<commit_before>"""ThreatConnect STIX module"""
from typing import Union
from .model import StixModel
import jmespath
from stix2.v21 import (
    ThreatActor,
    Identity,
    AttackPattern,
    Campaign,
    IntrusionSet,
    Relationship,
    ExternalReference,
    Bundle,
)


class StixThreatActor(StixModel):
    """STIX Threat Actor object."""

    @property
    def produce_map(self):
        # mapping of STIX fields to TC jmespath expressions
        return {
            'id': '@.id',
            'created': '@.dateAdded',
            'modified': '@.dateAdded',
            'name': '@.name',
            # multiple groups
            # 'description': '[].attribute[?type==`Description` && displayed==`true`].value | []',
            # join the results from this
            'description': '@.attribute[?type==`Description` && displayed==`true`].value',
            'threat_actor_types': '@.attribute[?type==`Actor Type`].value',  # no idea
            'spec_version': '2.1',
            'type': 'threat-actor'
        }

    def consume(self, stix_data: Union[list, dict]):
        pass

    def produce(self, tc_data: Union[list, dict]):
        """Produce STIX 2.0 JSON object from TC API response.

        .. code:: json

            {
              "id": 130292,
              "name": "kpot",
              "ownerName": "TCI",
              "dateAdded": "2020-07-22T18:45:06Z",
              "webLink": "https://int-tc-01.tci.ninja/auth/threat/threat.xhtml?threat=130292",
              "attribute": [
                {
                  "id": 1098243,
                  "type": "Threat Type",
                  "value": "Malware Family",
                  "dateAdded": "2020-07-24T15:33:04Z",
                  "lastModified": "2020-07-24T15:33:04Z",
                  "displayed": false,
                  "xid": "e336e2dd-5dfb-48cd-a33a-f8809e83e904:1098243"
                },
                {
                  "id": 1098242,
                  "type": "External ID",
                  "value": "eed6df9be6bdcc0b2ca2f88d7245cfa0",
                  "dateAdded": "2020-07-24T15:33:04Z",
                  "lastModified": "2020-07-24T15:33:04Z",
                  "displayed": false,
                  "xid": "e336e2dd-5dfb-48cd-a33a-f8809e83e904:1098242"
                }
              ],
              "xid": "eed6df9be6bdcc0b2ca2f88d7245cfa0"
            }
        """
        if isinstance(tc_data, dict):
            tc_data = [tc_data]

        actors = []
        for data in tc_data:
            actors.append(ThreatActor(**self._map(data, self.map)))

        return actors

        # return ThreatActor(
        #     id='threat-actor--9a8a0d25-7636-429b-a99e-b2a73cd0f11f',
        #     created='2015-05-07T14:22:14.760Z',
        #     modified='2015-05-07T14:22:14.760Z',
        #     name='<NAME>',
        #     description='<NAME> is known to use phishing attacks to deliver remote access malware to the targets.',
        #     threat_actor_types=['spy', 'criminal'],
        #     spec_version='2.1',
        #     type='threat-actor',
        # )

# identity = Identity(
#     id="identity--1621d4d4-b67d-41e3-9670-f01faf20d111",
#     created="2015-05-10T16:27:17.760Z",
#     modified="2015-05-10T16:27:17.760Z",
#     name="<NAME>",
#     description="<NAME> is a threat actor that utilizes phishing attacks.",
#     identity_class="unknown",<commit_msg>updating threat_actor<commit_after>"""ThreatConnect STIX module"""
from typing import Union
from .model import StixModel
import jmespath
from stix2.v21 import (
    ThreatActor,
    Identity,
    AttackPattern,
    Campaign,
    IntrusionSet,
    Relationship,
    ExternalReference,
    Bundle,
)


class StixThreatActor(StixModel):
    """STIX Threat Actor object."""

    @property
    def produce_map(self):
        # mapping of STIX fields to TC jmespath expressions
        return {
            'id': '@.id',
            'created': '@.dateAdded',
            'modified': '@.dateAdded',
            'name': '@.name',
            # multiple groups
            # 'description': '[].attribute[?type==`Description` && displayed==`true`].value | []',
            # join the results from this
            'description': '@.attribute[?type==`Description` && displayed==`true`].value',
            'threat_actor_types': '@.attribute[?type==`Actor Type`].value',  # no idea
            'spec_version': '2.1',
            'type': 'threat-actor'
        }

    def consume(self, stix_data: Union[list, dict]):
        pass

    def produce(self, tc_data: Union[list, dict]):
        """Produce STIX 2.0 JSON object from TC API response.

        .. code:: json

            {
              "id": 130292,
              "name": "kpot",
              "ownerName": "TCI",
              "dateAdded": "2020-07-22T18:45:06Z",
              "webLink": "https://int-tc-01.tci.ninja/auth/threat/threat.xhtml?threat=130292",
              "attribute": [
                {
                  "id": 1098243,
                  "type": "Threat Type",
                  "value": "Malware Family",
                  "dateAdded": "2020-07-24T15:33:04Z",
                  "lastModified": "2020-07-24T15:33:04Z",
                  "displayed": false,
                  "xid": "e336e2dd-5dfb-48cd-a33a-f8809e83e904:1098243"
                },
                {
                  "id": 1098242,
                  "type": "External ID",
                  "value": "eed6df9be6bdcc0b2ca2f88d7245cfa0",
                  "dateAdded": "2020-07-24T15:33:04Z",
                  "lastModified": "2020-07-24T15:33:04Z",
                  "displayed": false,
                  "xid": "e336e2dd-5dfb-48cd-a33a-f8809e83e904:1098242"
                }
              ],
              "xid": "eed6df9be6bdcc0b2ca2f88d7245cfa0"
            }
        """
        map = {
            'id': '@.id',
            'created': '@.dateAdded',
            'modified': '@.dateAdded',
            'name': '@.name',
            # multiple groups
            # 'description': '[].attribute[?type==`Description` && displayed==`true`].value | []',
            # join the results from this
            'description': '@.attribute[?type==`Description` && displayed==`true`].value',
            'threat_actor_types': '@.attribute[?type==`Actor Type`].value',  # no idea
            'spec_version': '2.1',
            'type': 'threat-actor'
        }

        if isinstance(tc_data, dict):
            tc_data = [tc_data]

        for data in tc_data:
            yield ThreatActor(**self._map(data, map))

        # return ThreatActor(
        #     id='threat-actor--9a8a0d25-7636-429b-a99e-b2a73cd0f11f',
        #     created='2015-05-07T14:22:14.760Z',
        #     modified='2015-05-07T14:22:14.760Z',
        #     name='<NAME>',
        #     description='Adversary Bravo is known to use phishing attacks to deliver remote access malware to the targets.',
        #     threat_actor_types=['spy', 'criminal'],
        #     spec_version='2.1',
        #     type='threat-actor',
        # )

# identity = Identity(
#     id="identity--1621d4d4-b67d-41e3-9670-f01faf20d111",
#     created="2015-05-10T16:27:17.760Z",
#     modified="2015-05-10T16:27:17.760Z",
#     name="<NAME>",
#     description="Adversary Bravo is a threat actor that utilizes phishing attacks.",
#     identity_class="unknown",
{'fraction_non_alphanumeric': 0.148344912137311, 'fraction_numerical': 0.08009807928075194, 'mean_word_length': 1.8141050210808738, 'pattern_counts': {'":': 42, '<': 9, '<?xml version=': 0, '>': 9, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4007389', 'n_tokens_mistral': 2718, 'n_tokens_neox': 2327, 'n_words': 417}