stix - STIX Content API

1.2.0.11 verified Fri May 01 auth: no python maintenance

An API for parsing and generating Structured Threat Information Expression (STIX) content. Current version 1.2.0.11 is legacy, based on the older STIX 1.x standard; development has been superseded by stix2 for STIX 2.x. Low release cadence.

pip install stix

Common errors

error ImportError: cannot import name 'STIXPackage' from 'stix' ↓

cause STIXPackage is located in stix.core, not top-level stix.

fix

Use: from stix.core import STIXPackage

error AttributeError: 'NoneType' object has no attribute 'title' ↓

cause parse_xml returned None because the XML was empty or invalid.

fix

Ensure the XML string is well-formed STIX 1.x. Print the XML before parsing.

error lxml.etree.XMLSyntaxError: ... ↓

cause Input XML is malformed or not XML.

fix

Validate the XML using an XML validator.

Warnings

gotcha stix library is for STIX 1.x only. For STIX 2.x, use the stix2 library. Using stix with STIX 2.x XML will fail. ↓

fix Install stix2 (`pip install stix2`) and import from stix2.

deprecated The stix library is no longer actively developed. New features and STIX 2.x support are only in stix2. ↓

fix Migrate to the stix2 library for STIX 2.x compatibility.

gotcha parse_xml() expects a string, not a file path. Use open().read() or handle file reading separately. ↓

fix with open('file.xml', 'r') as f: package = parse_xml(f.read())

Imports

STIXPackage
wrong
```
import stix; stix.STIXPackage
```
correct
```
from stix.core import STIXPackage
```
STIXPackage is in stix.core, not top-level stix
Indicator
```
from stix.indicator import Indicator
```
parse_xml
```
from stix.utils import parse_xml
```

Quickstart

Parse a STIX 1.x XML document and access the package title.

from stix.core import STIXPackage
from stix.utils import parse_xml
import os

stix_xml = os.environ.get('STIX_XML', '<stix:STIXPackage xmlns:stix="http://stix.mitre.org/stix-1" id="example:package-1"><stix:STIX_Header><stix:Title>Example</stix:Title></stix:STIX_Header></stix:STIXPackage>')
package = parse_xml(stix_xml)
print(package.stix_header.title)