[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFCXHP2A5JRASEW4CJ77MZ":3,"skill-same:01M6AFCXHP2A5JRASEW4CJ77MZ":112},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":71,"commitSha":72,"skillDirectory":73,"forksCount":74,"repositoryHtmlUrl":75,"repositoryHomepageUrl":76,"ownerHtmlUrl":77,"ownerBlogUrl":78,"ownerDescription":79,"updatedAt":80,"install":81,"resources":94},"01M6AFCXHP2A5JRASEW4CJ77MZ","implementing-security-information-sharing-with-stix2",null,"Create, validate, and share STIX 2.1 threat intelligence objects (indicators, malware, campaigns, relationships, bundles) using the stix2 Python library, and publish them over TAXII 2.1. Use when building or exchanging structured threat intelligence, modeling relationships between threat objects, or publishing\u002Fconsuming a TAXII 2.1 feed.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-security-information-sharing-with-stix2\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"security","implementing security information sharing with stix2","sharing","malware","python","intelligence-exchange","indicators","cybersecurity","threat-sharing","TAXII","publish","stix","threat intelligence","threat-intelligence","file","protocol","share","validation","create","validate","2026-11-10 10:12:30",false,"---\nname: implementing-security-information-sharing-with-stix2\ndescription: 'Create, validate, and share STIX 2.1 threat intelligence objects (indicators,\n  malware, campaigns, relationships, bundles) using the stix2 Python library, and\n  publish them over TAXII 2.1. Use when building or exchanging structured threat\n  intelligence, modeling relationships between threat objects, or publishing\u002Fconsuming\n  a TAXII 2.1 feed.\n\n  '\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- stix\n- taxii\n- threat-sharing\n- intelligence-exchange\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- File Metadata Consistency Validation\n- Application Protocol Command Analysis\n- Identifier Analysis\n- Content Format Conversion\n- Message Analysis\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1591\n- T1592\n- T1593\n- T1589\n- T1027\n---\n\n# Implementing Security Information Sharing with STIX 2.1\n\nBuild and share structured threat intelligence using STIX 2.1 objects\nwith the stix2 Python library and TAXII 2.1 transport protocol.\n\n## When to Use\n\n- Building a threat intelligence platform that exchanges IOCs with partner organizations\n- Automating ingestion and export of indicators from MISP, OpenCTI, or other TIP platforms\n- Creating machine-readable intelligence reports for ISAC\u002FISAO sharing communities\n- Publishing threat data to a TAXII 2.1 server for downstream consumption by SIEMs and SOARs\n- Converting unstructured threat reports into standardized STIX 2.1 bundles\n- Enriching detection rules with context by linking indicators to malware, campaigns, and threat actors\n\n**Do not use** for sharing simple IP blocklists or CSV-based IOC feeds that do not require relationship context; plain-text feeds with simpler formats like CSV or OpenIOC may be more efficient in those cases.\n\n## Prerequisites\n\n- Python 3.8+ with `stix2` library (`pip install stix2`)\n- `taxii2-client` for consuming TAXII feeds (`pip install taxii2-client`)\n- A TAXII 2.1 server endpoint for publishing (e.g., OpenTAXII, Medallion, or MISP TAXII service)\n- Familiarity with STIX 2.1 SDO types: Indicator, Malware, Threat Actor, Campaign, Attack Pattern, Identity\n- Familiarity with STIX 2.1 SRO types: Relationship, Sighting\n- Optional: OpenCTI or MISP instance for end-to-end integration testing\n\n## Workflow\n\n### Step 1: Install Dependencies\n\n```bash\npip install stix2 taxii2-client requests\n```\n\n### Step 2: Create STIX 2.1 Domain Objects (SDOs)\n\nCreate core intelligence objects that describe threats, actors, and campaigns:\n\n```python\nfrom stix2 import (\n    Indicator, Malware, ThreatActor, Campaign,\n    AttackPattern, Identity, Relationship, Bundle,\n    ExternalReference\n)\nfrom datetime import datetime\n\n# Create a producer identity\nproducer = Identity(\n    name=\"ACME Threat Intel Team\",\n    identity_class=\"organization\",\n    sectors=[\"technology\"],\n    contact_information=\"threatintel@acme.example.com\"\n)\n\n# Create a malware object\nemotet_malware = Malware(\n    name=\"Emotet\",\n    description=\"Banking trojan turned modular botnet loader. \"\n                \"Distributed via malspam with macro-enabled Office documents.