stix.ttp Module


class stix.ttp.TTP(id_=None, idref=None, timestamp=None, title=None, description=None, short_description=None)

Bases: stix.base.BaseCoreComponent

Implementation of the STIX TTP.

  • id (optional) – An identifier. If None, a value will be generated via mixbox.idgen.create_id(). If set, this will unset the idref property.
  • idref (optional) – An identifier reference. If set this will unset the id_ property.
  • timestamp (optional) – A timestamp value. Can be an instance of datetime.datetime or str.
  • description – A description of the purpose or intent of this object.
  • short_description – A short description of the intent or purpose of this object.
  • title – The title of this object.

Adds a ExploitTarget object to the exploit_targets collection.


Adds a Statement object to the intended_effects collection.

If value is a string, an attempt will be made to convert it into an instance of Statement.


Adds a KillChainPhaseReference to the kill_chain_phases collection.

Parameters:value – A KillChainPhase, KillChainPhaseReference or a str representing the phase_id of. Note that you if you are defining a custom Kill Chain, you need to add it to the STIX package separately.

Adds a RelatedPackageRef object to the related_packages collection.

Parameters:value – A RelatedPackageRef or a STIXPackage object.

Adds an Related TTP to the related_ttps list property of this TTP.

The TTP parameter must be an instance of RelatedTTP or TTP.

If the TTP parameter is None, no item wil be added to the related_ttps list property.

Calling this method is the same as calling append() on the related_ttps property.

See also

The RelatedTTPs documentation.


If the TTP parameter is not an instance of RelatedTTP an attempt will be made to convert it to one.

Parameters:value – An instance of TTP or RelatedTTP.
Raises:ValueError – If the TTP parameter cannot be converted into an instance of RelatedTTP