Lion Cipher Lab
Work with STIX 2.1 in Python (build and parse real threat intel)
- Threat Intel Analyst
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Threat intelligence is only useful if machines can act on it. A PDF report that says "watch out for evil.example" cannot feed a firewall, a SIEM, or a detection rule — a human has to retype it, and things get lost. STIX 2.1 is the common JSON language that lets tools and teams exchange intel without that manual step: one team's indicator becomes another team's detection automatically. Being able to build and parse STIX in code — not just click it out of a platform — is what lets you wire feeds together, script bulk imports, sanity-check what a vendor sent you, and understand what your…
What you'll learn
- Reading and writing STIX 2.1 objects
- Using the OASIS stix2 Python library
- Building indicators, malware, and relationships in code
- Serializing and parsing STIX bundles
- Telling an indicator (a pattern) apart from an observable (a raw fact)
- Adding MITRE ATT&CK context to intel
Steps in this lab
- What STIX 2.1 is, and why it exists
- Set up a clean workspace (a virtual environment)
- Install the stix2 library and confirm the import
- Create an Indicator, a Malware SDO, and a Relationship SRO
- Wrap it in a Bundle, serialize, and save the JSON
- Parse a bundle back in and pull fields out
- Add ATT&CK context — and meet the TAXII transport
- Versioning, revocation, and when a platform is the right answer