\",\n    malware_types=[\"trojan\", \"bot\"],\n    is_family=True,\n    created_by_ref=producer.id\n)\n\n# Create an attack pattern referencing MITRE ATT&CK\nspearphishing_pattern = AttackPattern(\n    name=\"Spearphishing Attachment\",\n    description=\"Adversaries send spearphishing emails with a malicious attachment.\",\n    external_references=[\n        ExternalReference(\n            source_name=\"mitre-attack\",\n            external_id=\"T1566.001\",\n            url=\"https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1566\u002F001\u002F\"\n        )\n    ],\n    created_by_ref=producer.id\n)\n\n# Create a threat actor\nthreat_actor = ThreatActor(\n    name=\"Mummy Spider\",\n    description=\"Cybercriminal group operating the Emotet botnet infrastructure.\",\n    threat_actor_types=[\"crime-syndicate\"],\n    aliases=[\"TA542\", \"Gold Crestwood\"],\n    primary_motivation=\"personal-gain\",\n    created_by_ref=producer.id\n)\n\n# Create a campaign\ncampaign = Campaign(\n    name=\"Emotet Q1 2026 Resurgence\",\n    description=\"Renewed Emotet distribution campaign using thread-hijacked \"\n                \"reply-chain emails with OneNote lure attachments.\",\n    first_seen=\"2026-01-15T00:00:00Z\",\n    created_by_ref=producer.id\n)\n\nprint(f\"Created malware SDO: {emotet_malware.id}\")\nprint(f\"Created threat actor SDO: {threat_actor.id}\")\nprint(f\"Created campaign SDO: {campaign.id}\")\n```\n\n### Step 3: Create STIX Indicators with Patterns\n\nDefine detection patterns using the STIX Patterning Language:\n\n```python\n# File hash indicator\nhash_indicator = Indicator(\n    name=\"Emotet dropper hash\",\n    description=\"SHA-256 hash of Emotet first-stage dropper observed in Jan 2026 campaign.\",\n    indicator_types=[\"malicious-activity\"],\n    pattern_type=\"stix\",\n    pattern=\"[file:hashes.'SHA-256' = 'a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2']\",\n    valid_from=\"2026-01-15T00:00:00Z\",\n    created_by_ref=producer.id\n)\n\n# Network indicator for C2 domain\nc2_indicator = Indicator(\n    name=\"Emotet C2 domain\",\n    description=\"Command and control domain observed in Emotet tier-1 botnet infrastructure.\",\n    indicator_types=[\"malicious-activity\"],\n    pattern_type=\"stix\",\n    pattern=\"[domain-name:value = 'malicious-c2.example.com']\",\n    valid_from=\"2026-01-20T00:00:00Z\",\n    created_by_ref=producer.id\n)\n\n# Compound pattern: process spawning with suspicious command line\nprocess_indicator = Indicator(\n    name=\"Emotet PowerShell download cradle\",\n    description=\"PowerShell execution pattern used by Emotet to download next-stage payload.\",\n    indicator_types=[\"malicious-activity\"],\n    pattern_type=\"stix\",\n    pattern=(\n        \"[process:command_line MATCHES 'powershell.*-enc.*' \"\n        \"AND process:parent_ref.name = 'winword.exe']\"\n    ),\n    valid_from=\"2026-01-15T00:00:00Z\",\n    created_by_ref=producer.id\n)\n\n# Email subject indicator\nemail_indicator = Indicator(\n    name=\"Emotet phishing subject line pattern\",\n    description=\"Subject line pattern seen in thread-hijacked Emotet phishing emails.\",\n    indicator_types=[\"malicious-activity\"],\n    pattern_type=\"stix\",\n    pattern=\"[email-message:subject MATCHES '^RE:.*Invoice.