misp-stix 2026.7.8 - Sturdier STIX patterns, fail-loud input validation, and TLP fixes

When Conversion Should Fail Loudly - and When It Shouldn't Fail at All

misp-stix is the library that converts threat intelligence in both directions
between MISP and STIX, and it is the same engine behind the browser-based
conversions on cti-transmute.org. This release is
less about new mappings than about making the conversions you already rely on
behave predictably: objects that used to be silently dropped now export
correctly, input that isn't a MISP event is rejected up front with a clear
error instead of an opaque stack trace, and hash and marking handling was
tightened on both the export and import sides.

The changes below will be brought to CTI-Transmute with the next upcoming
release, landing there soon - so you will be able to put them straight to the
test against your own data in the browser, at
cti-transmute.org, without installing anything
locally.

Changelog - 2026.6.25 → 2026.7.8

STIX patterns no longer silently drop objects

The central pattern-value handling escaped apostrophes but never backslashes, so
any value containing one - Windows filenames, file paths, registry key names -
produced a lexically-invalid STIX pattern. Indicator creation then raised and
the whole object was silently dropped from the output. Escaping is now
centralised in a shared _escape_pattern_value helper (backslash first, then
apostrophe) and reused across the pattern builders, so those objects export to
valid Indicators. The registry-key path was reconciled through the same helper -
_sanitise_registry_key_value now only folds % markers - with no change to its
resulting output.

• a57e3eb - escape backslashes via a shared _escape_pattern_value helper
• b658f26 - behaviour tests (file and lnk objects with backslashes plus an
  apostrophe) and unit tests covering escape order and the no-op cases

Invalid input now fails loudly instead of confusingly

Feeding the exporters content that isn't a MISP event - or a MISP structure at
the wrong layer - used to fail deep inside the conversion with an opaque error.
A new InvalidMISPInputError is now raised up front: both the STIX 1 and STIX 2
export paths detect the shape of the input (STIX 2's parse_json_content
included) and reject non-MISP or wrong-layer content with a clear message.
Exposing a dedicated exception type also lets consumers such as CTI-Transmute
catch the right error and surface a meaningful message to the user, instead of
having to guess at a generic failure. Key-validation errors were also attached
to their proper context rather than to a generic "misp event" sentinel.

• c45a75c - add the InvalidMISPInputError exception
• 17d0c5b, 6f4ba27 - detect input shape and raise on non-MISP input (STIX 2
  and STIX 1)
• 10c2793 - attach key-validation errors to their context
• d2d1782 - tests covering non-MISP / wrong-layer input across STIX 1, 2.0 and 2.1

One clear error per invalid hash

Invalid hash values used to raise inconsistent, sometimes duplicated errors
during export. InvalidHashValueError is now centralised with context-specific
messages, and each invalid hash produces exactly one consistently-labelled error
instead of several.

• 7b275ae - a single consistently-labelled error per invalid hash
• ee2e928 - centralise InvalidHashValueError with context-specific messages
• 3649905 - tests asserting a single error is raised per invalid hash

TLP and marking handling

A round of fixes around TLP tags and marking definitions. On STIX 1 export, the
TLP-tag check method was declared on the Events parser but used from the shared
parent class, so the Attributes parser could not see it; it is now available to
both (fixes #86). Marking definitions imported back to MISP TLP tags gained test
coverage across internal and external STIX 2.0 and 2.1, and TLP mapping entries
that were never reached (tlp:green, tlp:amber, tlp:red) were removed.

• 014e5ea - make the TLP-tag check method available to both the Attributes and
  Events parsers (#86)
• f2e6556 - drop unreachable TLP mapping entries
• 3ea88c8 - tests for markings imported back to TLP tags

Import simplification

artifact and hashlookup patterns now go through the standard pattern-parsing
path on the way back to MISP, removing the special-case handling that had
accumulated in the indicator converter.

• a2072fa - use standard pattern parsing for artifact and hashlookup
  conversion back to MISP

Maintenance

Dependency refresh and lock-file bump. Two releases were cut in this window:
2026.6.30 and 2026.7.8.

