Warning

This documentation is still a work in progress. If you have any issues or questions, please ask on the stix-discussion mailing list or file a bug in our issue tracker.

API Reference

The python-stix APIs are the recommended tools for reading, writing, and manipulating STIX XML documents.

Note

The python-stix APIs are currently under development. As such, API coverage of STIX data constructs is incomplete; please bear with us as we work toward complete coverage. This documentation also serves to outline current API coverage.

STIX

Modules located in the base stix package

• stix.base Module
• stix.data_marking Module

STIX Campaign

Modules located in the stix.campaign package

• stix.campaign Module

STIX Common

Modules located in the stix.common package

• stix.common Module
• stix.common.activity Module
• stix.common.confidence Module
• stix.common.datetimewithprecision Module
• stix.common.identity Module
• stix.common.information_source Module
• stix.common.kill_chains Module
• stix.common.related Module
• stix.common.statement Module
• stix.common.structured_text Module
• stix.common.tools Module
• stix.common.vocabs Module

STIX Core

Modules located in the stix.core package

• stix.core.stix_header Module
• stix.core.stix_package Module
• stix.core.ttps Module

STIX Course of Action (COA)

Modules located in the stix.coa package

• stix.coa Module
• stix.coa.objective Module

STIX Exploit Target

Modules located in the stix.exploit_target package

• stix.exploit_target Module
• stix.exploit_target.configuration Module
• stix.exploit_target.vulnerability Module
• stix.exploit_target.weakness Module

STIX Extensions

Modules located in the stix.extensions package

• stix.extensions.identity.ciq_identity_3_0 Module
• stix.extensions.malware.maec_4_1_malware Module
• stix.extensions.marking.simple_marking Module
• stix.extensions.marking.terms_of_use_marking Module
• stix.extensions.marking.tlp Module
• stix.extensions.test_mechanism.generic_test_mechanism Module
• stix.extensions.test_mechanism.open_ioc_2010_test_mechanism Module
• stix.extensions.test_mechanism.snort_test_mechanism Module
• stix.extensions.test_mechanism.yara_test_mechanism Module

STIX Incident

Modules located in the stix.incident package

• stix.incident Module
• stix.incident.affected_asset Module
• stix.incident.coa Module
• stix.incident.contributors Module
• stix.incident.direct_impact_summary Module
• stix.incident.external_id Module
• stix.incident.history Module
• stix.incident.impact_assessment Module
• stix.incident.indirect_impact_summary Module
• stix.incident.loss_estimation Module
• stix.incident.property_affected Module
• stix.incident.time Module
• stix.incident.total_loss_estimation Module

STIX Indicator

Modules located in the stix.indicator package

• stix.indicator.indicator Module
• stix.indicator.sightings Module
• stix.indicator.test_mechanism Module
• stix.indicator.valid_time Module

STIX Threat Actor

Modules located in the stix.threat_actor package

• stix.threat_actor Module

STIX Tactics, Techniques, and Procedures (TTP)

Modules located in the stix.ttp package

• stix.ttp Module
• stix.ttp.attack_pattern Module
• stix.ttp.behavior Module
• stix.ttp.exploit Module
• stix.ttp.exploit_targets Module
• stix.ttp.infrastructure Module
• stix.ttp.malware_instance Module
• stix.ttp.related_ttps Module
• stix.ttp.resource Module
• stix.ttp.victim_targeting Module

STIX Utils

Modules located in the stix.utils package

• stix.utils.dates Module
• stix.utils.idgen Module
• stix.utils.nsparser Module
• stix.utils.parser Module