STIX 2.1 Objects, Relationships, and Bundles

Structured intelligence is machine-consumable intelligence. STIX is the format that bridges human-readable reports and automated security tooling.

STIX 2.1 Worked Example

{
  "type": "bundle",
  "id": "bundle--f9a4e5b7-1234-5678-abcd-ef0123456789",
  "objects": [
    {
      "type": "threat-actor",
      "spec_version": "2.1",
      "id": "threat-actor--12345678-abcd-1234-abcd-123456789abc",
      "created": "2024-09-01T00:00:00.000Z",
      "modified": "2024-09-01T00:00:00.000Z",
      "name": "SCATTERED SPIDER",
      "aliases": ["Starfraud", "UNC3944", "Muddled Libra"],
      "threat_actor_types": ["crime-syndicate"],
      "sophistication": "advanced",
      "resource_level": "organization",
      "primary_motivation": "financial-gain",
      "labels": ["financially-motivated", "initial-access-broker"]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--abcdef12-3456-7890-abcd-ef1234567890",
      "created": "2024-09-01T00:00:00.000Z",
      "modified": "2024-09-01T00:00:00.000Z",
      "name": "ALPHV/BlackCat Ransomware",
      "malware_types": ["ransomware"],
      "is_family": true,
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "impact"
        }
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c2d3e4f5-6789-0abc-def0-123456789012",
      "created": "2024-09-01T00:00:00.000Z",
      "modified": "2024-09-01T00:00:00.000Z",
      "name": "Ransomware C2 Domain",
      "indicator_types": ["malicious-activity"],
      "pattern_type": "stix",
      "pattern": "[domain-name:value = 'update-cdn-service.com']",
      "valid_from": "2024-09-01T00:00:00Z",
      "valid_until": "2024-12-01T00:00:00Z",
      "confidence": 75,
      "labels": ["c2"]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--7830cfcf-b268-4d61-a3d6-2375a1a2ea5e",
      "created": "2024-09-01T00:00:00.000Z",
      "modified": "2024-09-01T00:00:00.000Z",
      "name": "Phishing: Spearphishing Attachment",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "url": "https://attack.mitre.org/techniques/T1566/001/",
          "external_id": "T1566.001"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--11111111-2222-3333-4444-555555555555",
      "created": "2024-09-01T00:00:00.000Z",
      "modified": "2024-09-01T00:00:00.000Z",
      "relationship_type": "uses",
      "source_ref": "threat-actor--12345678-abcd-1234-abcd-123456789abc",
      "target_ref": "malware--abcdef12-3456-7890-abcd-ef1234567890"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22222222-3333-4444-5555-666666666666",
      "created": "2024-09-01T00:00:00.000Z",
      "modified": "2024-09-01T00:00:00.000Z",
      "relationship_type": "indicates",
      "source_ref": "indicator--c2d3e4f5-6789-0abc-def0-123456789012",
      "target_ref": "malware--abcdef12-3456-7890-abcd-ef1234567890"
    }
  ]
}

MISP Event Structure

# Creating a MISP event programmatically via PyMISP

from pymisp import PyMISP, MISPEvent, MISPAttribute, MISPObject

misp = PyMISP('https://misp.company.local', 'YOUR_API_KEY', ssl=False)

# Create event
event = MISPEvent()
event.info = "SCATTERED SPIDER - Ransomware Campaign - Sep 2024"
event.threat_level_id = 1   # High
event.distribution = 1      # This community only (or 3 = all communities)
event.analysis = 2          # Completed

# Add TLP tag
event.add_tag('tlp:amber')
event.add_tag('misp-galaxy:threat-actor="Scattered Spider"')
event.add_tag('misp-galaxy:mitre-attack-pattern="T1566.001"')

# Add C2 domain attribute
domain_attr = event.add_attribute('domain', 'update-cdn-service.com')
domain_attr.to_ids = True   # This attribute should be used for detection
domain_attr.comment = 'Confirmed ALPHV C2 domain - first seen 2024-09-01'
domain_attr.add_tag('tlp:amber')

# Add file hash
hash_attr = event.add_attribute('sha256', 'abc123...sha256hash...')
hash_attr.to_ids = True
hash_attr.comment = 'ALPHV/BlackCat ransomware binary - packed'

# Add network indicator using MISP object (groups related attributes)
net_obj = MISPObject('network-connection')
net_obj.add_attribute('ip-dst', value='185.220.101.9', to_ids=True)
net_obj.add_attribute('dst-port', value='443')
net_obj.add_attribute('protocol', value='TCP')
event.add_object(net_obj)

# Submit to MISP
result = misp.add_event(event)
print(f"Event created: {result['Event']['uuid']}")