diff --git a/stix2/patterns.py b/stix2/patterns.py
index f0cceb8..a44f68e 100644
--- a/stix2/patterns.py
+++ b/stix2/patterns.py
@@ -121,21 +121,21 @@ class BooleanConstant(_Constant):
 
 
 _HASH_REGEX = {
-    "MD5": ("^[a-fA-F0-9]{32}$", "MD5"),
-    "MD6": ("^[a-fA-F0-9]{32}|[a-fA-F0-9]{40}|[a-fA-F0-9]{56}|[a-fA-F0-9]{64}|[a-fA-F0-9]{96}|[a-fA-F0-9]{128}$", "MD6"),
-    "RIPEMD160": ("^[a-fA-F0-9]{40}$", "RIPEMD-160"),
-    "SHA1": ("^[a-fA-F0-9]{40}$", "SHA-1"),
-    "SHA224": ("^[a-fA-F0-9]{56}$", "SHA-224"),
-    "SHA256": ("^[a-fA-F0-9]{64}$", "SHA-256"),
-    "SHA384": ("^[a-fA-F0-9]{96}$", "SHA-384"),
-    "SHA512": ("^[a-fA-F0-9]{128}$", "SHA-512"),
-    "SHA3224": ("^[a-fA-F0-9]{56}$", "SHA3-224"),
-    "SHA3256": ("^[a-fA-F0-9]{64}$", "SHA3-256"),
-    "SHA3384": ("^[a-fA-F0-9]{96}$", "SHA3-384"),
-    "SHA3512": ("^[a-fA-F0-9]{128}$", "SHA3-512"),
-    "SSDEEP": ("^[a-zA-Z0-9/+:.]{1,128}$", "ssdeep"),
-    "WHIRLPOOL": ("^[a-fA-F0-9]{128}$", "WHIRLPOOL"),
-    "TLSH": ("^[a-fA-F0-9]{70}$", "TLSH"),
+    "MD5": (r"^[a-fA-F0-9]{32}$", "MD5"),
+    "MD6": (r"^[a-fA-F0-9]{32}|[a-fA-F0-9]{40}|[a-fA-F0-9]{56}|[a-fA-F0-9]{64}|[a-fA-F0-9]{96}|[a-fA-F0-9]{128}$", "MD6"),
+    "RIPEMD160": (r"^[a-fA-F0-9]{40}$", "RIPEMD-160"),
+    "SHA1": (r"^[a-fA-F0-9]{40}$", "SHA-1"),
+    "SHA224": (r"^[a-fA-F0-9]{56}$", "SHA-224"),
+    "SHA256": (r"^[a-fA-F0-9]{64}$", "SHA-256"),
+    "SHA384": (r"^[a-fA-F0-9]{96}$", "SHA-384"),
+    "SHA512": (r"^[a-fA-F0-9]{128}$", "SHA-512"),
+    "SHA3224": (r"^[a-fA-F0-9]{56}$", "SHA3-224"),
+    "SHA3256": (r"^[a-fA-F0-9]{64}$", "SHA3-256"),
+    "SHA3384": (r"^[a-fA-F0-9]{96}$", "SHA3-384"),
+    "SHA3512": (r"^[a-fA-F0-9]{128}$", "SHA3-512"),
+    "SSDEEP": (r"^[a-zA-Z0-9/+:.]{1,128}$", "SSDEEP"),
+    "WHIRLPOOL": (r"^[a-fA-F0-9]{128}$", "WHIRLPOOL"),
+    "TLSH": (r"^[a-fA-F0-9]{70}$", "TLSH"),
 }
 
 
diff --git a/stix2/properties.py b/stix2/properties.py
index a1bab6d..c876c11 100644
--- a/stix2/properties.py
+++ b/stix2/properties.py
@@ -417,7 +417,7 @@ HASHES_REGEX = {
     "SHA3256": (r"^[a-fA-F0-9]{64}$", "SHA3-256"),
     "SHA3384": (r"^[a-fA-F0-9]{96}$", "SHA3-384"),
     "SHA3512": (r"^[a-fA-F0-9]{128}$", "SHA3-512"),
-    "SSDEEP": (r"^[a-zA-Z0-9/+:.]{1,128}$", "ssdeep"),
+    "SSDEEP": (r"^[a-zA-Z0-9/+:.]{1,128}$", "SSDEEP"),
     "WHIRLPOOL": (r"^[a-fA-F0-9]{128}$", "WHIRLPOOL"),
     "TLSH": (r"^[a-fA-F0-9]{70}$", "TLSH"),
 }
@@ -431,6 +431,8 @@ class HashesProperty(DictionaryProperty):
             key = k.upper().replace('-', '')
             if key in HASHES_REGEX:
                 vocab_key = HASHES_REGEX[key][1]
+                if vocab_key == "SSDEEP" and self.spec_version == "2.0":
+                    vocab_key = vocab_key.lower()
                 if not re.match(HASHES_REGEX[key][0], v):
                     raise ValueError("'{0}' is not a valid {1} hash".format(v, vocab_key))
                 if k != vocab_key:

SSDEEP Hashing algorithm case mismatch
Currently if an `ssdeep` hash is added to an object it will change it to its lowercase variant (not aligned with Section 10.6 STIX 2.1 https://docs.oasis-open.org/cti/stix/v2.1/cs01/stix-v2.1-cs01.html#_tumklw3o2gyz) because stix2 will "clean" the field name. This causes the validator to emit a warning on a "unrecognized hash".

Validator:
``` 
