Module Import alias ImportFrom alias ImportFrom alias alias Assign NameStore Call AttributeLoad NameLoad attr NameLoad FunctionDef arguments args NameParam NameParam defaults body Assign NameStore AttributeLoad NameLoad attr If Call NameLoad NameLoad NameLoad body Return If Call NameLoad NameLoad NameLoad body Return Raise Call NameLoad BinOpMod Str NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam NameParam defaults NameLoad body Expr Call NameLoad NameLoad NameLoad Call AttributeLoad NameLoad attr NameLoad Assign NameStore Call NameLoad NameLoad NameLoad If BoolOpAnd Call NameLoad NameLoad Str NameLoad body Assign AttributeStore NameLoad attr NameLoad Return NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam NameParam defaults NameLoad body Assign NameStore Call AttributeLoad NameLoad attr Str Assign NameStore Call AttributeLoad NameLoad attr Str If CompareEq Call NameLoad NameLoad Num body Return Call NameLoad NameLoad NameLoad SubscriptLoad NameLoad Index Num NameLoad Assign NameStore Call NameLoad NameLoad NameLoad NameLoad Str If CompareIn NameLoad TupleLoad Str Str body Assign AttributeStore NameLoad attr Str orelse If CompareIn NameLoad TupleLoad Str Str body Assign AttributeStore NameLoad attr Str orelse Assign AttributeStore NameLoad attr Str Return NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam NameParam defaults NameLoad body Expr Call NameLoad NameLoad NameLoad If Call AttributeLoad NameLoad attr NameLoad NameLoad body Return Call NameLoad NameLoad NameLoad NameLoad NameLoad orelse Return Call NameLoad NameLoad NameLoad NameLoad NameLoad decorator_list FunctionDef arguments args NameParam defaults body If UnaryOpNot Call NameLoad NameLoad Str body Return NameLoad Return Call NameLoad GeneratorExp NameLoad comprehension NameStore Call AttributeLoad AttributeLoad NameLoad attr attr decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body ImportFrom alias alias alias Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign NameStore Dict Str Str Str Str Assign NameStore Dict Str Str Str Str Str Str Str Str If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad orelse If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad Assign AttributeStore NameLoad attr Call NameLoad NameLoad orelse Return NameLoad Return Call NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body ImportFrom alias ImportFrom alias alias Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign NameStore Dict Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad orelse Return NameLoad Assign NameStore Call NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Return Call NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body ImportFrom alias alias alias Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign NameStore Dict Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Assign NameStore Dict Str Str Str Str Str Str Str Str Str Str Str Str Str Str Assign NameStore TupleLoad Str Str Str If CompareIn Str NameLoad body Return Call NameLoad NameLoad NameLoad NameLoad If CompareIn NameLoad NameLoad body Return Call NameLoad NameLoad NameLoad NameLoad orelse If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad Assign AttributeStore NameLoad attr Call NameLoad NameLoad orelse If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad orelse Return NameLoad Return Call NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body ImportFrom alias ImportFrom alias alias alias alias alias Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign NameStore NameLoad Assign NameStore Dict Str Str Str Str Assign NameStore Dict Str Str Str Str Assign NameStore Dict Str Str Str Str Str Str Assign NameStore Dict Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad orelse If CompareIn NameLoad NameLoad body Assign NameStore Call NameLoad Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad Assign AttributeStore NameLoad attr Call NameLoad AttributeLoad AttributeLoad NameLoad attr attr orelse If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad orelse If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad Assign AttributeStore NameLoad attr Call NameLoad NameLoad orelse Return NameLoad If UnaryOpNot NameLoad body Return Call NameLoad NameLoad Assign NameStore Call NameLoad NameLoad Expr Call AttributeLoad NameLoad attr NameLoad Return NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body ImportFrom alias ImportFrom alias alias Assign NameStore Call NameLoad Assign NameStore Dict Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad orelse If CompareEq NameLoad Str body Assign NameStore Call NameLoad Call AttributeLoad NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr Call NameLoad NameLoad orelse Return NameLoad Return Call NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body ImportFrom alias ImportFrom alias alias Assign NameStore Call NameLoad Assign NameStore Dict Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Assign NameStore TupleLoad Str Str Str Str Str Str Str Str Str Str Str Str If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad orelse If CompareIn NameLoad NameLoad body Return Call NameLoad NameLoad NameLoad NameLoad orelse If CompareEq NameLoad Str body Return Call NameLoad NameLoad NameLoad NameLoad orelse If CompareIn Str NameLoad body Return Call NameLoad NameLoad NameLoad NameLoad orelse If CompareIn Str NameLoad body Assign NameStore Call NameLoad Assign AttributeStore NameLoad attr Call NameLoad Call AttributeLoad NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad orelse Return NameLoad Return Call NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body ImportFrom alias ImportFrom alias Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign NameStore Dict Str Str Str Str Str Str Str Str Str Str Assign NameStore Dict Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad If CompareIn Str NameLoad body Assign AttributeStore NameLoad attr NameLoad orelse Assign AttributeStore NameLoad attr NameLoad orelse If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad orelse Return NameLoad Return Call NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body ImportFrom alias Assign NameStore Dict Str Str Str Str Str Str Str Str Assign NameStore Call NameLoad If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad orelse Return NameLoad Return Call NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body ImportFrom alias ImportFrom alias ImportFrom alias alias ImportFrom alias alias alias alias alias alias alias Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Assign NameStore Dict Str Str Str TupleLoad Str Str TupleLoad Str Str TupleLoad Str Str If CompareIn NameLoad NameLoad body Assign TupleStore NameStore NameStore SubscriptLoad NameLoad Index NameLoad Expr Call NameLoad NameLoad NameLoad NameLoad NameLoad Expr Call NameLoad NameLoad NameLoad NameLoad orelse If CompareEq NameLoad Str body Assign NameStore Call NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Expr Call NameLoad NameLoad Str NameLoad NameLoad orelse If CompareEq NameLoad Str body Expr Call NameLoad NameLoad Str NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad orelse If CompareEq NameLoad Str body Expr Call NameLoad NameLoad Str NameLoad NameLoad orelse If CompareEq NameLoad Str body Expr Call NameLoad NameLoad Str NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad orelse If CompareEq NameLoad Str body Expr Call NameLoad NameLoad Str NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad orelse If CompareIn Str NameLoad body Expr Call NameLoad NameLoad Str NameLoad NameLoad orelse Return NameLoad Return Call NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body ImportFrom alias ImportFrom alias Assign NameStore Call NameLoad Assign NameStore Call NameLoad keyword AttributeLoad NameLoad attr Assign NameStore Set Str Str Str Assign NameStore Dict Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad Str NameLoad NameLoad Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad orelse If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad orelse Return NameLoad Return Call NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body ImportFrom alias Assign NameStore Call NameLoad Assign NameStore TupleLoad Str Str Str Assign NameStore Dict Str Str Str Str Str Str If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad orelse If CompareIn NameLoad NameLoad body Return Call NameLoad NameLoad NameLoad NameLoad orelse Return NameLoad Return Call NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body ImportFrom alias ImportFrom alias ImportFrom alias alias Assign NameStore Dict Str Str Str Str Str Str Str Str Assign NameStore Dict Str