---
id: stix2
version: "3.0.2"
license: BSD
license_treatment: permissive
maintenance: aging
---

# stix2 — Produce and consume STIX 2 JSON content

License: permissive · Maintenance: aging · Downloads: 1.8M/mo

## What it is and what it does

stix2 is a Python library for working with STIX 2 (Structured Threat Information Expression), the OASIS standard format for representing and sharing cyber threat intelligence. It provides APIs to construct STIX objects (like indicators, malware, campaigns) by passing keyword arguments to constructors, parse STIX JSON strings into Python objects, and serialize objects back to JSON. The library supports STIX 2.1 at the Committee Specification level and handles common CTI tasks including object versioning, data markings, and resolving STIX identifiers across multiple data sources.

The package depends on pytz for timezone handling, requests for HTTP operations, simplejson for JSON serialization, and stix2-patterns for pattern validation. It is maintained as an OASIS TC Open Repository with BSD-3-Clause licensing, meaning contributions are open to the community. The library supports modern Python versions (3.10 through 3.14) and is positioned for developers building threat intelligence systems, security platforms, or tools that need to consume or produce standardized CTI data.

Use it for:

- Parse STIX JSON feeds from threat intelligence platforms and convert them into Python objects for analysis.
- Create and serialize malware indicators, attack patterns, or campaign objects for sharing with other security tools.
- Build a threat intelligence ingestion pipeline that normalizes data from multiple CTI sources into STIX format.
- Validate and version STIX objects as part of a security data management workflow.
- Integrate threat intelligence data into a security information and event management (SIEM) or incident response system.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Serializes and deserializes STIX 2 JSON content, providing Python APIs for creating, parsing, and manipulating cyber threat intelligence objects with support for data markings, versioning, and ID resolution across multiple sources.

Yes, if you work with STIX 2 threat intelligence data. The library has low install friction, no known vulnerabilities, permissive licensing, and active maintenance from OASIS-backed maintainers. The aging status reflects stable maturity rather than abandonment—recent commits and community governance are present. Install it if you need to produce, consume, or transform STIX 2 JSON in a Python application; skip it if you don't work with CTI standards.

## Install

pip install stix2
uv add stix2
poetry add stix2

## Installing stix2

Before you install: Low friction installation with four lightweight runtime dependencies. Last release was 183 days ago; repository remains active with recent commits and community maintenance, though classified as aging rather than actively developed.

License in practice: BSD-3-Clause permissive license allows commercial and private use with minimal restrictions, requiring only license and copyright notice preservation in distributions.

Quickstart:

pip install stix2

from stix2 import Indicator

indicator = Indicator(
    name="File hash for malware variant",
    indicator_types=["malicious-activity"],
    pattern_type="stix",
    pattern="[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"
)
print(indicator.serialize(pretty=True))

Requires Python 3.10 or later.

Verify before relying:

- Whether the aging maintenance status reflects planned stability or reduced active development.
- Performance characteristics when handling large volumes of STIX objects or complex pattern queries.

## Package facts

- License: BSD (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: aging
- Downloads: 1.8M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

stix 2 json serialization, cyber threat intelligence python, stix object creation parsing, threat intelligence data format, oasis stix library, cti json handling, malware indicator parsing, threat-intelligence, stix-standard, cti

[View on SkillFed](https://skillfed.io/packages/stix2) · [View on PyPI](https://pypi.org/project/stix2/)