[!] Warning: file--xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx: {241} Object 'file--xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' has a 'hashes' dictionary with a hash of type 'ssdeep', which is not a value in the hash-algorithm-ov vocabulary nor a custom value prepended with 'x_'.
```

https://github.com/oasis-open/cti-python-stix2/blob/df92770d255d66bd614d4975fc4602c7407998fb/stix2/properties.py#L420
diff --git a/stix2/test/v20/test_observed_data.py b/stix2/test/v20/test_observed_data.py
index bfe9c34..354d70c 100644
--- a/stix2/test/v20/test_observed_data.py
+++ b/stix2/test/v20/test_observed_data.py
@@ -714,6 +714,22 @@ def test_file_example():
     assert f.decryption_key == "fred"   # does the key have a format we can test for?
 
 
+def test_file_ssdeep_example():
+    f = stix2.v20.File(
+        name="example.dll",
+        hashes={
+            "SHA-256": "ceafbfd424be2ca4a5f0402cae090dda2fb0526cf521b60b60077c0f622b285a",
+            "ssdeep": "96:gS/mFkCpXTWLr/PbKQHbr/S/mFkCpXTWLr/PbKQHbrB:Tu6SXTWGQHbeu6SXTWGQHbV",
+        },
+        size=1024,
+    )
+
+    assert f.name == "example.dll"
+    assert f.size == 1024
+    assert f.hashes["SHA-256"] == "ceafbfd424be2ca4a5f0402cae090dda2fb0526cf521b60b60077c0f622b285a"
+    assert f.hashes["ssdeep"] == "96:gS/mFkCpXTWLr/PbKQHbr/S/mFkCpXTWLr/PbKQHbrB:Tu6SXTWGQHbeu6SXTWGQHbV"
+
+
 def test_file_example_with_NTFSExt():
     f = stix2.v20.File(
         name="abc.txt",
diff --git a/stix2/test/v21/test_observed_data.py b/stix2/test/v21/test_observed_data.py
index b8732be..c13148a 100644
--- a/stix2/test/v21/test_observed_data.py
+++ b/stix2/test/v21/test_observed_data.py
@@ -785,6 +785,22 @@ def test_file_example():
     assert f.atime == dt.datetime(2016, 12, 21, 20, 0, 0, tzinfo=pytz.utc)
 
 
+def test_file_ssdeep_example():
+    f = stix2.v21.File(
+        name="example.dll",
+        hashes={
+            "SHA-256": "ceafbfd424be2ca4a5f0402cae090dda2fb0526cf521b60b60077c0f622b285a",
+            "SSDEEP": "96:gS/mFkCpXTWLr/PbKQHbr/S/mFkCpXTWLr/PbKQHbrB:Tu6SXTWGQHbeu6SXTWGQHbV",
+        },
+        size=1024,
+    )
+
+    assert f.name == "example.dll"
+    assert f.size == 1024
+    assert f.hashes["SHA-256"] == "ceafbfd424be2ca4a5f0402cae090dda2fb0526cf521b60b60077c0f622b285a"
+    assert f.hashes["SSDEEP"] == "96:gS/mFkCpXTWLr/PbKQHbr/S/mFkCpXTWLr/PbKQHbrB:Tu6SXTWGQHbeu6SXTWGQHbV"
+
+
 def test_file_example_with_NTFSExt():
     f = stix2.v21.File(
         name="abc.txt",
diff --git a/stix2/test/v21/test_pattern_expressions.py b/stix2/test/v21/test_pattern_expressions.py
index 198edac..8294a41 100644
--- a/stix2/test/v21/test_pattern_expressions.py
+++ b/stix2/test/v21/test_pattern_expressions.py
@@ -518,7 +518,7 @@ def test_invalid_boolean_constant():
 @pytest.mark.parametrize(
     "hashtype, data", [
         ('MD5', 'zzz'),
-        ('ssdeep', 'zzz=='),
+        ('SSDEEP', 'zzz=='),
     ],
 )
 def test_invalid_hash_constant(hashtype, data):

pip install -e .[dev]
parse_log_pytest
requirements.txt
pytest pytest-cov pytest-xdist pytest
3.6
requirements.txt
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
alabaster==0.7.13
antlr4-python3-runtime==4.9.3
async-generator==1.10
attrs==22.2.0
Babel==2.11.0
backcall==0.2.0
bleach==4.1.0
bump2version==1.0.1
bumpversion==0.6.0