• 344c357, 5ccc656, 713ae7b

misp-stix 2026.6.25: Broader Object Coverage and Sturdier Round-Trips

Bridging MISP and STIX: Try the Extended Conversion Capacity

The conversions shown in the screenshots below from cti-transmute.org are produced by misp-stix, the library that converts threat intelligence in both directions between MISP and STIX 2.x.

The changes described below are already deployed on CTI-Transmute. The newly mapped hashlookup, directory and artifact objects, the broader registry-key coverage, and the Galaxy Cluster and import fixes can all be exercised there directly: visit cti-transmute.org and convert your data in the browser, without installing anything locally.

Changelog - 2026.6.1 → 2026.6.25

Three more MISP objects converted end to end

Three MISP object templates that previously had no dedicated mapping — and therefore
fell through to a generic x-misp-object custom object — are now first-class citizens
with full round-trip support to and from STIX 2.0 and 2.1.

• hashlookup now maps to a STIX File observable, plus an Indicator when its
  attributes carry the to_ids flag. Before this change the object was emitted as a
  custom object, so no Indicator was produced for its hashes even with to_ids set
  (issue #56). On the way back, a File Observable and/or Indicator is reconstructed into
  a hashlookup object.
• directory is converted to a STIX Directory observable and/or Indicator (path,
  path-encoding), with the reverse path rebuilding the object on import.
• artifact is converted to a STIX Artifact observable and/or Indicator, carrying
  its mime_type, url, payload and the full set of supported hash types, and is
  imported back into an artifact object — including correct handling of the
  has_encryption field.

Each object gained export, import and round-trip tests so the conversion stays stable in
both directions.

• 5e74cab, 6721124, e6f6a92, a9021ca, 9e59e30 — hashlookup export, import and tests
• dbeb197, fcd74d2, 400f7d3, 7b8237f — directory export, import and tests
• 8a72575, 074933d, f4f904e, 1234224, 36b6446, 341910a — artifact export, import and tests

Registry keys: single, multiple, and standalone values

Registry key conversion previously assumed exactly one value per key, matching the shape
of the MISP object template. With the External STIX 2.x converter now able to turn a STIX
Registry Key into a registry-key object plus several registry-key-value objects, the
export side was reworked to cover every case: a registry key with a single value, a
registry key with multiple values, and standalone registry-key-value objects on their
own. Pattern handling was improved on the way out, and the import side learned to map the
different key-and-value combinations back to MISP — without processing STIX 2.0 registry
key indicators twice.

• efc09d0, 902ab5d, 763913f — single, multiple and standalone value export handling
• e8aa3d3, 344fa79 — import of the different registry key and value use cases
• 58d05df, 2746596, b50f026, bc1cb13 — tests across the use cases, both directions

Galaxy Cluster export hardening

A series of fixes made Galaxy Cluster conversion robust against clusters that omit fields
the export code used to assume were always present. A missing meta field no longer
raises a KeyError, sector clusters without a timestamp are handled gracefully,
attribute-level location clusters are converted correctly, and ACS marking clusters with
no meta field now export (STIX 2.0) and import back cleanly.

• 7bdfd22, cf43e48, 22561c3 — meta, sector timestamp and attribute-level location fixes
• 1605c31, 9b6c469 — ACS marking clusters with no meta field, export and import
• bc60783, 2a46497 — additional and round-trip tests for the above

Import robustness fixes

Two defensive fixes on the import path:

• Domain observable reuse assumed a reused observable always carried a misp_attribute.
  In mixed domain / domain-ip flows the observable may instead be stored as a
  misp_object, which raised KeyError('misp_attribute') on reprocessing. Both domain
  observable reference parsers now fall back to misp_object and only touch the content
  when it exists, matching the defensive handling already used elsewhere. (PR #84)

• A duplicated Identity conversion was removed: the reusable conversion method already
  produces the MISP object, so the leftover inline block that built a second one is gone.

• 2e9bd92 — guard domain observable reuse against a missing misp_attribute

• 88d5041 — remove duplicated identity object conversion calls

Documentation

The few SDOs and use cases that were not yet documented gained descriptions and
additional test coverage, and the mapping documentation was regenerated to reflect all of
the changes above.

• 31a1c23, 740943b, 1b8a872, e1db75e, 7405012, 08c956d

Maintenance

Dependency refreshes, including pinning the latest versions of the STIX 1.x related
dependencies. Three releases were cut in this window: 2026.6.3, 2026.6.9 and
2026.6.25.

