maec.utils.deduplicator Module

Version: 4.1.0.17


Classes

class maec.utils.deduplicator.BundleDeduplicator[source]

Bases: object

classmethod add_unique_objects(bundle, all_objects)[source]

Add the unique Objects to the collection and perform the properties replacement.

classmethod cleanup(bundle)[source]

Cleanup and remove and Objects that may be referencing the re-used Objects. Otherwise, this can create Object->Object->Object etc. references which don’t make sense.

classmethod deduplicate(bundle)[source]

Deduplicate the input Bundle.

classmethod find_matching_object(obj)[source]

Find a matching object, if it exists.

classmethod get_object_values(obj, ignoreCase=False)[source]

Get the values specified for an Object’s properties as a set.

classmethod get_typedfield_values(val, name, values, ignoreCase=False)[source]

Returns the value contained in a TypedField or its nested members, if applicable.

classmethod handle_duplicate_objects(bundle, all_objects)[source]

Replace all of the duplicate Objects with references to the unique object placed in the “Re-used Objects” Collection.

classmethod handle_unique_objects(bundle, all_objects)[source]

Add a new Object collection to the Bundle for storing the unique Objects. Add the Objects to the collection.

classmethod map_objects(all_objects)[source]

Map the non-unique Objects to their unique (first observed) counterparts.