colander_data_converter.formats.threatr.models module
- pydantic model colander_data_converter.formats.threatr.models.Entity[source]
Bases:
ThreatrTypeRepresent an entity in the Threatr data model.
Entities are the primary data objects in Threatr, representing observables, indicators, or other threat intelligence artifacts with associated metadata and classification levels.
Show JSON schema
{ "title": "Entity", "description": "Represent an entity in the Threatr data model.\n\nEntities are the primary data objects in Threatr, representing observables,\nindicators, or other threat intelligence artifacts with associated metadata\nand classification levels.", "type": "object", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "default": "2025-07-18T00:09:31.653295Z", "format": "date-time", "title": "Created At", "type": "string" }, "updated_at": { "default": "2025-07-18T00:09:31.653317Z", "format": "date-time", "title": "Updated At", "type": "string" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "type": { "$ref": "#/$defs/CommonEntityType" }, "super_type": { "$ref": "#/$defs/CommonEntitySuperType" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "attributes": { "anyOf": [ { "additionalProperties": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" } }, "$defs": { "CommonEntitySuperType": { "description": "CommonEntitySuperType defines metadata for a super type of entities in the Colander data model.\n\nThis class is used to represent high-level categories of entities (such as Actor, Artifact, Device, etc.)\nand provides fields for the short name, display name, associated types, and the Python class implementing the entity.", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "types": { "anyOf": [ { "items": {}, "type": "array" }, { "type": "null" } ], "default": null, "title": "Types" }, "model_class": { "default": null, "title": "Model Class" }, "type_class": { "default": null, "title": "Type Class" }, "default_type": { "default": null, "title": "Default Type" } }, "required": [ "short_name", "name" ], "title": "CommonEntitySuperType", "type": "object" }, "CommonEntityType": { "description": "CommonEntityType is an abstract base class for defining shared attributes across various entity data types.\n\nThis class provides fields for identifiers, names, descriptions, and other metadata.", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "CommonEntityType", "type": "object" }, "TlpPapLevel": { "description": "Traffic Light Protocol (TLP) and Permissible Actions Protocol (PAP) classification levels.\n\nThe TLP is a set of designations used to ensure that sensitive information is shared\nwith the appropriate audience. PAP complements TLP by providing guidance on what\nactions can be taken with the information.\n\n:Attributes:\n - **RED**: Highly sensitive information, restricted to specific recipients\n - **AMBER**: Sensitive information, limited to a defined group\n - **GREEN**: Information that can be shared within the community\n - **WHITE**: Information that can be shared publicly\n\n.. seealso::\n `FIRST TLP Standard <https://www.first.org/tlp/>`_ for complete specification.\n\nExample:\n >>> level = TlpPapLevel.RED\n >>> print(level)\n RED\n >>> str(level) == \"RED\"\n True", "enum": [ "RED", "AMBER", "GREEN", "WHITE" ], "title": "TlpPapLevel", "type": "string" } }, "required": [ "name", "type", "super_type" ] }
- Config:
str_strip_whitespace: bool = True
arbitrary_types_allowed: bool = True
- Fields:
- field created_at: datetime = datetime.datetime(2025, 7, 18, 0, 9, 31, 653295, tzinfo=datetime.timezone.utc)
The timestamp when the entity was created.
- field id: Annotated[UUID, UuidVersion(uuid_version=4)] [Optional]
The unique identifier for the entity.
- Constraints:
uuid_version = 4
- field pap: TlpPapLevel = TlpPapLevel.WHITE
The PAP (Permissible Actions Protocol) level for the entity.
- field super_type: CommonEntitySuperType [Required]
The super type classification of the entity.
- field tlp: TlpPapLevel = TlpPapLevel.WHITE
The TLP (Traffic Light Protocol) level for the entity.
- field type: CommonEntityType [Required]
The specific type of the entity.
- pydantic model colander_data_converter.formats.threatr.models.EntityRelation[source]
Bases:
ThreatrTypeRepresent a relation between two entities in the Threatr data model.
EntityRelations define directed relationships between entities, supporting complex threat intelligence graphs and entity associations.