certifi==2021.5.30
cfgv==3.3.1
charset-normalizer==2.0.12
coverage==6.2
decorator==5.1.1
defusedxml==0.7.1
distlib==0.3.9
docutils==0.17.1
entrypoints==0.4
execnet==1.9.0
filelock==3.4.1
identify==2.4.4
idna==3.10
imagesize==1.4.1
importlib-metadata==4.8.3
importlib-resources==5.2.3
iniconfig==1.1.1
ipython==7.16.3
ipython-genutils==0.2.0
jedi==0.17.2
Jinja2==3.0.3
jsonschema==3.2.0
jupyter-client==7.1.2
jupyter-core==4.9.2
jupyterlab-pygments==0.1.2
MarkupSafe==2.0.1
mistune==0.8.4
nbclient==0.5.9
nbconvert==6.0.7
nbformat==5.1.3
nbsphinx==0.4.3
nest-asyncio==1.6.0
nodeenv==1.6.0
packaging==21.3
pandocfilters==1.5.1
parso==0.7.1
pexpect==4.9.0
pickleshare==0.7.5
platformdirs==2.4.0
pluggy==1.0.0
pre-commit==2.17.0
prompt-toolkit==3.0.36
ptyprocess==0.7.0
py==1.11.0
Pygments==2.14.0
pyparsing==3.1.4
pyrsistent==0.18.0
pytest==7.0.1
pytest-cov==4.0.0
pytest-xdist==3.0.2
python-dateutil==2.9.0.post0
pytz==2025.2
PyYAML==6.0.1
pyzmq==25.1.2
requests==2.27.1
simplejson==3.20.1
six==1.17.0
snowballstemmer==2.2.0
Sphinx==1.8.6
sphinx-prompt==1.5.0
sphinxcontrib-serializinghtml==1.1.5
sphinxcontrib-websupport==1.2.4
-e git+https://github.com/oasis-open/cti-python-stix2.git@658e70bf04b2145e8b108ea7117867288a31e2a7#egg=stix2
stix2-patterns==2.0.0
testpath==0.6.0
toml==0.10.2
tomli==1.2.3
tornado==6.1
tox==3.28.0
traitlets==4.3.3
typing_extensions==4.1.1
urllib3==1.26.20
virtualenv==20.16.2
wcwidth==0.2.13
webencodings==0.5.1
zipp==3.6.0

name: cti-python-stix2
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - ca-certificates=2025.2.25=h06a4308_0
  - certifi=2021.5.30=py36h06a4308_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.3=he6710b0_2
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - ncurses=6.4=h6a678d5_0
  - openssl=1.1.1w=h7f8727e_0
  - pip=21.2.2=py36h06a4308_0
  - python=3.6.13=h12debd9_1
  - readline=8.2=h5eee18b_0
  - setuptools=58.0.4=py36h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - wheel=0.37.1=pyhd3eb1b0_0
  - xz=5.6.4=h5eee18b_1
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - alabaster==0.7.13
      - antlr4-python3-runtime==4.9.3
      - async-generator==1.10
      - attrs==22.2.0
      - babel==2.11.0
      - backcall==0.2.0
      - bleach==4.1.0
      - bump2version==1.0.1
      - bumpversion==0.6.0
      - cfgv==3.3.1
      - charset-normalizer==2.0.12
      - coverage==6.2
      - decorator==5.1.1
      - defusedxml==0.7.1
      - distlib==0.3.9
      - docutils==0.17.1
      - entrypoints==0.4
      - execnet==1.9.0
      - filelock==3.4.1
      - identify==2.4.4
      - idna==3.10
      - imagesize==1.4.1
      - importlib-metadata==4.8.3
      - importlib-resources==5.2.3
      - iniconfig==1.1.1
      - ipython==7.16.3
      - ipython-genutils==0.2.0
      - jedi==0.17.2
      - jinja2==3.0.3
      - jsonschema==3.2.0
      - jupyter-client==7.1.2
      - jupyter-core==4.9.2
      - jupyterlab-pygments==0.1.2
      - markupsafe==2.0.1
      - mistune==0.8.4
      - nbclient==0.5.9
      - nbconvert==6.0.7
      - nbformat==5.1.3
      - nbsphinx==0.4.3
      - nest-asyncio==1.6.0
      - nodeenv==1.6.0
      - packaging==21.3
      - pandocfilters==1.5.1
      - parso==0.7.1
      - pexpect==4.9.0
      - pickleshare==0.7.5
      - platformdirs==2.4.0
      - pluggy==1.0.0
      - pre-commit==2.17.0
