colander_data_converter.converters.threatr.converter

class colander_data_converter.converters.threatr.converter.ColanderToThreatrMapper[source]

Bases: ThreatrMapper

Mapper for converting Colander data model to Threatr data model.

This class handles the conversion of Colander feeds, entities, relations, and events to their corresponding Threatr equivalents. It processes reference fields and creates appropriate relationship mappings between entities.

Note

The mapper uses the mapping configuration loaded from the parent ThreatrMapper class to determine appropriate field and relation name mappings.

convert(colander_feed, root_entity)[source]

Convert a Colander data model to a Threatr data model.

This method transforms a complete Colander feed including all entities, relations, and events into the equivalent Threatr representation. It handles reference field extraction and conversion to explicit relations.

Parameters:

colander_feed (ColanderFeed) – The Colander feed to convert
root_entity (str | Annotated[UUID, UuidVersion(uuid_version=4)] | Annotated[Actor | Artifact | DataFragment | Observable | DetectionRule | Device | Event | Threat, FieldInfo(annotation=NoneType, required=True, discriminator='colander_internal_type')]) – The root entity ID, UUID, or entity object to use as the root

Returns:

A ThreatrFeed object containing the converted data

Return type:

ThreatrFeed

Raises:

ValueError – If the root entity cannot be found or is invalid

Important

The root entity must exist in the provided Colander feed. If a string ID is provided, it must be a valid UUID format.

convert_entity(entity)[source]

Convert a Colander entity to a Threatr entity or event.

Parameters:: entity (Entity) – The Colander entity to convert
Returns:: A Threatr entity or event based on the input type
Return type:: Entity | Event

Note

Events are detected by checking if the entity is an instance of the Event class and are converted to ThreatrEvent objects accordingly.

convert_relation(relation)[source]

Convert a Colander entity relation to a Threatr entity relation.

Parameters:: relation (EntityRelation) – The Colander entity relation to convert
Returns:: A Threatr entity relation
Return type:: EntityRelation

Note

Object references are normalized to UUIDs during conversion to maintain consistency in the Threatr model.

class colander_data_converter.converters.threatr.converter.ThreatrConverter[source]

Bases: object

Converter for Threatr data to Colander data and vice versa. Uses the mapping file to convert between formats.

static colander_to_threatr(colander_feed, root_entity)[source]

Converts Colander data to Threatr data using the mapping file.

Parameters:

colander_feed (ColanderFeed) – The Colander data to convert.
root_entity (str | Annotated[UUID, UuidVersion(uuid_version=4)] | Annotated[Actor | Artifact | DataFragment | Observable | DetectionRule | Device | Event | Threat, FieldInfo(annotation=NoneType, required=True, discriminator='colander_internal_type')]) – The root entity ID, UUID, or entity object to use as the root

Returns:

The converted Threatr data.

Return type:

ThreatrFeed

static threatr_to_colander(threatr_feed)[source]

Converts Threatr data to Colander data using the mapping file.

Parameters:: threatr_feed (ThreatrFeed) – The Threatr data to convert.
Returns:: The converted Colander data.
Return type:: ColanderFeed

class colander_data_converter.converters.threatr.converter.ThreatrToColanderMapper[source]

Bases: ThreatrMapper

Mapper for converting Threatr data model to Colander data model.

This class handles the conversion of Threatr feeds, entities, events, and relations to their corresponding Colander equivalents. It processes explicit relations and attempts to convert them back to reference fields where appropriate.

Important

This mapper maintains state during conversion, storing the input ThreatrFeed and building the output ColanderFeed incrementally.

threatr_feed: The input Threatr feed being converted

colander_feed: The output Colander feed being built

__init__()[source]: Initialize the mapper with empty feed containers.

Note

The mapper creates a new ColanderFeed instance for each conversion process.

convert(threatr_feed)[source]

Convert a Threatr data model to a Colander data model.

This method performs a complete conversion of a ThreatrFeed to a ColanderFeed, handling entities, events, and relations. It attempts to convert explicit relations back to reference fields where possible.

Parameters:: threatr_feed (ThreatrFeed) – The Threatr feed to convert
Returns:: A ColanderFeed object containing the converted data
Raises:: AssertionError – If threatr_feed is None or not a ThreatrFeed instance
Return type:: ColanderFeed

Important

The method resolves all references in the input feed before processing to ensure consistent object relationships.