Standards Lab 04 — STIX-style Threat-Intel Bundle

Frameworks: STIX / TAXII (Standards WARMUP Chapter 12). Kind: taxonomy / sharing.

The idea

Threat intelligence is shared as a machine-readable graph: typed STIX objects (indicator, malware, threat-actor, attack-pattern, campaign, infrastructure) joined by relationships (indicates, uses, attributed-to, communicates-with), exchanged over TAXII. It's the Diamond Model (Lab in the Offensive module) and ATT&CK made interoperable. This lab validates a bundle and performs the analyst's core move — pivoting from one object to related ones and tracing a path from an indicator up to a threat actor.

What you build (lab.py)

  • validate_bundle(bundle) — dangling relationship refs, duplicate ids, STIX <type>-- prefix mismatches.
  • find_by_type(bundle, type) — objects of a type.
  • related(bundle, id) — directly connected objects (the pivot).
  • pivot_path(bundle, source, target) — shortest relationship path (e.g. indicator → malware → campaign → threat-actor).

Cases the tests cover

  • A well-formed bundle validates clean; a dangling ref, duplicate id, and type-prefix mismatch are caught; find_by_type and related return the right neighbors; pivot_path traces the indicator-to-actor chain; same-node and unconnected cases handled.

Run

pip install -r requirements.txt
LAB_MODULE=solution pytest -q
pytest -q

Hardening / extensions

  • Parse real STIX 2.1 JSON bundles and emit grouping/relationship objects.
  • Add a TAXII-style publish/subscribe feed model with collection filtering.
  • Weight pivots by confidence and add time windows (infrastructure reuse only within active periods).

Interview / resume

"Built a STIX-style intel bundle engine — typed objects + relationships — with validation and graph pivoting (indicator→malware→campaign→threat-actor), the machine-readable form of the Diamond Model shared over TAXII."

Limitations: a representative object/relationship subset (not full STIX 2.1); undirected pivot traversal; no confidence/time weighting.