      - prompt-toolkit==3.0.36
      - ptyprocess==0.7.0
      - py==1.11.0
      - pygments==2.14.0
      - pyparsing==3.1.4
      - pyrsistent==0.18.0
      - pytest==7.0.1
      - pytest-cov==4.0.0
      - pytest-xdist==3.0.2
      - python-dateutil==2.9.0.post0
      - pytz==2025.2
      - pyyaml==6.0.1
      - pyzmq==25.1.2
      - requests==2.27.1
      - simplejson==3.20.1
      - six==1.17.0
      - snowballstemmer==2.2.0
      - sphinx==1.8.6
      - sphinx-prompt==1.5.0
      - sphinxcontrib-serializinghtml==1.1.5
      - sphinxcontrib-websupport==1.2.4
      - stix2-patterns==2.0.0
      - testpath==0.6.0
      - toml==0.10.2
      - tomli==1.2.3
      - tornado==6.1
      - tox==3.28.0
      - traitlets==4.3.3
      - typing-extensions==4.1.1
      - urllib3==1.26.20
      - virtualenv==20.16.2
      - wcwidth==0.2.13
      - webencodings==0.5.1
      - zipp==3.6.0
prefix: /opt/conda/envs/cti-python-stix2

stix2/test/v21/test_observed_data.py::test_file_ssdeep_example
stix2/test/v20/test_observed_data.py::test_observed_data_example stix2/test/v20/test_observed_data.py::test_observed_data_example_with_refs stix2/test/v20/test_observed_data.py::test_observed_data_example_with_bad_refs stix2/test/v20/test_observed_data.py::test_observed_data_example_with_non_dictionary stix2/test/v20/test_observed_data.py::test_observed_data_example_with_empty_dictionary stix2/test/v20/test_observed_data.py::test_parse_observed_data[{\n stix2/test/v20/test_observed_data.py::test_parse_observed_data[data1] stix2/test/v20/test_observed_data.py::test_parse_artifact_valid["0": stix2/test/v20/test_observed_data.py::test_parse_artifact_invalid["0": stix2/test/v20/test_observed_data.py::test_artifact_example_dependency_error stix2/test/v20/test_observed_data.py::test_parse_autonomous_system_valid["0": stix2/test/v20/test_observed_data.py::test_parse_email_address[{\n stix2/test/v20/test_observed_data.py::test_parse_email_message[\n stix2/test/v20/test_observed_data.py::test_parse_email_message_not_multipart[\n stix2/test/v20/test_observed_data.py::test_parse_file_archive["0": stix2/test/v20/test_observed_data.py::test_parse_email_message_with_at_least_one_error[\n stix2/test/v20/test_observed_data.py::test_parse_basic_tcp_traffic[\n stix2/test/v20/test_observed_data.py::test_parse_basic_tcp_traffic_with_error[\n stix2/test/v20/test_observed_data.py::test_observed_data_with_process_example stix2/test/v20/test_observed_data.py::test_artifact_example stix2/test/v20/test_observed_data.py::test_artifact_mutual_exclusion_error stix2/test/v20/test_observed_data.py::test_directory_example stix2/test/v20/test_observed_data.py::test_directory_example_ref_error stix2/test/v20/test_observed_data.py::test_domain_name_example stix2/test/v20/test_observed_data.py::test_domain_name_example_invalid_ref_type stix2/test/v20/test_observed_data.py::test_file_example stix2/test/v20/test_observed_data.py::test_file_ssdeep_example stix2/test/v20/test_observed_data.py::test_file_example_with_NTFSExt stix2/test/v20/test_observed_data.py::test_file_example_with_empty_NTFSExt stix2/test/v20/test_observed_data.py::test_file_example_with_PDFExt stix2/test/v20/test_observed_data.py::test_file_example_with_PDFExt_Object stix2/test/v20/test_observed_data.py::test_file_example_with_RasterImageExt_Object