Str Str Str Str Str Assign NameStore Call NameLoad If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad orelse If CompareIn NameLoad NameLoad body Expr Call AttributeLoad NameLoad attr Str orelse If CompareEq NameLoad Str body Assign NameStore Call NameLoad Call AttributeLoad NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr Call NameLoad NameLoad orelse Return NameLoad Return Call NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body ImportFrom alias alias alias ImportFrom alias alias alias ImportFrom alias Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign NameStore Dict Str Str Str Str Str Str Str Str Str Str Str Str Assign NameStore Dict Str Str Str Str Str Str Assign NameStore Dict Str Str Str Str Str Str Assign NameStore TupleLoad Str Str Str Assign NameStore TupleLoad Str Str Str Str If Call NameLoad GeneratorExp CompareIn NameLoad NameLoad comprehension NameStore NameLoad body Return Call NameLoad NameLoad NameLoad NameLoad orelse If CompareIn NameLoad NameLoad body Return Call NameLoad NameLoad NameLoad NameLoad orelse If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad orelse If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad Assign AttributeStore NameLoad attr Call NameLoad NameLoad orelse If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad orelse If CompareEq NameLoad Str body Assign NameStore Call NameLoad Expr Call NameLoad NameLoad Str NameLoad NameLoad Assign NameStore Call NameLoad Assign AttributeStore NameLoad attr Call NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad orelse Return NameLoad Return Call NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body ImportFrom alias alias alias Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign NameStore Dict Str Str Str Str Str Str Str Str Str Str Str Str Assign NameStore Dict Str Str Str Str Str Str Str Str If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad orelse If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad Assign AttributeStore NameLoad attr Call NameLoad NameLoad orelse If CompareEq NameLoad Str body If UnaryOpNot Call AttributeLoad NameLoad attr Str body Expr Call NameLoad NameLoad Str NameLoad NameLoad orelse If CompareNotIn Str NameLoad body Expr Call NameLoad NameLoad Str NameLoad NameLoad orelse Assign TupleStore NameStore NameStore Call AttributeLoad NameLoad attr Str Num Expr Call NameLoad NameLoad Str NameLoad keyword Str Expr Call NameLoad NameLoad Str NameLoad NameLoad orelse Return NameLoad Return Call NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body ImportFrom alias alias ImportFrom alias ImportFrom alias Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign NameStore Dict Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Assign NameStore Dict Str Str Str Str Str Str Assign NameStore TupleLoad Str Str If CompareIn NameLoad NameLoad body Return Call NameLoad NameLoad NameLoad NameLoad orelse If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad orelse If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad orelse If CompareEq NameLoad Str body Assign NameStore Call NameLoad Call AttributeLoad NameLoad attr NameLoad Assign AttributeStore NameLoad attr Call NameLoad NameLoad orelse Return NameLoad Return Call NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body ImportFrom alias ImportFrom alias alias alias alias alias alias alias alias Assign NameStore TupleLoad Str Str Str Str Assign NameStore Dict Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Assign NameStore Dict Str Str Str Str Str Str Str Str Assign NameStore Dict Str Str Str Str Assign NameStore Dict Str Str Str Str Str Str Str Str Str Str Str Str Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign NameStore Call NameLoad If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad orelse If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad orelse If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad orelse If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad Assign AttributeStore NameLoad attr Call NameLoad NameLoad orelse If CompareIn NameLoad NameLoad body Return Call NameLoad NameLoad NameLoad NameLoad orelse If CompareEq NameLoad Str body Assign NameStore Call NameLoad Call AttributeLoad NameLoad attr NameLoad keyword AttributeLoad NameLoad attr Assign AttributeStore NameLoad attr Call NameLoad NameLoad Assign AttributeStore NameLoad attr Call NameLoad NameLoad orelse If CompareEq NameLoad Str body Assign NameStore Call NameLoad Call AttributeLoad NameLoad attr NameLoad keyword AttributeLoad NameLoad attr Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr Call NameLoad NameLoad Assign AttributeStore NameLoad attr Call NameLoad NameLoad orelse If CompareEq NameLoad Str body Assign NameStore Call NameLoad Call AttributeLoad NameLoad attr NameLoad keyword AttributeLoad NameLoad attr Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr Call NameLoad NameLoad Assign AttributeStore NameLoad attr Call NameLoad NameLoad orelse Return NameLoad Return Call NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body ImportFrom alias alias ImportFrom alias Assign NameStore Call NameLoad Assign NameStore Dict Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad orelse If CompareEq NameLoad Str body Assign NameStore Call NameLoad Call AttributeLoad NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr Call NameLoad NameLoad orelse Return NameLoad Return Call NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body ImportFrom alias ImportFrom alias alias Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign NameStore TupleLoad Str Str Assign NameStore TupleLoad Str Str Str Assign NameStore Dict Str Str Str Str Str Str Str Str Str Str If CompareIn NameLoad NameLoad body Return Call NameLoad NameLoad NameLoad NameLoad orelse If CompareIn NameLoad NameLoad body Return Call NameLoad NameLoad NameLoad NameLoad orelse If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad orelse If CompareEq NameLoad Str body Expr Call NameLoad NameLoad Str NameLoad NameLoad Assign AttributeStore NameLoad attr Call NameLoad NameLoad orelse Return NameLoad Return Call NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body ImportFrom alias alias ImportFrom alias Assign NameStore Dict Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Assign NameStore Call NameLoad If CompareEq NameLoad Str body Return Call NameLoad NameLoad NameLoad NameLoad orelse If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad orelse If CompareEq NameLoad Str body Assign NameStore Call NameLoad Call AttributeLoad NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr Call NameLoad NameLoad orelse Return NameLoad Return Call NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body ImportFrom alias Assign NameStore Dict Str Str Str Str Str Str Str Str Str Str If CompareNotIn NameLoad NameLoad body Return NameLoad Assign NameStore Call NameLoad Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad Return Call NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body ImportFrom alias alias alias alias alias alias alias alias Assign NameStore Dict Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Assign NameStore Dict Str Str Str Str Assign NameStore Dict Str Str Str Str Str Str Assign NameStore Dict Str Str Str Str Assign NameStore Dict Str Str Str Str Str Str Str Str Str Str Str Str Assign NameStore Dict Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign NameStore Call NameLoad NameLoad Assign NameStore Call NameLoad Assign NameStore Call NameLoad NameLoad If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad orelse If CompareIn NameLoad NameLoad body Assign NameStore Call NameLoad Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad orelse If CompareIn NameLoad NameLoad body Assign NameStore Call NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad orelse If CompareIn NameLoad NameLoad body Assign NameStore Call NameLoad Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad orelse If CompareIn NameLoad NameLoad body Assign NameStore Call NameLoad Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad Assign AttributeStore NameLoad attr TupleLoad NameLoad Assign AttributeStore NameLoad attr NameLoad orelse If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad orelse If CompareEq NameLoad Str body Expr Call NameLoad NameLoad Str NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad orelse Return NameLoad Return Call NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body Expr Call AttributeLoad NameLoad attr Str Return NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body Pass decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body ImportFrom