Package security.whisper.javastix.sdo.objects

Class Indicator

java.lang.Object
security.whisper.javastix.sdo.objects.Indicator
All Implemented Interfaces:
Serializable, BundleableObject, Stix, StixCommonProperties, StixCustomProperties, StixLabels, StixModified, StixRevoked, StixSpecVersion, DomainObject, IndicatorSdo, SdoDefaultValidator
@ParametersAreNonnullByDefault @Generated("org.immutables.processor.ProxyProcessor") @Immutable @CheckReturnValue @Redactable(useMask=false, redactionMask="\u2588\u2588REDACTED\u2588\u2588") public final class Indicator extends Object implements IndicatorSdo
indicator

Indicators contain a pattern that can be used to detect suspicious or malicious cyber activity.

See Also:

  • Method Details

    • getLabels

      @JsonPropertyDescription("This field is an Open Vocabulary that specifies the type of indicator. Open vocab - indicator-label-ov") @Redactable(useMask=true, redactionMask="\u2588\u2588REDACTED\u2588\u2588") public com.google.common.collect.ImmutableSet<String> getLabels()
      Specified by:
      getLabels in interface IndicatorSdo
      Specified by:
      getLabels in interface StixLabels
      Returns:
      The value of the labels attribute

    • getIndicatorTypes

      @JsonPropertyDescription("This field is an Open Vocabulary that specifies the type of indicator. Open vocab - indicator-type-ov") @Redactable(useMask=false, redactionMask="\u2588\u2588REDACTED\u2588\u2588") public com.google.common.collect.ImmutableSet<String> getIndicatorTypes()
      Specified by:
      getIndicatorTypes in interface IndicatorSdo
      Returns:
      The value of the indicatorTypes attribute

    • getConfidence

      @JsonPropertyDescription("This field identifies the confidence that the creator has in the correctness of their data. The value ranges from 0 (no confidence) to 100 (complete confidence).") @Redactable(useMask=false, redactionMask="\u2588\u2588REDACTED\u2588\u2588") public Optional<Integer> getConfidence()
      Specified by:
      getConfidence in interface IndicatorSdo
      Returns:
      The value of the confidence attribute

    • getName

      @JsonPropertyDescription("The name used to identify the Indicator.") @Redactable(useMask=false, redactionMask="\u2588\u2588REDACTED\u2588\u2588") public Optional<String> getName()
      Specified by:
      getName in interface IndicatorSdo
      Returns:
      The value of the name attribute

    • getDescription

      @JsonPropertyDescription("A description that provides more details and context about this Indicator, potentially including its purpose and its key characteristics.") @Redactable(useMask=false, redactionMask="\u2588\u2588REDACTED\u2588\u2588") public Optional<String> getDescription()
      Specified by:
      getDescription in interface IndicatorSdo
      Returns:
      The value of the description attribute

    • getPattern

      @JsonPropertyDescription("The detection pattern for this indicator. The default language is STIX Patterning.") @Redactable(useMask=true, redactionMask="\u2588\u2588REDACTED\u2588\u2588") public String getPattern()
      Specified by:
      getPattern in interface IndicatorSdo
      Returns:
      The value of the pattern attribute

    • getPatternType

      @JsonPropertyDescription("The pattern language used in this indicator. The default is \'stix\' which represents STIX Patterning.") @Redactable(useMask=false, redactionMask="\u2588\u2588REDACTED\u2588\u2588") public String getPatternType()
      Specified by:
      getPatternType in interface IndicatorSdo
      Returns:
      The value of the patternType attribute

    • getValidFrom

      @JsonPropertyDescription("The time from which this indicator should be considered valuable intelligence.") @Redactable(useMask=true, redactionMask="\u2588\u2588REDACTED\u2588\u2588") public StixInstant getValidFrom()
      Specified by:
      getValidFrom in interface IndicatorSdo
      Returns:
      The value of the validFrom attribute

    • getValidUntil

      @JsonPropertyDescription("The time at which this indicator should no longer be considered valuable intelligence.") @Redactable(useMask=false, redactionMask="\u2588\u2588REDACTED\u2588\u2588") public Optional<StixInstant> getValidUntil()
      Specified by:
      getValidUntil in interface IndicatorSdo
      Returns:
      The value of the validUntil attribute

    • getKillChainPhases

      @JsonPropertyDescription("The list of kill chain phases for which this attack pattern is used.") @Redactable(useMask=false, redactionMask="\u2588\u2588REDACTED\u2588\u2588") public com.google.common.collect.ImmutableSet<KillChainPhaseType> getKillChainPhases()
      Specified by:
      getKillChainPhases in interface IndicatorSdo
      Returns:
      The value of the killChainPhases attribute