stix2/test/v20/test_observed_data.py::test_raster_image_ext_parse stix2/test/v20/test_observed_data.py::test_raster_images_ext_create stix2/test/v20/test_observed_data.py::test_file_example_with_WindowsPEBinaryExt stix2/test/v20/test_observed_data.py::test_file_example_encryption_error stix2/test/v20/test_observed_data.py::test_ip4_address_example stix2/test/v20/test_observed_data.py::test_ip4_address_valid_refs stix2/test/v20/test_observed_data.py::test_ip4_address_example_cidr stix2/test/v20/test_observed_data.py::test_ip6_address_example stix2/test/v20/test_observed_data.py::test_mac_address_example stix2/test/v20/test_observed_data.py::test_network_traffic_example stix2/test/v20/test_observed_data.py::test_network_traffic_http_request_example stix2/test/v20/test_observed_data.py::test_network_traffic_icmp_example stix2/test/v20/test_observed_data.py::test_network_traffic_socket_example stix2/test/v20/test_observed_data.py::test_network_traffic_tcp_example stix2/test/v20/test_observed_data.py::test_mutex_example stix2/test/v20/test_observed_data.py::test_process_example stix2/test/v20/test_observed_data.py::test_process_example_empty_error stix2/test/v20/test_observed_data.py::test_process_example_empty_with_extensions stix2/test/v20/test_observed_data.py::test_process_example_windows_process_ext stix2/test/v20/test_observed_data.py::test_process_example_windows_process_ext_empty stix2/test/v20/test_observed_data.py::test_process_example_extensions_empty stix2/test/v20/test_observed_data.py::test_process_example_with_WindowsProcessExt_Object stix2/test/v20/test_observed_data.py::test_process_example_with_WindowsServiceExt stix2/test/v20/test_observed_data.py::test_process_example_with_WindowsProcessServiceExt stix2/test/v20/test_observed_data.py::test_software_example stix2/test/v20/test_observed_data.py::test_url_example stix2/test/v20/test_observed_data.py::test_user_account_example stix2/test/v20/test_observed_data.py::test_user_account_unix_account_ext_example stix2/test/v20/test_observed_data.py::test_windows_registry_key_example stix2/test/v20/test_observed_data.py::test_x509_certificate_example stix2/test/v20/test_observed_data.py::test_new_version_with_related_objects stix2/test/v21/test_observed_data.py::test_observed_data_example stix2/test/v21/test_observed_data.py::test_observed_data_example_with_refs stix2/test/v21/test_observed_data.py::test_observed_data_example_with_object_refs stix2/test/v21/test_observed_data.py::test_observed_data_object_constraint stix2/test/v21/test_observed_data.py::test_observed_data_example_with_bad_refs stix2/test/v21/test_observed_data.py::test_observed_data_example_with_non_dictionary stix2/test/v21/test_observed_data.py::test_observed_data_example_with_empty_dictionary stix2/test/v21/test_observed_data.py::test_parse_observed_data[{\n stix2/test/v21/test_observed_data.py::test_parse_observed_data[data1] stix2/test/v21/test_observed_data.py::test_parse_artifact_valid["0": stix2/test/v21/test_observed_data.py::test_parse_artifact_invalid["0": stix2/test/v21/test_observed_data.py::test_artifact_example_dependency_error stix2/test/v21/test_observed_data.py::test_parse_autonomous_system_valid["0": stix2/test/v21/test_observed_data.py::test_parse_email_address[{\n stix2/test/v21/test_observed_data.py::test_parse_email_message[\n