadata for devices in Colander. Check :ref:`the list of supported types <device_types>`.\n\nExample:\n >>> device_type = DeviceTypes.enum.MOBILE.value\n >>> print(device_type.name)\n Mobile device", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "DeviceType", "type": "object" }, "ObjectReference": { "format": "uuid4", "type": "string" }, "ObservableType": { "description": "ObservableType represents metadata for observables in Colander. Check :ref:`the list of supported\ntypes <observable_types>`.\n\nExample:\n >>> observable_type = ObservableType(\n ... id=uuid4(),\n ... short_name='IPV4',\n ... name='IPv4',\n ... description='An IPv4 address type'\n ... )\n >>> print(observable_type.name)\n IPv4", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "ObservableType", "type": "object" }, "Threat": { "description": "Threat represents a threat entity, such as a malware family, campaign, or adversary.\n\nThis class extends the Entity base class and includes a type field for threat classification.\n\nExample:\n >>> threat_type = ThreatTypes.enum.TROJAN.value\n >>> threat = Threat(\n ... name='Emotet',\n ... type=threat_type\n ... )\n >>> print(threat.name)\n Emotet", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/ThreatType" }, "colander_internal_type": { "const": "threat", "default": "threat", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "type" ], "title": "Threat", "type": "object" }, "ThreatType": { "description": "ThreatType represents metadata for threats in Colander. Check :ref:`the list of supported types <threat_types>`.\n\nExample:\n >>> threat_type = ThreatTypes.enum.TROJAN.value\n >>> print(threat_type.name)\n Trojan", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "ThreatType", "type": "object" }, "TlpPapLevel": { "description": "TlpPapLevel represents the Traffic Light Protocol (TLP) and Permissible Actions Protocol (PAP) levels.\n\nThese levels are used to classify the sensitivity of information and its sharing restrictions.\n\nExample:\n >>> level = TlpPapLevel.RED\n >>> print(level)\n RED", "enum": [ "RED", "AMBER", "GREEN", "WHITE" ], "title": "TlpPapLevel", "type": "string" } }, "required": [ "name", "type" ] }
- Config:
str_strip_whitespace: bool = True
arbitrary_types_allowed: bool = True
- Fields:
- field attributes: Dict[str, str] | None = None
Optional dictionary of additional attributes for the observable.
- field classification: str | None = None
Optional classification label for the observable.
- Constraints:
max_length = 512
- field colander_internal_type: Literal['observable'] = 'observable'
Internal type discriminator for (de)serialization.
- field extracted_from: Artifact | None | ObjectReference = None
Reference to the artifact from which this observable was extracted.
- field operated_by: Actor | None | ObjectReference = None
Reference to the actor operating this observable.
- field raw_value: str | None = None
The raw value associated with the observable.
- field type: ObservableType [Required]
The type definition for the observable.
- pydantic model colander_data_converter.base.models.ObservableType[source]
Bases:
CommonEntityTypeObservableType represents metadata for observables in Colander. Check the list of supported types.
Example
>>> observable_type = ObservableType( ... id=uuid4(), ... short_name='IPV4', ... name='IPv4', ... description='An IPv4 address type' ... ) >>> print(observable_type.name) IPv4
Show JSON schema
{ "title": "ObservableType", "description": "ObservableType represents metadata for observables in Colander. Check :ref:`the list of supported\ntypes <observable_types>`.\n\nExample:\n >>> observable_type = ObservableType(\n ... id=uuid4(),\n ... short_name='IPV4',\n ... name='IPv4',\n ... description='An IPv4 address type'\n ... )\n >>> print(observable_type.name)\n IPv4", "type": "object", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ] }
- Fields:
- Validators:
is_supported_type»short_name
- class colander_data_converter.base.models.ObservableTypes[source]
Bases:
objectObservableTypes provides access to all supported observable types.
This class loads observable type definitions from the observable types JSON file and exposes them as an enum. It also provides a method to look up an observable type by its short name.
Example
>>> observable_type = ObservableTypes.enum.IPV4.value >>> print(observable_type.name) IPv4 >>> default_type = ObservableTypes.by_short_name("nonexistent") >>> print(default_type.name) Generic
- classmethod by_short_name(short_name: str) ObservableType[source]
- default = ObservableType(short_name='GENERIC', name='Generic', description='A general or unspecified observable type that does not fit other categories.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)
- enum
alias of
EntityTypes
- class colander_data_converter.base.models.Repository(*args, **kwargs)[source]
Bases:
objectSingleton repository for managing and storing Case, Entity, and EntityRelation objects.
This class provides centralized storage and reference management for all model instances, supporting insertion, lookup, and reference resolution/unlinking.
- entities: Dict[str, Annotated[Actor | Artifact | DataFragment | Observable | DetectionRule | Device | Event | Threat, FieldInfo(annotation=NoneType, required=True, discriminator='colander_internal_type')]]
- relations: Dict[str, EntityRelation]
- pydantic model colander_data_converter.base.models.Threat[source]
Bases:
EntityThreat represents a threat entity, such as a malware family, campaign, or adversary.
This class extends the Entity base class and includes a type field for threat classification.