alias alias alias alias alias Assign NameStore Dict Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Assign NameStore Dict Str Str Str Str Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign NameStore Call NameLoad NameLoad If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad orelse If CompareEq NameLoad Str body Assign NameStore Call NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr Call NameLoad NameLoad orelse Return NameLoad Return Call NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body ImportFrom alias ImportFrom alias alias alias alias alias ImportFrom alias alias alias alias alias alias alias alias alias alias alias alias alias alias alias alias alias alias Assign NameStore Dict Str Str Str Str Str Str Str Str Str Str Assign NameStore Dict Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Assign NameStore Dict Str Str Str Str Assign NameStore Dict Str Str Str Str Str Str Assign NameStore Dict Str Str Str Str Assign NameStore Dict Str Str Str Str Assign NameStore Dict Str Str Str Str Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign NameStore Call NameLoad NameLoad Assign NameStore Call NameLoad Assign NameStore Call NameLoad NameLoad Assign NameStore Call NameLoad Assign NameStore Call NameLoad If CompareIn Str NameLoad body Expr Call NameLoad NameLoad Str NameLoad NameLoad orelse If Call NameLoad GeneratorExp CompareIn NameLoad NameLoad comprehension NameStore NameLoad body Assign NameStore Call AttributeLoad NameLoad attr NameLoad NameLoad Expr Call NameLoad NameLoad NameLoad NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad orelse If Call NameLoad GeneratorExp CompareIn NameLoad NameLoad comprehension NameStore NameLoad body Assign NameStore Call AttributeLoad NameLoad attr NameLoad NameLoad Expr Call NameLoad NameLoad NameLoad NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad orelse If Call NameLoad GeneratorExp CompareIn NameLoad NameLoad comprehension NameStore NameLoad body Assign NameStore Call AttributeLoad NameLoad attr NameLoad NameLoad Expr Call NameLoad NameLoad NameLoad NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad orelse If Call NameLoad GeneratorExp CompareIn NameLoad NameLoad comprehension NameStore NameLoad body Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign NameStore Call NameLoad NameLoad Assign NameStore Call NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Assign NameStore Call AttributeLoad NameLoad attr NameLoad NameLoad Expr Call NameLoad NameLoad NameLoad NameLoad NameLoad orelse If Call NameLoad GeneratorExp CompareIn NameLoad NameLoad comprehension NameStore NameLoad body Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign NameStore Call NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Assign NameStore Call AttributeLoad NameLoad attr NameLoad NameLoad Expr Call NameLoad NameLoad NameLoad NameLoad NameLoad orelse If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad orelse If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad orelse If CompareIn Str NameLoad body Assign NameStore Call NameLoad Assign NameStore Call NameLoad Expr Call NameLoad NameLoad Str NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad orelse If CompareIn Str NameLoad body Assign NameStore Call NameLoad Assign NameStore Call NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Expr Call NameLoad NameLoad Str NameLoad NameLoad orelse If BoolOpOr CompareEq NameLoad Str CompareEq NameLoad Str body Assign NameStore Call NameLoad Assign NameStore Call NameLoad NameLoad Assign NameStore Call NameLoad Assign NameStore Call NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Expr Call NameLoad NameLoad Str NameLoad NameLoad orelse If CompareIn Str NameLoad body Assign NameStore Call NameLoad Assign NameStore Call NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad Expr Call NameLoad NameLoad Str NameLoad NameLoad orelse If CompareIn Str NameLoad body Assign NameStore Call NameLoad Assign NameStore Call NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Expr Call NameLoad NameLoad Str NameLoad NameLoad orelse If CompareIn Str NameLoad body Assign NameStore Call NameLoad Assign NameStore Call NameLoad NameLoad Assign NameStore Call NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Expr Call NameLoad NameLoad Str NameLoad NameLoad orelse Return NameLoad Return Call NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body ImportFrom alias Assign NameStore Call NameLoad Assign NameStore Dict Str Str Str Str If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad orelse Return NameLoad Return Call NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body ImportFrom alias Assign NameStore Call NameLoad Assign NameStore Dict Str Str Str Str Str Str If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad orelse Return NameLoad Return Call NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body ImportFrom alias If CompareNotEq NameLoad Str body Return Assign NameStore Call NameLoad Expr Call NameLoad NameLoad Str NameLoad NameLoad Return Call NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body ImportFrom alias ImportFrom alias Assign NameStore Call AttributeLoad NameLoad attr Assign NameStore Dict Str Str Str Str Str Str Str Str Str Str Str Str Assign NameStore Dict Str Str Str Str Str Str Str Str Str Str Assign NameStore Dict Str Str Str Str Str Str Assign NameStore Dict Str Str Str Str If CompareIn Str NameLoad body Return Call NameLoad NameLoad NameLoad NameLoad orelse If CompareEq NameLoad Str body Expr Call NameLoad NameLoad NameLoad NameLoad orelse If CompareIn NameLoad NameLoad body Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad orelse If CompareIn NameLoad NameLoad body Assign NameStore Call AttributeLoad NameLoad attr Assign NameStore Call AttributeLoad NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad orelse If CompareIn NameLoad NameLoad body Assign NameStore Call AttributeLoad NameLoad attr Assign NameStore Call AttributeLoad NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad orelse If CompareIn NameLoad NameLoad body Assign NameStore Call AttributeLoad NameLoad attr Assign NameStore Call AttributeLoad NameLoad attr Assign AttributeStore NameLoad attr NameLoad Assign NameStore Call AttributeLoad NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Expr Call NameLoad NameLoad SubscriptLoad NameLoad Index NameLoad NameLoad NameLoad orelse Return NameLoad Return Call NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body Assign NameStore NameLoad Assign NameStore SubscriptLoad Call AttributeLoad NameLoad attr Str Num Index Num If CompareIn NameLoad NameLoad body Assign NameStore SubscriptLoad NameLoad Index NameLoad Assign NameStore Call NameLoad NameLoad NameLoad NameLoad If CompareIs NameLoad NameLoad body Expr Call AttributeLoad NameLoad attr Str NameLoad Return NameLoad decorator_list Assign NameStore Dict Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str NameLoad NameLoad NameLoad NameLoad NameLoad NameLoad NameLoad NameLoad NameLoad NameLoad NameLoad NameLoad NameLoad NameLoad NameLoad NameLoad NameLoad NameLoad NameLoad NameLoad
N/A N/A logging cybox.core Object N/A xml utils N/A LOG N/A N/A logging getLogger __name__ _assert_field N/A N/A obj attrname N/A N/A N/A klass N/A obj __class__ N/A N/A hasattr obj attrname N/A N/A N/A N/A hasattr klass attrname N/A N/A N/A N/A AttributeError N/A Object has no attribute: %s attrname N/A _set_field N/A N/A obj attrname value condition N/A None N/A N/A N/A setattr obj attrname N/A N/A xml sanitize value N/A attr N/A getattr obj attrname N/A N/A N/A hasattr attr condition condition N/A N/A N/A attr condition condition N/A attr N/A _set_numeric_field N/A N/A obj attrname value condition N/A None N/A N/A stripped N/A N/A value strip [] N/A values N/A N/A stripped split  TO  N/A N/A N/A len values 1 N/A N/A N/A _set_field obj attrname N/A values N/A 0 condition N/A field N/A _set_field obj attrname values InclusiveBetween N/A N/A condition N/A Contains Equals N/A N/A N/A field apply_condition ANY N/A N/A N/A condition N/A DoesNotContain DoesNotEqual N/A N/A N/A field apply_condition NONE N/A N/A N/A field apply_condition ALL N/A field N/A set_field N/A N/A obj attrname value condition N/A None N/A N/A N/A _assert_field obj attrname N/A N/A N/A utils is_numeric obj attrname N/A N/A N/A _set_numeric_field obj attrname value condition N/A N/A N/A _set_field obj attrname value condition N/A has_content N/A N/A object N/A N/A N/A N/A N/A hasattr object _fields N/A N/A False N/A N/A any N/A x N/A x N/A N/A N/A object _fields itervalues N/A create_disk_obj N/A N/A search_string content_string condition N/A