stix2_indicator_malware_relationship_bundle_json_serialization.py

1from stix2 import Indicator, Malware, Relationship, Bundle
2
3# Create an Indicator object
4indicator = Indicator(
5    name="File hash for Poison Ivy variant",
6    indicator_types=["malicious-activity"],
7    pattern_type="stix",
8    pattern="[file:hashes.'SHA-256' = 'ef537f25c895bfa782526529a9b63d97aa631564d5d789c2b765448c8635fb6c']",
9)
10
11# Create a Malware object
12malware = Malware(
13    name="Poison Ivy",
14    is_family=False,
15)
16
17# Create a Relationship object linking the Indicator to the Malware
18relationship = Relationship(indicator, 'indicates', malware)
19
20# Create a Bundle containing the objects
21bundle = Bundle(indicator, malware, relationship)
22
23# Print the bundle as JSON
24print(bundle.serialize(pretty=True))