stix

What it is and what it does

python-stix is a library for working with STIX v1.2.0, a standardized XML-based format for expressing and sharing structured threat intelligence. It provides Python APIs to read STIX documents from XML, construct threat objects programmatically (campaigns, indicators, threat actors, incidents, and other STIX constructs), and serialize them back to XML. The library depends on lxml for XML handling, cybox for cyber observable data, mixbox for common utilities, and python-dateutil for timestamp handling.

The package is production-stable but abandoned—its last release was November 2020 and the repository received its final commit in November 2021. It remains suitable for parsing and generating existing STIX v1.2.0 content in established workflows, but it will not evolve to support newer STIX versions or adapt to future Python ecosystem changes. Use it only if your threat intelligence pipeline is locked to STIX v1.2.0 and you have no migration path to newer standards.

Use it for:

• Parse STIX v1.2.0 XML threat intelligence feeds from external sources into Python objects for analysis.
• Programmatically construct STIX packages describing campaigns, threat actors, and indicators for export to legacy systems.
• Convert threat data between STIX and other formats by leveraging the library's object model as an intermediate representation.
• Integrate STIX threat intelligence into legacy security tools or workflows that depend on v1.2.0 compatibility.
• Extract and manipulate individual STIX constructs (indicators, exploit targets, TTPs) from larger documents.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Parses, manipulates, and generates STIX v1.2.0 (Structured Threat Information eXpression) content in Python, enabling programmatic work with threat intelligence data structures.

Yes, but only for legacy STIX v1.2.0 workflows. The package is stable, has low install friction, carries no license restrictions, and has no known vulnerabilities. However, it is abandoned and will not receive updates. Install it if your threat intelligence pipeline is committed to STIX v1.2.0 and you cannot migrate to a maintained alternative. Do not install it for new projects—evaluate whether STIX 2.0+ or a maintained STIX library is available for your use case.

Install

stix on PyPI

pip install stix

uv add stix

poetry add stix

Installing stix

Before you install

Low install friction with a pure-wheel distribution. Maintenance status is abandoned—last commit was 2021-11-24, over two years ago. The package remains functional for its stated purpose but will not receive updates for new Python versions, security patches, or bug fixes.

License in practice

BSD license is permissive and poses no restrictions on use, modification, or distribution. You may use this package freely in commercial or private projects without license compliance burden.

Quickstart

pip install stix

import stix
from stix.core import STIXPackage

package = STIXPackage()

lxml requires libxml2-dev and libxslt-dev system libraries on Linux; pre-built wheels are available for Windows and macOS but may require manual installation on older systems.

Verify before relying

• Whether the package works reliably with Python versions beyond 3.8 (classifiers list 3.8 as the latest tested version).
• Current compatibility with modern versions of its runtime dependencies (mixbox, cybox, python-dateutil, lxml).
• Whether STIX v1.2.0 remains the active standard or if newer STIX versions require a different library.

Package facts

Evidence: stix-1.2.0.11-py2.py3-none-any.whl

Tags

More Security packages