• 9f5e29e, 24a3a1b, 145dcde, 21de326, 031d5a3, 944a5da

misp-stix 2026.6.1 - Import pipeline cleanup, full TLP support & byte-stable conversions

Bridging MISP and STIX: Try the Latest Conversion Improvements

The conversion capabilities showcased below on the screenshot taken from cti-transmute.org are powered by misp-stix, used as the bidirectional conversion engine between MISP and STIX 2.x formats.

The latest release is already available for hands-on testing through CTI-Transmute, if you'd like to try the new conversion features, improved interoperability, and expanded format support without installing anything locally, simply visit cti-transmute.org and start converting your data directly in the browser.

Changelog - 2026.5.13 → 2026.6.1

STIX 2 import: converter wiring and parse-state ownership reworked

The import pipeline used to pick the right converter for each STIX object through
lazily-built converter properties and string-based dispatch. That indirection is gone:
converters are now looked up from a single registry keyed by STIX type, with explicit
2.0 / 2.1 selection, so routing an object is one direct lookup instead of a chain of
property accessors and name juggling.

The observable-handling logic — previously a shared base class mixed into several
converters through multiple inheritance — became a standalone peer that the other
converters call into. This removed the inherited-method tangle (and its diamond
inheritance) from the converters that only needed a few observable helpers.

The loaded observable objects were also being duplicated across several converters, each
keeping its own copy and its own fetch logic, with inconsistent behaviour on missing
references (some paths raised, some silently skipped). That state now lives in one place,
on the main parser, and every converter reads it through shared accessors. As a side
effect, references that point at a missing object are now skipped cleanly everywhere
instead of crashing on some paths, and a redundant double-lookup was removed.

• e24cb53, 3e6e475 — converter registry with explicit 2.0/2.1 dispatch; observable converter as a peer
• fbb366f, 2e81ddf, 40cbff6, 36133e2 — single owner for the loaded observables, consumed through accessors

Full TLP marking support, shared across both directions

Export now converts the complete set of TLP tags rather than a subset, and the TLP 2.0
marking definitions are described once in a mapping that both export and import use,
instead of being maintained separately on each side.

• a754302, b5a6865, fbd81b3

Patterning languages and documentation

The list of supported patterning languages was extended to include ones that were
missing, and the mapping documentation was regenerated to reflect it along with the
changes above.

• 5dd25a7, 2417e0b, a9374ce, 561c8ce

Deterministic, reproducible conversions

Remaining sources of run-to-run variation were removed so the same input always produces
byte-identical output:

• Set-derived lists that were emitted in arbitrary order — notably object_refs and a
  Network Traffic object's protocols — are now produced in a stable order, with
  deduplication preserved.
• On import, MISP UUIDs are consistently derived (UUID v5) from the originating STIX
  object id across every object and attribute path, rather than only on some of them.
  (ObjectReference UUIDs are intentionally left random.)

This also makes the auto-generated mapping documentation stable between runs.

• f02f32c, b90b8f2, b873073, 945394a, 1d9d642, 5c26927

STIX 1 export: data-driven collection framing

The seven STIX 1.x collection types each carried repeated definitions describing how their
content is wrapped in the streamed multi-file output. These were collapsed into a single
data-driven table keyed by collection type and output format, removing the duplication.
The rewrite also corrected a wrong XML tag that was emitted for the courses-of-action
collection.

• a90c13a

Maintenance

General cleanup, an updated minimum stix2 requirement, and dependency refreshes.
Two releases were cut in this window: 2026.5.20 and 2026.6.1.

• e758a6c, bcb5485, c00d258, 1b602da, ce35840, 96f19e4

misp-stix 2026.5.13 - Enhanced Interoperability and STIX 2 Conversion Optimisations

Highlights

• Improved Internal STIX 2.x ↔ MISP Galaxy interoperability and round-trip conversion support.
• Better STIX 2 pattern compliance with updated hash property handling and interoperability fixes.
• Replaced the heavy submodules with:
  • Lightweight CTI UUID catalog.
  • Galaxy metadata mapping.
  • New tooling for automated CTI UUID catalog and Galaxy mapping updates.
• Major documentation and test suite refresh for STIX 2.x conversion workflows.

