Source code for cybox.objects.process_object

# Copyright (c) 2020, The MITRE Corporation. All rights reserved.
# See LICENSE.txt for complete terms.

from mixbox import entities, fields

import cybox
import cybox.bindings.process_object as process_binding
from cybox.common import ObjectProperties, String, DateTime, UnsignedInteger, Duration, EnvironmentVariableList, ExtractedFeatures
from cybox.objects.network_connection_object import NetworkConnection
from cybox.objects.port_object import Port


class ProcessStatusFactory(entities.EntityFactory):
    @classmethod
    def entity_class(cls, key):
        import cybox.objects.unix_process_object    # noqa
        return cybox.lookup_extension(key, default=ProcessStatus)


[docs]class ProcessStatus(entities.Entity):
    _binding = process_binding
    _binding_class = process_binding.ProcessStatusType
    _namespace = "http://cybox.mitre.org/objects#ProcessObject-2"
    _XSI_TYPE = None    # overridden by subclasses

[docs]    def to_dict(self):
        d = super(ProcessStatus, self).to_dict()

        if self._XSI_TYPE:
            d["xsi:type"] = self._XSI_TYPE

        return d

    @staticmethod
[docs]    def lookup_class(xsi_type):
        return cybox.lookup_extension(xsi_type, default=ProcessStatus)


[docs]class PortList(entities.EntityList):
    _binding = process_binding
    _binding_class = process_binding.PortListType
    _namespace = "http://cybox.mitre.org/objects#ProcessObject-2"

    port = fields.TypedField("Port", Port, multiple=True)


[docs]class NetworkConnectionList(entities.EntityList):
    _binding = process_binding
    _binding_class = process_binding.NetworkConnectionListType
    _namespace = "http://cybox.mitre.org/objects#ProcessObject-2"

    network_connection = fields.TypedField("Network_Connection", NetworkConnection, multiple=True)


[docs]class ChildPIDList(entities.EntityList):
    _binding = process_binding
    _binding_class = process_binding.ChildPIDListType
    _namespace = "http://cybox.mitre.org/objects#ProcessObject-2"

    child_pid = fields.TypedField("Child_PID", UnsignedInteger, multiple=True)


[docs]class ArgumentList(entities.EntityList):
    _binding = process_binding
    _binding_class = process_binding.ArgumentListType
    _namespace = "http://cybox.mitre.org/objects#ProcessObject-2"

    argument = fields.TypedField("Argument", String, multiple=True)


[docs]class ImageInfo(entities.Entity):
    _binding = process_binding
    _binding_class = process_binding.ImageInfoType
    _namespace = "http://cybox.mitre.org/objects#ProcessObject-2"

    file_name = fields.TypedField("File_Name", String)
    command_line = fields.TypedField("Command_Line", String)
    current_directory = fields.TypedField("Current_Directory", String)
    path = fields.TypedField("Path", String)


[docs]class Process(ObjectProperties):
    _binding = process_binding
    _binding_class = process_binding.ProcessObjectType
    _namespace = "http://cybox.mitre.org/objects#ProcessObject-2"
    _XSI_NS = "ProcessObj"
    _XSI_TYPE = "ProcessObjectType"

    pid = fields.TypedField("PID", UnsignedInteger)
    name = fields.TypedField("Name", String)
    creation_time = fields.TypedField("Creation_Time", DateTime)
    parent_pid = fields.TypedField("Parent_PID", UnsignedInteger)
    child_pid_list = fields.TypedField("Child_PID_List", ChildPIDList)
    image_info = fields.TypedField("Image_Info", ImageInfo)
    argument_list = fields.TypedField("Argument_List", ArgumentList)
    environment_variable_list = fields.TypedField("Environment_Variable_List", EnvironmentVariableList)
    kernel_time = fields.TypedField("Kernel_Time", Duration)
    port_list = fields.TypedField("Port_List", PortList)
    network_connection_list = fields.TypedField("Network_Connection_List", NetworkConnectionList)
    start_time = fields.TypedField("Start_Time", DateTime)
    status = fields.TypedField("Status", ProcessStatus, factory=ProcessStatusFactory)
    username = fields.TypedField("Username", String)
    user_time = fields.TypedField("User_Time", Duration)
    extracted_features = fields.TypedField("Extracted_Features", ExtractedFeatures)
    is_hidden = fields.TypedField("is_hidden")