Added support for context-aware indicators.

This way when a detection is logged, the user can know which STIX2
file was matched by the module

tests/common/test_indicators.py

@@ -13,11 +13,11 @@ class TestIndicators:
     def test_parse_stix2(self, indicator_file):
         ind = Indicators(log=logging)
         ind.load_indicators_files([indicator_file], load_default=False)
-        assert ind.ioc_count == 4
-        assert len(ind.ioc_domains) == 1
-        assert len(ind.ioc_emails) == 1
-        assert len(ind.ioc_files) == 1
-        assert len(ind.ioc_processes) == 1
+        assert ind.ioc_files[0]["count"] == 4
+        assert len(ind.ioc_files[0]["domains"]) == 1
+        assert len(ind.ioc_files[0]["emails"]) == 1
+        assert len(ind.ioc_files[0]["file_names"]) == 1
+        assert len(ind.ioc_files[0]["processes"]) == 1
 
     def test_check_domain(self, indicator_file):
         ind = Indicators(log=logging)
@@ -28,5 +28,5 @@ class TestIndicators:
     def test_env_stix(self, indicator_file):
         os.environ["MVT_STIX2"] = indicator_file
         ind = Indicators(log=logging)
-        ind.load_indicators_files([indicator_file], load_default=False)
-        assert ind.ioc_count == 4
+        ind.load_indicators_files([], load_default=False)
+        assert ind.total_ioc_count == 4

tests/ios/test_datausage.py

@@ -25,7 +25,7 @@ class TestDatausageModule:
         ind = Indicators(log=logging)
         ind.parse_stix2(indicator_file)
         # Adds a file that exists in the manifest.
-        ind.ioc_processes[0] = "CumulativeUsageTracker"
+        ind.ioc_files[0]["processes"].append("CumulativeUsageTracker")
         m.indicators = ind
         run_module(m)
         assert len(m.detected) == 2

tests/ios/test_manifest.py

@@ -24,8 +24,7 @@ class TestManifestModule:
         m = Manifest(base_folder=get_backup_folder(), log=logging, results=[])
         ind = Indicators(log=logging)
         ind.parse_stix2(indicator_file)
-        # Adds a file that exists in the manifest
-        ind.ioc_files[0] = "com.apple.CoreBrightness.plist"
+        ind.ioc_files[0]["file_names"].append("com.apple.CoreBrightness.plist")
         m.indicators = ind
         run_module(m)
         assert len(m.detected) == 1