Major changes

New Features

STIX 2 Import

• Better support for MISP Galaxies converted from Internal STIX 2.x objects (47ceebb)
• Round-trip conversion: Custom Galaxy imported back to MISP from Internal STIX (a628969)
• Improved tag name generation for Galaxies imported from Internal STIX 2.x (cfa6ca3)
• Better hash type mapping for STIX 2 indicators (ac32927)

Tools

• Script to update the CTI UUID catalog from submodules (71ac5b2)
• Script to update the Galaxy definition mapping from submodules (71ac5b2)

Changes

STIX 2 Export

• Replaced the massive cti git submodule with a lightweight CTI UUID catalog (aa4c045)
• Regenerated CTI UUID catalog with latest data (92ecffe)
• Better STIX pattern property name handling to comply with the STIX spec (ec9ebca)

STIX 2 Import

• Regenerated Galaxies definition mapping (d137728)

STIX 1 Export

• Guard against missing MISP data layer fields to avoid conversion errors (2e23e97)

Submodules

• Bumped submodules to latest versions (cbe4de0)

Fixes

STIX 2 Export

• Compliant hash property names in STIX patterns (9f6a670, 066a8c5)

STIX 2 Import

• Fixed tag name generation for Galaxy clusters from Internal STIX (cfa6ca3)

Tests

• Fixed STIX 2.x samples and tests for internal content conversion to match STIX pattern compliance changes (98759ff)
• Fixed interoperability tests (36cfd30)
• Fixed no longer existing pattern handling method (d1a3a96)

Documentation

• Complete documentation for STIX 2.x → MISP conversion (9328320)
• Documentation for External STIX 2.x content conversion to MISP (ad127c6)
• Documentation content for Galaxy mapping from Internal STIX 2.x (c2da4f4, ab191e3)
• Fixed mapping summary auto-generation (da26793)
• Fixed missing content and mapping documents for external STIX to MISP (ddf8782)
• Regenerated full documentation with all latest changes (efea131)

Testing

• Quick pattern handling test suite (844e964)
• Tests populating Galaxy mapping documentation from Internal STIX 2.x (ab191e3)

Detailed changelog

Full Changelog: 2026.4.28...2026.5.13

misp-stix 2026.4.28 - Support for MISP Object collections conversion to STIX, and mapping extension to better support various patterning languages

Highlights

This release expands STIX 2 conversion coverage, especially around MISP object collections, detection rule objects, and the suricata attribute type. It also improves the reliability of STIX 2 import/export paths by fixing creator handling, pattern parsing, object storage, and documentation generation.

STIX 2 Export

MISP Objects collections can now be exported to STIX 2. The exporter gained the collection-specific initialisation and parsing logic needed to process objects stored for later conversion, while preserving creator information where available.

The STIX 2 export path now sets created_by_ref on demand, checks for creators across attributes and objects in MISP collections, and removes no longer needed Identity arguments. A bug in the Path method used while removing files was also fixed.

Support was added for exporting the new suricata attribute type. The exporter also now supports additional detection rule object templates, and a missing argument in cluster-to-STIX mapping was fixed.

STIX 2 Import

The STIX 2 import path has better pattern handling, including improved conversion of indicators with different patterning languages back to MISP.

Internal STIX 2.1 content can now reimport additional Rulezet-specific patterning languages back to MISP. The release also improves storage handling for STIX objects and currently skips extension-definition objects during import to avoid unsupported conversion paths.

Documentation And Tests

The mapping documentation was regenerated to reflect the new and updated conversion behavior. The automatic documentation generation was also fixed so it passes the correct number of STIX objects through the documentation pipeline and handles recent mapping updates correctly.

Test coverage was added or updated for:

• MISP Objects collections export.
• Attributes and Objects collection reference samples.
• Detection rule objects converted as Indicators.
• Indicators using different patterning languages.
• Rulezet-specific patterning language conversion from internal STIX 2.1.
• The new suricata attribute type.

Packaging And Dependencies

The package version was bumped for the release. Dependency lock files were refreshed several times, the PyMISP requirement was updated, and the misp-galaxy submodule was bumped to a newer version.

