common

STIX 2 Common Data Types and Properties.

class ExternalReference(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • source_name (String, required)
  • description (String)
  • url (String)
  • hashes (Hashes)
  • external_id (String)
class GranularMarking(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • marking_ref (Reference, required)
  • selectors (List of Selectors, required)
class KillChainPhase(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • kill_chain_name (String, required)
  • phase_name (String, required)
class MarkingDefinition(**kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • id (ID)
  • created_by_ref (Reference)
  • created (Timestamp, default: current date/time)
  • external_references (List of External References)
  • object_marking_refs (List of References)
  • granular_markings (List of Granular Markings)
  • definition_type (String, required)
  • definition (Marking, required)
class MarkingProperty(required=False, fixed=None, default=None)

Represent the marking objects in the definition property of marking-definition objects.

clean(value)
class StatementMarking(statement=None, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • statement (String, required)
class TLPMarking(allow_custom=False, **kwargs)

For more detailed information on this object’s properties, see the STIX 2.0 specification.

Properties:
  • tlp (String, required)
CustomMarking(type='x-custom-marking', properties=None)

Custom STIX Marking decorator.

Example

>>> @CustomMarking('x-custom-marking', [
...     ('property1', StringProperty(required=True)),
...     ('property2', IntegerProperty()),
... ])
... class MyNewMarkingObjectType():
...     pass