v20

STIX 2.0 API Objects.

bundle STIX 2.0 Bundle Representation.
common STIX 2.0 Common Data Types and Properties.
observables STIX 2.0 Cyber Observable Objects.
sdo STIX 2.0 Domain Objects.
sro STIX 2.0 Relationship Objects.

class Bundle(*args, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • id (ID)
  • spec_version (String)
  • objects (List of STIX Objects)
get_obj(obj_uuid)
class ExternalReference(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • source_name (String, required)
  • description (String)
  • url (String)
  • hashes (Hashes)
  • external_id (String)
class GranularMarking(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • marking_ref (Reference, required)
  • selectors (List of Selectors, required)
class KillChainPhase(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • kill_chain_name (String, required)
  • phase_name (String, required)
class MarkingDefinition(**kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • id (ID)
  • created_by_ref (Reference)
  • created (Timestamp, default: current date/time)
  • definition_type (String, required)
  • definition (Marking, required)
  • external_references (List of External References)
  • object_marking_refs (List of References)
  • granular_markings (List of Granular Markings)
serialize(pretty=False, include_optional_defaults=False, **kwargs)

Serialize a STIX object.

Examples

>>> import stix2
>>> identity = stix2.Identity(name='Example Corp.', identity_class='organization')
>>> print(identity.serialize(sort_keys=True))
{"created": "2018-06-08T19:03:54.066Z", ... "name": "Example Corp.", "type": "identity"}
>>> print(identity.serialize(sort_keys=True, indent=4))
{
    "created": "2018-06-08T19:03:54.066Z",
    "id": "identity--d7f3e25a-ba1c-447a-ab71-6434b092b05e",
    "identity_class": "organization",
    "modified": "2018-06-08T19:03:54.066Z",
    "name": "Example Corp.",
    "type": "identity"
}
Returns:str – The serialized JSON object.

See also

stix2.serialization.serialize for options.