*[0-9]{6}']\",\n    valid_from=\"2026-01-15T00:00:00Z\",\n    created_by_ref=producer.id\n)\n\nprint(f\"Created {4} indicator objects\")\n```\n\n### Step 4: Build Relationships Between Objects\n\nLink SDOs together using Relationship objects to express how threats are connected:\n\n```python\n# Malware uses attack pattern\nrel_malware_attack = Relationship(\n    relationship_type=\"uses\",\n    source_ref=emotet_malware.id,\n    target_ref=spearphishing_pattern.id,\n    description=\"Emotet is distributed via spearphishing attachments.\",\n    created_by_ref=producer.id\n)\n\n# Threat actor uses malware\nrel_actor_malware = Relationship(\n    relationship_type=\"uses\",\n    source_ref=threat_actor.id,\n    target_ref=emotet_malware.id,\n    description=\"Mummy Spider operates the Emotet malware infrastructure.\",\n    created_by_ref=producer.id\n)\n\n# Indicator indicates malware\nrel_indicator_malware = Relationship(\n    relationship_type=\"indicates\",\n    source_ref=hash_indicator.id,\n    target_ref=emotet_malware.id,\n    description=\"File hash indicator for Emotet dropper binary.\",\n    created_by_ref=producer.id\n)\n\n# Campaign uses malware\nrel_campaign_malware = Relationship(\n    relationship_type=\"uses\",\n    source_ref=campaign.id,\n    target_ref=emotet_malware.id,\n    created_by_ref=producer.id\n)\n\n# Threat actor attributed to campaign\nrel_actor_campaign = Relationship(\n    relationship_type=\"attributed-to\",\n    source_ref=campaign.id,\n    target_ref=threat_actor.id,\n    created_by_ref=producer.id\n)\n\nprint(f\"Created {5} relationship objects linking threat intelligence\")\n```\n\n### Step 5: Assemble and Serialize a STIX Bundle\n\nPackage all objects into a bundle for sharing:\n\n```python\nimport json\n\nbundle = Bundle(\n    objects=[\n        producer,\n        emotet_malware,\n        spearphishing_pattern,\n        threat_actor,\n        campaign,\n        hash_indicator,\n        c2_indicator,\n        process_indicator,\n        email_indicator,\n        rel_malware_attack,\n        rel_actor_malware,\n        rel_indicator_malware,\n        rel_campaign_malware,\n        rel_actor_campaign,\n    ]\n)\n\n# Serialize to JSON\nbundle_json = bundle.serialize(pretty=True)\n\n# Write bundle to file for sharing\nwith open(\"emotet_campaign_bundle.json\", \"w\") as f:\n    f.write(bundle_json)\n\nprint(f\"Bundle {bundle.id} contains {len(bundle.objects)} objects\")\nprint(f\"Written to emotet_campaign_bundle.json\")\n\n# Validate the bundle by re-parsing\nfrom stix2 import parse\nparsed = parse(bundle_json, allow_custom=False)\nprint(f\"Bundle validation passed: {len(parsed.objects)} objects parsed successfully\")\n```\n\n### Step 6: Consume Intelligence from a TAXII 2.1 Server\n\nRetrieve published threat intelligence from a TAXII feed:\n\n```python\nfrom taxii2client.v21 import Server, Collection, as_pages\nimport json\n\n# Connect to a TAXII 2.1 server\ntaxii_server = Server(\n    \"https:\u002F\u002Ftaxii.example.com\u002Ftaxii2\u002F\",\n    user=\"readonly\",\n    password=\"readonly_password\"\n)\n\n# Discover API roots and collections\napi_root = taxii_server.api_roots[0]\nprint(f\"API Root: {api_root.title}\")\n\nfor collection in api_root.collections:\n    print(f\"  Collection: {collection.title} (ID: {collection.id})\")\n\n# Fetch indicators from a specific collection\ntarget_collection = Collection(\n    f\"https:\u002F\u002Ftaxii.example.com\u002Ftaxii2\u002Fcollections\u002F{api_root.collections[0].id}\u002F\",\n    user=\"readonly\",\n    password=\"readonly_password\"\n)\n\n# Retrieve objects with filtering\nresponse = target_collection.get_objects(\n    added_after=\"2026-01-01T00:00:00Z\",\n    type=[\"indicator\", \"malware\"]\n)\n\nstix_data = json.loads(response.text)\nprint(f\"Retrieved {len(stix_data.get('objects', []))} objects from TAXII server\")\n\n# Process each retrieved object\nfor obj in stix_data.get(\"objects\", []):\n    if obj[\"type\"] == \"indicator\":\n        print(f\"  Indicator: {obj['name']} | Pattern: {obj['pattern'][:60]}...