stix.common.kill_chains
KillChain
KillChains
KillChainPhase
KillChainPhaseReference
KillChainPhasesReference
There is a shortcuts for adding kill chain phases from the Lockheed Martin Cyber Kill Chain to indicators:
from stix.common.kill_chains.lmco import PHASE_RECONNAISSANCE
from stix.indicator import Indicator
i = Indicator()
i.add_kill_chain_phase(PHASE_RECONNAISSANCE)
print i.to_xml(include_namespaces=False)
<indicator:Indicator id="example:indicator-2bb1c0ea-7dd8-40fb-af64-7199f00719c1"
timestamp="2015-03-17T19:14:22.797675+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Kill_Chain_Phases>
<stixCommon:Kill_Chain_Phase phase_id="stix:TTP-af1016d6-a744-4ed7-ac91-00fe2272185a"/>
</indicator:Kill_Chain_Phases>
</indicator:Indicator>