Cybersecurity / Python · STIX / TAXII

Threat intelligence platform

STIX indicators are checked against example network logs. Inspect the exact match and see why expired or revoked indicators are excluded.

STIX indicator / log correlationFixture snapshot · 13 October 2026

Indicator triage

Indicator matches

The Python matcher checks an indicator’s validity before comparing it with a log. Select a STIX record to inspect its result.

3 / 9sample events matched

4 eligible indicators from 8 records

Show

STIX 2.1 indicatorEligible

Example destination IP

[ipv4-addr:value = '198.51.100.24']

Eligible for exact matching.

Valid from: 2026-10-01 00:00:00 UTC
Valid until: No end date supplied
Source: indicators.stix.json

Matching log evidence

flow-01

dst_ip equals 198.51.100.24

{
  "timestamp": "2026-10-13T09:00:00Z",
  "src_ip": "192.0.2.10",
  "dst_ip": "198.51.100.24"
}

Inspect all sample log events

Event	Observed value	Result
`flow-01`	`198.51.100.24`	Review match
`dns-02`	`GATEWAY.SAMPLE.TEST.`	Review match
`flow-03`	`203.0.113.80`	No eligible match
`flow-04`	`198.51.100.50`	No eligible match
`flow-05`	`198.51.100.60`	No eligible match
`dns-06`	`first.sample.test`	No eligible match
`flow-07`	`198.51.100.70`	No eligible match
`dns-08`	`sub.gateway.sample.test`	No eligible match
`flow-09`	`2001:0db8:0:0:0:0:0:24`	Review match

Exact IP or domain equality only. A match is a triage lead. The Python client also supports configured TAXII 2.1 collection ingestion.

Implementation notes

The matching rule stays visible

The Python matcher normalizes DNS names and IP addresses before comparison. GATEWAY.SAMPLE.TEST. matches gateway.sample.test. A subdomain remains a different observable.

STIX validity is checked at the fixed analysis time and at each event time. A revoked indicator is excluded even when an older version would have matched.

The TAXII client follows paginated collections when a provider is configured. The public walkthrough uses a fixed STIX fixture, with compound patterns recorded as unsupported.

OASIS: TAXII 2.1

Run locally

Source and example data

The Python project includes the example inputs and tests. Open its README for prerequisites and the complete workflow.

Download project source

python tip.py \
  --bundle fixtures/indicators.stix.json \
  --logs fixtures/network-logs.json \
  --as-of 2026-10-13T12:00:00Z \
  --sample --out demo.json
python -m unittest -v

Read the setup notes

Back to the courtyard All work