cybox

What it is and what it does

python-cybox is a library for working with Cyber Observable eXpression (CybOX) v2.1.0 content, a structured format for describing cyber observables like files, network addresses, and other security-relevant entities. It provides two layers of API: a low-level auto-generated binding to the XML schema (for complete coverage of the CybOX standard) and a higher-level manually designed API (for common use cases and more Pythonic interaction). The library can parse CybOX from XML, generate CybOX XML output, and convert to and from JSON and Python dictionaries.

The package depends on lxml, python-dateutil, and mixbox for its core functionality. It is designed to be faithful to both the CybOX standard and Python conventions, making it usable by both XML schema experts and Python developers. However, the project has been abandoned since 2020-05-01 with no active maintenance, meaning it will not receive updates for new Python versions, security issues, or changes in its dependencies.

Use it for:

• Parse and validate CybOX XML documents from security tools or threat intelligence feeds.
• Programmatically construct CybOX observables for threat reporting or integration with other standards.
• Convert CybOX content to JSON for use in web APIs or modern data pipelines.
• Work with legacy security applications that depend on the CybOX v2.1.0 standard.
• Extract and manipulate cyber observable metadata from structured threat intelligence.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Parses, manipulates, and generates Cyber Observable eXpression (CybOX) v2.1.0 content in XML and JSON formats through both low-level schema bindings and higher-level Python APIs.

Yes, but only if you are locked into CybOX v2.1.0 for legacy or compliance reasons. The package is stable with no known vulnerabilities, but it is abandoned and will not receive maintenance or Python version updates. Install it if you must work with existing CybOX content; avoid it for new projects unless CybOX is a hard requirement.

Install

cybox on PyPI

pip install cybox

uv add cybox

poetry add cybox

Installing cybox

Before you install

Low install friction with three straightforward dependencies. However, the package is abandoned—last commit was 2020-05-01 with no active maintenance or security updates since then.

License in practice

BSD permissive license allows commercial and private use with minimal restrictions, making it safe to adopt from a licensing perspective.

Quickstart

pip install cybox

from cybox.core import Observables
from cybox.objects.file_object import File

f = File()
f.file_name = "example.txt"
observables = Observables()
observables.add_observable(f)

lxml requires system libraries (libxml2-dev, libxslt1-dev, zlib1g-dev on Ubuntu) to build from source on some platforms.

Verify before relying

• Whether the package works reliably with Python versions beyond 3.7 despite classifier claims.
• Current compatibility status with recent versions of lxml and python-dateutil.
• Whether the CybOX standard itself remains in active use or has been superseded.

Package facts

Evidence: cybox-2.1.0.21-py2.py3-none-any.whl

Tags

More Security packages