Example
>>> threat_type = ThreatTypes.enum.TROJAN.value >>> threat = Threat( ... name='Emotet', ... type=threat_type ... ) >>> print(threat.name) Emotet
Show JSON schema
{ "title": "Threat", "description": "Threat represents a threat entity, such as a malware family, campaign, or adversary.\n\nThis class extends the Entity base class and includes a type field for threat classification.\n\nExample:\n >>> threat_type = ThreatTypes.enum.TROJAN.value\n >>> threat = Threat(\n ... name='Emotet',\n ... type=threat_type\n ... )\n >>> print(threat.name)\n Emotet", "type": "object", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Case" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "format": "uri", "minLength": 1, "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "type": { "$ref": "#/$defs/ThreatType" }, "colander_internal_type": { "const": "threat", "default": "threat", "title": "Colander Internal Type", "type": "string" } }, "$defs": { "Case": { "description": "Case represents a collection or grouping of related entities, artifacts, or events.\n\nThis class is used to organize and manage related data, such as incidents, investigations, or projects.\n\nExample:\n >>> case = Case(\n ... name='Investigation Alpha',\n ... description='Investigation of suspicious activity'\n ... )\n >>> print(case.name)\n Investigation Alpha", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Created At" }, "updated_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "default": null, "title": "Updated At" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "description": { "minLength": 1, "title": "Description", "type": "string" }, "documentation": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Documentation" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "parent_case": { "anyOf": [ { "$ref": "#/$defs/Case" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Parent Case" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "colander_internal_type": { "const": "case", "default": "case", "title": "Colander Internal Type", "type": "string" } }, "required": [ "name", "description" ], "title": "Case", "type": "object" }, "ObjectReference": { "format": "uuid4", "type": "string" }, "ThreatType": { "description": "ThreatType represents metadata for threats in Colander. Check :ref:`the list of supported types <threat_types>`.\n\nExample:\n >>> threat_type = ThreatTypes.enum.TROJAN.value\n >>> print(threat_type.name)\n Trojan", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "ThreatType", "type": "object" }, "TlpPapLevel": { "description": "TlpPapLevel represents the Traffic Light Protocol (TLP) and Permissible Actions Protocol (PAP) levels.\n\nThese levels are used to classify the sensitivity of information and its sharing restrictions.\n\nExample:\n >>> level = TlpPapLevel.RED\n >>> print(level)\n RED", "enum": [ "RED", "AMBER", "GREEN", "WHITE" ], "title": "TlpPapLevel", "type": "string" } }, "required": [ "name", "type" ] }
- Config:
str_strip_whitespace: bool = True
arbitrary_types_allowed: bool = True
- Fields:
- field colander_internal_type: Literal['threat'] = 'threat'
Internal type discriminator for (de)serialization.
- field type: ThreatType [Required]
The type definition for the threat.
- pydantic model colander_data_converter.base.models.ThreatType[source]
Bases:
CommonEntityTypeThreatType represents metadata for threats in Colander. Check the list of supported types.
Example
>>> threat_type = ThreatTypes.enum.TROJAN.value >>> print(threat_type.name) Trojan
Show JSON schema
{ "title": "ThreatType", "description": "ThreatType represents metadata for threats in Colander. Check :ref:`the list of supported types <threat_types>`.\n\nExample:\n >>> threat_type = ThreatTypes.enum.TROJAN.value\n >>> print(threat_type.name)\n Trojan", "type": "object", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ] }
- Fields:
- Validators:
is_supported_type»short_name
- class colander_data_converter.base.models.ThreatTypes[source]
Bases:
objectThreatTypes provides access to all supported threat types.
This class loads threat type definitions from the threat types JSON file and exposes them as an enum. It also provides a method to look up a threat type by its short name.
Example
>>> threat_type = ThreatTypes.enum.TROJAN.value >>> print(threat_type.name) Trojan >>> default_type = ThreatTypes.by_short_name("nonexistent") >>> print(default_type.name) Generic
- classmethod by_short_name(short_name: str) ThreatType[source]
- default = ThreatType(short_name='GENERIC', name='Generic', description='A general or unspecified threat type that does not fit other categories.', svg_icon='', nf_icon='nf nf-fa-bug', stix2_type=None, stix2_value_field_name=None, stix2_pattern=None, stix2_pattern_type=None, default_attributes=None, type_hints=None)
- enum
alias of
EntityTypes
colander_data_converter.base.utils module
- class colander_data_converter.base.utils.BaseModelMerger(strategy: MergingStrategy = MergingStrategy.OVERWRITE)[source]
Bases:
objectA utility class for merging Pydantic BaseModel instances with configurable strategies.
This class provides functionality to merge fields from a source BaseModel into a destination BaseModel, handling both regular model fields and extra attributes.
Example
>>> from pydantic import BaseModel >>> class SourceModel(BaseModel): ... name: str ... age: int >>> class DestinationModel(BaseModel): ... name: str ... age: int ... city: str = "Unknown" >>> source = SourceModel(name="Alice", age=30) >>> destination = DestinationModel(name="Bob", age=25) >>> merger = BaseModelMerger() >>> unprocessed = merger.merge(source, destination) >>> print(destination) name='Alice' age=30 city='Unknown' >>> print(unprocessed) []
- merge(source: BaseModel, destination: BaseModel) List[str][source]
Merge all compatible fields from the source object into the destination object.
This method iterates through all fields in the source object and attempts to merge them into the destination object. It handles both regular object fields and extra attributes dictionary if supported.
- Parameters:
source (BaseModel) – The source model to merge from
destination (BaseModel) – The destination model to merge to
- Returns:
A list of field names that could not be processed during the merge operation. Fields containing ObjectReference types are automatically added to this list.
- Return type:
List[str]