Project Metadata

Documentation was updated to provide an up-to-date description of the Mapping between MISP and STIX 2.x versions

Detailed changelog

2026.4.28 / 2026-04-28

• chg: [poetry] Updated lock file with latest PyMISP version
• ifix: [documentation] Regenerated the entire documentation
• fix: [documentation] Updated automatic documentation generation
• chg: [documentation] Got the latest mapping documentation regenerated from tests
• fix: [poetry] PyMISP required version bump
• chg: [poetry] Updated lock file with latest PyMISP version
• Merge branch 'main' of github.com:MISP/misp-stix
• chg: [poetry] New PyMISP version requirement set
• Merge branch 'dev' of github.com:MISP/misp-stix
• chg: [tests] Supporting new suricata attribute type
• add: [stix2 import] Supporting new suricata attribute type in single attribute and as part of the suricata object template
• add: [stix2 export] Supporting new attribute type suricata
• chg: [package] Version bump
• chg: [poetry] Lock file with latest versions bump
• Merge branch 'dev' of github.com:MISP/misp-stix
• fix: [stix2 import] Skipping extension-definition objects for now
• Merge branch 'dev' of github.com:MISP/misp-stix
• chg: [documentation] Regenerated documentation with recent updates on mapping
• fix: [tests, documentation] Passing the right amount of STIX objects to the documentation automation process
• fix: [stix2 import] Better handling of STIX object storage variables
• add: [tests] Tests for additional patterning languages specific to Rulezet conversion from Internal STIX 2.1 to MISP
• add: [stix2 import] Reimporting additional patterning language specific to Rulezet, back to MISP from STIX 2.1
• add: [tests] Tests for indicator with different patterning languages
• fix: [stix2 import] Better patterning language patterns conversion to MISP
• fix: [stix2 import] Better handling patterns

2026.4.17 / 2026-04-21

• chg: [poetry] Bumped lock file with latest dependencies versions
• Merge branch 'dev' of github.com:MISP/misp-stix
• chg: [doc] Mapping documentation got updated
• fix: [documentation] Fixed special character in mapping doc
• chg: [package, poetry] Version bump
• chg: [poetry] Bumped lock file
• chg: [misp-galaxy] Latest version bump
• add: [tests] Samples and tests for additional rule objects converted as Indicator
• fix: [stix2 export] Fixed cluster to stix mapping missing its argument
• add: [stix2 export] Supporting new detection rule object templates
• Merge branch 'main' of github.com:MISP/misp-stix into dev

2026.4.9 / 2026-04-09

• chg: [package, poetry] New version
• chg: [poetry] Bumped latest dependencies versions
• chg: [misp-galaxy] Bumped latest submodule version
• Merge branch 'dev' of github.com:MISP/misp-stix
• Merge branch 'dev' of github.com:MISP/misp-stix into dev
• Merge pull request #82 from MISP/creator_handling
• fix: [tests] Updated Attributes & Objects collections reference samples
• fix: [stix2 export] Fixed Path method used to remove a file
• fix: [stix2 export] Removed no longer used Identity args
• fix: [stix2 export] Making sure we check the existence of a creator in every attribute or object from a MISP collection
• fix: [stix2 export] Setting STIX 2.x object created_by_ref argument on demand
• fix: [stix2 export] Making sure we parse objects - from collections - that are stored for later parsing
• fix: [stix2 export] Added specific initialisation method for objects collections conversion
• Merge branch 'main' of github.com:MISP/misp-stix into dev

2026.3.30 / 2026-03-30

• chg: [submodules] Latest misp-galaxy version
• chg: [package] New version
• chg: [poetry] Bumped lock file with latest versions
• Merge branch 'dev' of github.com:MISP/misp-stix
• add: [tests] Checking MISP objects collections export
• add: [stix2 export] Allowing export of MISP Objects collections
• Merge branch 'main' of github.com:MISP/misp-stix into dev
• chg: [readme] Updated description and Licensing information

misp-stix 2026.3.13 - Indicator & Observable Fingerprinting, plus broad improvements across import & export features

misp-stix v2026.3.13 Release Notes

---

New major feature: Indicator & Observable Fingerprinting

• New matching system that links STIX Indicators with Observable objects by comparing pattern values against observable fields
• When an indicator describes the same data as an observable (e.g., file hashes in a pattern matching a full file observable), the to_ids flag is set on the resulting MISP attributes
• Indicator IDs stored in attribute comments for traceability
• Separate implementations for internal (MISP-generated) vs external (third-party) STIX content
• Deterministic v5 UUID generation based on content values for consistent attribute identification

