STIX 2.1威胁情报报告生成

---
name: stix-report-generation
description: Generate STIX 2.1 threat intelligence reports with proper SDOs, SROs, marking definitions, and validated bundles for sharing via TAXII or direct exchange.
---

# STIX Report Generation

Generate STIX 2.1 compliant threat intelligence reports from malware analysis findings. Create Structured Threat Information Expression (STIX) bundles with proper domain objects, relationships, and Traffic Light Protocol (TLP) markings.

## Prerequisites

- **Python 3.10+** for running the generator and validator scripts
- **python-stix2**: STIX 2.1 Python library for object creation and serialization (`pip install stix2`)
- **TAXII client**: For pushing reports to a TAXII 2.1 server (optional, `pip install taxii2-client`)
- **MISP** instance: For importing STIX bundles for correlation (optional)

## Steps

### 1. Identify Report Components

From your analysis, identify the STIX Domain Objects (SDOs) needed:

- **Malware**: The malware sample and family information
- **Indicator**: Observable patterns (file hashes, network IOCs, YARA rules)
- **Attack Pattern**: TTPs mapped to ATT&CK techniques
- **Threat Actor**: Attribution information (if available)
- **Campaign**: Campaign context (if applicable)
- **Relationship**: Links between objects (e.g., Indicator "indicates" Malware)

Consult `references/stix-objects.md` for object schemas and examples.

### 2. Generate STIX Bundle

Use the generator script to create a STIX 2.1 bundle:

```bash
python3 scripts/stix_generator.py \
    --malware-name "TrojanX" \
    --malware-type trojan \
    --hashes md5:abc123,sha256:def456 \
    --network-iocs "evil.com,192.168.1.100" \
    --attack-patterns T1055,T1071.001,T1547.001 \
    --tlp green \
    --output report.json
```

For more complex reports with descriptions and custom indicators:

```bash
python3 scripts/stix_generator.py \
    --malware-name "APT-Backdoor" \
    --malware-type backdoor \
    --description "Custom backdoor used by APT group for long-term access" \
    --hashes sha256:aabbccdd \
    --network-iocs "c2.example.com:443,10.0.0.1" \
    --file-indicators "dropper.exe,payload.dll" \
    --attack-patterns T1055.012,T1071.001,T1082,T1547.001 \
    --threat-actor "APT-X" \
    --campaign "Operation Shadow" \
    --tlp amber \
    --output apt_report.json
```

### 3. Add Custom STIX Indicators

For STIX pattern-based indicators (using the STIX Patterning Language):

```bash
python3 scripts/stix_generator.py \
    --malware-name "RansomY" \
    --custom-pattern "[file:hashes.'SHA-256' = 'abc123'] OR [network-traffic:dst_ref.type = 'domain-name' AND network-traffic:dst_ref.value = 'ransom.evil']" \
    --output ransom_report.json
```

See `references/stix-patterns.md` for the STIX patterning language reference.

### 4. Validate the Bundle

Validate the generated STIX bundle:

```bash
python3 scripts/stix_validator.py --input report.json
```

The validator checks:
- Valid STIX 2.1 JSON structure
- Required properties on all objects
- Valid STIX identifiers (type--UUID format)
- Relationship reference integrity
- STIX pattern syntax validity
- TLP marking correctness

### 5. Share the Report

- **TAXII**: Push to a TAXII 2.1 server for automated sharing
- **Direct Exchange**: Share the JSON file via secure channels
- **MISP**: Import into MISP for correlation with other intelligence

Use `assets/stix-bundle-template.json` as a starting point for manual report creation.

## References

- `references/stix-objects.md` — STIX 2.1 object reference with examples
- `references/stix-patterns.md` — STIX patterning language reference
- `assets/stix-bundle-template.json` — Template STIX bundle