skip to navigation
skip to content


An API for parsing and generating STIX content.

Latest Version:


A python library for parsing, manipulating, and generating STIX v1.1.1 content.

The ``python-stix`` library utilizes the STIX v1.1.1 bindings, is under heavy
development. For more information about STIX, see

.. image::
:alt: Build Status


The python-stix library can be installed via the distutils script
included at the root directory:

$ python install

The python-stix library is also hosted on `PyPI
<https:"" pypi="" stix=""/>`_ and can be installed with `pip
<https:"" pypi="" pip="">`_:

$ pip install stix


The python-stix library depends on the presence of certain packages/libraries
to function. Please refer to their installation documentation for installation

- `python-cybox <https:"" cyboxproject="" python-cybox="">`_
- `lxml <http:""/>`_

Installing Dependencies on Ubuntu


$ sudo apt-get install python-dev python-pip libxml2-dev libxslt-dev
$ sudo pip install stix


Releases of the python-stix library will be given version numbers of the form
``major.minor.update.revision``, where ``major``, ``minor``, and ``update``
correspond to the STIX version being supported. The ``revision`` number is used
to indicate new versions of the python-stix library itself.


The python-stix package layout is as follows:

* ``stix/`` : root level package

* ``examples/`` : example python scripts that leverage the python-stix library

* ``stix/utils/`` : utility classes and modules used internally by the python-stix

* ``stix/bindings/`` : generateDS generated xml-to-python bindings (leveraged for
parsing and output of STIX XML content)

* ``stix/campaign/`` : APIs for STIX Campaign constructs

* ``stix/coa/`` : APIs for STIX Course Of Action constructs

* ``stix/core/`` : APIs for core STIX constructs (e.g., STIX Header, STIX Package)

* ``stix/common/`` : APIs for common STIX constructs (e.g., Structured Text,
Information Source)

* ``stix/exploit_target/`` : APIs for STIX Exploit Target constructs

* ``stix/incident/`` : APIs for common Incident constructs

* ``stix/indicator/`` : APIs for STIX Indicator constructs

* ``stix/extensions/`` : APIs for STIX extensions (e.g., CIQ Identity)

* ``stix/threat_actor/`` : APIs for STIX Threat Actor constructs

* ``stix/ttp/`` : APIs for STIX TTP constructs

Please refer to examples for concrete examples of how to interact with the
python-stix library  
File Type Py Version Uploaded on Size
stix- (md5) Source 2014-05-12 199KB (md5) Source 2014-05-12 331KB