stix-bundle

What problem does it solve?

STIX 2.1 bundle creation standardizes how threat intelligence is shared by providing a clear structure for indicators, malware, threat actors, campaigns, identities, and relationships, enabling consistent data exchange.

Core Features & Use Cases

• Supports STIX Domain Objects (Indicator, Threat Actor, Malware, Attack Pattern, Campaign, Identity) and Relationship Objects to model complex threat intelligence.
• Provides JSON templates and bundle assembly guidance for sharing structured intel across teams and tools.
• Use Case: Build repeatable threat intel bundles for incident response, threat-hunting workflows, and information-sharing collaborations.

Quick Start

Create a sample STIX 2.1 bundle using the provided examples to validate your workflow.