stix2/test/v21/test_observed_data.py::test_parse_email_message_not_multipart[\n stix2/test/v21/test_observed_data.py::test_parse_file_archive["0": stix2/test/v21/test_observed_data.py::test_parse_email_message_with_at_least_one_error[\n stix2/test/v21/test_observed_data.py::test_parse_basic_tcp_traffic[\n stix2/test/v21/test_observed_data.py::test_parse_basic_tcp_traffic_with_error[\n stix2/test/v21/test_observed_data.py::test_observed_data_with_process_example stix2/test/v21/test_observed_data.py::test_artifact_example stix2/test/v21/test_observed_data.py::test_artifact_mutual_exclusion_error stix2/test/v21/test_observed_data.py::test_directory_example stix2/test/v21/test_observed_data.py::test_directory_example_ref_error stix2/test/v21/test_observed_data.py::test_domain_name_example stix2/test/v21/test_observed_data.py::test_domain_name_example_invalid_ref_type stix2/test/v21/test_observed_data.py::test_file_example stix2/test/v21/test_observed_data.py::test_file_example_with_NTFSExt stix2/test/v21/test_observed_data.py::test_file_example_with_empty_NTFSExt stix2/test/v21/test_observed_data.py::test_file_example_with_PDFExt stix2/test/v21/test_observed_data.py::test_file_example_with_PDFExt_Object stix2/test/v21/test_observed_data.py::test_file_example_with_RasterImageExt_Object stix2/test/v21/test_observed_data.py::test_raster_image_ext_parse stix2/test/v21/test_observed_data.py::test_raster_images_ext_create stix2/test/v21/test_observed_data.py::test_file_example_with_WindowsPEBinaryExt stix2/test/v21/test_observed_data.py::test_file_example_encryption_error stix2/test/v21/test_observed_data.py::test_ipv4_address_example stix2/test/v21/test_observed_data.py::test_ipv4_address_valid_refs stix2/test/v21/test_observed_data.py::test_ipv4_address_example_cidr stix2/test/v21/test_observed_data.py::test_ipv6_address_example stix2/test/v21/test_observed_data.py::test_mac_address_example stix2/test/v21/test_observed_data.py::test_network_traffic_example stix2/test/v21/test_observed_data.py::test_network_traffic_http_request_example stix2/test/v21/test_observed_data.py::test_network_traffic_icmp_example stix2/test/v21/test_observed_data.py::test_network_traffic_socket_example stix2/test/v21/test_observed_data.py::test_correct_socket_options stix2/test/v21/test_observed_data.py::test_incorrect_socket_options stix2/test/v21/test_observed_data.py::test_network_traffic_tcp_example stix2/test/v21/test_observed_data.py::test_mutex_example stix2/test/v21/test_observed_data.py::test_process_example stix2/test/v21/test_observed_data.py::test_process_example_empty_error stix2/test/v21/test_observed_data.py::test_process_example_empty_with_extensions stix2/test/v21/test_observed_data.py::test_process_example_windows_process_ext stix2/test/v21/test_observed_data.py::test_process_example_windows_process_ext_empty stix2/test/v21/test_observed_data.py::test_process_example_extensions_empty stix2/test/v21/test_observed_data.py::test_process_example_with_WindowsProcessExt_Object stix2/test/v21/test_observed_data.py::test_process_example_with_WindowsServiceExt stix2/test/v21/test_observed_data.py::test_process_example_with_WindowsProcessServiceExt stix2/test/v21/test_observed_data.py::test_software_example stix2/test/v21/test_observed_data.py::test_url_example