Version: 2.5.0

sdv.validators.stix.best_practice Module

class sdv.validators.stix.best_practice.STIXBestPracticeValidator

Bases: object

Performs STIX Best Practice validation.

validate(doc, version=None)

Checks that a STIX document aligns with suggested authoring practices.

Parameters:

• doc – The STIX document. Can be a filename, file-like object, lxml._Element, or lxml._ElementTree instance.
• version – The version of the STIX document. This will determine the set of best practice rules to check. If None an attempt will be made to extract the version from doc.

Returns:

An instance of BestPracticeValidationResults.

Raises:

• UnknownSTIXVersionError – If version was None and doc did not contain any version information.
• InvalidSTIXVersionError – If discovered version or version argument contains an invalid STIX version number.
• ValidationError – If there are any issues parsing doc.

class sdv.validators.stix.best_practice.BestPracticeWarning(node, message=None)

Represents a best practice warning. These are built within best practice rule checking methods and attached to BestPracticeWarningCollection instances.

Note

This class acts like a dictionary and contains the following keys at a minimum:

• 'id': The id of a node associated with the warning.
• 'idref': The idref of a node associated with the warning.
• 'line': The line number of the offending node.
• 'message': A message associated with the warning.
• 'tag': The lxml tag for the offending node.

These keys can be retrieved via the core_keys property.

Instances of this class may attach additional keys. These other keys can be obtained via the other_keys property.

Parameters:

• node – The lxml._Element node associated with this warning.
• message – A message for this warning.

as_dict()

Returns a dictionary representation of this class instance. This is implemented for consistency across other validation error types.

The BestPracticeWarning class extends collections.MutableMapping, so this method isn’t really necessary.

as_json()

Returns a JSON representation of this class instance.

core_keys

Returns a tuple of the keys that can always be found on instance of this class.

Returns:A tuple including the following keys.

• 'id': The id of the warning node. The associated value may be None.
• 'idref': The idref of the warning node. The associated value may be None.
• 'line': The line number of the warning node in the input document. The associated value may be None.
• 'tag': The {namespace}localname value of the warning node.
• 'message': An optional message that can be attached to the warning. The associated value may be None.

line

Returns the line number of the warning node in the input document.

other_keys

Returns a tuple of keys attached to instances of this class that are not found in the core_keys.

class sdv.validators.stix.best_practice.BestPracticeWarningCollection(name)

Bases: _abcoll.MutableSequence

A collection of BestPracticeWarning instances for a given type of STIX Best Practice.

For example, all warnings about STIX constructs missing titles would go within an instance of this class.

Note

This class behaves like a mutable sequence, such as a list.

Parameters:name – The name of the STIX best practice for this collection (e.g., ‘Missing Titles’).

name

The name of the STIX best practice for this collection (e.g., ‘Missing Titles’).

as_dict()

Returns a dictionary representation.

The key of the dictionary is the name of this collection. The associated value is a list of BestPracticeWarning dictionaries.

insert(idx, value)

Inserts value at idx into this BestPracticeWarningCollection instance.

Note

Values that evaluate to False will not be inserted.

class sdv.validators.stix.best_practice.BestPracticeValidationResults

Bases: sdv.validators.base.ValidationResults, _abcoll.MutableSequence

Represents STIX best practice validation results. This class behaves like a list and accepts instances of BestPracticeWarningCollection.

as_dict()

Returns a dictionary representation.

Keys:

• 'result': The result of the validation. Values can be True or False .
• 'errors': A list of BestPracticeWarningCollection dictionaries.

as_json()

Returns a JSON representation of this class instance.

errors

Returns a list of BestPracticeWarningCollection instances.

is_valid

Returns True if an instance of this class contains no warning collections or only contains only warning collections.