threatactor

Documentation

Overview

Package threatactor implements the STIX 2.1 Threat Actor object.

The following information comes directly from the STIX 2.1 specification.

Threat Actors are actual individuals, groups, or organizations believed to be operating with malicious intent. A Threat Actor is not an Intrusion Set but may support or be affiliated with various Intrusion Sets, groups, or organizations over time.

Threat Actors leverage their resources, and possibly the resources of an Intrusion Set, to conduct attacks and run Campaigns against targets.

Threat Actors can be characterized by their motives, capabilities, goals, sophistication level, past activities, resources they have access to, and their role in the organization.

Index

• type ThreatActor
  • func Decode(data []byte) (*ThreatActor, error)
  • func New() *ThreatActor
  • func (o *ThreatActor) AddPersonalMotivation(s string) error
  • func (o *ThreatActor) AddTypes(values interface{}) error
  • func (o *ThreatActor) Encode() ([]byte, error)
  • func (o *ThreatActor) EncodeToString() (string, error)
  • func (o *ThreatActor) GetPropertyList() []string
  • func (o *ThreatActor) SetSophistication(s string) error
  • func (o *ThreatActor) UnmarshalJSON(b []byte) error
  • func (o *ThreatActor) Valid() (bool, int, []string)

Types

type ThreatActor

type ThreatActor struct {
	objects.CommonObjectProperties
	properties.NameProperty
	properties.DescriptionProperty
	ThreatActorTypes []string `json:"threat_actor_types,omitempty"`
	properties.AliasesProperty
	properties.SeenProperties
	properties.RolesProperty
	properties.GoalsProperty
	Sophistication string `json:"sophistication,omitempty"`
	properties.ResourceLevelProperty
	properties.MotivationProperties
	PersonalMotivations []string `json:"personal_motivations,omitempty"`
}

ThreatActor - This type implements the STIX 2 Threat Actor SDO and defines

all of the properties and methods needed to create and work with this object. All of the methods not defined local to this type are inherited from the individual properties.

func Decode

func Decode(data []byte) (*ThreatActor, error)

Decode - This function is a simple wrapper for decoding JSON data. It will

decode a slice of bytes into an actual struct and return a pointer to that object along with any errors.

func New

func New() *ThreatActor

New - This function will create a new STIX Threat Actor object and return it

as a pointer. It will also initialize the object by setting all of the basic properties.

func (*ThreatActor) AddPersonalMotivation

func (o *ThreatActor) AddPersonalMotivation(s string) error

AddPersonalMotivation - This method takes in a string value representing the motivation of a threat actor from the threat-actor-motivation-ov and adds it to the personal motivations property.

func (*ThreatActor) AddTypes

func (o *ThreatActor) AddTypes(values interface{}) error

AddTypes - This method takes in a string value, a comma separated list of

string values, or a slice of string values that represents an threat actor type and adds it to the threat actor types property. The values SHOULD come from the threat-actor-type-ov open vocabulary.

func (*ThreatActor) Encode

func (o *ThreatActor) Encode() ([]byte, error)

Encode - This method is a simple wrapper for encoding an object into JSON

func (*ThreatActor) EncodeToString

func (o *ThreatActor) EncodeToString() (string, error)

EncodeToString - This method is a simple wrapper for encoding an object into

JSON

func (*ThreatActor) GetPropertyList

func (o *ThreatActor) GetPropertyList() []string

GetProperties - This method will return a list of all of the properties that

are unique to this object. This is used by the custom UnmarshalJSON for this object. It is defined here in this file to make it easy to keep in sync.

func (*ThreatActor) SetSophistication

func (o *ThreatActor) SetSophistication(s string) error

SetSophistication - This method takes in a string value representing the sophistication level of a threat actor from the threat-actor-sophistication-ov and adds it to the sophistication property.

func (*ThreatActor) UnmarshalJSON

func (o *ThreatActor) UnmarshalJSON(b []byte) error

UnmarshalJSON - This method will over write the default UnmarshalJSON method

to enable custom properties that this library does not know about. It will store them as map where the value of each key is a byte arrays. This way a tool that does know how to deal with them can then further process them after this is done. This will also allow the storage of the raw JSON data.

func (*ThreatActor) Valid

func (o *ThreatActor) Valid() (bool, int, []string)

Valid - This method will verify and test all of the properties on an object

to make sure they are valid per the specification. It will return a boolean, an integer that tracks the number of problems found, and a slice of strings that contain the detailed results, whether good or bad.