class StatementMarking(statement=None, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • statement (String, required)
class TLPMarking(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • tlp (String, required)
class URL(**kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • value (String, required)
  • extensions (Extensions)
class AlternateDataStream(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • name (String, required)
  • hashes (Hashes)
  • size (Integer)
class ArchiveExt(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • contains_refs (List of Object References, required)
  • version (String)
  • comment (String)
class Artifact(**kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • mime_type (String)
  • payload_bin (Binary)
  • url (String)
  • hashes (Hashes)
  • extensions (Extensions)
class AutonomousSystem(**kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • number (Integer, required)
  • name (String)
  • rir (String)
  • extensions (Extensions)
class Directory(**kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • path (String, required)
  • path_enc (String)
  • created (Timestamp)
  • modified (Timestamp)
  • accessed (Timestamp)
  • contains_refs (List of Object References)
  • extensions (Extensions)
class DomainName(**kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • value (String, required)
  • resolves_to_refs (List of Object References)
  • extensions (Extensions)
class EmailAddress(**kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • value (String, required)
  • display_name (String)
  • belongs_to_ref (Object Reference)
  • extensions (Extensions)
class EmailMessage(**kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • is_multipart (Boolean, required)
  • date (Timestamp)
  • content_type (String)
  • from_ref (Object Reference)
  • sender_ref (Object Reference)
  • to_refs (List of Object References)
  • cc_refs (List of Object References)
  • bcc_refs (List of Object References)
  • subject (String)
  • received_lines (List of Strings)
  • additional_header_fields (Dictionary)
  • body (String)
  • body_multipart (List of Embedded Objects)
  • raw_email_ref (Object Reference)
  • extensions (Extensions)
class EmailMIMEComponent(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • body (String)
  • body_raw_ref (Object Reference)
  • content_type (String)
  • content_disposition (String)
class File(**kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • hashes (Hashes)
  • size (Integer)
  • name (String)
  • name_enc (String)
  • magic_number_hex (Hex)
  • mime_type (String)
  • created (Timestamp)
  • modified (Timestamp)
  • accessed (Timestamp)
  • parent_directory_ref (Object Reference)
  • is_encrypted (Boolean)
  • encryption_algorithm (String)
  • decryption_key (String)
  • contains_refs (List of Object References)
  • content_ref (Object Reference)
  • extensions (Extensions)
class HTTPRequestExt(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • request_method (String, required)
  • request_value (String, required)
  • request_version (String)
  • request_header (Dictionary)
  • message_body_length (Integer)
  • message_body_data_ref (Object Reference)
class ICMPExt(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • icmp_type_hex (Hex, required)
  • icmp_code_hex (Hex, required)
class IPv4Address(**kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • value (String, required)
  • resolves_to_refs (List of Object References)
  • belongs_to_refs (List of Object References)
  • extensions (Extensions)
class IPv6Address(**kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • value (String, required)
  • resolves_to_refs (List of Object References)
  • belongs_to_refs (List of Object References)
  • extensions (Extensions)
class MACAddress(**kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • value (String, required)
  • extensions (Extensions)
class Mutex(**kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • name (String, required)
  • extensions (Extensions)
class NetworkTraffic(**kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • start (Timestamp)
  • end (Timestamp)
  • is_active (Boolean)
  • src_ref (Object Reference)
  • dst_ref (Object Reference)
  • src_port (Integer)
  • dst_port (Integer)
  • protocols (List of Strings, required)
  • src_byte_count (Integer)
  • dst_byte_count (Integer)
  • src_packets (Integer)
  • dst_packets (Integer)
  • ipfix (Dictionary)
  • src_payload_ref (Object Reference)
  • dst_payload_ref (Object Reference)
  • encapsulates_refs (List of Object References)
  • encapsulates_by_ref (Object Reference)
  • extensions (Extensions)
class NTFSExt(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • sid (String)
  • alternate_data_streams (List of Embedded Objects)
class PDFExt(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • version (String)
  • is_optimized (Boolean)
  • document_info_dict (Dictionary)
  • pdfid0 (String)
  • pdfid1 (String)
class Process(**kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • is_hidden (Boolean)
  • pid (Integer)
  • name (String)
  • created (Timestamp)
  • cwd (String)
  • arguments (List of Strings)
  • command_line (String)
  • environment_variables (Dictionary)
  • opened_connection_refs (List of Object References)
  • creator_user_ref (Object Reference)
  • binary_ref (Object Reference)
  • parent_ref (Object Reference)
  • child_refs (List of Object References)
  • extensions (Extensions)
class RasterImageExt(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • image_height (Integer)
  • image_width (Integer)
  • bits_per_pixel (Integer)
  • image_compression_algorithm (String)
  • exif_tags (Dictionary)
class SocketExt(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • address_family (Enum, required)
  • is_blocking (Boolean)
  • is_listening (Boolean)
  • protocol_family (Enum)
  • options (Dictionary)
  • socket_type (Enum)
  • socket_descriptor (Integer)
  • socket_handle (Integer)
class Software(**kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • name (String, required)
  • cpe (String)
  • languages (List of Strings)
  • vendor (String)
  • version (String)
  • extensions (Extensions)
class TCPExt(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • src_flags_hex (Hex)
  • dst_flags_hex (Hex)