Show JSON schema
{ "title": "EntityRelation", "description": "Represent a relation between two entities in the Threatr data model.\n\nEntityRelations define directed relationships between entities, supporting\ncomplex threat intelligence graphs and entity associations.", "type": "object", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "default": "2025-07-18T00:09:31.654502Z", "format": "date-time", "title": "Created At", "type": "string" }, "updated_at": { "default": "2025-07-18T00:09:31.654524Z", "format": "date-time", "title": "Updated At", "type": "string" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "attributes": { "anyOf": [ { "additionalProperties": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "obj_from": { "anyOf": [ { "$ref": "#/$defs/Entity" }, { "$ref": "#/$defs/ObjectReference" } ], "title": "Obj From" }, "obj_to": { "anyOf": [ { "$ref": "#/$defs/Entity" }, { "$ref": "#/$defs/ObjectReference" } ], "title": "Obj To" } }, "$defs": { "CommonEntitySuperType": { "description": "CommonEntitySuperType defines metadata for a super type of entities in the Colander data model.\n\nThis class is used to represent high-level categories of entities (such as Actor, Artifact, Device, etc.)\nand provides fields for the short name, display name, associated types, and the Python class implementing the entity.", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "types": { "anyOf": [ { "items": {}, "type": "array" }, { "type": "null" } ], "default": null, "title": "Types" }, "model_class": { "default": null, "title": "Model Class" }, "type_class": { "default": null, "title": "Type Class" }, "default_type": { "default": null, "title": "Default Type" } }, "required": [ "short_name", "name" ], "title": "CommonEntitySuperType", "type": "object" }, "CommonEntityType": { "description": "CommonEntityType is an abstract base class for defining shared attributes across various entity data types.\n\nThis class provides fields for identifiers, names, descriptions, and other metadata.", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "CommonEntityType", "type": "object" }, "Entity": { "description": "Represent an entity in the Threatr data model.\n\nEntities are the primary data objects in Threatr, representing observables,\nindicators, or other threat intelligence artifacts with associated metadata\nand classification levels.", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "default": "2025-07-18T00:09:31.653295Z", "format": "date-time", "title": "Created At", "type": "string" }, "updated_at": { "default": "2025-07-18T00:09:31.653317Z", "format": "date-time", "title": "Updated At", "type": "string" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "type": { "$ref": "#/$defs/CommonEntityType" }, "super_type": { "$ref": "#/$defs/CommonEntitySuperType" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "attributes": { "anyOf": [ { "additionalProperties": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" } }, "required": [ "name", "type", "super_type" ], "title": "Entity", "type": "object" }, "ObjectReference": { "format": "uuid4", "type": "string" }, "TlpPapLevel": { "description": "Traffic Light Protocol (TLP) and Permissible Actions Protocol (PAP) classification levels.\n\nThe TLP is a set of designations used to ensure that sensitive information is shared\nwith the appropriate audience. PAP complements TLP by providing guidance on what\nactions can be taken with the information.\n\n:Attributes:\n - **RED**: Highly sensitive information, restricted to specific recipients\n - **AMBER**: Sensitive information, limited to a defined group\n - **GREEN**: Information that can be shared within the community\n - **WHITE**: Information that can be shared publicly\n\n.. seealso::\n `FIRST TLP Standard <https://www.first.org/tlp/>`_ for complete specification.\n\nExample:\n >>> level = TlpPapLevel.RED\n >>> print(level)\n RED\n >>> str(level) == \"RED\"\n True", "enum": [ "RED", "AMBER", "GREEN", "WHITE" ], "title": "TlpPapLevel", "type": "string" } }, "required": [ "name", "obj_from", "obj_to" ] }
- Config:
str_strip_whitespace: bool = True
arbitrary_types_allowed: bool = True
- Fields:
- field attributes: Dict[str, str | None] | None = None
Dictionary of additional attributes for the relation.
- field created_at: datetime = datetime.datetime(2025, 7, 18, 0, 9, 31, 654502, tzinfo=datetime.timezone.utc)
The timestamp when the entity relation was created.
- field id: Annotated[UUID, UuidVersion(uuid_version=4)] [Optional]
The unique identifier for the entity relation.
- Constraints:
uuid_version = 4
- field name: str [Required]
The name of the entity relation.
- Constraints:
min_length = 1
max_length = 512
- pydantic model colander_data_converter.formats.threatr.models.Event[source]
Bases:
ThreatrTypeRepresent an event in the Threatr data model.
Events capture temporal occurrences related to threat intelligence, tracking when specific activities or observations took place.
