stix-bundle

STIX 2.1 Bundle Creation

STIX (Structured Threat Information Expression) 2.1 is the standard for representing and sharing cyber threat intelligence.

Bundle Structure

{
  "type": "bundle",
  "id": "bundle--<UUID>",
  "objects": [
    // Array of STIX Domain Objects (SDOs) and Relationship Objects (SROs)
  ]
}

STIX Domain Objects (SDOs)

Indicator

Represents a pattern that can be used to detect suspicious activity.

{
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--<UUID>",
  "created": "2026-01-15T00:00:00.000Z",
  "modified": "2026-01-15T00:00:00.000Z",
  "name": "Malicious IP used by APT28",
  "description": "C2 server observed in campaign targeting European government entities",
  "pattern": "[ipv4-addr:value = '203.0.113.42']",
  "pattern_type": "stix",
  "valid_from": "2026-01-15T00:00:00.000Z",
  "valid_until": "2026-04-15T00:00:00.000Z",
  "kill_chain_phases": [
    {
      "kill_chain_name": "mitre-attack",
      "phase_name": "command-and-control"
    }
  ],
  "confidence": 85,
  "labels": ["malicious-activity"],
  "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
}

STIX Pattern Syntax

IOC Type	STIX Pattern
IPv4	[ipv4-addr:value = '1.2.3.4']
IPv6	[ipv6-addr:value = '2001:db8::1']
Domain	[domain-name:value = 'evil.com']
URL	[url:value = 'https://evil.com/payload']
SHA-256	[file:hashes.'SHA-256' = 'abc123...']
MD5	[file:hashes.MD5 = 'abc123...']
Email	[email-addr:value = '[email protected]']
File name	[file:name = 'malware.exe']
Combined	[file:hashes.'SHA-256' = 'abc...' AND file:name = 'payload.dll']

Threat Actor

{
  "type": "threat-actor",
  "spec_version": "2.1",
  "id": "threat-actor--<UUID>",
  "created": "2026-01-15T00:00:00.000Z",
  "modified": "2026-01-15T00:00:00.000Z",
  "name": "APT28",
  "description": "Russian state-sponsored threat actor also known as Fancy Bear, Sofacy",
  "aliases": ["Fancy Bear", "Sofacy", "Pawn Storm", "Forest Blizzard"],
  "threat_actor_types": ["nation-state"],
  "roles": ["agent"],
  "sophistication": "expert",
  "resource_level": "government",
  "primary_motivation": "political",
  "goals": ["espionage", "disruption"]
}