stix2/test/v21/test_observed_data.py::test_user_account_example stix2/test/v21/test_observed_data.py::test_user_account_unix_account_ext_example stix2/test/v21/test_observed_data.py::test_windows_registry_key_example stix2/test/v21/test_observed_data.py::test_x509_certificate_example stix2/test/v21/test_observed_data.py::test_x509_certificate_error stix2/test/v21/test_observed_data.py::test_new_version_with_related_objects stix2/test/v21/test_observed_data.py::test_objects_deprecation stix2/test/v21/test_observed_data.py::test_deterministic_id_same_extra_prop_vals stix2/test/v21/test_observed_data.py::test_deterministic_id_diff_extra_prop_vals stix2/test/v21/test_observed_data.py::test_deterministic_id_diff_contributing_prop_vals stix2/test/v21/test_observed_data.py::test_deterministic_id_no_contributing_props stix2/test/v21/test_observed_data.py::test_id_gen_recursive_dict_conversion_1 stix2/test/v21/test_observed_data.py::test_id_gen_recursive_dict_conversion_2 stix2/test/v21/test_pattern_expressions.py::test_create_comparison_expression stix2/test/v21/test_pattern_expressions.py::test_boolean_expression stix2/test/v21/test_pattern_expressions.py::test_boolean_expression_with_parentheses stix2/test/v21/test_pattern_expressions.py::test_hash_followed_by_registryKey_expression_python_constant stix2/test/v21/test_pattern_expressions.py::test_hash_followed_by_registryKey_expression stix2/test/v21/test_pattern_expressions.py::test_file_observable_expression stix2/test/v21/test_pattern_expressions.py::test_multiple_file_observable_expression[AndObservationExpression-AND] stix2/test/v21/test_pattern_expressions.py::test_multiple_file_observable_expression[OrObservationExpression-OR] stix2/test/v21/test_pattern_expressions.py::test_root_types stix2/test/v21/test_pattern_expressions.py::test_artifact_payload stix2/test/v21/test_pattern_expressions.py::test_greater_than_python_constant stix2/test/v21/test_pattern_expressions.py::test_greater_than stix2/test/v21/test_pattern_expressions.py::test_parsing_greater_than stix2/test/v21/test_pattern_expressions.py::test_less_than stix2/test/v21/test_pattern_expressions.py::test_parsing_less_than stix2/test/v21/test_pattern_expressions.py::test_greater_than_or_equal stix2/test/v21/test_pattern_expressions.py::test_parsing_greater_than_or_equal stix2/test/v21/test_pattern_expressions.py::test_less_than_or_equal stix2/test/v21/test_pattern_expressions.py::test_parsing_less_than_or_equal stix2/test/v21/test_pattern_expressions.py::test_parsing_issubset stix2/test/v21/test_pattern_expressions.py::test_parsing_issuperset stix2/test/v21/test_pattern_expressions.py::test_parsing_like stix2/test/v21/test_pattern_expressions.py::test_parsing_match stix2/test/v21/test_pattern_expressions.py::test_parsing_followed_by stix2/test/v21/test_pattern_expressions.py::test_not stix2/test/v21/test_pattern_expressions.py::test_and_observable_expression stix2/test/v21/test_pattern_expressions.py::test_parsing_and_observable_expression stix2/test/v21/test_pattern_expressions.py::test_or_observable_expression stix2/test/v21/test_pattern_expressions.py::test_parsing_or_observable_expression stix2/test/v21/test_pattern_expressions.py::test_invalid_and_observable_expression stix2/test/v21/test_pattern_expressions.py::test_hex stix2/test/v21/test_pattern_expressions.py::test_parsing_hex