    • getRelationships

      @Redactable(useMask=false, redactionMask="\u2588\u2588REDACTED\u2588\u2588") public com.google.common.collect.ImmutableSet<RelationshipSro> getRelationships()
      This is used with the SROs. The SRO interface enforces what relationships can be created. The Relationships can then be stored in the Domain object if they choose. Otherwise you would typically add these Relationship SROs that are specific to SDOs, can be grabbed during bundle creation.
      Specified by:
      getRelationships in interface DomainObject
      Returns:
      Set of Relationship SROs

    • getHydrated

      @Redactable(useMask=false, redactionMask="\u2588\u2588REDACTED\u2588\u2588") public boolean getHydrated()
      Dictates if the object is hydrated. Hydration is defined as if the Object has only a "ID" or has been properly hydrated with the expected required fields
      Specified by:
      getHydrated in interface BundleableObject
      Specified by:
      getHydrated in interface StixCommonProperties
      Returns:
      boolean

    • getType

      @JsonPropertyDescription("The type property identifies the type of STIX Object (SDO, Relationship Object, etc). The value of the type field MUST be one of the types defined by a STIX Object (e.g., indicator).") @Redactable(useMask=false, redactionMask="\u2588\u2588REDACTED\u2588\u2588") public String getType()
      Specified by:
      getType in interface BundleableObject
      Specified by:
      getType in interface StixCommonProperties
      Returns:
      The value of the type attribute

    • getId

      @JsonPropertyDescription("Represents identifiers across the CTI specifications. The format consists of the name of the top-level object being identified, followed by two dashes (--), followed by a UUIDv4.") @Redactable(useMask=false, redactionMask="\u2588\u2588REDACTED\u2588\u2588") public String getId()
      Specified by:
      getId in interface BundleableObject
      Specified by:
      getId in interface StixCommonProperties
      Returns:
      The value of the id attribute

    • getCreatedByRef

      @JsonPropertyDescription("Represents identifiers across the CTI specifications. The format consists of the name of the top-level object being identified, followed by two dashes (--), followed by a UUIDv4.") @Redactable(useMask=true, redactionMask="identity--__REDACTED__") public Optional<IdentitySdo> getCreatedByRef()
      Specified by:
      getCreatedByRef in interface StixCommonProperties
      Returns:
      The value of the createdByRef attribute

    • getCreated

      @JsonPropertyDescription("The created property represents the time at which the first version of this object was created. The timstamp value MUST be precise to the nearest millisecond.") @Redactable(useMask=true, redactionMask="\u2588\u2588REDACTED\u2588\u2588") public StixInstant getCreated()
      Specified by:
      getCreated in interface StixCommonProperties
      Returns:
      The value of the created attribute

    • getLang

      @JsonPropertyDescription("Identifies the language of the text content in this object using ISO 639-2 language codes.") @Redactable(useMask=false, redactionMask="\u2588\u2588REDACTED\u2588\u2588") public Optional<String> getLang()
      Specified by:
      getLang in interface StixCommonProperties
      Returns:
      The value of the lang attribute

    • getExternalReferences

      @JsonPropertyDescription("A list of external references which refers to non-STIX information.") @Redactable(useMask=false, redactionMask="\u2588\u2588REDACTED\u2588\u2588") public com.google.common.collect.ImmutableSet<ExternalReferenceType> getExternalReferences()
      Specified by:
      getExternalReferences in interface StixCommonProperties
      Returns:
      The value of the externalReferences attribute

    • getObjectMarkingRefs

      @JsonPropertyDescription("The list of marking-definition objects to be applied to this object.") @Redactable(useMask=false, redactionMask="\u2588\u2588REDACTED\u2588\u2588") public com.google.common.collect.ImmutableSet<MarkingDefinitionDm> getObjectMarkingRefs()
      Specified by:
      getObjectMarkingRefs in interface BundleableObject
      Specified by:
      getObjectMarkingRefs in interface StixCommonProperties
      Returns:
      The value of the objectMarkingRefs attribute

    • getGranularMarkings

      @JsonPropertyDescription("The set of granular markings that apply to this object.") @Redactable(useMask=false, redactionMask="\u2588\u2588REDACTED\u2588\u2588") public com.google.common.collect.ImmutableSet<GranularMarkingDm> getGranularMarkings()
      Specified by:
      getGranularMarkings in interface BundleableObject
      Specified by:
      getGranularMarkings in interface StixCommonProperties
      Returns:
      The value of the granularMarkings attribute