\")\n    elif obj[\"type\"] == \"malware\":\n        print(f\"  Malware: {obj['name']} | Family: {obj.get('is_family', False)}\")\n```\n\n### Step 7: Publish Intelligence to a TAXII 2.1 Server\n\nPush your STIX bundle to a writable TAXII collection:\n\n```python\nimport requests\nimport json\n\nTAXII_URL = \"https:\u002F\u002Ftaxii.example.com\u002Ftaxii2\u002Fcollections\u002FCOLLECTION_ID\u002Fobjects\u002F\"\nTAXII_USER = \"publisher\"\nTAXII_PASS = \"publisher_password\"\n\nheaders = {\n    \"Content-Type\": \"application\u002Ftaxii+json;version=2.1\",\n    \"Accept\": \"application\u002Ftaxii+json;version=2.1\"\n}\n\n# Read the bundle we created earlier\nwith open(\"emotet_campaign_bundle.json\", \"r\") as f:\n    bundle_data = f.read()\n\nresponse = requests.post(\n    TAXII_URL,\n    headers=headers,\n    auth=(TAXII_USER, TAXII_PASS),\n    data=bundle_data,\n    timeout=30\n)\n\nif response.status_code in (200, 201, 202):\n    status = response.json()\n    print(f\"Published successfully. Status ID: {status.get('id')}\")\n    print(f\"  Total count: {status.get('total_count')}\")\n    print(f\"  Success count: {status.get('success_count')}\")\n    print(f\"  Failure count: {status.get('failure_count')}\")\nelse:\n    print(f\"Publishing failed: {response.status_code} - {response.text}\")\n```\n\n### Step 8: Validate and Lint STIX Objects\n\nEnsure objects comply with the STIX 2.1 specification:\n\n```python\nfrom stix2 import parse, exceptions\nimport json\n\ndef validate_stix_bundle(bundle_path):\n    \"\"\"Validate all objects in a STIX bundle against the 2.1 spec.\"\"\"\n    with open(bundle_path, \"r\") as f:\n        raw = json.load(f)\n\n    errors = []\n    valid_count = 0\n\n    for obj in raw.get(\"objects\", []):\n        try:\n            parsed = parse(json.dumps(obj), allow_custom=False)\n            valid_count += 1\n        except (exceptions.InvalidValueError, exceptions.MissingPropertiesError) as e:\n            errors.append({\n                \"object_id\": obj.get(\"id\", \"unknown\"),\n                \"object_type\": obj.get(\"type\", \"unknown\"),\n                \"error\": str(e)\n            })\n\n    print(f\"Validation results: {valid_count} valid, {len(errors)} errors\")\n    for err in errors:\n        print(f\"  ERROR in {err['object_type']} ({err['object_id']}): {err['error']}\")\n\n    return len(errors) == 0\n\nvalidate_stix_bundle(\"emotet_campaign_bundle.json\")\n```\n\n## Verification\n\n- Confirm all STIX objects serialize to valid JSON and include required properties (`type`, `id`, `created`, `modified`)\n- Verify relationship `source_ref` and `target_ref` point to existing object IDs within the bundle\n- Validate indicator patterns parse correctly using the STIX patterning grammar\n- Test TAXII publishing returns a success status with `success_count` matching the number of objects sent\n- Re-retrieve published objects from the TAXII server and confirm they round-trip without data loss\n- Check that consuming systems (SIEM, SOAR, TIP) can ingest the bundle and create corresponding detection rules or enrichment data\n- Run `stix2-validator` CLI tool against exported bundles: `stix2_validator emotet_campaign_bundle.json`\n","# Implementing Security Information Sharing with STIX 2.1\n\nBuild and share structured threat intelligence using STIX 2.1 objects\nwith the stix2 Python library and TAXII 2.1 transport protocol.\n\n## When to Use\n\n- Building a threat intelligence platform that exchanges IOCs with partner organizations\n- Automating ingestion and export of indicators from MISP, OpenCTI, or other TIP platforms\n- Creating machine-readable intelligence reports for ISAC\u002FISAO sharing communities\n- Publishing threat data to a TAXII 2.1 server for downstream consumption by SIEMs and SOARs\n- Converting unstructured threat reports into standardized STIX 2.1 bundles\n- Enriching detection rules with context by linking indicators to malware, campaigns, and threat actors\n\n**Do not use** for sharing simple IP blocklists or CSV-based IOC feeds that do not require relationship context; plain-text feeds with simpler formats like CSV or OpenIOC may be more efficient in those cases.