implementing-security-information-sharing-with-stix2

name	implementing-security-information-sharing-with-stix2
description	Create, validate, and share STIX 2.1 threat intelligence objects using the stix2 Python library. Covers indicators, malware, campaigns, relationships, bundles, and TAXII 2.1 publishing.
domain	cybersecurity
subdomain	threat-intelligence
tags	["stix","taxii","threat-sharing","intelligence-exchange"]
version	1.0
author	mahipal
license	Apache-2.0
d3fend_techniques	["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"]
nist_csf	["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"]

Implementing Security Information Sharing with STIX 2.1

Build and share structured threat intelligence using STIX 2.1 objects with the stix2 Python library and TAXII 2.1 transport protocol.

When to Use

• Building a threat intelligence platform that exchanges IOCs with partner organizations
• Automating ingestion and export of indicators from MISP, OpenCTI, or other TIP platforms
• Creating machine-readable intelligence reports for ISAC/ISAO sharing communities
• Publishing threat data to a TAXII 2.1 server for downstream consumption by SIEMs and SOARs
• Converting unstructured threat reports into standardized STIX 2.1 bundles
• Enriching detection rules with context by linking indicators to malware, campaigns, and threat actors

Do not use for sharing simple IP blocklists or CSV-based IOC feeds that do not require relationship context; plain-text feeds with simpler formats like CSV or OpenIOC may be more efficient in those cases.

Prerequisites

• Python 3.8+ with stix2 library (pip install stix2)
• taxii2-client for consuming TAXII feeds (pip install taxii2-client)
• A TAXII 2.1 server endpoint for publishing (e.g., OpenTAXII, Medallion, or MISP TAXII service)
• Familiarity with STIX 2.1 SDO types: Indicator, Malware, Threat Actor, Campaign, Attack Pattern, Identity
• Familiarity with STIX 2.1 SRO types: Relationship, Sighting
• Optional: OpenCTI or MISP instance for end-to-end integration testing

Workflow

Step 1: Install Dependencies

pip install stix2 taxii2-client requests

Step 2: Create STIX 2.1 Domain Objects (SDOs)

Create core intelligence objects that describe threats, actors, and campaigns:

from stix2 import (
    Indicator, Malware, ThreatActor, Campaign,
    AttackPattern, Identity, Relationship, Bundle,
    ExternalReference
)
from datetime import datetime

# Create a producer identity
producer = Identity(
    name="ACME Threat Intel Team",
    identity_class="organization",
    sectors=["technology"],
    contact_information="[e-mail]"
)

# Create a malware object
emotet_malware = Malware(
    name=,
    description=
                ,
    malware_types=[, ],
    is_family=,
    created_by_ref=producer.
)


spearphishing_pattern = AttackPattern(
    name=,
    description=,
    external_references=[
        ExternalReference(
            source_name=,
            external_id=,
            url=
        )
    ],
    created_by_ref=producer.
)


threat_actor = ThreatActor(
    name=,
    description=,
    threat_actor_types=[],
    aliases=[, ],
    primary_motivation=,
    created_by_ref=producer.
)


campaign = Campaign(
    name=,
    description=
                ,
    first_seen=,
    created_by_ref=producer.
)

()
()
()