class UNIXAccountExt(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • gid (Integer)
  • groups (List of Strings)
  • home_dir (String)
  • shell (String)
class UserAccount(**kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • user_id (String, required)
  • account_login (String)
  • account_type (String)
  • display_name (String)
  • is_service_account (Boolean)
  • is_privileged (Boolean)
  • can_escalate_privs (Boolean)
  • is_disabled (Boolean)
  • account_created (Timestamp)
  • account_expires (Timestamp)
  • password_last_changed (Timestamp)
  • account_first_login (Timestamp)
  • account_last_login (Timestamp)
  • extensions (Extensions)
class WindowsPEBinaryExt(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • pe_type (String, required)
  • imphash (String)
  • machine_hex (Hex)
  • number_of_sections (Integer)
  • time_date_stamp (Timestamp)
  • pointer_to_symbol_table_hex (Hex)
  • number_of_symbols (Integer)
  • size_of_optional_header (Integer)
  • characteristics_hex (Hex)
  • file_header_hashes (Hashes)
  • optional_header (Embedded Object)
  • sections (List of Embedded Objects)
class WindowsPEOptionalHeaderType(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • magic_hex (Hex)
  • major_linker_version (Integer)
  • minor_linker_version (Integer)
  • size_of_code (Integer)
  • size_of_initialized_data (Integer)
  • size_of_uninitialized_data (Integer)
  • address_of_entry_point (Integer)
  • base_of_code (Integer)
  • base_of_data (Integer)
  • image_base (Integer)
  • section_alignment (Integer)
  • file_alignment (Integer)
  • major_os_version (Integer)
  • minor_os_version (Integer)
  • major_image_version (Integer)
  • minor_image_version (Integer)
  • major_subsystem_version (Integer)
  • minor_subsystem_version (Integer)
  • win32_version_value_hex (Hex)
  • size_of_image (Integer)
  • size_of_headers (Integer)
  • checksum_hex (Hex)
  • subsystem_hex (Hex)
  • dll_characteristics_hex (Hex)
  • size_of_stack_reserve (Integer)
  • size_of_stack_commit (Integer)
  • size_of_heap_reserve (Integer)
  • size_of_heap_commit (Integer)
  • loader_flags_hex (Hex)
  • number_of_rva_and_sizes (Integer)
  • hashes (Hashes)
class WindowsPESection(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • name (String, required)
  • size (Integer)
  • entropy (Float)
  • hashes (Hashes)
class WindowsProcessExt(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • aslr_enabled (Boolean)
  • dep_enabled (Boolean)
  • priority (String)
  • owner_sid (String)
  • window_title (String)
  • startup_info (Dictionary)
class WindowsRegistryKey(**kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • key (String, required)
  • values (List of Embedded Objects)
  • modified (Timestamp)
  • creator_user_ref (Object Reference)
  • number_of_subkeys (Integer)
  • extensions (Extensions)
class WindowsRegistryValueType(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • name (String, required)
  • data (String)
  • data_type (Enum)
class WindowsServiceExt(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • service_name (String, required)
  • descriptions (List of Strings)
  • display_name (String)
  • group_name (String)
  • start_type (Enum)
  • service_dll_refs (List of Object References)
  • service_type (Enum)
  • service_status (Enum)
class X509Certificate(**kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • is_self_signed (Boolean)
  • hashes (Hashes)
  • version (String)
  • serial_number (String)
  • signature_algorithm (String)
  • issuer (String)
  • validity_not_before (Timestamp)
  • validity_not_after (Timestamp)
  • subject (String)
  • subject_public_key_algorithm (String)
  • subject_public_key_modulus (String)
  • subject_public_key_exponent (Integer)
  • x509_v3_extensions (Embedded Object)
  • extensions (Extensions)
class X509V3ExtensionsType(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • basic_constraints (String)
  • name_constraints (String)
  • policy_constraints (String)
  • key_usage (String)
  • extended_key_usage (String)
  • subject_key_identifier (String)
  • authority_key_identifier (String)
  • subject_alternative_name (String)
  • issuer_alternative_name (String)
  • subject_directory_attributes (String)
  • crl_distribution_points (String)
  • inhibit_any_policy (String)
  • private_key_usage_period_not_before (Timestamp)
  • private_key_usage_period_not_after (Timestamp)
  • certificate_policies (String)
  • policy_mappings (String)
class AttackPattern(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • id (ID)
  • created_by_ref (Reference)
  • created (Timestamp, default: current date/time)
  • modified (Timestamp, default: current date/time)
  • name (String, required)
  • description (String)
  • kill_chain_phases (List of Kill Chain Phases)
  • revoked (Boolean)
  • labels (List of Strings)
  • external_references (List of External References)
  • object_marking_refs (List of References)
  • granular_markings (List of Granular Markings)
class Campaign(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • id (ID)
  • created_by_ref (Reference)
  • created (Timestamp, default: current date/time)
  • modified (Timestamp, default: current date/time)
  • name (String, required)
  • description (String)
  • aliases (List of Strings)
  • first_seen (Timestamp)
  • last_seen (Timestamp)
  • objective (String)
  • revoked (Boolean)
  • labels (List of Strings)
  • external_references (List of External References)
  • object_marking_refs (List of References)
  • granular_markings (List of Granular Markings)
class CourseOfAction(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • id (ID)
  • created_by_ref (Reference)
  • created (Timestamp, default: current date/time)
  • modified (Timestamp, default: current date/time)
  • name (String, required)
  • description (String)
  • revoked (Boolean)
  • labels (List of Strings)
  • external_references (List of External References)
  • object_marking_refs (List of References)
  • granular_markings (List of Granular Markings)
class Identity(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • id (ID)
  • created_by_ref (Reference)
  • created (Timestamp, default: current date/time)
  • modified (Timestamp, default: current date/time)
  • name (String, required)
  • description (String)
  • identity_class (Open Vocab, required)
  • sectors (List of Open Vocabs)