\n\n## Prerequisites\n\n- Python 3.8+ with `stix2` library (`pip install stix2`)\n- `taxii2-client` for consuming TAXII feeds (`pip install taxii2-client`)\n- A TAXII 2.1 server endpoint for publishing (e.g., OpenTAXII, Medallion, or MISP TAXII service)\n- Familiarity with STIX 2.1 SDO types: Indicator, Malware, Threat Actor, Campaign, Attack Pattern, Identity\n- Familiarity with STIX 2.1 SRO types: Relationship, Sighting\n- Optional: OpenCTI or MISP instance for end-to-end integration testing\n\n## Workflow\n\n### Step 1: Install Dependencies\n\n```bash\npip install stix2 taxii2-client requests\n```\n\n### Step 2: Create STIX 2.1 Domain Objects (SDOs)\n\nCreate core intelligence objects that describe threats, actors, and campaigns:\n\n```python\nfrom stix2 import (\n    Indicator, Malware, ThreatActor, Campaign,\n    AttackPattern, Identity, Relationship, Bundle,\n    ExternalReference\n)\nfrom datetime import datetime\n\n# Create a producer identity\nproducer = Identity(\n    name=\"ACME Threat Intel Team\",\n    identity_class=\"organization\",\n    sectors=[\"technology\"],\n    contact_information=\"threatintel@acme.example.com\"\n)\n\n# Create a malware object\nemotet_malware = Malware(\n    name=\"Emotet\",\n    description=\"Banking trojan turned modular botnet loader. \"\n                \"Distributed via malspam with macro-enabled Office documents.\",\n    malware_types=[\"trojan\", \"bot\"],\n    is_family=True,\n    created_by_ref=producer.id\n)\n\n# Create an attack pattern referencing MITRE ATT&CK\nspearphishing_pattern = AttackPattern(\n    name=\"Spearphishing Attachment\",\n    description=\"Adversaries send spearphishing emails with a malicious attachment.\",\n    external_references=[\n        ExternalReference(\n            source_name=\"mitre-attack\",\n            external_id=\"T1566.001\",\n            url=\"https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1566\u002F001\u002F\"\n        )\n    ],\n    created_by_ref=producer.id\n)\n\n# Create a threat actor\nthreat_actor = ThreatActor(\n    name=\"Mummy Spider\",\n    description=\"Cybercriminal group operating the Emotet botnet infrastructure.\",\n    threat_actor_types=[\"crime-syndicate\"],\n    aliases=[\"TA542\", \"Gold Crestwood\"],\n    primary_motivation=\"personal-gain\",\n    created_by_ref=producer.id\n)\n\n# Create a campaign\ncampaign = Campaign(\n    name=\"Emotet Q1 2026 Resurgence\",\n    description=\"Renewed Emotet distribution campaign using thread-hijacked \"\n                \"reply-chain emails with OneNote lure attachments.\",\n    first_seen=\"2026-01-15T00:00:00Z\",\n    created_by_ref=producer.id\n)\n\nprint(f\"Created malware SDO: {emotet_malware.id}\")\nprint(f\"Created threat actor SDO: {threat_actor.id}\")\nprint(f\"Created campaign SDO: {campaign.id}\")\n```\n\n### Step 3: Create STIX Indicators with Patterns\n\nDefine detection patterns using the STIX Patterning Language:\n\n```python\n# File hash indicator\nhash_indicator = Indicator(\n    name=\"Emotet dropper hash\",\n    description=\"SHA-256 hash of Emotet first-stage dropper observed in Jan 2026 campaign.\",\n    indicator_types=[\"malicious-activity\"],\n    pattern_type=\"stix\",\n    pattern=\"[file:hashes.'SHA-256' = 'a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2']\",\n    valid_from=\"2026-01-15T00:00:00Z\",\n    created_by_ref=producer.id\n)\n\n# Network indicator for C2 domain\nc2_indicator = Indicator(\n    name=\"Emotet C2 domain\",\n    description=\"Command and control domain observed in Emotet tier-1 botnet infrastructure.\",\n    indicator_types=[\"malicious-activity\"],\n    pattern_type=\"stix\",\n    pattern=\"[domain-name:value = 'malicious-c2.example.com']\",\n    valid_from=\"2026-01-20T00:00:00Z\",\n    created_by_ref=producer.id\n)\n\n# Compound pattern: process spawning with suspicious command line\nprocess_indicator = Indicator(\n    name=\"Emotet PowerShell download cradle\",\n    description=\"PowerShell execution pattern used by Emotet to download next-stage payload.