@mitre-attack/attack-data-model
Version:
A TypeScript API for the MITRE ATT&CK data model
213 lines (210 loc) • 11.9 kB
text/typescript
import { z } from 'zod/v4';
import { StixIdentifier } from '../common/property-schemas/stix-id.cjs';
import { StixType } from '../common/property-schemas/stix-type.cjs';
declare const relationshipTypeSchema: z.ZodEnum<{
uses: "uses";
mitigates: "mitigates";
"subtechnique-of": "subtechnique-of";
detects: "detects";
"attributed-to": "attributed-to";
targets: "targets";
"revoked-by": "revoked-by";
}>;
type RelationshipType = z.infer<typeof relationshipTypeSchema>;
declare const validRelationshipObjectTypes: ("attack-pattern" | "campaign" | "course-of-action" | "intrusion-set" | "malware" | "tool" | "x-mitre-data-component" | "x-mitre-asset")[];
/**
* Validates a STIX relationship based on source type, relationship type, and target type.
*
* @param {StixType} sourceType - The type of the source object in the relationship.
* @param {RelationshipType} relationshipType - The type of relationship between the source and target.
* @param {StixType} targetType - The type of the target object in the relationship.
* @param {function} [errorCollector] - Optional function to collect detailed error information.
* If provided, it will be called with a ZodIssue object for each validation error.
*
* @returns {boolean} Returns true if the relationship is valid, false otherwise.
*
* @example
* // Validate a relationship without error collection
* const isValid = isValidRelationship('malware', 'uses', 'attack-pattern');
*
* @example
* // Validate a relationship with error collection
* let errors = [];
* const isValid = isValidRelationship('malware', 'uses', 'malware', (issue) => errors.push(issue));
*/
declare function isValidRelationship(sourceType: StixType, relationshipType: RelationshipType, targetType: StixType, errorCollector?: (issue: z.core.$ZodIssue) => void): boolean;
/**
* Represents a possible STIX relationship combination.
*/
type RelationshipCombination = {
sourceType: StixType;
relationshipType: RelationshipType;
targetType: StixType;
};
/**
* Filters out invalid relationships from all possible combinations.
* This array contains only the relationships that are not valid according to the STIX specification.
* It's useful for testing purposes and for identifying which relationship combinations are not allowed.
*/
declare const invalidRelationships: RelationshipCombination[];
/**
* Creates a refinement function for relationships
*
* @returns A refinement function for relationship validation
*/
declare function createRelationshipValidationRefinement(): (ctx: z.core.ParsePayload<Partial<Relationship> | {
relationship_type: RelationshipType;
source_ref: StixIdentifier;
target_ref: StixIdentifier;
}>) => void;
declare const relationshipBaseSchema: z.ZodObject<{
type: z.ZodLiteral<"file" | "attack-pattern" | "bundle" | "campaign" | "course-of-action" | "extension-definition" | "identity" | "intrusion-set" | "malware" | "tool" | "marking-definition" | "x-mitre-analytic" | "x-mitre-data-component" | "x-mitre-detection-strategy" | "x-mitre-tactic" | "x-mitre-asset" | "x-mitre-data-source" | "x-mitre-matrix" | "x-mitre-collection" | "relationship" | "artifact">;
id: z.ZodString & z.ZodType<`relationship--${string}`, string, z.core.$ZodTypeInternals<`relationship--${string}`, string>>;
description: z.ZodOptional<z.ZodString>;
lang: z.ZodOptional<z.ZodString>;
spec_version: z.ZodLiteral<"2.1">;
created_by_ref: z.ZodOptional<z.ZodString & z.ZodType<`identity--${string}`, string, z.core.$ZodTypeInternals<`identity--${string}`, string>>>;
created: z.ZodISODateTime;
modified: z.ZodISODateTime;
revoked: z.ZodOptional<z.ZodBoolean>;