stix2/test/v21/test_pattern_expressions.py::test_multiple_qualifiers stix2/test/v21/test_pattern_expressions.py::test_set_op stix2/test/v21/test_pattern_expressions.py::test_timestamp stix2/test/v21/test_pattern_expressions.py::test_boolean stix2/test/v21/test_pattern_expressions.py::test_binary stix2/test/v21/test_pattern_expressions.py::test_parsing_binary stix2/test/v21/test_pattern_expressions.py::test_list stix2/test/v21/test_pattern_expressions.py::test_list2 stix2/test/v21/test_pattern_expressions.py::test_invalid_constant_type stix2/test/v21/test_pattern_expressions.py::test_invalid_integer_constant stix2/test/v21/test_pattern_expressions.py::test_invalid_timestamp_constant stix2/test/v21/test_pattern_expressions.py::test_invalid_float_constant stix2/test/v21/test_pattern_expressions.py::test_boolean_constant[True-True0] stix2/test/v21/test_pattern_expressions.py::test_boolean_constant[False-False0] stix2/test/v21/test_pattern_expressions.py::test_boolean_constant[True-True1] stix2/test/v21/test_pattern_expressions.py::test_boolean_constant[False-False1] stix2/test/v21/test_pattern_expressions.py::test_boolean_constant[true-True] stix2/test/v21/test_pattern_expressions.py::test_boolean_constant[false-False] stix2/test/v21/test_pattern_expressions.py::test_boolean_constant[t-True] stix2/test/v21/test_pattern_expressions.py::test_boolean_constant[f-False] stix2/test/v21/test_pattern_expressions.py::test_boolean_constant[T-True] stix2/test/v21/test_pattern_expressions.py::test_boolean_constant[F-False] stix2/test/v21/test_pattern_expressions.py::test_boolean_constant[1-True] stix2/test/v21/test_pattern_expressions.py::test_boolean_constant[0-False] stix2/test/v21/test_pattern_expressions.py::test_invalid_boolean_constant stix2/test/v21/test_pattern_expressions.py::test_invalid_hash_constant[MD5-zzz] stix2/test/v21/test_pattern_expressions.py::test_invalid_hash_constant[SSDEEP-zzz==] stix2/test/v21/test_pattern_expressions.py::test_invalid_hex_constant stix2/test/v21/test_pattern_expressions.py::test_invalid_binary_constant stix2/test/v21/test_pattern_expressions.py::test_escape_quotes_and_backslashes stix2/test/v21/test_pattern_expressions.py::test_like stix2/test/v21/test_pattern_expressions.py::test_issuperset stix2/test/v21/test_pattern_expressions.py::test_repeat_qualifier stix2/test/v21/test_pattern_expressions.py::test_invalid_repeat_qualifier stix2/test/v21/test_pattern_expressions.py::test_invalid_within_qualifier stix2/test/v21/test_pattern_expressions.py::test_startstop_qualifier stix2/test/v21/test_pattern_expressions.py::test_invalid_startstop_qualifier stix2/test/v21/test_pattern_expressions.py::test_make_constant_already_a_constant stix2/test/v21/test_pattern_expressions.py::test_parsing_comparison_expression stix2/test/v21/test_pattern_expressions.py::test_parsing_repeat_and_within_qualified_expression stix2/test/v21/test_pattern_expressions.py::test_parsing_start_stop_qualified_expression stix2/test/v21/test_pattern_expressions.py::test_list_constant stix2/test/v21/test_pattern_expressions.py::test_parsing_boolean stix2/test/v21/test_pattern_expressions.py::test_parsing_multiple_slashes_quotes stix2/test/v21/test_pattern_expressions.py::test_parse_error
stix2/properties.py stix2/patterns.py
stix2/properties.py stix2/patterns.py