Show JSON schema
{ "title": "Event", "description": "Represent an event in the Threatr data model.\n\nEvents capture temporal occurrences related to threat intelligence,\ntracking when specific activities or observations took place.", "type": "object", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "default": "2025-07-18T00:09:31.655618Z", "format": "date-time", "title": "Created At", "type": "string" }, "updated_at": { "default": "2025-07-18T00:09:31.655639Z", "format": "date-time", "title": "Updated At", "type": "string" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "attributes": { "anyOf": [ { "additionalProperties": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "first_seen": { "default": "2025-07-18T00:09:31.655691Z", "format": "date-time", "title": "First Seen", "type": "string" }, "last_seen": { "default": "2025-07-18T00:09:31.655692Z", "format": "date-time", "title": "Last Seen", "type": "string" }, "count": { "default": 1, "exclusiveMinimum": 0, "title": "Count", "type": "integer" }, "type": { "$ref": "#/$defs/CommonEntityType" }, "super_type": { "$ref": "#/$defs/CommonEntitySuperType", "default": { "short_name": "EVENT", "name": "Event" } }, "involved_entity": { "anyOf": [ { "$ref": "#/$defs/Entity" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Involved Entity" } }, "$defs": { "CommonEntitySuperType": { "description": "CommonEntitySuperType defines metadata for a super type of entities in the Colander data model.\n\nThis class is used to represent high-level categories of entities (such as Actor, Artifact, Device, etc.)\nand provides fields for the short name, display name, associated types, and the Python class implementing the entity.", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "types": { "anyOf": [ { "items": {}, "type": "array" }, { "type": "null" } ], "default": null, "title": "Types" }, "model_class": { "default": null, "title": "Model Class" }, "type_class": { "default": null, "title": "Type Class" }, "default_type": { "default": null, "title": "Default Type" } }, "required": [ "short_name", "name" ], "title": "CommonEntitySuperType", "type": "object" }, "CommonEntityType": { "description": "CommonEntityType is an abstract base class for defining shared attributes across various entity data types.\n\nThis class provides fields for identifiers, names, descriptions, and other metadata.", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "CommonEntityType", "type": "object" }, "Entity": { "description": "Represent an entity in the Threatr data model.\n\nEntities are the primary data objects in Threatr, representing observables,\nindicators, or other threat intelligence artifacts with associated metadata\nand classification levels.", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "default": "2025-07-18T00:09:31.653295Z", "format": "date-time", "title": "Created At", "type": "string" }, "updated_at": { "default": "2025-07-18T00:09:31.653317Z", "format": "date-time", "title": "Updated At", "type": "string" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "type": { "$ref": "#/$defs/CommonEntityType" }, "super_type": { "$ref": "#/$defs/CommonEntitySuperType" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "attributes": { "anyOf": [ { "additionalProperties": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" } }, "required": [ "name", "type", "super_type" ], "title": "Entity", "type": "object" }, "ObjectReference": { "format": "uuid4", "type": "string" }, "TlpPapLevel": { "description": "Traffic Light Protocol (TLP) and Permissible Actions Protocol (PAP) classification levels.\n\nThe TLP is a set of designations used to ensure that sensitive information is shared\nwith the appropriate audience. PAP complements TLP by providing guidance on what\nactions can be taken with the information.\n\n:Attributes:\n - **RED**: Highly sensitive information, restricted to specific recipients\n - **AMBER**: Sensitive information, limited to a defined group\n - **GREEN**: Information that can be shared within the community\n - **WHITE**: Information that can be shared publicly\n\n.. seealso::\n `FIRST TLP Standard <https://www.first.org/tlp/>`_ for complete specification.\n\nExample:\n >>> level = TlpPapLevel.RED\n >>> print(level)\n RED\n >>> str(level) == \"RED\"\n True", "enum": [ "RED", "AMBER", "GREEN", "WHITE" ], "title": "TlpPapLevel", "type": "string" } }, "required": [ "name", "type" ] }
- Config:
str_strip_whitespace: bool = True
arbitrary_types_allowed: bool = True
- Fields:
- Validators:
_check_dates»all fields
- field attributes: Dict[str, str | None] | None = None
Dictionary of additional attributes for the event.
- Validated by:
_check_dates
- field count: Annotated[int, Gt(gt=0)] = 1
The number of times this event was observed.
- Constraints:
gt = 0
- Validated by:
_check_dates
- field created_at: datetime = datetime.datetime(2025, 7, 18, 0, 9, 31, 655618, tzinfo=datetime.timezone.utc)
The timestamp when the event was created.
- Validated by:
_check_dates
- field first_seen: datetime = datetime.datetime(2025, 7, 18, 0, 9, 31, 655691, tzinfo=datetime.timezone.utc)
The timestamp when the event was first observed.
- Validated by:
_check_dates
- field id: Annotated[UUID, UuidVersion(uuid_version=4)] [Optional]
The unique identifier for the event.