    • getCustomProperties

      @Redactable(useMask=false, redactionMask="\u2588\u2588REDACTED\u2588\u2588") public com.google.common.collect.ImmutableMap<String,Object> getCustomProperties()
      Custom Properties for STIX Objects. Any object that supports custom properties will have a validation of the custom property prefix (typically "x_"). If the additional property in the JSON does not meet the StartsWith condition, then the JSON will be rejected.
      Specified by:
      getCustomProperties in interface StixCustomProperties
      Returns:
      Map of custom properties Map<String, Object>

    • getModified

      @JsonPropertyDescription("The modified property represents the time that this particular version of the object was created. The timstamp value MUST be precise to the nearest millisecond.") @Redactable(useMask=false, redactionMask="\u2588\u2588REDACTED\u2588\u2588") public StixInstant getModified()
      Specified by:
      getModified in interface StixModified
      Returns:
      The value of the modified attribute

    • getRevoked

      @JsonPropertyDescription("The revoked property indicates whether the object has been revoked.") @Redactable(useMask=false, redactionMask="\u2588\u2588REDACTED\u2588\u2588") public StixBoolean getRevoked()
      Specified by:
      getRevoked in interface StixRevoked
      Returns:
      The value of the revoked attribute

    • withLabels

      public final Indicator withLabels(String... elements)
      Copy the current immutable object with elements that replace the content of labels.
      Parameters:
      elements - The elements to set
      Returns:
      A modified copy of this object

    • withLabels

      public final Indicator withLabels(Iterable<String> elements)
      Copy the current immutable object with elements that replace the content of labels. A shallow reference equality check is used to prevent copying of the same value by returning this.
      Parameters:
      elements - An iterable of labels elements to set
      Returns:
      A modified copy of this object

    • withIndicatorTypes

      public final Indicator withIndicatorTypes(String... elements)
      Copy the current immutable object with elements that replace the content of indicatorTypes.
      Parameters:
      elements - The elements to set
      Returns:
      A modified copy of this object

    • withIndicatorTypes

      public final Indicator withIndicatorTypes(Iterable<String> elements)
      Copy the current immutable object with elements that replace the content of indicatorTypes. A shallow reference equality check is used to prevent copying of the same value by returning this.
      Parameters:
      elements - An iterable of indicatorTypes elements to set
      Returns:
      A modified copy of this object

    • withConfidence

      public final Indicator withConfidence(int value)
      Copy the current immutable object by setting a present value for the optional confidence attribute.
      Parameters:
      value - The value for confidence
      Returns:
      A modified copy of this object

    • withConfidence

      public final Indicator withConfidence(Optional<Integer> optional)
      Copy the current immutable object by setting an optional value for the confidence attribute. An equality check is used on inner nullable value to prevent copying of the same value by returning this.
      Parameters:
      optional - A value for confidence
      Returns:
      A modified copy of this object

    • withName

      public final Indicator withName(String value)
      Copy the current immutable object by setting a present value for the optional name attribute.
      Parameters:
      value - The value for name
      Returns:
      A modified copy of this object

    • withName

      public final Indicator withName(Optional<String> optional)
      Copy the current immutable object by setting an optional value for the name attribute. An equality check is used on inner nullable value to prevent copying of the same value by returning this.
      Parameters:
      optional - A value for name
      Returns:
      A modified copy of this object

    • withDescription

      public final Indicator withDescription(String value)
      Copy the current immutable object by setting a present value for the optional description attribute.
      Parameters:
      value - The value for description
      Returns:
      A modified copy of this object

    • withDescription

      public final Indicator withDescription(Optional<String> optional)
      Copy the current immutable object by setting an optional value for the description attribute. An equality check is used on inner nullable value to prevent copying of the same value by returning this.
      Parameters:
      optional - A value for description
      Returns:
      A modified copy of this object

    • withPattern

      public final Indicator withPattern(String value)
      Copy the current immutable object by setting a value for the pattern attribute. An equals check used to prevent copying of the same value by returning this.
      Parameters:
      value - A new value for pattern (can be null)
      Returns:
      A modified copy of the this object

    • withPatternType

      public final Indicator withPatternType(String value)
      Copy the current immutable object by setting a value for the patternType attribute. An equals check used to prevent copying of the same value by returning this.
      Parameters:
      value - A new value for patternType
      Returns:
      A modified copy of the this object

