stix-bundle

Generate STIX 2.1 bundles modeling threat intelligence objects and relationships.

15|5|Updated Apr 6, 2026

Search Tags:#template #json #bundle #threat-intelligence #stix #stix-2.1

Ready to run

npx skills add https://github.com/Liberty91LTD/cti-skills --skill stix-bundle

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: stix-bundle
Source: https://github.com/Liberty91LTD/cti-skills/tree/main/skills/stix-bundle
Command: npx skills add https://github.com/Liberty91LTD/cti-skills --skill stix-bundle

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

STIX 2.1 bundle creation standardizes how threat intelligence is shared by providing a clear structure for indicators, malware, threat actors, campaigns, identities, and relationships, enabling consistent data exchange.

Core Features & Use Cases

Supports STIX Domain Objects (Indicator, Threat Actor, Malware, Attack Pattern, Campaign, Identity) and Relationship Objects to model complex threat intelligence.
Provides JSON templates and bundle assembly guidance for sharing structured intel across teams and tools.
Use Case: Build repeatable threat intel bundles for incident response, threat-hunting workflows, and information-sharing collaborations.

Quick Start

Create a sample STIX 2.1 bundle using the provided examples to validate your workflow.

Frequently Asked Questions about stix-bundle

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I create a STIX 2.1 bundle for sharing threat intelligence?▼

STIX 2.1 bundles standardize threat intelligence sharing by structuring indicators, malware, threat actors, and relationships into a consistent format for data exchange across teams and tools.

What STIX objects can I model for incident response workflows?▼

You can model STIX Domain Objects including Indicator, Threat Actor, Malware, Attack Pattern, Campaign, and Identity, alongside Relationship Objects to map complex threat intelligence interactions for incident response.

Can I use JSON templates to build repeatable threat hunting bundles?▼

Yes, you can use JSON templates to build repeatable threat hunting bundles. These templates provide assembly guidance for structuring threat intel, ensuring consistent sharing across collaborative workflows.

Does this approach enforce correct timestamps and schema validation for STIX?▼

Yes, generating bundles this way enforces correct STIX objects, relationships, and timestamps according to the STIX 2.1 schema, ensuring your structured threat intelligence data remains valid and shareable.

What is the best way to structure relationships between threat actors and campaigns in STIX?▼

The best way to structure relationships in STIX is by using Relationship Objects to explicitly connect threat actors, campaigns, and malware, ensuring the threat intelligence model accurately reflects complex interactions.