- Constraints:
uuid_version = 4
- Validated by:
_check_dates
- field involved_entity: Entity | None | ObjectReference = None
Optional entity or reference involved in this event.
- Validated by:
_check_dates
- field last_seen: datetime = datetime.datetime(2025, 7, 18, 0, 9, 31, 655692, tzinfo=datetime.timezone.utc)
The timestamp when the event was last observed.
- Validated by:
_check_dates
- field name: str [Required]
The name of the event.
- Constraints:
min_length = 1
max_length = 512
- Validated by:
_check_dates
- field super_type: CommonEntitySuperType = CommonEntitySuperTypes.EVENT
The super type classification of the event.
- Validated by:
_check_dates
- field type: CommonEntityType [Required]
The type of the event.
- Validated by:
_check_dates
- pydantic model colander_data_converter.formats.threatr.models.ThreatrFeed[source]
Bases:
ThreatrTypeRepresent a feed of Threatr data, including entities, relations, and events.
ThreatrFeed serves as a container for complete threat intelligence datasets, organizing related entities, their relationships, and associated events into a cohesive data structure.
Show JSON schema
{ "title": "ThreatrFeed", "description": "Represent a feed of Threatr data, including entities, relations, and events.\n\nThreatrFeed serves as a container for complete threat intelligence datasets,\norganizing related entities, their relationships, and associated events into\na cohesive data structure.", "type": "object", "properties": { "root_entity": { "$ref": "#/$defs/Entity" }, "entities": { "anyOf": [ { "items": { "$ref": "#/$defs/Entity" }, "type": "array" }, { "type": "null" } ], "default": [], "title": "Entities" }, "relations": { "anyOf": [ { "items": { "$ref": "#/$defs/EntityRelation" }, "type": "array" }, { "type": "null" } ], "default": [], "title": "Relations" }, "events": { "anyOf": [ { "items": { "$ref": "#/$defs/Event" }, "type": "array" }, { "type": "null" } ], "default": [], "title": "Events" } }, "$defs": { "CommonEntitySuperType": { "description": "CommonEntitySuperType defines metadata for a super type of entities in the Colander data model.\n\nThis class is used to represent high-level categories of entities (such as Actor, Artifact, Device, etc.)\nand provides fields for the short name, display name, associated types, and the Python class implementing the entity.", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "types": { "anyOf": [ { "items": {}, "type": "array" }, { "type": "null" } ], "default": null, "title": "Types" }, "model_class": { "default": null, "title": "Model Class" }, "type_class": { "default": null, "title": "Type Class" }, "default_type": { "default": null, "title": "Default Type" } }, "required": [ "short_name", "name" ], "title": "CommonEntitySuperType", "type": "object" }, "CommonEntityType": { "description": "CommonEntityType is an abstract base class for defining shared attributes across various entity data types.\n\nThis class provides fields for identifiers, names, descriptions, and other metadata.", "properties": { "short_name": { "maxLength": 32, "title": "Short Name", "type": "string" }, "name": { "maxLength": 512, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "svg_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Svg Icon" }, "nf_icon": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Nf Icon" }, "stix2_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Type" }, "stix2_value_field_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Value Field Name" }, "stix2_pattern": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern" }, "stix2_pattern_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Stix2 Pattern Type" }, "default_attributes": { "anyOf": [ { "additionalProperties": { "type": "string" }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Default Attributes" }, "type_hints": { "anyOf": [ { "additionalProperties": true, "type": "object" }, { "type": "null" } ], "default": null, "title": "Type Hints" } }, "required": [ "short_name", "name" ], "title": "CommonEntityType", "type": "object" }, "Entity": { "description": "Represent an entity in the Threatr data model.\n\nEntities are the primary data objects in Threatr, representing observables,\nindicators, or other threat intelligence artifacts with associated metadata\nand classification levels.", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "default": "2025-07-18T00:09:31.653295Z", "format": "date-time", "title": "Created At", "type": "string" }, "updated_at": { "default": "2025-07-18T00:09:31.653317Z", "format": "date-time", "title": "Updated At", "type": "string" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "type": { "$ref": "#/$defs/CommonEntityType" }, "super_type": { "$ref": "#/$defs/CommonEntitySuperType" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "pap": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "source_url": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Source Url" }, "tlp": { "$ref": "#/$defs/TlpPapLevel", "default": "WHITE" }, "attributes": { "anyOf": [ { "additionalProperties": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" } }, "required": [ "name", "type", "super_type" ], "title": "Entity", "type": "object" }, "EntityRelation": { "description": "Represent a relation between two entities in the Threatr data model.