\",\n    indicator_types=[\"malicious-activity\"],\n    pattern_type=\"stix\",\n    pattern=(\n        \"[process:command_line MATCHES 'powershell.*-enc.*' \"\n        \"AND process:parent_ref.name = 'winword.exe']\"\n    ),\n    valid_from=\"2026-01-15T00:00:00Z\",\n    created_by_ref=producer.id\n)\n\n# Email subject indicator\nemail_indicator = Indicator(\n    name=\"Emotet phishing subject line pattern\",\n    description=\"Subject line pattern seen in thread-hijacked Emotet phishing emails.\",\n    indicator_types=[\"malicious-activity\"],\n    pattern_type=\"stix\",\n    pattern=\"[email-message:subject MATCHES '^RE:.*Invoice.*[0-9]{6}']\",\n    valid_from=\"2026-01-15T00:00:00Z\",\n    created_by_ref=producer.id\n)\n\nprint(f\"Created {4} indicator objects\")\n```\n\n### Step 4: Build Relationships Between Objects\n\nLink SDOs together using Relationship objects to express how threats are connected:\n\n```python\n# Malware uses attack pattern\nrel_malware_attack = Relationship(\n    relationship_type=\"uses\",\n    source_ref=emotet_malware.id,\n    target_ref=spearphishing_pattern.id,\n    description=\"Emotet is distributed via spearphishing attachments.\",\n    created_by_ref=producer.id\n)\n\n# Threat actor uses malware\nrel_actor_malware = Relationship(\n    relationship_type=\"uses\",\n    source_ref=threat_actor.id,\n    target_ref=emotet_malware.id,\n    description=\"Mummy Spider operates the Emotet malware infrastructure.\",\n    created_by_ref=producer.id\n)\n\n# Indicator indicates malware\nrel_indicator_malware = Relationship(\n    relationship_type=\"indicates\",\n    source_ref=hash_indicator.id,\n    target_ref=emotet_malware.id,\n    description=\"File hash indicator for Emotet dropper binary.\",\n    created_by_ref=producer.id\n)\n\n# Campaign uses malware\nrel_campaign_malware = Relationship(\n    relationship_type=\"uses\",\n    source_ref=campaign.id,\n    target_ref=emotet_malware.id,\n    created_by_ref=producer.id\n)\n\n# Threat actor attributed to campaign\nrel_actor_campaign = Relationship(\n    relationship_type=\"attributed-to\",\n    source_ref=campaign.id,\n    target_ref=threat_actor.id,\n    created_by_ref=producer.id\n)\n\nprint(f\"Created {5} relationship objects linking threat intelligence\")\n```\n\n### Step 5: Assemble and Serialize a STIX Bundle\n\nPackage all objects into a bundle for sharing:\n\n```python\nimport json\n\nbundle = Bundle(\n    objects=[\n        producer,\n        emotet_malware,\n        spearphishing_pattern,\n        threat_actor,\n        campaign,\n        hash_indicator,\n        c2_indicator,\n        process_indicator,\n        email_indicator,\n        rel_malware_attack,\n        rel_actor_malware,\n        rel_indicator_malware,\n        rel_campaign_malware,\n        rel_actor_campaign,\n    ]\n)\n\n# Serialize to JSON\nbundle_json = bundle.serialize(pretty=True)\n\n# Write bundle to file for sharing\nwith open(\"emotet_campaign_bundle.json\", \"w\") as f:\n    f.write(bundle_json)\n\nprint(f\"Bundle {bundle.id} contains {len(bundle.objects)} objects\")\nprint(f\"Written to emotet_campaign_bundle.json\")\n\n# Validate the bundle by re-parsing\nfrom stix2 import parse\nparsed = parse(bundle_json, allow_custom=False)\nprint(f\"Bundle validation passed: {len(parsed.objects)} objects parsed successfully\")\n```\n\n### Step 6: Consume Intelligence from a TAXII 2.1 Server\n\nRetrieve published threat intelligence from a TAXII feed:\n\n```python\nfrom taxii2client.v21 import Server, Collection, as_pages\nimport json\n\n# Connect to a TAXII 2.1 server\ntaxii_server = Server(\n    \"https:\u002F\u002Ftaxii.example.com\u002Ftaxii2\u002F\",\n    user=\"readonly\",\n    password=\"readonly_password\"\n)\n\n# Discover API roots and collections\napi_root = taxii_server.api_roots[0]\nprint(f\"API Root: {api_root.title}\")\n\nfor collection in api_root.collections:\n    print(f\"  