common

STIX 2.1 Common Data Types and Properties.

class ExtensionDefinition(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.1 specification.

Properties:
  • spec_version (String)
  • id (ID)
  • created_by_ref (Reference, required)
  • created (Timestamp, default: current date/time)
  • modified (Timestamp, default: current date/time)
  • name (String, required)
  • description (String)
  • schema (String, required)
  • version (String, required)
  • extension_types (List of Enums, required)
  • extension_properties (List of Strings)
  • revoked (Boolean)
  • labels (List of Strings)
  • external_references (List of External References)
  • object_marking_refs (List of References)
  • granular_markings (List of Granular Markings)
class ExternalReference(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.1 specification.

Properties:
  • source_name (String, required)
  • description (String)
  • url (String)
  • hashes (Hashes)
  • external_id (String)
class GranularMarking(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.1 specification.

Properties:
  • lang (String)
  • marking_ref (Reference)
  • selectors (List of Selectors, required)
class KillChainPhase(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.1 specification.

Properties:
  • kill_chain_name (String, required)
  • phase_name (String, required)
class LanguageContent(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.1 specification.

Properties:
  • spec_version (String)
  • id (ID)
  • created_by_ref (Reference)
  • created (Timestamp, default: current date/time)
  • modified (Timestamp, default: current date/time)
  • object_ref (Reference, required)
  • object_modified (Timestamp)
  • contents (Dictionary, required)
  • revoked (Boolean)
  • labels (List of Strings)
  • confidence (Integer)
  • external_references (List of External References)
  • object_marking_refs (List of References)
  • granular_markings (List of Granular Markings)
  • extensions (Extensions)
class MarkingDefinition(**kwargs)

For more detailed information on this object’s properties, see the STIX 2.1 specification.

Properties:
  • spec_version (String)
  • id (ID)
  • created_by_ref (Reference)
  • created (Timestamp, default: current date/time)
  • definition_type (String)
  • name (String)
  • definition (Marking)
  • external_references (List of External References)
  • object_marking_refs (List of References)
  • granular_markings (List of Granular Markings)
  • extensions (Extensions)
serialize(pretty=False, include_optional_defaults=False, **kwargs)

Serialize a STIX object.

Examples

>>> import stix2
>>> identity = stix2.Identity(name='Example Corp.', identity_class='organization')
>>> print(identity.serialize(sort_keys=True))
{"created": "2018-06-08T19:03:54.066Z", ... "name": "Example Corp.", "type": "identity"}
>>> print(identity.serialize(sort_keys=True, indent=4))
{
    "created": "2018-06-08T19:03:54.066Z",
    "id": "identity--d7f3e25a-ba1c-447a-ab71-6434b092b05e",
    "identity_class": "organization",
    "modified": "2018-06-08T19:03:54.066Z",
    "name": "Example Corp.",
    "type": "identity"
}
Returns:str – The serialized JSON object.

See also

stix2.serialization.serialize for options.

class MarkingProperty(required=False, fixed=None, default=None)

Represent the marking objects in the definition property of marking-definition objects.

clean(value, allow_custom=False)
class StatementMarking(statement=None, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.1 specification.

Properties:
  • statement (String, required)
class TLPMarking(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.1 specification.

Properties:
  • tlp (String, required)
CustomExtension(type='x-custom-ext', properties=None)

Custom STIX Object Extension decorator.

CustomMarking(type='x-custom-marking', properties=None)

Custom STIX Marking decorator.

Example

>>> from stix2.v21 import CustomMarking
>>> from stix2.properties import IntegerProperty, StringProperty
>>> @CustomMarking('x-custom-marking', [
...     ('property1', StringProperty(required=True)),
...     ('property2', IntegerProperty()),
... ])
... class MyNewMarkingObjectType():
...     pass