    • withValidFrom

      public final Indicator withValidFrom(StixInstant value)
      Copy the current immutable object by setting a value for the validFrom attribute. A shallow reference equality check is used to prevent copying of the same value by returning this.
      Parameters:
      value - A new value for validFrom (can be null)
      Returns:
      A modified copy of the this object

    • withValidUntil

      public final Indicator withValidUntil(StixInstant value)
      Copy the current immutable object by setting a present value for the optional validUntil attribute.
      Parameters:
      value - The value for validUntil
      Returns:
      A modified copy of this object

    • withValidUntil

      public final Indicator withValidUntil(Optional<? extends StixInstant> optional)
      Copy the current immutable object by setting an optional value for the validUntil attribute. A shallow reference equality check is used on unboxed optional value to prevent copying of the same value by returning this.
      Parameters:
      optional - A value for validUntil
      Returns:
      A modified copy of this object

    • withKillChainPhases

      public final Indicator withKillChainPhases(KillChainPhaseType... elements)
      Copy the current immutable object with elements that replace the content of killChainPhases.
      Parameters:
      elements - The elements to set
      Returns:
      A modified copy of this object

    • withKillChainPhases

      public final Indicator withKillChainPhases(Iterable<? extends KillChainPhaseType> elements)
      Copy the current immutable object with elements that replace the content of killChainPhases. A shallow reference equality check is used to prevent copying of the same value by returning this.
      Parameters:
      elements - An iterable of killChainPhases elements to set
      Returns:
      A modified copy of this object

    • withRelationships

      public final Indicator withRelationships(RelationshipSro... elements)
      Copy the current immutable object with elements that replace the content of relationships.
      Parameters:
      elements - The elements to set
      Returns:
      A modified copy of this object

    • withRelationships

      public final Indicator withRelationships(Iterable<? extends RelationshipSro> elements)
      Copy the current immutable object with elements that replace the content of relationships. A shallow reference equality check is used to prevent copying of the same value by returning this.
      Parameters:
      elements - An iterable of relationships elements to set
      Returns:
      A modified copy of this object

    • withHydrated

      public final Indicator withHydrated(boolean value)
      Copy the current immutable object by setting a value for the hydrated attribute. A value equality check is used to prevent copying of the same value by returning this.
      Parameters:
      value - A new value for hydrated
      Returns:
      A modified copy of the this object

    • withType

      public final Indicator withType(String value)
      Copy the current immutable object by setting a value for the type attribute. An equals check used to prevent copying of the same value by returning this.
      Parameters:
      value - A new value for type (can be null)
      Returns:
      A modified copy of the this object

    • withId

      public final Indicator withId(String value)
      Copy the current immutable object by setting a value for the id attribute. An equals check used to prevent copying of the same value by returning this.
      Parameters:
      value - A new value for id (can be null)
      Returns:
      A modified copy of the this object

    • withCreatedByRef

      public final Indicator withCreatedByRef(IdentitySdo value)
      Copy the current immutable object by setting a present value for the optional createdByRef attribute.
      Parameters:
      value - The value for createdByRef
      Returns:
      A modified copy of this object

    • withCreatedByRef

      public final Indicator withCreatedByRef(Optional<? extends IdentitySdo> optional)
      Copy the current immutable object by setting an optional value for the createdByRef attribute. A shallow reference equality check is used on unboxed optional value to prevent copying of the same value by returning this.
      Parameters:
      optional - A value for createdByRef
      Returns:
      A modified copy of this object

    • withCreated

      public final Indicator withCreated(StixInstant value)
      Copy the current immutable object by setting a value for the created attribute. A shallow reference equality check is used to prevent copying of the same value by returning this.
      Parameters:
      value - A new value for created
      Returns:
      A modified copy of the this object

    • withLang

      public final Indicator withLang(String value)
      Copy the current immutable object by setting a present value for the optional lang attribute.
      Parameters:
      value - The value for lang
      Returns:
      A modified copy of this object

    • withLang

      public final Indicator withLang(Optional<String> optional)
      Copy the current immutable object by setting an optional value for the lang attribute. An equality check is used on inner nullable value to prevent copying of the same value by returning this.
      Parameters:
      optional - A value for lang
      Returns:
      A modified copy of this object

    • withExternalReferences

      public final Indicator withExternalReferences(ExternalReferenceType... elements)
      Copy the current immutable object with elements that replace the content of externalReferences.
      Parameters:
      elements - The elements to set
      Returns:
      A modified copy of this object

    • withExternalReferences

      public final Indicator withExternalReferences(Iterable<? extends ExternalReferenceType> elements)
      Copy the current immutable object with elements that replace the content of externalReferences. A shallow reference equality check is used to prevent copying of the same value by returning this.
      Parameters:
      elements - An iterable of externalReferences elements to set
      Returns:
      A modified copy of this object