Collection: {collection.title} (ID: {collection.id})\")\n\n# Fetch indicators from a specific collection\ntarget_collection = Collection(\n    f\"https:\u002F\u002Ftaxii.example.com\u002Ftaxii2\u002Fcollections\u002F{api_root.collections[0].id}\u002F\",\n    user=\"readonly\",\n    password=\"readonly_password\"\n)\n\n# Retrieve objects with filtering\nresponse = target_collection.get_objects(\n    added_after=\"2026-01-01T00:00:00Z\",\n    type=[\"indicator\", \"malware\"]\n)\n\nstix_data = json.loads(response.text)\nprint(f\"Retrieved {len(stix_data.get('objects', []))} objects from TAXII server\")\n\n# Process each retrieved object\nfor obj in stix_data.get(\"objects\", []):\n    if obj[\"type\"] == \"indicator\":\n        print(f\"  Indicator: {obj['name']} | Pattern: {obj['pattern'][:60]}...\")\n    elif obj[\"type\"] == \"malware\":\n        print(f\"  Malware: {obj['name']} | Family: {obj.get('is_family', False)}\")\n```\n\n### Step 7: Publish Intelligence to a TAXII 2.1 Server\n\nPush your STIX bundle to a writable TAXII collection:\n\n```python\nimport requests\nimport json\n\nTAXII_URL = \"https:\u002F\u002Ftaxii.example.com\u002Ftaxii2\u002Fcollections\u002FCOLLECTION_ID\u002Fobjects\u002F\"\nTAXII_USER = \"publisher\"\nTAXII_PASS = \"publisher_password\"\n\nheaders = {\n    \"Content-Type\": \"application\u002Ftaxii+json;version=2.1\",\n    \"Accept\": \"application\u002Ftaxii+json;version=2.1\"\n}\n\n# Read the bundle we created earlier\nwith open(\"emotet_campaign_bundle.json\", \"r\") as f:\n    bundle_data = f.read()\n\nresponse = requests.post(\n    TAXII_URL,\n    headers=headers,\n    auth=(TAXII_USER, TAXII_PASS),\n    data=bundle_data,\n    timeout=30\n)\n\nif response.status_code in (200, 201, 202):\n    status = response.json()\n    print(f\"Published successfully. Status ID: {status.get('id')}\")\n    print(f\"  Total count: {status.get('total_count')}\")\n    print(f\"  Success count: {status.get('success_count')}\")\n    print(f\"  Failure count: {status.get('failure_count')}\")\nelse:\n    print(f\"Publishing failed: {response.status_code} - {response.text}\")\n```\n\n### Step 8: Validate and Lint STIX Objects\n\nEnsure objects comply with the STIX 2.1 specification:\n\n```python\nfrom stix2 import parse, exceptions\nimport json\n\ndef validate_stix_bundle(bundle_path):\n    \"\"\"Validate all objects in a STIX bundle against the 2.1 spec.\"\"\"\n    with open(bundle_path, \"r\") as f:\n        raw = json.load(f)\n\n    errors = []\n    valid_count = 0\n\n    for obj in raw.get(\"objects\", []):\n        try:\n            parsed = parse(json.dumps(obj), allow_custom=False)\n            valid_count += 1\n        except (exceptions.InvalidValueError, exceptions.MissingPropertiesError) as e:\n            errors.append({\n                \"object_id\": obj.get(\"id\", \"unknown\"),\n                \"object_type\": obj.get(\"type\", \"unknown\"),\n                \"error\": str(e)\n            })\n\n    print(f\"Validation results: {valid_count} valid, {len(errors)} errors\")\n    for err in errors:\n        print(f\"  ERROR in {err['object_type']} ({err['object_id']}): {err['error']}\")\n\n    return len(errors) == 0\n\nvalidate_stix_bundle(\"emotet_campaign_bundle.json\")\n```\n\n## Verification\n\n- Confirm all STIX objects serialize to valid JSON and include required properties (`type`, `id`, `created`, `modified`)\n- Verify relationship `source_ref` and `target_ref` point to existing object IDs within the bundle\n- Validate indicator patterns parse correctly using the STIX patterning grammar\n- Test TAXII publishing returns a success status with `success_count` matching the number of objects sent\n- Re-retrieve published objects from the TAXII server and confirm they round-trip without data loss\n- Check that consuming systems (SIEM, SOAR, TIP) can ingest the bundle and create corresponding detection rules or enrichment data\n- Run `stix2-validator` CLI tool against exported bundles: `stix2_validator