N/A cybox.objects.disk_object Disk DiskPartition PartitionList N/A disk N/A Disk N/A part N/A DiskPartition N/A disk_attrmap N/A DiskItem/DiskName DiskItem/DiskSize disk_name disk_size N/A part_attrmap N/A DiskItem/PartitionList/Partition/PartitionLength DiskItem/PartitionList/Partition/PartitionNumber DiskItem/PartitionList/Partition/PartitionOffset DiskItem/PartitionList/Partition/PartitionType partition_length partition_id partition_offset partition_type N/A N/A search_string disk_attrmap N/A N/A N/A set_field disk N/A disk_attrmap N/A search_string content_string condition N/A N/A N/A search_string part_attrmap N/A N/A N/A set_field part N/A part_attrmap N/A search_string content_string condition N/A N/A disk partition_list N/A PartitionList part N/A N/A None N/A N/A Object disk N/A create_dns_obj N/A N/A search_string content_string condition N/A N/A cybox.objects.dns_record_object DNSRecord cybox.objects.dns_cache_object DNSCache DNSCacheEntry N/A cache N/A DNSCache N/A record N/A DNSRecord N/A attrmap N/A DnsEntryItem/DataLength DnsEntryItem/Flags DnsEntryItem/Host DnsEntryItem/RecordData/Host DnsEntryItem/RecordData/IPv4Address DnsEntryItem/RecordName DnsEntryItem/RecordType DnsEntryItem/TimeToLive data_length flags domain_name record_data record_data record_name record_type ttl N/A N/A search_string attrmap N/A N/A N/A set_field record N/A attrmap N/A search_string content_string condition N/A N/A None N/A entry N/A DNSCacheEntry N/A N/A entry dns_entry record N/A N/A cache dns_cache_entry entry N/A N/A Object cache N/A create_driver_obj N/A N/A search_string content_string condition N/A N/A cybox.objects.win_driver_object WinDriver DeviceObjectStruct DeviceObjectList N/A windriver N/A WinDriver N/A device N/A DeviceObjectStruct N/A device_attrmap N/A DriverItem/DeviceItem/AttachedDeviceName DriverItem/DeviceItem/AttachedDeviceObject DriverItem/DeviceItem/AttachedToDeviceName DriverItem/DeviceItem/AttachedToDeviceObject DriverItem/DeviceItem/AttachedToDriverName DriverItem/DeviceItem/AttachedToDriverObject DriverItem/DeviceItem/DeviceName DriverItem/DeviceItem/DeviceObject attached_device_name attached_device_object attached_to_device_name attached_to_device_object attached_to_driver_name attached_to_driver_object device_name device_object N/A driver_attrmap N/A DriverItem/DriverInit DriverItem/DriverName DriverItem/DriverObjectAddress DriverItem/DriverStartIo DriverItem/DriverUnload DriverItem/ImageBase DriverItem/ImageSize driver_init driver_name driver_object_address driver_start_io driver_unload image_base image_size N/A file_keys N/A DriverItem/Sha1sum DriverItem/Sha256sum DriverItem/StringList/string N/A N/A /PEInfo/ search_string N/A N/A N/A create_pefile_obj search_string content_string condition N/A N/A search_string file_keys N/A N/A N/A create_file_obj search_string content_string condition N/A N/A N/A search_string device_attrmap N/A N/A N/A set_field device N/A device_attrmap N/A search_string content_string condition N/A N/A windriver device_object_list N/A DeviceObjectList device N/A N/A N/A search_string driver_attrmap N/A N/A N/A set_field windriver N/A driver_attrmap N/A search_string content_string condition N/A N/A None N/A N/A Object windriver N/A create_email_obj N/A N/A search_string content_string condition N/A N/A cybox.objects.file_object File cybox.objects.email_message_object Attachments EmailMessage EmailHeader ReceivedLine ReceivedLineList N/A email N/A EmailMessage N/A header N/A EmailHeader N/A received N/A ReceivedLine N/A attachment None N/A file_attrmap N/A Email/Attachment/Name Email/Attachment/SizeInBytes file_name size_in_bytes N/A email_attrmap N/A Email/Body Email/EmailServer raw_body email_server N/A received_attrmap N/A Email/Received Email/ReceivedFromHost Email/ReceivedFromIP timestamp from_ from_ N/A header_attrmap N/A Email/BCC Email/CC Email/Content-Type Email/Date Email/From Email/In-Reply-To Email/MIME-Version Email/Subject Email/To Email/ReplyTo bcc cc content_type date from_ in_reply_to mime_version subject to reply_to N/A N/A search_string email_attrmap N/A N/A N/A set_field email N/A email_attrmap N/A search_string content_string condition N/A N/A N/A search_string file_attrmap N/A N/A attachment N/A File N/A N/A set_field attachment N/A file_attrmap N/A search_string content_string condition N/A N/A email attachments N/A Attachments N/A N/A attachment parent id_ N/A N/A N/A search_string header_attrmap N/A N/A N/A set_field header N/A header_attrmap N/A search_string content_string condition N/A N/A email header header N/A N/A N/A search_string received_attrmap N/A N/A N/A set_field received N/A received_attrmap N/A search_string content_string condition N/A N/A header received_lines N/A ReceivedLineList received N/A N/A None N/A N/A attachment N/A N/A N/A Object email N/A email N/A Object email N/A N/A N/A email add_related attachment N/A email N/A create_win_event_log_obj N/A N/A search_string content_string condition N/A N/A cybox.common.properties String cybox.objects.win_event_log_object WinEventLog UnformattedMessageList N/A eventlog N/A WinEventLog N/A attrmap N/A EventLogItem/CorrelationActivityId EventLogItem/CorrelationRelatedActivityId EventLogItem/EID EventLogItem/ExecutionProcessId EventLogItem/ExecutionThreadId EventLogItem/blob EventLogItem/category EventLogItem/categoryNum EventLogItem/genTime EventLogItem/index EventLogItem/log EventLogItem/machine EventLogItem/message EventLogItem/reserved EventLogItem/source EventLogItem/type EventLogItem/user EventLogItem/writeTime correlation_activity_id correlation_related_activity_id eid execution_process_id execution_thread_id blob category category_num generation_time index log machine message reserved source type_ user write_time N/A N/A search_string attrmap N/A N/A N/A set_field eventlog N/A attrmap N/A search_string content_string condition N/A N/A N/A search_string EventLogItem/unformattedMessage/string N/A N/A s N/A String N/A N/A xml sanitize content_string N/A N/A s condition condition N/A N/A eventlog unformatted_message_list N/A UnformattedMessageList s N/A N/A None N/A N/A Object eventlog N/A create_file_obj N/A N/A search_string content_string condition N/A N/A cybox.objects.file_object File cybox.common ExtractedStrings ExtractedFeatures N/A f N/A File N/A attrmap N/A FileItem/Accessed FileItem/Created FileItem/DevicePath FileItem/FileExtension FileItem/FileName FileItem/FilePath FileItem/FullPath FileItem/Md5sum FileItem/Sha256sum FileItem/Sha1sum DriverItem/Sha1sum DriverItem/Md5sum DriverItem/Sha256sum FileItem/Modified FileItem/PeakEntropy FileItem/SizeInBytes FileItem/Username accessed_time created_time device_path file_extension file_name file_path full_path md5 sha256 sha1 sha1 md5 sha256 modified_time peak_entropy size_in_bytes user_owner N/A winfile_keys N/A FileItem/Drive FileItem/FileAttributes FileItem/FilenameAccessed FileItem/FilenameCreated FileItem/FilenameModified FileItem/SecurityID FileItem/SecurityType FileItem/StreamList/Stream/Md5sum FileItem/StreamList/Stream/Name FileItem/StreamList/Stream/Sha1sum FileItem/StreamList/Stream/Sha256sum FileItem/StreamList/Stream/SizeInBytes N/A N/A search_string attrmap N/A N/A N/A set_field f N/A attrmap N/A search_string content_string condition N/A N/A N/A search_string winfile_keys N/A N/A N/A create_win_file_obj search_string content_string condition N/A N/A N/A search_string FileItem/INode N/A N/A N/A create_unix_file_obj search_string content_string condition N/A N/A N/A /PEInfo/ search_string N/A N/A N/A create_pefile_obj search_string content_string condition N/A N/A N/A /StringList/string search_string N/A N/A extracted_features N/A ExtractedFeatures N/A N/A extracted_features strings N/A ExtractedStrings N/A N/A xml sanitize content_string N/A N/A f extracted_features extracted_features N/A N/A None N/A N/A Object f N/A create_hook_obj N/A N/A search_string content_string condition N/A N/A cybox.objects.win_kernel_hook_object WinKernelHook cybox.common.digitalsignature DigitalSignature N/A hook N/A WinKernelHook N/A ds N/A DigitalSignature N/A hook_attrmap N/A HookItem/HookDescription HookItem/HookedFunction HookItem/HookedModule HookItem/HookingAddress HookItem/HookingModule hook_description hooked_function hooked_module hooking_address hooking_module N/A ds_attrmap N/A HookItem/DigitalSignatureHooking/CertificateIssuer HookItem/DigitalSignatureHooking/CertificateSubject HookItem/DigitalSignatureHooking/Description HookItem/DigitalSignatureHooking/SignatureExists HookItem/DigitalSignatureHooking/SignatureVerified HookItem/DigitalSignatureHooked/CertificateIssuer HookItem/DigitalSignatureHooked/CertificateSubject