  • contact_information (String)
  • revoked (Boolean)
  • labels (List of Strings)
  • external_references (List of External References)
  • object_marking_refs (List of References)
  • granular_markings (List of Granular Markings)
class Indicator(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • id (ID)
  • created_by_ref (Reference)
  • created (Timestamp, default: current date/time)
  • modified (Timestamp, default: current date/time)
  • name (String)
  • description (String)
  • pattern (Pattern, required)
  • valid_from (Timestamp, default: current date/time)
  • valid_until (Timestamp)
  • kill_chain_phases (List of Kill Chain Phases)
  • revoked (Boolean)
  • labels (List of Open Vocabs, required)
  • external_references (List of External References)
  • object_marking_refs (List of References)
  • granular_markings (List of Granular Markings)
class IntrusionSet(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • id (ID)
  • created_by_ref (Reference)
  • created (Timestamp, default: current date/time)
  • modified (Timestamp, default: current date/time)
  • name (String, required)
  • description (String)
  • aliases (List of Strings)
  • first_seen (Timestamp)
  • last_seen (Timestamp)
  • goals (List of Strings)
  • resource_level (String)
  • primary_motivation (Open Vocab)
  • secondary_motivations (List of Open Vocabs)
  • revoked (Boolean)
  • labels (List of Strings)
  • external_references (List of External References)
  • object_marking_refs (List of References)
  • granular_markings (List of Granular Markings)
class Malware(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • id (ID)
  • created_by_ref (Reference)
  • created (Timestamp, default: current date/time)
  • modified (Timestamp, default: current date/time)
  • name (String, required)
  • description (String)
  • kill_chain_phases (List of Kill Chain Phases)
  • revoked (Boolean)
  • labels (List of Open Vocabs, required)
  • external_references (List of External References)
  • object_marking_refs (List of References)
  • granular_markings (List of Granular Markings)
class ObservedData(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • id (ID)
  • created_by_ref (Reference)
  • created (Timestamp, default: current date/time)
  • modified (Timestamp, default: current date/time)
  • first_observed (Timestamp, required)
  • last_observed (Timestamp, required)
  • number_observed (Integer, required)
  • objects (Observable, required)
  • revoked (Boolean)
  • labels (List of Strings)
  • external_references (List of External References)
  • object_marking_refs (List of References)
  • granular_markings (List of Granular Markings)
class Report(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • id (ID)
  • created_by_ref (Reference)
  • created (Timestamp, default: current date/time)
  • modified (Timestamp, default: current date/time)
  • name (String, required)
  • description (String)
  • published (Timestamp, required)
  • object_refs (List of References, required)
  • revoked (Boolean)
  • labels (List of Open Vocabs, required)
  • external_references (List of External References)
  • object_marking_refs (List of References)
  • granular_markings (List of Granular Markings)
class ThreatActor(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • id (ID)
  • created_by_ref (Reference)
  • created (Timestamp, default: current date/time)
  • modified (Timestamp, default: current date/time)
  • name (String, required)
  • description (String)
  • aliases (List of Strings)
  • roles (List of Open Vocabs)
  • goals (List of Strings)
  • sophistication (Open Vocab)
  • resource_level (Open Vocab)
  • primary_motivation (Open Vocab)
  • secondary_motivations (List of Open Vocabs)
  • personal_motivations (List of Open Vocabs)
  • revoked (Boolean)
  • labels (List of Open Vocabs, required)
  • external_references (List of External References)
  • object_marking_refs (List of References)
  • granular_markings (List of Granular Markings)
class Tool(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • id (ID)
  • created_by_ref (Reference)
  • created (Timestamp, default: current date/time)
  • modified (Timestamp, default: current date/time)
  • name (String, required)
  • description (String)
  • kill_chain_phases (List of Kill Chain Phases)
  • tool_version (String)
  • revoked (Boolean)
  • labels (List of Open Vocabs, required)
  • external_references (List of External References)
  • object_marking_refs (List of References)
  • granular_markings (List of Granular Markings)
class Vulnerability(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • id (ID)
  • created_by_ref (Reference)
  • created (Timestamp, default: current date/time)
  • modified (Timestamp, default: current date/time)
  • name (String, required)
  • description (String)
  • revoked (Boolean)
  • labels (List of Strings)
  • external_references (List of External References)
  • object_marking_refs (List of References)
  • granular_markings (List of Granular Markings)
class Relationship(source_ref=None, relationship_type=None, target_ref=None, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • id (ID)
  • created_by_ref (Reference)
  • created (Timestamp, default: current date/time)
  • modified (Timestamp, default: current date/time)
  • relationship_type (String, required)
  • description (String)
  • source_ref (Reference, required)
  • target_ref (Reference, required)
  • revoked (Boolean)
  • labels (List of Strings)
  • external_references (List of External References)
  • object_marking_refs (List of References)
  • granular_markings (List of Granular Markings)
class Sighting(sighting_of_ref=None, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • id (ID)
  • created_by_ref (Reference)
  • created (Timestamp, default: current date/time)
  • modified (Timestamp, default: current date/time)
  • first_seen (Timestamp)
  • last_seen (Timestamp)
  • count (Integer)
  • sighting_of_ref (Reference, required)
  • observed_data_refs (List of References)
  • where_sighted_refs (List of References)
  • summary (Boolean)
  • revoked (Boolean)
  • labels (List of Strings)
  • external_references (List of External References)
  • object_marking_refs (List of References)
  • granular_markings (List of Granular Markings)
CustomMarking(type='x-custom-marking', properties=None)