emotet_campaign_bundle.json`\n",{"name":5,"tags":49,"author":51,"domain":31,"license":15,"version":52,"nist_csf":53,"subdomain":37,"description":58,"mitre_attack":59,"d3fend_techniques":65},[35,50,32,29],"taxii","mahipal","1.0",[54,55,56,57],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02","Create, validate, and share STIX 2.1 threat intelligence objects (indicators, malware, campaigns, relationships, bundles) using the stix2 Python library, and publish them over TAXII 2.1. Use when building or exchanging structured threat intelligence, modeling relationships between threat objects, or publishing\u002Fconsuming a TAXII 2.1 feed.\n",[60,61,62,63,64],"T1591","T1592","T1593","T1589","T1027",[66,67,68,69,70],"File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-security-information-sharing-with-stix2",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":82,"prompt":92,"zipAvailable":93},[83,86,89],{"tool":84,"command":85},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-security-information-sharing-with-stix2",{"tool":87,"command":88},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-security-information-sharing-with-stix2",{"tool":90,"command":91},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-security-information-sharing-with-stix2","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-security-information-sharing-with-stix2\u002FSKILL.md",true,[95,100,106],{"path":96,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-security-information-sharing-with-stix2\u002FLICENSE",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fapi-reference.md","REFERENCE","参考文档",2070,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-security-information-sharing-with-stix2\u002Freferences\u002Fapi-reference.md",{"path":107,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":110,"sourceHtmlUrl":111},"scripts\u002Fagent.py","SCRIPT","脚本",7185,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-security-information-sharing-with-stix2\u002Fscripts\u002Fagent.py",[113,139,163,190,216,243],{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":120,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[119],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[121,122,123,124,24,31,125,126,127,128,129,130,131,132,133,134,135,136,137,138],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":146,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[145],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[147,135,148,149,24,150,31,127,151,152,153,154,155,156,157,158,159,160,161,162],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":173,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[169,172],{"categoryNo":170,"categoryName":171,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[157,174,175,176,177,31,178,41,151,179,180,181,182,183,184,185,186,187,188,189],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":191,"name":192,"nameZh":6,"description":193,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":194,"categories":195,"keywords":197,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[196],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[198,199,200,31,201,202,203,204,205,206,207,208,209,210,211,212,154,213,214,215],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":217,"name":218,"nameZh":6,"description":219,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":220,"categories":221,"keywords":223,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[222],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[224,225,226,31,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":244,"name":245,"nameZh":6,"description":246,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":247,"categories":248,"keywords":250,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[249],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[24,251,31,252,38,253,254,255,256,257,258,185,259,186,260,261,262,263,264,265],"triaging security incident","siem","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]