Semantic Equivalence: Consider how to change comparison function across all objects;

oasis-open / cti-python-stix2

OASIS TC Open Repository: Python APIs for STIX 2

https://stix2.readthedocs.io/

BSD 3-Clause "New" or "Revised" License

362 stars 118 forks source link

Semantic Equivalence: Consider how to change comparison function across all objects; #295

Open clenk opened 4 years ago

clenk commented 4 years ago

We should consider how to alter how a given data type is compared across all objects. For example, if I want to use a string comparison algorithm other than Jaro-Winkler, I have to define it for every single object in the config dictionary. Can we offer an interface to overwrite partial_string_based so it gets changed on all object types?

acabrol commented 4 years ago

Dear Clenk i think i have the same need.

I'm trying to compare two object values to detect an anomalous behaviour and i got an exception: Pattern: account_login != user_id

Error: stix2.exceptions.InvalidValueError: Invalid value for Indicator 'pattern': FAIL: Error found at line 1:30. mismatched input 'account_login' expecting {IntNegLiteral, IntPosLiteral, FloatNegLiteral, FloatPosLiteral, HexLiteral, BinaryLiteral, StringLiteral, BoolLiteral, TimestampLiteral}

clenk commented 4 years ago

@acabrol I believe you are seeing a different issue. This issue relates to the Environment.semantic_equivalence() method.

If you have an indicator with "pattern": "account_login != user_id" then you are getting that error because it is not a valid STIX Pattern. Please review the Patterning section in the STIX specification; patterns have to specify an object type and property name and can't just use the name of a Python variable. If you have further questions/bugs please open a new issue.