Custom STIX Marking decorator.

Example

>>> from stix2 import CustomMarking
>>> from stix2.properties import IntegerProperty, StringProperty
>>> @CustomMarking('x-custom-marking', [
...     ('property1', StringProperty(required=True)),
...     ('property2', IntegerProperty()),
... ])
... class MyNewMarkingObjectType():
...     pass
CustomExtension(type='x-custom-observable-ext', properties=None)

Decorator for custom extensions to STIX Cyber Observables.

CustomObservable(type='x-custom-observable', properties=None)

Custom STIX Cyber Observable Object type decorator.

Example

>>> from stix2.v20 import CustomObservable
>>> from stix2.properties import IntegerProperty, StringProperty
>>> @CustomObservable('x-custom-observable', [
...     ('property1', StringProperty(required=True)),
...     ('property2', IntegerProperty()),
... ])
... class MyNewObservableType():
...     pass
CustomObject(type='x-custom-type', properties=None)

Custom STIX Object type decorator.

Example

>>> from stix2.v20 import CustomObject
>>> from stix2.properties import IntegerProperty, StringProperty
>>> @CustomObject('x-type-name', [
...     ('property1', StringProperty(required=True)),
...     ('property2', IntegerProperty()),
... ])
... class MyNewObjectType():
...     pass

Supply an __init__() function to add any special validations to the custom type. Don’t call super().__init__() though - doing so will cause an error.

Example

>>> from stix2.v20 import CustomObject
>>> from stix2.properties import IntegerProperty, StringProperty
>>> @CustomObject('x-type-name', [
...     ('property1', StringProperty(required=True)),
...     ('property2', IntegerProperty()),
... ])
... class MyNewObjectType():
...     def __init__(self, property2=None, **kwargs):
...         if property2 and property2 < 10:
...             raise ValueError("'property2' is too small.")