HookItem/DigitalSignatureHooked/Description HookItem/DigitalSignatureHooked/SignatureExists HookItem/DigitalSignatureHooked/SignatureVerified certificate_issuer certificate_subject signature_description signature_exists signature_verified certificate_issuer certificate_subject signature_description signature_exists signature_verified N/A N/A search_string ds_attrmap N/A N/A N/A set_field ds N/A ds_attrmap N/A search_string content_string condition N/A N/A DigitalSignatureHooking search_string N/A N/A N/A hook digital_signature_hooking ds N/A N/A N/A hook digital_signature_hooked ds N/A N/A N/A search_string hook_attrmap N/A N/A N/A set_field hook N/A hook_attrmap N/A search_string content_string condition N/A N/A None N/A N/A Object hook N/A create_library_obj N/A N/A search_string content_string condition N/A N/A cybox.objects.library_object Library N/A attrmap N/A ModuleItem/ModuleBase ModuleItem/ModuleName ModuleItem/ModulePath ModuleItem/ModuleSize base_address name path size N/A library N/A Library N/A N/A search_string attrmap N/A N/A N/A set_field library N/A attrmap N/A search_string content_string condition N/A N/A None N/A N/A Object library N/A create_network_connection_obj N/A N/A search_string content_string condition N/A N/A cybox.objects.socket_address_object SocketAddress cybox.objects.port_object Port cybox.objects.network_connection_object NetworkConnection Layer7Connections cybox.objects.http_session_object HTTPSession HTTPClientRequest HTTPRequestResponse HTTPRequestHeader HTTPRequestHeaderFields HostField HTTPRequestLine N/A session N/A HTTPSession N/A request_response N/A HTTPRequestResponse N/A request N/A HTTPClientRequest N/A request_line N/A HTTPRequestLine N/A header N/A HTTPRequestHeader N/A header_fields N/A HTTPRequestHeaderFields N/A layer7 N/A Layer7Connections N/A socketaddr N/A SocketAddress N/A net N/A NetworkConnection N/A N/A layer7 http_session session N/A N/A session http_request_response request_response N/A N/A request_response http_client_request request N/A N/A request http_request_header header N/A socket_attrmap N/A PortItem/localIP PortItem/remoteIP ProcessItem/PortList/PortItem/localIP N/A ip_address source_socket_address N/A ip_address destination_socket_address N/A ip_address source_socket_address N/A N/A search_string socket_attrmap N/A N/A N/A socket_field net_field N/A socket_attrmap N/A search_string N/A N/A set_field socketaddr socket_field content_string condition N/A N/A set_field net net_field socketaddr N/A N/A N/A search_string Network/DNS N/A N/A host N/A HostField N/A N/A header_fields host host N/A N/A header parsed_header header_fields N/A N/A set_field host domain_name content_string condition N/A N/A N/A search_string Network/HTTP_Referer N/A N/A N/A set_field header_fields referer content_string condition N/A N/A header parsed_header header_fields N/A N/A N/A search_string Network/String N/A N/A N/A set_field header raw_header content_string condition N/A N/A N/A search_string Network/URI N/A N/A N/A set_field request_line value content_string condition N/A N/A request http_request_line request_line N/A N/A N/A search_string Network/UserAgent N/A N/A N/A set_field header_fields user_agent content_string condition N/A N/A header parsed_header header_fields N/A N/A N/A PortItem/CreationTime search_string N/A N/A N/A set_field net creation_time content_string condition N/A N/A None N/A N/A Object net N/A create_net_route_obj N/A N/A search_string content_string condition N/A N/A cybox.objects.network_route_entry_object NetworkRouteEntry cybox.objects.address_object Address N/A net N/A NetworkRouteEntry N/A addr N/A Address category N/A Address CAT_IPV4 N/A addr_keys N/A RouteEntryItem/Destination RouteEntryItem/Gateway RouteEntryItem/Netmask N/A attr_map N/A RouteEntryItem/Destination RouteEntryItem/Gateway RouteEntryItem/Interface RouteEntryItem/IsIPv6 RouteEntryItem/Metric RouteEntryItem/Netmask RouteEntryItem/Protocol RouteEntryItem/RouteAge RouteEntryItem/RouteType destination_address gateway_address interface is_ipv6 metric netmask protocol route_age route_type N/A N/A search_string addr_keys N/A N/A N/A set_field addr address_value content_string condition N/A N/A set_field net N/A attr_map N/A search_string addr N/A N/A N/A search_string attr_map N/A N/A N/A set_field net N/A attr_map N/A search_string content_string condition N/A N/A None N/A N/A Object net N/A create_port_obj N/A N/A search_string content_string condition N/A N/A cybox.objects.port_object Port N/A port N/A Port N/A netconn_keys N/A PortItem/CreationTime PortItem/localIP PortItem/remoteIP N/A attrmap N/A PortItem/localPort PortItem/remotePort PortItem/protocol port_value port_value layer4_protocol N/A N/A search_string attrmap N/A N/A N/A set_field port N/A attrmap N/A search_string content_string condition N/A N/A N/A search_string netconn_keys N/A N/A N/A create_network_connection_obj search_string content_string condition N/A N/A None N/A N/A Object port N/A create_prefetch_obj N/A N/A search_string content_string condition N/A N/A cybox.common.properties String cybox.objects.win_volume_object WinVolume cybox.objects.win_prefetch_object WinPrefetch AccessedFileList N/A prefected_attrmap N/A PrefetchItem/ApplicationFileName PrefetchItem/LastRun PrefetchItem/PrefetchHash PrefetchItem/TimesExecuted application_file_name last_run prefetch_hash times_executed N/A volume_attrmap N/A PrefetchItem/VolumeList/VolumeItem/DevicePath PrefetchItem/VolumeList/VolumeItem/CreationTime PrefetchItem/VolumeList/VolumeItem/SerialNumber device_path creation_time serial_number N/A prefetch N/A WinPrefetch N/A N/A search_string prefected_attrmap N/A N/A N/A set_field prefetch N/A prefected_attrmap N/A search_string content_string condition N/A N/A N/A search_string volume_attrmap N/A N/A N/A N/A LOG info Cannot translate WinVolume object. See https://github.com/CybOXProject/python-cybox/issues/269 N/A N/A N/A search_string PrefetchItem/AccessedFileList/AccessedFile N/A N/A s N/A String N/A N/A xml sanitize content_string N/A N/A s condition condition N/A N/A prefetch accessed_file_list N/A AccessedFileList s N/A N/A None N/A N/A Object prefetch N/A create_process_obj N/A N/A search_string content_string condition N/A N/A cybox.common ExtractedFeatures ExtractedStrings ExtractedString cybox.objects.process_object Process PortList ImageInfo cybox.objects.port_object Port N/A proc N/A Process N/A port N/A Port N/A image N/A ImageInfo N/A exfeatures N/A ExtractedFeatures N/A proc_attrmap N/A ProcessItem/Username ProcessItem/name ProcessItem/parentpid ProcessItem/pid ProcessItem/startTime ProcessItem/userTime username name parent_pid pid start_time user_time N/A port_attrmap N/A ProcessItem/PortList/PortItem/localPort ProcessItem/PortList/PortItem/remotePort ProcessItem/PortList/PortItem/protocol port_value port_value layer4_protcol N/A image_attrmap N/A ProcessItem/arguments ProcessItem/path ServiceItem/path command_line path path N/A netconn_keys N/A ProcessItem/PortList/PortItem/CreationTime ProcessItem/PortList/PortItem/localIP ProcessItem/PortList/PortItem/remoteIP N/A winproc_keys N/A HandleList SectionList ProcessItem/SecurityID ProcessItem/SecurityType N/A N/A any N/A N/A term search_string N/A term winproc_keys N/A N/A N/A create_win_process_obj search_string content_string condition N/A N/A N/A search_string netconn_keys N/A N/A N/A create_network_connection_obj search_string content_string condition N/A N/A N/A search_string proc_attrmap N/A N/A N/A set_field proc N/A proc_attrmap N/A search_string content_string condition N/A N/A N/A search_string port_attrmap N/A N/A N/A set_field port N/A port_attrmap N/A search_string content_string condition N/A N/A proc port_list N/A PortList port N/A N/A N/A search_string image_attrmap N/A N/A N/A set_field image N/A image_attrmap N/A search_string content_string condition N/A N/A proc image_info image N/A N/A N/A search_string ProcessItem/StringList/string N/A N/A s N/A ExtractedString N/A N/A set_field s string_value content_string condition N/A exfeatures N/A ExtractedFeatures N/A N/A exfeatures strings N/A ExtractedStrings s N/A N/A proc extracted_features exfeatures N/A N/A None N/A N/A Object proc N/A create_registry_obj N/A N/A search_string content_string condition N/A N/A cybox.objects.win_registry_key_object WinRegistryKey RegistryValue RegistryValues N/A value N/A RegistryValue N/A key N/A WinRegistryKey N/A key_attrmap N/A RegistryItem/Username RegistryItem/Hive RegistryItem/KeyPath RegistryItem/Modified RegistryItem/NumSubKeys RegistryItem/NumValues creator_username hive key modified_time num_subkeys