    • withObjectMarkingRefs

      public final Indicator withObjectMarkingRefs(MarkingDefinitionDm... elements)
      Copy the current immutable object with elements that replace the content of objectMarkingRefs.
      Parameters:
      elements - The elements to set
      Returns:
      A modified copy of this object

    • withObjectMarkingRefs

      public final Indicator withObjectMarkingRefs(Iterable<? extends MarkingDefinitionDm> elements)
      Copy the current immutable object with elements that replace the content of objectMarkingRefs. A shallow reference equality check is used to prevent copying of the same value by returning this.
      Parameters:
      elements - An iterable of objectMarkingRefs elements to set
      Returns:
      A modified copy of this object

    • withGranularMarkings

      public final Indicator withGranularMarkings(GranularMarkingDm... elements)
      Copy the current immutable object with elements that replace the content of granularMarkings.
      Parameters:
      elements - The elements to set
      Returns:
      A modified copy of this object

    • withGranularMarkings

      public final Indicator withGranularMarkings(Iterable<? extends GranularMarkingDm> elements)
      Copy the current immutable object with elements that replace the content of granularMarkings. A shallow reference equality check is used to prevent copying of the same value by returning this.
      Parameters:
      elements - An iterable of granularMarkings elements to set
      Returns:
      A modified copy of this object

    • withCustomProperties

      public final Indicator withCustomProperties(Map<String,? extends Object> entries)
      Copy the current immutable object by replacing the customProperties map with the specified map. Nulls are not permitted as keys or values. A shallow reference equality check is used to prevent copying of the same value by returning this.
      Parameters:
      entries - The entries to be added to the customProperties map
      Returns:
      A modified copy of this object

    • withModified

      public final Indicator withModified(StixInstant value)
      Copy the current immutable object by setting a value for the modified attribute. A shallow reference equality check is used to prevent copying of the same value by returning this.
      Parameters:
      value - A new value for modified
      Returns:
      A modified copy of the this object

    • withRevoked

      public final Indicator withRevoked(StixBoolean value)
      Copy the current immutable object by setting a value for the revoked attribute. A shallow reference equality check is used to prevent copying of the same value by returning this.
      Parameters:
      value - A new value for revoked
      Returns:
      A modified copy of the this object

    • equals

      public boolean equals(@Nullable Object another)
      This instance is equal to all instances of Indicator that have equal attribute values.
      Overrides:
      equals in class Object
      Returns:
      true if this is equal to another instance

    • hashCode

      public int hashCode()
      Computes a hash code from attributes: labels, indicatorTypes, confidence, name, description, pattern, patternType, validFrom, validUntil, killChainPhases, relationships, hydrated, type, id, createdByRef, created, lang, externalReferences, objectMarkingRefs, granularMarkings, customProperties, modified, revoked.
      Overrides:
      hashCode in class Object
      Returns:
      hashCode value

    • toString

      public String toString()
      Prints the immutable value Indicator with attribute values.
      Overrides:
      toString in class Object
      Returns:
      A string representation of the value

    • toJsonString

      @Redactable(useMask=false, redactionMask="\u2588\u2588REDACTED\u2588\u2588") public String toJsonString()

      Returns a lazily initialized value of the toJsonString attribute. Initialized once and only once and stored for subsequent access with proper synchronization.

      Specified by:
      toJsonString in interface BundleableObject
      Specified by:
      toJsonString in interface StixCommonProperties
      Returns:
      A lazily initialized value of the toJsonString attribute

    • getSpecVersion

      @Redactable(useMask=false, redactionMask="\u2588\u2588REDACTED\u2588\u2588") public String getSpecVersion()
      Helper attribute to track the STIX Spec Version that was used for this object.

      Returns a lazily initialized value of the specVersion attribute. Initialized once and only once and stored for subsequent access with proper synchronization.

      Specified by:
      getSpecVersion in interface StixSpecVersion
      Returns:
      A lazily initialized value of the specVersion attribute

    • copyOf

      public static Indicator copyOf(IndicatorSdo instance)
      Creates an immutable copy of a IndicatorSdo value. Uses accessors to get values to initialize the new immutable instance. If an instance is already immutable, it is returned as is.
      Parameters:
      instance - The instance to copy
      Returns:
      A copied immutable Indicator instance

    • builder

      public static Indicator.Builder builder()
      Creates a builder for Indicator.
      Returns:
      A new Indicator builder