core

STIX 2.0 Objects that are neither SDOs nor SROs.

class Bundle(*args, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • id (ID)
  • spec_version (**)
  • objects (List of STIX Objects)
class STIXObjectProperty(allow_custom=False)
clean(value)
dict_to_stix2(stix_dict, allow_custom=False, version=None)

convert dictionary to full python-stix2 object

Parameters:
  • stix_dict (dict) – a python dictionary of a STIX object that (presumably) is semantically correct to be parsed into a full python-stix2 obj
  • allow_custom (bool) – Whether to allow custom properties as well unknown custom objects. Note that unknown custom objects cannot be parsed into STIX objects, and will be returned as is. Default: False.
Returns:

An instantiated Python STIX object

WARNING: ‘allow_custom=True’ will allow for the return of any supplied STIX dict(s) that cannot be found to map to any known STIX object types (both STIX2 domain objects or defined custom STIX2 objects); NO validation is done. This is done to allow the processing of possibly unknown custom STIX objects (example scenario: I need to query a third-party TAXII endpoint that could provide custom STIX objects that I dont know about ahead of time)

parse(data, allow_custom=False, version=None)

Convert a string, dict or file-like object into a STIX object.

Parameters:
  • data (str, dict, file-like object) – The STIX 2 content to be parsed.
  • allow_custom (bool) – Whether to allow custom properties as well unknown custom objects. Note that unknown custom objects cannot be parsed into STIX objects, and will be returned as is. Default: False.
  • version (str) – Which STIX2 version to use. (e.g. “2.0”, “2.1”). If None, use latest version.
Returns:

An instantiated Python STIX object.
WARNING: ‘allow_custom=True’ will allow for the return of any supplied STIX
dict(s) that cannot be found to map to any known STIX object types (both STIX2 domain objects or defined custom STIX2 objects); NO validation is done. This is done to allow the processing of possibly unknown custom STIX objects (example scenario: I need to query a third-party TAXII endpoint that could provide custom STIX objects that I dont know about ahead of time)