\n\nEntityRelations define directed relationships between entities, supporting\ncomplex threat intelligence graphs and entity associations.", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "default": "2025-07-18T00:09:31.654502Z", "format": "date-time", "title": "Created At", "type": "string" }, "updated_at": { "default": "2025-07-18T00:09:31.654524Z", "format": "date-time", "title": "Updated At", "type": "string" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "attributes": { "anyOf": [ { "additionalProperties": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "obj_from": { "anyOf": [ { "$ref": "#/$defs/Entity" }, { "$ref": "#/$defs/ObjectReference" } ], "title": "Obj From" }, "obj_to": { "anyOf": [ { "$ref": "#/$defs/Entity" }, { "$ref": "#/$defs/ObjectReference" } ], "title": "Obj To" } }, "required": [ "name", "obj_from", "obj_to" ], "title": "EntityRelation", "type": "object" }, "Event": { "description": "Represent an event in the Threatr data model.\n\nEvents capture temporal occurrences related to threat intelligence,\ntracking when specific activities or observations took place.", "properties": { "id": { "format": "uuid4", "title": "Id", "type": "string" }, "created_at": { "default": "2025-07-18T00:09:31.655618Z", "format": "date-time", "title": "Created At", "type": "string" }, "updated_at": { "default": "2025-07-18T00:09:31.655639Z", "format": "date-time", "title": "Updated At", "type": "string" }, "name": { "maxLength": 512, "minLength": 1, "title": "Name", "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Description" }, "attributes": { "anyOf": [ { "additionalProperties": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "type": "object" }, { "type": "null" } ], "default": null, "title": "Attributes" }, "first_seen": { "default": "2025-07-18T00:09:31.655691Z", "format": "date-time", "title": "First Seen", "type": "string" }, "last_seen": { "default": "2025-07-18T00:09:31.655692Z", "format": "date-time", "title": "Last Seen", "type": "string" }, "count": { "default": 1, "exclusiveMinimum": 0, "title": "Count", "type": "integer" }, "type": { "$ref": "#/$defs/CommonEntityType" }, "super_type": { "$ref": "#/$defs/CommonEntitySuperType", "default": { "short_name": "EVENT", "name": "Event" } }, "involved_entity": { "anyOf": [ { "$ref": "#/$defs/Entity" }, { "$ref": "#/$defs/ObjectReference" }, { "type": "null" } ], "default": null, "title": "Involved Entity" } }, "required": [ "name", "type" ], "title": "Event", "type": "object" }, "ObjectReference": { "format": "uuid4", "type": "string" }, "TlpPapLevel": { "description": "Traffic Light Protocol (TLP) and Permissible Actions Protocol (PAP) classification levels.\n\nThe TLP is a set of designations used to ensure that sensitive information is shared\nwith the appropriate audience. PAP complements TLP by providing guidance on what\nactions can be taken with the information.\n\n:Attributes:\n - **RED**: Highly sensitive information, restricted to specific recipients\n - **AMBER**: Sensitive information, limited to a defined group\n - **GREEN**: Information that can be shared within the community\n - **WHITE**: Information that can be shared publicly\n\n.. seealso::\n `FIRST TLP Standard <https://www.first.org/tlp/>`_ for complete specification.\n\nExample:\n >>> level = TlpPapLevel.RED\n >>> print(level)\n RED\n >>> str(level) == \"RED\"\n True", "enum": [ "RED", "AMBER", "GREEN", "WHITE" ], "title": "TlpPapLevel", "type": "string" } }, "required": [ "root_entity" ] }
- Config:
str_strip_whitespace: bool = True
arbitrary_types_allowed: bool = True
- Fields:
entities (List[colander_data_converter.formats.threatr.models.Entity] | None)events (List[colander_data_converter.formats.threatr.models.Event] | None)relations (List[colander_data_converter.formats.threatr.models.EntityRelation] | None)root_entity (colander_data_converter.formats.threatr.models.Entity)
- field relations: List[EntityRelation] | None = []
List of entity relation objects in the feed.
- field root_entity: Entity [Required]
The root entity of the feed, corresponding to the primary requested entity.
- static load(raw_object, strict=False)[source]
Load a ThreatrFeed from a raw object dictionary, resolving references.
- Parameters:
raw_object (Dict[str, Union[Entity, Event, EntityRelation]]) – The raw data to validate and load
strict (bool) – If True, raises a ValueError when a UUID reference cannot be resolved. If False, unresolved references remain as UUIDs.