num_values N/A value_attrmap N/A RegistryItem/Text RegistryItem/Value RegistryItem/Type RegistryItem/ValueName data data data_type name N/A N/A search_string key_attrmap N/A N/A N/A set_field key N/A key_attrmap N/A search_string content_string condition N/A N/A N/A search_string value_attrmap N/A N/A N/A set_field value N/A value_attrmap N/A search_string content_string condition N/A N/A key values N/A RegistryValues value N/A N/A N/A search_string RegistryItem/Path N/A N/A N/A N/A N/A content_string startswith HKEY_ N/A N/A N/A set_field key key content_string condition N/A N/A N/A \ content_string N/A N/A N/A set_field key hive content_string condition N/A N/A N/A hiveval keyval N/A N/A content_string split \ 1 N/A N/A set_field key hive hiveval condition Equals N/A N/A set_field key key keyval condition N/A N/A None N/A N/A Object key N/A create_service_obj N/A N/A search_string content_string condition N/A N/A cybox.objects.win_service_object WinService ServiceDescriptionList cybox.common.hashes HashList cybox.common.properties String N/A hashlist N/A HashList N/A service N/A WinService N/A attrmap N/A ServiceItem/arguments ServiceItem/mode ServiceItem/name ServiceItem/serviceDLL ServiceItem/serviceDLLCertificateSubject ServiceItem/serviceDLLCertificateIssuer ServiceItem/serviceDLLSignatureExists ServiceItem/serviceDLLSignatureVerified ServiceItem/serviceDLLSignatureDescription ServiceItem/startedAs ServiceItem/status ServiceItem/type startup_command_line startup_type service_name service_dll service_dll_certificate_subject service_dll_certificate_issuer service_dll_signature_exists service_dll_signature_verified service_dll_signature_description started_as service_status service_type N/A hashmap N/A ServiceItem/serviceDLLmd5sum ServiceItem/serviceDLLsha1sum ServiceItem/serviceDLLsha256sum md5 sha1 sha256 N/A proc_keys N/A ServiceItem/path ServiceItem/pid N/A N/A search_string proc_keys N/A N/A N/A create_process_obj search_string content_string condition N/A N/A N/A search_string attrmap N/A N/A N/A set_field service N/A attrmap N/A search_string content_string condition N/A N/A N/A search_string hashmap N/A N/A N/A set_field hashlist N/A hashmap N/A search_string content_string condition N/A N/A service service_dll_hashes hashlist N/A N/A N/A search_string ServiceItem/description N/A N/A s N/A String N/A N/A xml sanitize content_string N/A N/A service description_list N/A ServiceDescriptionList s N/A N/A None N/A N/A Object service N/A create_system_object N/A N/A search_string content_string condition N/A N/A cybox.objects.address_object Address cybox.objects.system_object System OS BIOSInfo NetworkInterface NetworkInterfaceList DHCPServerList IPInfo IPInfoList N/A winsys_keys N/A SystemInfoItem/productID SystemInfoItem/regOrg SystemInfoItem/regOwner SystemInfoItem/domain N/A sys_attrmap N/A SystemInfoItem/processor SystemInfoItem/timezoneDST SystemInfoItem/timezoneStandard SystemInfoItem/totalphysical SystemInfoItem/uptime SystemInfoItem/user SystemInfoItem/availphysical SystemInfoItem/date SystemInfoItem/hostname processor timezone_dst timezone_standard total_physical uptime username available_physical_memory date hostname N/A os_attrmap N/A SystemInfoItem/buildNumber SystemInfoItem/installDate SystemInfoItem/OS SystemInfoItem/patchLevel build_number install_date platform patch_level N/A bios_attrmap N/A SystemInfoItem/biosInfo/biosDate SystemInfoItem/biosInfo/biosVersion bios_date bios_version N/A iface_attrmap N/A SystemInfoItem/MAC SystemInfoItem/networkArray/networkInfo/MAC SystemInfoItem/networkArray/networkInfo/adapter SystemInfoItem/networkArray/networkInfo/description SystemInfoItem/networkArray/networkInfo/dhcpLeaseExpires SystemInfoItem/networkArray/networkInfo/dhcpLeaseObtained mac mac adapter description dhcp_lease_expires dhcp_lease_obtained N/A os_ N/A OS N/A system N/A System N/A bios N/A BIOSInfo N/A ipinfo N/A IPInfo N/A iface N/A NetworkInterface N/A N/A search_string sys_attrmap N/A N/A N/A set_field system N/A sys_attrmap N/A search_string content_string condition N/A N/A N/A search_string os_attrmap N/A N/A N/A set_field os_ N/A os_attrmap N/A search_string content_string condition N/A N/A system os os_ N/A N/A N/A search_string bios_attrmap N/A N/A N/A set_field bios N/A bios_attrmap N/A search_string content_string condition N/A N/A system bios_info bios N/A N/A N/A search_string iface_attrmap N/A N/A N/A set_field iface N/A iface_attrmap N/A search_string content_string condition N/A N/A system network_interface_list N/A NetworkInterfaceList iface N/A N/A N/A search_string winsys_keys N/A N/A N/A create_win_system_obj search_string content_string condition N/A N/A N/A search_string SystemInfoItem/networkArray/networkInfo/dhcpServerArray/dhcpServer N/A N/A addr N/A Address N/A N/A xml sanitize content_string category N/A Address CAT_IPV4 N/A N/A iface dhcp_server_list N/A DHCPServerList addr N/A N/A system network_interface_list N/A NetworkInterfaceList iface N/A N/A N/A search_string SystemInfoItem/networkArray/networkInfo/ipArray/ipInfo/ipAddress N/A N/A addr N/A Address N/A N/A xml sanitize content_string category N/A Address CAT_IPV4 N/A N/A ipinfo ip_address addr N/A N/A iface ip_list N/A IPInfoList ipinfo N/A N/A system network_interface_list N/A NetworkInterfaceList iface N/A N/A N/A content_string SystemInfoItem/networkArray/networkInfo/ipArray/ipInfo/subnetMask N/A N/A addr N/A Address N/A N/A xml sanitize content_string category N/A Address CAT_IPV4_NETMASK N/A N/A ipinfo subnet_mask addr N/A N/A iface ip_list N/A IPInfoList ipinfo N/A N/A system network_interface_list N/A NetworkInterfaceList iface N/A N/A None N/A N/A Object system N/A create_system_restore_obj N/A N/A search_string content_string condition N/A N/A cybox.objects.win_system_restore_object WinSystemRestore HiveList cybox.common.properties String N/A restore N/A WinSystemRestore N/A attrmap N/A SystemRestoreItem/RestorePointName SystemRestoreItem/RestorePointFullPath SystemRestoreItem/RestorePointDescription SystemRestoreItem/RestorePointType SystemRestoreItem/Created SystemRestoreItem/ChangeLogEntrySequenceNumber SystemRestoreItem/ChangeLogEntryFlags SystemRestoreItem/FileAttributes SystemRestoreItem/OriginalFileName SystemRestoreItem/BackupFileName SystemRestoreItem/AclChangeUsername SystemRestoreItem/AclChangeSecurityID SystemRestoreItem/OriginalShortFileName SystemRestoreItem/ChangeLogEntryType restore_point_name restore_point_full_path restore_point_description restore_point_type created changelog_entry_sequence_number changelog_entry_flags file_attributes original_file_name backup_file_name acl_change_sid acl_change_security_id original_short_file_name changelog_entry_type N/A N/A search_string attrmap N/A N/A N/A set_field restore N/A attrmap N/A search_string content_string condition N/A N/A N/A content_string SystemRestoreItem/RegistryHives/String N/A N/A s N/A String N/A N/A xml sanitize content_string N/A N/A s condition condition N/A N/A restore registry_hive_list N/A HiveList s N/A N/A None N/A N/A Object restore N/A create_user_obj N/A N/A search_string content_string condition N/A N/A cybox.objects.user_account_object UserAccount cybox.objects.win_user_object WinGroup WinGroupList N/A user_account N/A UserAccount N/A group N/A WinGroup N/A winuser_keys N/A UserItem/SecurityID UserItem/SecurityType N/A account_keys N/A UserItem/description UserItem/disabled UserItem/lockedout N/A attrmap N/A UserItem/fullname UserItem/homedirectory UserItem/passwordrequired UserItem/scriptpath UserItem/userpasswordage full_name home_directory password_required script_path user_password_age N/A N/A search_string winuser_keys N/A N/A N/A create_win_user_obj search_string content_string condition N/A N/A N/A search_string account_keys N/A N/A N/A create_account_obj search_string content_string condition N/A N/A N/A search_string attrmap N/A N/A N/A set_field user_account N/A attrmap N/A search_string content_string condition N/A N/A N/A search_string UserItem/grouplist/groupname N/A N/A N/A set_field group name content_string condition N/A N/A user_account group_list N/A WinGroupList group N/A N/A None N/A N/A Object user_account N/A create_volume_obj N/A N/A search_string content_string condition N/A N/A cybox.objects.volume_object Volume FileSystemFlagList cybox.common.properties String N/A attrmap N/A VolumeItem/ActualAvailableAllocationUnits VolumeItem/BytesPerSector VolumeItem/CreationTime VolumeItem/DevicePath VolumeItem/FileSystemType VolumeItem/IsMounted VolumeItem/Name VolumeItem/SectorsPerAllocationUnit VolumeItem/SerialNumber VolumeItem/TotalAllocationUnits actual_available_allocation_units