labels: z.ZodOptional<z.ZodArray<z.ZodString>>;
external_references: z.ZodOptional<z.ZodArray<z.ZodObject<{
source_name: z.ZodString;
description: z.ZodOptional<z.ZodString>;
url: z.ZodOptional<z.ZodURL>;
external_id: z.ZodOptional<z.ZodString>;
}, z.core.$strip>>>;
object_marking_refs: z.ZodOptional<z.ZodArray<z.ZodString>>;
granular_markings: z.ZodOptional<z.ZodArray<z.ZodObject<{
lang: z.ZodOptional<z.ZodString>;
marking_ref: z.ZodOptional<z.ZodString>;
selectors: z.ZodArray<z.ZodString>;
}, z.core.$strip>>>;
confidence: z.ZodOptional<z.ZodOptional<z.ZodNumber>>;
extensions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
extension_type: z.ZodEnum<{
"new-sdo": "new-sdo";
"new-sco": "new-sco";
"new-sro": "new-sro";
"property-extension": "property-extension";
"toplevel-property-extension": "toplevel-property-extension";
}>;
}, z.core.$catchall<z.ZodUnknown>>, z.ZodRecord<z.ZodString, z.ZodUnknown>]>>>;
x_mitre_attack_spec_version: z.ZodString;
x_mitre_old_attack_id: z.ZodOptional<z.ZodString & z.ZodType<`MOB-M${number}` | `MOB-S${number}`, string, z.core.$ZodTypeInternals<`MOB-M${number}` | `MOB-S${number}`, string>>>;
x_mitre_deprecated: z.ZodOptional<z.ZodBoolean>;
x_mitre_modified_by_ref: z.ZodLiteral<`identity--${string}`>;
relationship_type: z.ZodEnum<{
uses: "uses";
mitigates: "mitigates";
"subtechnique-of": "subtechnique-of";
detects: "detects";
"attributed-to": "attributed-to";
targets: "targets";
"revoked-by": "revoked-by";
}>;
source_ref: z.ZodString;
target_ref: z.ZodString;
}, z.core.$strict>;
type Relationship = z.infer<typeof relationshipBaseSchema>;
type RelationshipPartial = Partial<Relationship>;
declare const relationshipChecks: (ctx: z.core.ParsePayload<RelationshipPartial>) => void;
declare const relationshipSchema: z.ZodObject<{
type: z.ZodLiteral<"file" | "attack-pattern" | "bundle" | "campaign" | "course-of-action" | "extension-definition" | "identity" | "intrusion-set" | "malware" | "tool" | "marking-definition" | "x-mitre-analytic" | "x-mitre-data-component" | "x-mitre-detection-strategy" | "x-mitre-tactic" | "x-mitre-asset" | "x-mitre-data-source" | "x-mitre-matrix" | "x-mitre-collection" | "relationship" | "artifact">;
id: z.ZodString & z.ZodType<`relationship--${string}`, string, z.core.$ZodTypeInternals<`relationship--${string}`, string>>;
description: z.ZodOptional<z.ZodString>;
lang: z.ZodOptional<z.ZodString>;
spec_version: z.ZodLiteral<"2.1">;
created_by_ref: z.ZodOptional<z.ZodString & z.ZodType<`identity--${string}`, string, z.core.$ZodTypeInternals<`identity--${string}`, string>>>;
created: z.ZodISODateTime;
modified: z.ZodISODateTime;
revoked: z.ZodOptional<z.ZodBoolean>;
labels: z.ZodOptional<z.ZodArray<z.ZodString>>;
external_references: z.ZodOptional<z.ZodArray<z.ZodObject<{
source_name: z.ZodString;
description: z.ZodOptional<z.ZodString>;
url: z.ZodOptional<z.ZodURL>;
external_id: z.ZodOptional<z.ZodString>;
}, z.core.$strip>>>;
object_marking_refs: z.ZodOptional<z.ZodArray<z.ZodString>>;
granular_markings: z.ZodOptional<z.ZodArray<z.ZodObject<{
lang: z.ZodOptional<z.ZodString>;
marking_ref: z.ZodOptional<z.ZodString>;
selectors: z.ZodArray<z.ZodString>;
}, z.core.$strip>>>;
confidence: z.ZodOptional<z.ZodOptional<z.ZodNumber>>;
extensions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
extension_type: z.ZodEnum<{
"new-sdo": "new-sdo";
"new-sco": "new-sco";
"new-sro": "new-sro";
"property-extension": "property-extension";
"toplevel-property-extension": "toplevel-property-extension";
}>;
}, z.core.$catchall<z.ZodUnknown>>, z.ZodRecord<z.ZodString, z.ZodUnknown>]>>>;
x_mitre_attack_spec_version: z.ZodString;
