skills.rest
Liberty91LTD
Liberty91LTDOFFICIAL
Explore all skills by this author →
Website𝕏@liberty__91GitHub

stix-bundle

Generate STIX 2.1 bundles modeling threat intelligence objects and relationships.

15|5|Updated Apr 6, 2026
Search Tags:#template#json#bundle#threat-intelligence#stix#stix-2.1
One-click install
npx skills add https://github.com/Liberty91LTD/cti-skills --skill stix-bundle
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: stix-bundle
Source: https://github.com/Liberty91LTD/cti-skills/tree/main/skills/stix-bundle
Command: npx skills add https://github.com/Liberty91LTD/cti-skills --skill stix-bundle

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

STIX 2.1 bundle creation standardizes how threat intelligence is shared by providing a clear structure for indicators, malware, threat actors, campaigns, identities, and relationships, enabling consistent data exchange.

Core Features & Use Cases

  • Supports STIX Domain Objects (Indicator, Threat Actor, Malware, Attack Pattern, Campaign, Identity) and Relationship Objects to model complex threat intelligence.
  • Provides JSON templates and bundle assembly guidance for sharing structured intel across teams and tools.
  • Use Case: Build repeatable threat intel bundles for incident response, threat-hunting workflows, and information-sharing collaborations.

Quick Start

Create a sample STIX 2.1 bundle using the provided examples to validate your workflow.

Frequently Asked Questions about stix-bundle

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a STIX 2.1 bundle for sharing threat intelligence?▼

STIX 2.1 bundles standardize threat intelligence sharing by structuring indicators, malware, threat actors, and relationships into a consistent format for data exchange across teams and tools.

What STIX objects can I model for incident response workflows?▼

You can model STIX Domain Objects including Indicator, Threat Actor, Malware, Attack Pattern, Campaign, and Identity, alongside Relationship Objects to map complex threat intelligence interactions for incident response.

Can I use JSON templates to build repeatable threat hunting bundles?▼

Yes, you can use JSON templates to build repeatable threat hunting bundles. These templates provide assembly guidance for structuring threat intel, ensuring consistent sharing across collaborative workflows.

Does this approach enforce correct timestamps and schema validation for STIX?▼

Yes, generating bundles this way enforces correct STIX objects, relationships, and timestamps according to the STIX 2.1 schema, ensuring your structured threat intelligence data remains valid and shareable.

What is the best way to structure relationships between threat actors and campaigns in STIX?▼

The best way to structure relationships in STIX is by using Relationship Objects to explicitly connect threat actors, campaigns, and malware, ensuring the threat intelligence model accurately reflects complex interactions.

Related Skills

Explore More Data & Analytics Skills→
ensingm2ensingm2
12

threat-modeler

Apply STRIDE, MITRE ATT&CK, and Kill Chain frameworks to identify and model security threats.

Community
Advanced
Liberty91LTDLiberty91LTD
15

ioc-export

Export IOC collections to CSV, STIX 2.1, OpenIOC, and MISP bundles.

Official
Intermediate
daemon-blockint-techdaemon-blockint-tech
7

cti-analyst

Vet and package cyber threat intelligence with STIX/TAXII exports and ATT&CK mappings.

Community
Advanced
robit-manrobit-man

ioc-extraction

Extract, classify, deduplicate, and enrich IOCs into STIX 2.1 observables.

Community
Advanced