bytes_per_sector creation_time device_path file_system_type is_mounted name sectors_per_allocation_unit serial_number total_allocation_units N/A volume N/A Volume N/A N/A search_string VolumeItem/DriveLetter N/A N/A N/A create_win_volume_obj search_string content_string condition N/A N/A N/A search_string attrmap N/A N/A N/A set_field volume N/A attrmap N/A search_string content_string condition N/A N/A N/A search_string VolumeItem/FileSystemFlags N/A N/A s N/A String N/A N/A xml sanitize content_string N/A N/A s condition condition N/A N/A volume file_system_flag_list N/A FileSystemFlagList s N/A N/A None N/A N/A Object volume N/A create_win_system_obj N/A N/A search_string content_string condition N/A N/A cybox.objects.win_system_object WinSystem N/A attrmap N/A SystemInfoItem/domain SystemInfoItem/productID SystemInfoItem/productName SystemInfoItem/regOrg SystemInfoItem/regOwner domain product_id product_name registered_organization registered_owner N/A N/A search_string attrmap N/A N/A None N/A winsys N/A WinSystem N/A N/A set_field winsys N/A attrmap N/A search_string content_string condition N/A N/A Object winsys N/A create_win_task_obj N/A N/A search_string content_string condition N/A N/A cybox.objects.win_task_object WinTask TaskAction TaskActionList IComHandlerAction IExecAction Trigger TriggerList IShowMessageAction N/A attrmap N/A TaskItem/AccountLogonType TaskItem/AccountName TaskItem/AccountRunLevel TaskItem/ApplicationName TaskItem/Comment TaskItem/CreationDate TaskItem/Creator TaskItem/ExitCode TaskItem/MaxRunTime TaskItem/MostRecentRunTime TaskItem/Name TaskItem/NextRunTime TaskItem/Parameters TaskItem/WorkItemData TaskItem/WorkingDirectory TaskItem/Flag TaskItem/Priority TaskItem/Status account_logon_type account_name account_run_level application_name comment creation_date creator exit_code max_run_time most_recent_run_time name next_run_time parameters work_item_data working_directory flags priority status N/A icom_attrmap N/A TaskItem/ActionList/Action/COMClassId TaskItem/ActionList/Action/COMData com_class_id com_data N/A iexecaction_attrmap N/A TaskItem/ActionList/Action/ExecArguments TaskItem/ActionList/Action/ExecProgramPath TaskItem/ActionList/Action/ExecWorkingDirectory exec_arguments exec_program_path exec_working_directory N/A ishowmessage_attrmap N/A TaskItem/ActionList/Action/ShowMessageBody TaskItem/ActionList/Action/ShowMessageTitle show_message_body show_message_title N/A trigger_attrmap N/A TaskItem/TriggerList/Trigger/TriggerBegin TaskItem/TriggerList/Trigger/TriggerDelay TaskItem/TriggerList/Trigger/TriggerEnd TaskItem/TriggerList/Trigger/TriggerFrequency TaskItem/TriggerList/Trigger/TriggerMaxRunTime TaskItem/TriggerList/Trigger/TriggerSessionChangeType trigger_begin trigger_delay trigger_end trigger_frequency trigger_max_run_time trigger_session_change_type N/A email_map N/A TaskItem/ActionList/Action/EmailBCC TaskItem/ActionList/Action/EmailBody TaskItem/ActionList/Action/EmailCC TaskItem/ActionList/Action/EmailSubject TaskItem/ActionList/Action/EmailFrom TaskItem/ActionList/Action/EmailTo TaskItem/ActionList/Action/EmailReplyTo TaskItem/ActionList/Action/EmailServer Email/BCC Email/Body Email/CC Email/Subject Email/From Email/To Email/ReplyTo Email/EmailServer N/A task N/A WinTask N/A action N/A TaskAction N/A actions N/A TaskActionList action N/A trigger N/A Trigger N/A triggers N/A TriggerList trigger N/A N/A search_string attrmap N/A N/A N/A set_field task N/A attrmap N/A search_string content_string condition N/A N/A N/A search_string icom_attrmap N/A N/A handler N/A IComHandlerAction N/A N/A set_field handler N/A icom_attrmap N/A search_string content_string condition N/A N/A action icomhandleraction handler N/A N/A task action_list actions N/A N/A N/A search_string email_map N/A N/A email N/A create_email_obj N/A email_map N/A search_string content_string condition N/A N/A action iemailaction email N/A N/A task action_list actions N/A N/A N/A search_string iexecaction_attrmap N/A N/A execaction N/A IExecAction N/A N/A set_field execaction N/A iexecaction_attrmap N/A search_string content_string condition N/A N/A action iexecaction execaction N/A N/A task action_list actions N/A N/A N/A search_string ishowmessage_attrmap N/A N/A ishowmessage N/A IShowMessageAction N/A N/A set_field ishowmessage N/A ishowmessage_attrmap N/A search_string content_string condition N/A N/A action ishowmessageaction N/A ishowmessage N/A N/A task action_list actions N/A N/A N/A search_string trigger_attrmap N/A N/A N/A set_field trigger N/A trigger_attrmap N/A search_string content_string condition N/A N/A task trigger_list triggers N/A N/A N/A search_string TaskItem/ActionList/Action/ActionType N/A N/A N/A set_field action action_type content_string condition N/A N/A task action_list actions N/A N/A None N/A N/A Object task N/A create_win_volume_obj N/A N/A search_string content_string condition N/A N/A N/A N/A N/A LOG info Cannot translate WinVolume object. See https://github.com/CybOXProject/python-cybox/issues/269 N/A None N/A create_unix_file_obj N/A N/A search_string content_string condition N/A N/A N/A N/A create_win_file_obj N/A N/A search_string content_string condition N/A N/A cybox.objects.win_file_object WinFile WindowsFileAttribute WindowsFileAttributes Stream StreamList N/A attrmap N/A FileItem/Drive FileItem/FilenameAccessed FileItem/FilenameCreated FileItem/FilenameModified FileItem/SecurityID FileItem/SecurityType FileItem/StreamList/Stream/Md5sum FileItem/StreamList/Stream/Sha1sum FileItem/StreamList/Stream/Sha256sum drive filename_accessed_time filename_created_time filename_modified_time security_id security_type md5 sha1 sha256 N/A stream_attrmap N/A FileItem/StreamList/Stream/Name FileItem/StreamList/Stream/SizeInBytes name size_in_bytes N/A file_ N/A WinFile N/A stream N/A Stream N/A streams N/A StreamList stream N/A N/A search_string attrmap N/A N/A N/A set_field file_ N/A attrmap N/A search_string content_string condition N/A N/A search_string stream_attrmap N/A N/A N/A set_field stream N/A stream_attrmap N/A search_string content_string condition N/A N/A file_ stream_list streams N/A N/A N/A search_string FileItem/FileAttributes N/A N/A attr N/A WindowsFileAttribute content_string N/A N/A attr condition condition N/A N/A file_ file_attributes_list N/A WindowsFileAttributes attr N/A N/A None N/A N/A Object file_ N/A create_pefile_obj N/A N/A search_string content_string condition N/A N/A cybox.common DigitalSignature cybox.objects.file_object EPJumpCode EntryPointSignature EntryPointSignatureList Packer PackerList cybox.objects.win_executable_file_object WinExecutableFile PEVersionInfoResource PEResource PEResourceList PEChecksum PEHeaders PEOptionalHeader PEExports PEExportedFunctions PEExportedFunction PEImport PEImportedFunction PEImportedFunctions PEImportList PEFileHeader PESection PESectionList PESectionHeaderStruct N/A ds_attrmap N/A /PEInfo/DigitalSignature/CertificateIssuer /PEInfo/DigitalSignature/CertificateSubject /PEInfo/DigitalSignature/Description /PEInfo/DigitalSignature/SignatureExists /PEInfo/DigitalSignature/SignatureVerified certificate_issuer certificate_subject certificate_description signature_exists signature_verified N/A verinfo_attrmap N/A FileItem/PEInfo/VersionInfoList/VersionInfoItem/Comments FileItem/PEInfo/VersionInfoList/VersionInfoItem/CompanyName FileItem/PEInfo/VersionInfoList/VersionInfoItem/FileDescription FileItem/PEInfo/VersionInfoList/VersionInfoItem/FileVersion FileItem/PEInfo/VersionInfoList/VersionInfoItem/InternalName FileItem/PEInfo/VersionInfoList/VersionInfoItem/Language FileItem/PEInfo/VersionInfoList/VersionInfoItem/LegalCopyright FileItem/PEInfo/VersionInfoList/VersionInfoItem/LegalTrademarks FileItem/PEInfo/VersionInfoList/VersionInfoItem/OriginalFilename FileItem/PEInfo/VersionInfoList/VersionInfoItem/PrivateBuild FileItem/PEInfo/VersionInfoList/VersionInfoItem/ProductName FileItem/PEInfo/VersionInfoList/VersionInfoItem/ProductVersion FileItem/PEInfo/VersionInfoList/VersionInfoItem/SpecialBuild comments companyname filedescription fileversion internalname language legalcopyright legaltrademarks originalfilename privatebuild productname productversion specialbuild N/A resource_attrmap N/A FileItem/PEInfo/ResourceInfoList/ResourceInfoItem/Name FileItem/PEInfo/ResourceInfoList/ResourceInfoItem/Type name type_ N/A checksum_attrmap N/A /PEInfo/PEChecksum/PEComputedAPI /PEInfo/PEChecksum/PEFileAPI /PEInfo/PEChecksum/PEFileRaw pe_computed_api pe_file_api pe_file_raw N/A epsig_attrmap N/A /PEInfo/DetectedEntryPointSignature/Name /PEInfo/DetectedEntryPointSignature/Type name type_ N/A jmpcode_attrmap