x_mitre_old_attack_id: z.ZodOptional<z.ZodString & z.ZodType<`MOB-M${number}` | `MOB-S${number}`, string, z.core.$ZodTypeInternals<`MOB-M${number}` | `MOB-S${number}`, string>>>;
x_mitre_deprecated: z.ZodOptional<z.ZodBoolean>;
x_mitre_modified_by_ref: z.ZodLiteral<`identity--${string}`>;
relationship_type: z.ZodEnum<{
uses: "uses";
mitigates: "mitigates";
"subtechnique-of": "subtechnique-of";
detects: "detects";
"attributed-to": "attributed-to";
targets: "targets";
"revoked-by": "revoked-by";
}>;
source_ref: z.ZodString;
target_ref: z.ZodString;
}, z.core.$strict>;
declare const relationshipPartialSchema: z.ZodObject<{
type: z.ZodOptional<z.ZodLiteral<"file" | "attack-pattern" | "bundle" | "campaign" | "course-of-action" | "extension-definition" | "identity" | "intrusion-set" | "malware" | "tool" | "marking-definition" | "x-mitre-analytic" | "x-mitre-data-component" | "x-mitre-detection-strategy" | "x-mitre-tactic" | "x-mitre-asset" | "x-mitre-data-source" | "x-mitre-matrix" | "x-mitre-collection" | "relationship" | "artifact">>;
id: z.ZodOptional<z.ZodString & z.ZodType<`relationship--${string}`, string, z.core.$ZodTypeInternals<`relationship--${string}`, string>>>;
description: z.ZodOptional<z.ZodOptional<z.ZodString>>;
lang: z.ZodOptional<z.ZodOptional<z.ZodString>>;
spec_version: z.ZodOptional<z.ZodLiteral<"2.1">>;
created_by_ref: z.ZodOptional<z.ZodOptional<z.ZodString & z.ZodType<`identity--${string}`, string, z.core.$ZodTypeInternals<`identity--${string}`, string>>>>;
created: z.ZodOptional<z.ZodISODateTime>;
modified: z.ZodOptional<z.ZodISODateTime>;
revoked: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
labels: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodString>>>;
external_references: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodObject<{
source_name: z.ZodString;
description: z.ZodOptional<z.ZodString>;
url: z.ZodOptional<z.ZodURL>;
external_id: z.ZodOptional<z.ZodString>;
}, z.core.$strip>>>>;
object_marking_refs: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodString>>>;
granular_markings: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodObject<{
lang: z.ZodOptional<z.ZodString>;
marking_ref: z.ZodOptional<z.ZodString>;
selectors: z.ZodArray<z.ZodString>;
}, z.core.$strip>>>>;
confidence: z.ZodOptional<z.ZodOptional<z.ZodOptional<z.ZodNumber>>>;
extensions: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
extension_type: z.ZodEnum<{
"new-sdo": "new-sdo";
"new-sco": "new-sco";
"new-sro": "new-sro";
"property-extension": "property-extension";
"toplevel-property-extension": "toplevel-property-extension";
}>;
}, z.core.$catchall<z.ZodUnknown>>, z.ZodRecord<z.ZodString, z.ZodUnknown>]>>>>;
x_mitre_attack_spec_version: z.ZodOptional<z.ZodString>;
x_mitre_old_attack_id: z.ZodOptional<z.ZodOptional<z.ZodString & z.ZodType<`MOB-M${number}` | `MOB-S${number}`, string, z.core.$ZodTypeInternals<`MOB-M${number}` | `MOB-S${number}`, string>>>>;
x_mitre_deprecated: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
x_mitre_modified_by_ref: z.ZodOptional<z.ZodLiteral<`identity--${string}`>>;
relationship_type: z.ZodOptional<z.ZodEnum<{
uses: "uses";
mitigates: "mitigates";
"subtechnique-of": "subtechnique-of";
detects: "detects";
"attributed-to": "attributed-to";
targets: "targets";
"revoked-by": "revoked-by";
}>>;
source_ref: z.ZodOptional<z.ZodString>;
target_ref: z.ZodOptional<z.ZodString>;
}, z.core.$strict>;
export { type Relationship, type RelationshipCombination, type RelationshipPartial, type RelationshipType, createRelationshipValidationRefinement, invalidRelationships, isValidRelationship, relationshipBaseSchema, relationshipChecks, relationshipPartialSchema, relationshipSchema, relationshipTypeSchema, validRelationshipObjectTypes };