or run

npx @tessl/cli init
Log in

Version

Tile

Overview

Evals

Files

docs

data-storage.mdequivalence.mdindex.mdmarkings.mdobject-creation.mdpattern-matching.mdrelationships.mdstix-domain-objects.mdstix-observables.mdutilities.mdversioning.md
tile.json

tessl/pypi-stix2

Produce and consume STIX 2 JSON content for cyber threat intelligence

Workspace
tessl
Visibility
Public
Created
Last updated
Describes
pypipkg:pypi/stix2@3.0.x

To install, run

npx @tessl/cli install tessl/pypi-stix2@3.0.0

index.mddocs/

STIX2

Python APIs for serializing and de-serializing STIX 2 JSON content, along with higher-level APIs for common tasks including data markings, versioning, and resolving STIX IDs across multiple data sources. STIX (Structured Threat Information Expression) is a standardized language for cyber threat intelligence enabling organizations to share, store, and analyze cyber threat information in a consistent manner.

Package Information

  • Package Name: stix2
  • Language: Python
  • Installation: pip install stix2
  • Requirements: Python 3.6+
  • Documentation: https://stix2.readthedocs.io/

Core Imports

import stix2

Common imports for specific functionality:

from stix2 import parse, Indicator, Malware, AttackPattern
from stix2 import FileSystemStore, MemoryStore
from stix2 import add_markings, get_markings

Basic Usage

Creating STIX Objects

from stix2 import Indicator, Malware, AttackPattern

# Create an indicator
indicator = Indicator(
    name="File hash for malware variant",
    indicator_types=["malicious-activity"],
    pattern_type="stix",
    pattern="[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"
)

# Create a malware object
malware = Malware(
    name="Poison Ivy",
    malware_types=["remote-access-trojan"]
)

# Create an attack pattern
attack_pattern = AttackPattern(
    name="Spear Phishing",
    external_references=[
        {
            "source_name": "mitre-attack",
            "external_id": "T1566.001"
        }
    ]
)

Parsing and Serializing STIX Content

from stix2 import parse

# Parse STIX JSON into Python objects
stix_json = '''
{
    "type": "indicator",
    "spec_version": "2.1",
    "id": "indicator--01234567-89ab-cdef-0123-456789abcdef",
    "created": "2018-04-23T18:07:56.000Z",
    "modified": "2018-04-23T18:07:56.000Z",
    "name": "File hash for malware variant",
    "indicator_types": ["malicious-activity"],
    "pattern_type": "stix",
    "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"
}
'''

indicator = parse(stix_json)
print(indicator.name)  # "File hash for malware variant"

# Serialize STIX object to JSON
json_output = indicator.serialize(pretty=True)

Data Storage and Retrieval

from stix2 import MemoryStore, FileSystemStore, Indicator

# Create in-memory data store
memory_store = MemoryStore()

# Add objects to store
indicator = Indicator(
    name="Example Indicator",
    indicator_types=["malicious-activity"],
    pattern_type="stix",
    pattern="[file:hashes.md5 = 'abc123']"
)
memory_store.add(indicator)

# Query objects
results = memory_store.query([stix2.Filter('type', '=', 'indicator')])

# File system store
fs_store = FileSystemStore("/path/to/stix/data")
fs_store.add(indicator)

Architecture

The STIX2 library is organized around several key concepts:

  • STIX Domain Objects (SDOs): Core cyber threat intelligence objects like Indicator, Malware, AttackPattern, ThreatActor
  • STIX Relationship Objects (SROs): Relationship and Sighting objects that connect SDOs
  • STIX Cyber Observable Objects (SCOs): Observable cyber artifacts like File, IPv4Address, DomainName
  • Data Stores: Pluggable backends for storing and retrieving STIX objects (Memory, FileSystem, TAXII)
  • Environment: Configurable context for object creation and parsing
  • Markings: Data marking and classification system for access control

Capabilities

STIX Object Creation and Parsing

Core functionality for creating STIX objects from scratch and parsing existing STIX JSON content into Python objects. Supports all STIX 2.0 and 2.1 specification objects including validation and automatic property generation.

def parse(data, allow_custom=False, version=None):
    """Parse STIX JSON data into Python objects."""

def parse_observable(data, _valid_refs=None, allow_custom=False, version=None):
    """Parse STIX Cyber Observable Objects."""

