Utility functions and classes for the STIX2 library.

class Precision

Timestamp format precisions.

ANY = 1
class PrecisionConstraint

Timestamp precision constraints. These affect how the Precision values are applied when formatting a timestamp.

These constraints don’t really make sense with the ANY precision, so they have no effect in that case.

MIN = 2
class STIXdatetime

Bundle a datetime with some format-related metadata, so that JSON serialization has the info it needs to produce compliant timestamps.


Deduplicate a list of STIX objects to a unique set.

Reduces a set of STIX objects to unique set by looking at ‘id’ and ‘modified’ fields - as a unique object version is determined by the combination of those fields

Note: Be aware, as can be seen in the implementation of deduplicate(),that if the “stix_obj_list” argument has multiple STIX objects of the same version, the last object version found in the list will be the one that is returned.

Parameters:stix_obj_list (list) – list of STIX objects (dicts)
Returns:A list with a unique set of the passed list of STIX objects.
find_property_index(obj, search_key, search_value)

Search (recursively) for the given key and value in the given object. Return an index for the key, relative to whatever object it’s found in.

  • obj – The object to search (list, dict, or stix object)
  • search_key – A search key
  • search_value – A search value

int – An index; -1 if the key and value aren’t found


Convert a datetime object into a valid STIX timestamp string.

  1. Convert to timezone-aware
  2. Convert to UTC
  3. Format in ISO format
  4. Ensure correct precision a. Add subsecond value if warranted, according to precision settings
  5. Add “Z”

Given an object, return the names of the class hierarchy.


Return a STIX timestamp of the current date and time.


Determines whether the given object or object ID is/is for a marking definition.

Parameters:obj_or_id – A STIX object or object ID as a string.
Returns:True if a marking definition, False otherwise.
parse_into_datetime(value, precision=<Precision.ANY: 1>, precision_constraint=<PrecisionConstraint.EXACT: 1>)

Parse a value into a valid STIX timestamp object. Also, optionally adjust precision of fractional seconds. This allows alignment with JSON serialization requirements, and helps ensure we’re not using extra precision which would be lost upon JSON serialization. The precision info will be embedded in the returned object, so that JSON serialization will format it correctly.

  • value – A datetime.datetime or datetime.date instance, or a string
  • precision – A precision value: either an instance of the Precision enum, or a string naming one of the enum values (case-insensitive)
  • precision_constraint – A precision constraint value: either an instance of the PrecisionConstraint enum, or a string naming one of the enum values (case-insensitive)

A STIXdatetime instance, which is a datetime but also carries the precision info necessary to properly JSON-serialize it.