colander_data_converter.converters.stix2.models

class colander_data_converter.converters.stix2.models.File

Bases: Stix2ObjectBase

Config:

• str_strip_whitespace: bool = True

• arbitrary_types_allowed: bool = True

• extra: str = allow

Fields:

• id (str)

• name (str)

• type (Literal['file'])

field id: str [Optional]

field type: Literal['file'] = 'file'

field name: str [Required]

class colander_data_converter.converters.stix2.models.Identity

Bases: Stix2ObjectBase

Config:

• str_strip_whitespace: bool = True

• arbitrary_types_allowed: bool = True

• extra: str = allow

Fields:

• id (str)

• identity_class (str)

• name (str)

• type (Literal['identity'])

field id: str [Optional]

field type: Literal['identity'] = 'identity'

field name: str [Required]

field identity_class: str = ''

class colander_data_converter.converters.stix2.models.Indicator

Bases: Stix2ObjectBase

Config:

• str_strip_whitespace: bool = True

• arbitrary_types_allowed: bool = True

• extra: str = allow

Fields:

• id (str)

• name (str)

• pattern (str)

• pattern_type (str)

• type (Literal['indicator'])

field id: str [Optional]

field type: Literal['indicator'] = 'indicator'

field name: str [Required]

field pattern: str = ''

field pattern_type: str = 'stix'

class colander_data_converter.converters.stix2.models.Infrastructure

Bases: Stix2ObjectBase

Config:

• str_strip_whitespace: bool = True

• arbitrary_types_allowed: bool = True

• extra: str = allow

Fields:

• id (str)

• infrastructure_types (List[str])

• name (str)

• type (Literal['infrastructure'])

field id: str [Optional]

field type: Literal['infrastructure'] = 'infrastructure'

field name: str [Required]

field infrastructure_types: List[str] = []

class colander_data_converter.converters.stix2.models.Malware

Bases: Stix2ObjectBase

Config:

• str_strip_whitespace: bool = True

• arbitrary_types_allowed: bool = True

• extra: str = allow

Fields:

• id (str)

• malware_types (List[str])

• name (str)

• type (Literal['malware'])

field id: str [Optional]

field type: Literal['malware'] = 'malware'

field name: str [Required]

field malware_types: List[str] = []

class colander_data_converter.converters.stix2.models.Relationship

Bases: Stix2ObjectBase

Config:

• str_strip_whitespace: bool = True

• arbitrary_types_allowed: bool = True

• extra: str = allow

Fields:

• id (str)

• relationship_type (str)

• source_ref (str)

• target_ref (str)

• type (Literal['relationship'])

field id: str [Optional]

field type: Literal['relationship'] = 'relationship'

field relationship_type: str = ''

field source_ref: str [Required]

field target_ref: str [Required]

class colander_data_converter.converters.stix2.models.Stix2Bundle

Bases: BaseModel

Fields:

• id (str)

• objects (List[colander_data_converter.converters.stix2.models.File | colander_data_converter.converters.stix2.models.Indicator | colander_data_converter.converters.stix2.models.Infrastructure | colander_data_converter.converters.stix2.models.Identity | colander_data_converter.converters.stix2.models.Malware | colander_data_converter.converters.stix2.models.ThreatActor | colander_data_converter.converters.stix2.models.Relationship])

• spec_version (Literal['2.1'])

• type (Literal['bundle'])

field id: str [Optional]

field type: Literal['bundle'] = 'bundle'

field spec_version: Literal['2.1'] = '2.1'

field objects: List[Annotated[File | Indicator | Infrastructure | Identity | Malware | ThreatActor | Relationship, FieldInfo(annotation=NoneType, required=True, discriminator='type')]] = []

by_type(object_type)

Return type:

Generator[Stix2Object_T, None, None]

by_id(obj_id)

Return type:

Stix2Object_T | None

static load(raw_object)

Return type:

Stix2Bundle

class colander_data_converter.converters.stix2.models.Stix2ObjectBase

Bases: BaseModel

Config:

• str_strip_whitespace: bool = True

• arbitrary_types_allowed: bool = True

• extra: str = allow

Fields:

• created (str)

• description (str | None)

• modified (str)

• type (str)

field type: str [Required]

field created: str = '2025-08-10T18:48:34.713033+00:00'

field modified: str = '2025-08-10T18:48:34.713064+00:00'

field description: str | None = None

model_post_init(_Stix2ObjectBase__context)

Executes post-initialization logic for the model, ensuring the repository registers the current subclass instance.

Parameters:

__context (Any) – Additional context provided for post-initialization handling.

classmethod subclasses()

Return type:

Dict[str, Type[Stix2ObjectBase]]

classmethod get_supported_types()

Return type:

List[str]

classmethod get_model_class(type_name)

Return type:

Type[Stix2ObjectBase] | None

class colander_data_converter.converters.stix2.models.Stix2Repository(*args, **kwargs)

Bases: object

Singleton repository for managing and storing STIX2 objects.

This class provides centralized storage and reference management for all STIX2 objects, supporting conversion to and from Colander data.

__init__()

Initializes the repository with an empty dictionary for STIX2 objects.

__lshift__(stix2_object)

Adds a STIX2 object to the repository.

Parameters:

stix2_object (Dict[str, Any]) – The STIX2 object to add.

__rshift__(object_id)

Retrieves a STIX2 object from the repository by its ID.

Parameters:

object_id (str) – The ID of the STIX2 object to retrieve.

Returns:

The STIX2 object if found, None otherwise.

Return type:

Optional[Dict[str, Any]]

clear()

Clears all STIX2 objects from the repository.

stix2_objects: Dict[str, Annotated[File | Indicator | Infrastructure | Identity | Malware | ThreatActor | Relationship, FieldInfo(annotation=NoneType, required=True, discriminator='type')]]

class colander_data_converter.converters.stix2.models.ThreatActor

Bases: Stix2ObjectBase

Config:

• str_strip_whitespace: bool = True

• arbitrary_types_allowed: bool = True

• extra: str = allow

Fields:

• id (str)

• name (str)

• threat_actor_types (List[str])

• type (Literal['threat-actor'])

field id: str [Optional]

field type: Literal['threat-actor'] = 'threat-actor'

field name: str [Required]

field threat_actor_types: List[str] = []