N/A /PEInfo/EpJumpCodes/Depth /PEInfo/EpJumpCodes/Opcodes depth opcodes N/A exports_attrmap N/A /PEInfo/Exports/ExportsTimeStamp /PEInfo/Exports/NumberOfNames exports_time_stamp number_of_names N/A winexec N/A WinExecutableFile N/A ds N/A DigitalSignature N/A verinfo N/A PEVersionInfoResource N/A verinforesources N/A PEResourceList verinfo N/A resource N/A PEResource N/A resources N/A PEResourceList resource N/A checksum N/A PEChecksum N/A exports N/A PEExports N/A N/A /PEInfo/ExtraneousBytes search_string N/A N/A N/A set_field winexec extraneous_bytes content_string condition N/A N/A N/A any N/A N/A k search_string N/A k ds_attrmap N/A N/A attr N/A N/A utils partial_match ds_attrmap search_string N/A N/A set_field ds attr content_string condition N/A N/A winexec digital_signature ds N/A N/A N/A any N/A N/A k search_string N/A k checksum_attrmap N/A N/A attr N/A N/A utils partial_match checksum_attrmap search_string N/A N/A set_field checksum attr content_string condition N/A N/A winexec pe_checksum checksum N/A N/A N/A any N/A N/A k search_string N/A k exports_attrmap N/A N/A attr N/A N/A utils partial_match exports_attrmap search_string N/A N/A set_field exports attr content_string condition N/A N/A winexec exports exports N/A N/A N/A any N/A N/A k search_string N/A k epsig_attrmap N/A N/A packer N/A Packer N/A epsig N/A EntryPointSignature N/A packerlist N/A PackerList packer N/A epsiglist N/A EntryPointSignatureList epsig N/A N/A packer detected_entrypoint_signatures epsiglist N/A N/A winexec packer_list packerlist N/A attr N/A N/A utils partial_match epsig_attrmap search_string N/A N/A set_field epsig attr content_string condition N/A N/A N/A any N/A N/A k search_string N/A k jmpcode_attrmap N/A N/A epjumpcode N/A EPJumpCode N/A packer N/A Packer N/A packerlist N/A PackerList packer N/A N/A packer ep_jump_codes epjumpcode N/A N/A winexec packer_list packerlist N/A attr N/A N/A utils partial_match jmpcode_attrmap search_string N/A N/A set_field epjumpcode attr content_string condition N/A N/A N/A search_string verinfo_attrmap N/A N/A N/A set_field verinfo N/A verinfo_attrmap N/A search_string content_string condition N/A N/A winexec resources verinforesources N/A N/A N/A search_string resource_attrmap N/A N/A N/A set_field resource N/A resource_attrmap N/A search_string content_string condition N/A N/A winexec resources resources N/A N/A N/A /PEInfo/BaseAddress search_string N/A N/A headers N/A PEHeaders N/A opt N/A PEOptionalHeader N/A N/A set_field opt base_of_code content_string condition N/A N/A headers optional_header opt N/A N/A winexec headers headers N/A N/A N/A /Exports/ExportedFunctions/string search_string N/A N/A func N/A PEExportedFunction N/A funclist N/A PEExportedFunctions func N/A N/A exports exported_functions funclist N/A N/A winexec exports exports N/A N/A set_field func function_name content_string condition N/A N/A N/A N/A search_string FileItem/PEInfo/ImportedModules/Module/ImportedFunctions/string N/A search_string DriverItem/PEInfo/ImportedModules/Module/ImportedFunctions/string N/A N/A import_ N/A PEImport N/A imports N/A PEImportList import_ N/A func N/A PEImportedFunction N/A funcs N/A PEImportedFunctions func N/A N/A import_ imported_functions funcs N/A N/A winexec imports imports N/A N/A set_field func function_name content_string condition N/A N/A N/A /PEInfo/ImportedModules/Module/Name search_string N/A N/A import_ N/A PEImport N/A imports N/A PEImportList import_ N/A N/A winexec imports imports N/A N/A set_field import_ file_name content_string condition N/A N/A N/A /PEInfo/PETimeStamp search_string N/A N/A header N/A PEFileHeader N/A headers N/A PEHeaders N/A N/A headers file_header header N/A N/A winexec headers headers N/A N/A set_field header time_date_stamp content_string condition N/A N/A N/A /PEInfo/Sections/Section/DetectedCharacteristics search_string N/A N/A section N/A PESection N/A sections N/A PESectionList section N/A header N/A PESectionHeaderStruct N/A N/A section section_header header N/A N/A winexec sections sections N/A N/A set_field header characteristics content_string condition N/A N/A None N/A N/A Object winexec N/A create_win_user_obj N/A N/A search_string content_string condition N/A N/A cybox.objects.win_user_object WinUser N/A winuser N/A WinUser N/A attrmap N/A UserItem/SecurityID UserItem/SecurityType security_id security_type N/A N/A search_string attrmap N/A N/A N/A set_field winuser N/A attrmap N/A search_string content_string condition N/A N/A None N/A N/A Object winuser N/A create_account_obj N/A N/A search_string content_string condition N/A N/A cybox.objects.account_object Account N/A account N/A Account N/A attrmap N/A UserItem/description UserItem/disabled UserItem/lockedout description disabled locked_out N/A N/A search_string attrmap N/A N/A N/A set_field account N/A attrmap N/A search_string content_string condition N/A N/A None N/A N/A Object account N/A create_win_memory_page_obj N/A N/A search_string content_string condition N/A N/A cybox.objects.win_memory_page_region_object WinMemoryPageRegion N/A N/A search_string ProcessItem/SectionList/MemorySection/Protection N/A N/A N/A page N/A WinMemoryPageRegion N/A N/A set_field page protect content_string condition N/A N/A Object page N/A create_win_process_obj N/A N/A search_string content_string condition N/A N/A cybox.objects win_process_object cybox.common hashes N/A proc N/A N/A win_process_object WinProcess N/A handle_attrmap N/A ProcessItem/HandleList/Handle/AccessMask ProcessItem/HandleList/Handle/Index ProcessItem/HandleList/Handle/Name ProcessItem/HandleList/Handle/ObjectAddress ProcessItem/HandleList/Handle/PointerCount ProcessItem/HandleList/Handle/Type access_mask id_ name object_address pointer_count type_ N/A memory_attrmap N/A ProcessItem/SectionList/MemorySection/Injected ProcessItem/SectionList/MemorySection/Mapped ProcessItem/SectionList/MemorySection/Name ProcessItem/SectionList/MemorySection/RegionSize ProcessItem/SectionList/MemorySection/RegionStart is_injected is_mapped name region_size region_start N/A hash_attrmap N/A ProcessItem/SectionList/MemorySection/Md5sum ProcessItem/SectionList/MemorySection/Sha1Sum ProcessItem/SectionList/MemorySection/Sha256Sum md5 sha1 sha256 N/A proc_attrmap N/A ProcessItem/SecurityID ProcessItem/SecurityType security_id security_type N/A N/A /PEInfo search_string N/A N/A N/A create_pefile_obj search_string content_string condition N/A N/A N/A search_string ProcessItem/SectionList/MemorySection/Protection N/A N/A N/A create_win_memory_page_obj search_string content_string condition N/A N/A N/A search_string proc_attrmap N/A N/A N/A set_field proc N/A proc_attrmap N/A search_string content_string condition N/A N/A N/A search_string handle_attrmap N/A N/A handle N/A N/A win_process_object WinHandle N/A handles N/A N/A win_process_object WinHandleList handle N/A N/A proc handle_list handles N/A N/A set_field handle N/A handle_attrmap N/A search_string content_string condition N/A N/A N/A search_string memory_attrmap N/A N/A section N/A N/A win_process_object Memory N/A sections N/A N/A win_process_object MemorySectionList section N/A N/A proc section_list sections N/A N/A set_field section N/A memory_attrmap N/A search_string content_string condition N/A N/A N/A search_string hash_attrmap N/A N/A hashlist N/A N/A hashes HashList N/A section N/A N/A win_process_object Memory N/A N/A section hashes hashlist N/A sections N/A N/A win_process_object MemorySectionList section N/A N/A proc section_list sections N/A N/A set_field hashlist N/A hash_attrmap N/A search_string content_string condition N/A N/A None N/A N/A Object proc N/A make_object N/A N/A search_string content_string condition N/A N/A N/A retval None N/A key N/A N/A N/A search_string split / 1 N/A 0 N/A N/A key OBJECT_FUNCS N/A N/A makefunc N/A OBJECT_FUNCS N/A key N/A retval N/A makefunc search_string content_string condition N/A N/A retval None N/A N/A N/A N/A LOG debug Unable to map %s to CybOX Object. search_string N/A retval N/A N/A OBJECT_FUNCS N/A DiskItem DnsEntryItem DriverItem Email EventLogItem FileItem HookItem ModuleItem Network PortItem PrefetchItem ProcessItem RegistryItem RouteEntryItem ServiceItem SystemInfoItem SystemRestoreItem TaskItem UserItem VolumeItem create_disk_obj create_dns_obj create_driver_obj create_email_obj create_win_event_log_obj create_file_obj create_hook_obj create_library_obj create_network_connection_obj create_port_obj create_prefetch_obj create_process_obj create_registry_obj create_net_route_obj create_service_obj create_system_object create_system_restore_obj create_win_task_obj create_user_obj create_volume_obj