Object Creation and Parsing

STIX Domain Objects (SDOs)

STIX Domain Objects represent higher-level cyber threat intelligence concepts including threat actors, attack patterns, malware, indicators, campaigns, and other strategic threat intelligence.

class AttackPattern: ...
class Campaign: ...
class CourseOfAction: ...
class Identity: ...
class Indicator: ...
class IntrusionSet: ...
class Malware: ...
class ObservedData: ...
class Report: ...
class ThreatActor: ...
class Tool: ...
class Vulnerability: ...

STIX Domain Objects

STIX Cyber Observable Objects (SCOs)

STIX Cyber Observable Objects represent observable cyber artifacts such as files, network addresses, processes, registry keys, and other technical indicators that can be observed in cyber operations.

class File: ...
class IPv4Address: ...
class IPv6Address: ...
class DomainName: ...
class URL: ...
class EmailAddress: ...
class NetworkTraffic: ...
class Process: ...
class Software: ...
class UserAccount: ...

STIX Cyber Observable Objects

Data Storage and Retrieval

Flexible data store backends for persisting and querying STIX objects including in-memory storage, file system storage, and TAXII server integration with comprehensive filtering and search capabilities.

class MemoryStore: ...
class FileSystemStore: ...
class TAXIICollectionStore: ...
class CompositeDataSource: ...
class Filter: ...

Data Storage

Object Relationships and Links

STIX Relationship Objects and utilities for creating and managing connections between STIX objects, including relationships, sightings, and reference resolution across multiple data sources.

class Relationship: ...
class Sighting: ...

Relationships

Data Markings and Access Control

Comprehensive data marking system for applying access control, handling restrictions, and managing classification levels on STIX objects using both object-level and granular markings.

def add_markings(obj, marking, selectors=None): ...
def clear_markings(obj, selectors=None, marking_ref=True, lang=True): ...
def get_markings(obj, selectors=None, inherited=False, descendants=False, marking_ref=True, lang=True): ...
def is_marked(obj, marking=None, selectors=None, inherited=False, descendants=False): ...
def remove_markings(obj, marking, selectors=None): ...
def set_markings(obj, marking, selectors=None, marking_ref=True, lang=True): ...

Data Markings

Object Versioning and Evolution

Version management system for creating new versions of STIX objects, tracking changes over time, and handling object revocation with proper timestamp and identifier management.

def new_version(stix_obj, **kwargs): ...
def revoke(stix_obj): ...

Versioning

Pattern Matching and Expressions

Comprehensive pattern expression system for STIX indicator patterns including observation expressions, boolean logic, comparison operations, and temporal qualifiers for complex threat detection rules.

class ObservationExpression: ...
class AndBooleanExpression: ...
class OrBooleanExpression: ...
class EqualityComparisonExpression: ...
class ObjectPath: ...

Pattern Matching

Utilities and Type Checking

Utility functions for working with STIX objects including type checking, timestamp handling, object deduplication, confidence scale conversions, and specification version detection.

def is_sdo(value, stix_version="2.1"): ...
def is_sco(value, stix_version="2.1"): ...
def is_sro(value, stix_version="2.1"): ...
def get_timestamp(): ...
def deduplicate(stix_obj_list): ...
def none_low_med_high_to_value(scale_value): ...
def value_to_none_low_medium_high(confidence_value): ...

Utilities

STIX Equivalence and Similarity

Semantic equivalence and similarity algorithms for STIX objects, graphs, and patterns implementing the STIX Semantic Equivalence Committee Note specifications for intelligent content comparison.

def object_equivalence(obj1, obj2, threshold=70, **kwargs): ...
def object_similarity(obj1, obj2, **kwargs): ...
def graph_equivalence(ds1, ds2, threshold=70, **kwargs): ...
def graph_similarity(ds1, ds2, **kwargs): ...
def equivalent_patterns(pattern1, pattern2, stix_version="2.1"): ...

STIX Equivalence