- Returns:
The loaded and reference-resolved feed
- Return type:
Important
Use
strict=Trueto ensure all references in the feed are valid and resolvable.
- resolve_references(strict=False)[source]
Resolve references within entities, relations, and events.
Iterates over each entity, relation, and event within the respective collections, calling their
resolve_referencesmethod to update them with any referenced data.- Parameters:
strict (bool) – If True, raises a ValueError when a UUID reference cannot be resolved. If False, unresolved references remain as UUIDs.
Note
This method synchronizes internal state with external dependencies after loading.
- unlink_references()[source]
Unlink references from all entities, relations, and events within the feed.
This method iterates through each entity, event, and relation, invoking their
unlink_references()methods to replace object references with UUIDs.Note
This operation is useful for breaking dependencies or preparing data for serialization.
- class colander_data_converter.formats.threatr.models.ThreatrRepository(*args, **kwargs)[source]
Bases:
objectSingleton repository for managing and storing Entity, Event, and EntityRelation objects.
This class provides centralized storage and reference management for all model instances, supporting insertion, lookup, and reference resolution/unlinking. Uses the Singleton pattern to ensure a single global repository instance.
Warning
As a singleton, this repository persists for the entire application lifecycle. Use the
clear()method to reset state when needed.- clear()[source]
Clear all stored entities, events, and relations from the repository.
Caution
This operation cannot be undone and will remove all data from the repository.
- relations: Dict[str, EntityRelation]
Dictionary storing EntityRelation objects by their string ID.
- resolve_references(strict=False)[source]
Resolve all UUID references in relations and events to their corresponding objects.
This method iterates through all stored relations and events in the repository, calling their respective
resolve_referencesmethods to convert UUID references back to actual object instances. This is typically used after deserialization to restore object relationships.- Parameters:
strict (bool) – If True, raises a ValueError when a UUID reference cannot be resolved. If False, unresolved references remain as UUIDs.
- Raises:
ValueError – If strict is True and any UUID reference cannot be resolved to an existing object in the repository
Important
Use
strict=Trueto ensure data integrity when all references must be resolvable.
- unlink_references()[source]
Unlink all object references in relations and events by replacing them with UUIDs.
This method calls
unlink_references()on all stored relations and events to convert object references back to UUID references for serialization purposes.Note
This operation modifies the stored objects in-place.
- pydantic model colander_data_converter.formats.threatr.models.ThreatrType[source]
Bases:
BaseModelBase model for Threatr objects, providing repository registration and reference management.
This class ensures that all subclasses are automatically registered in the ThreatrRepository and provides methods to unlink and resolve object references for serialization and deserialization workflows.
Important
All Threatr model classes must inherit from this base class to ensure proper repository integration and reference management.
Show JSON schema
{ "title": "ThreatrType", "description": "Base model for Threatr objects, providing repository registration and reference management.\n\nThis class ensures that all subclasses are automatically registered in the ThreatrRepository\nand provides methods to unlink and resolve object references for serialization and\ndeserialization workflows.\n\n.. important::\n All Threatr model classes must inherit from this base class to ensure proper\n repository integration and reference management.", "type": "object", "properties": {} }
- Config:
str_strip_whitespace: bool = True
arbitrary_types_allowed: bool = True
- model_post_init(_ThreatrType__context)[source]
Execute post-initialization logic for the model.
Ensures the repository registers the current subclass instance automatically after object creation.
- Parameters:
__context (Any) – Additional context provided for post-initialization handling
Note
This method is called automatically by Pydantic after model initialization.
- resolve_references(strict=False)[source]
Resolve UUID references to their corresponding objects using the ThreatrRepository.
Fields annotated with
ObjectReferenceorList[ObjectReference]are processed to fetch and replace their UUID references with actual object instances.- Parameters:
strict (bool) – If True, raises a ValueError when a UUID reference cannot be resolved. If False, unresolved references remain as UUIDs.
- Raises:
ValueError – If strict is True and a UUID reference cannot be resolved
Important
Use
strict=Trueto ensure all references are valid and resolvable.
- unlink_references()[source]
Unlink object references by replacing them with their respective UUIDs.
This method updates model fields annotated as
ObjectReferenceorList[ObjectReference]by replacing object references with their UUIDs for serialization purposes.Note
This operation modifies the object in-place and is typically used before serialization.
- Raises:
AttributeError – If the class instance does not have the expected field or attribute