Dual Indicator + Observed Data Export

• MISP attributes/objects with to_ids=True now generate both an Observed Data object AND an Indicator (with STIX pattern), linked by a relationship
• Removed the to_ids label from exported STIX objects for cleaner output
• Default to_ids values applied per attribute type
• Proper deduplication of relationships between indicators and observed data
• Deterministic relationship object IDs (no longer entirely random)

New MISP Object Types coverage

• artifact object: import from STIX Artifact observables and indicators (payload_bin support), and export back to STIX
• malware object: export to STIX 2.x Malware SDO
• malware-analysis object: export to STIX 2.1 MalwareAnalysis SDO
• http-request object: import from network-traffic observables with HTTP request extensions

ACS Marking Definition Support

• Import: STIX 2.1 ACS marking extension definitions converted to MISP Galaxy Clusters (grouped in a single Galaxy)
• Export: Custom ACS marking Galaxy Clusters converted back to STIX 2.1 Marking Definitions (and STIX 2.0 custom marking objects)
• Proper handling of multiple further_sharing rules
• Marking definitions referenced in Report/Grouping object_refs are properly handled
• Tags from marking definitions correctly attached to the resulting MISP Event

Enhanced STIX 2.x Indicator Pattern Parsing

Comprehensive parsing improvements for:

• x509 certificates (improved hash property handling)
• Processes
• Registry keys (proper value parsing with list index support)
• Email messages
• Domain-name + IP combinations (proper domain-ip object or domain attribute conversion)
• Autonomous systems
• Socket extensions
• Network traffic and network connections
• MAC addresses
• Mutex objects
• PE extensions
• Artifact payload_bin

Unreferenced Objects Handling

• STIX objects not referenced in any Report or Grouping are now properly parsed and converted

Identity Object Fixes

• Fixed conversion for Identity objects back to legal-entity, news-agency, and person MISP objects

Architecture & Code Quality

• New AbstractParser base class for shared error/warning tracking across all parsers
• Internal vs external STIX 2 handling properly separated at converter level
• Default MISP event validation before export
• Modern Python 3.10+ typing (| union syntax)
• Sightings and data analyst references properly handled for attributes and objects converted to both indicator and observed data

Testing

• Comprehensive new test suites for indicators converted to MISP attributes and objects
• Tests for standalone observable objects with related indicators
• Tests for observed data with related indicators
• Tests for large batches of multiple observable objects
• ACS marking definition tests
• Unreferenced objects handling tests
• Consistent UUID usage across all test samples for reproducible documentation generation

---

Detailed Changelog

349 commits since v2026.2.12 (~10 months of development), 120 files changed, ~89k insertions, ~48k deletions.

New Features

STIX 2 Import

• Parsing MAC address indicators (3cd5eb5)
• Converting external network-traffic observables with HTTP request extension as http-request MISP object (31d427d)
• Handling marking references for STIX 2 SDOs imported as Galaxy Cluster (c5d217e)
• Handling marking definitions referenced in report or grouping object_refs (3ebc7ea)
• Handling tags from marking definition extensions attached to the resulting MISP Event (ce1fd1f)
• Storing IDs of STIX objects not referenced in any grouping or report (fe178a0)
• Parsing artifact payload_bin from Artifact objects and indicators (18fe315)
• Added artifact indicator conversion method (f4b58b5)
• Added missing network_connection_pattern_mapping for Internal STIX indicators (062888d)
• Added possibility to parse multiple STIX objects having potential contextual fields while adding an Attribute (69213b3)
• Methods to check links between indicator patterns and observable objects (ac1b1bd)

STIX 2 Export

• Converting malware objects to STIX 2.x (6ea4151)
• Converting malware-analysis object to STIX 2.1 (55237be)
• Converting ACS Marking custom Galaxy Cluster to STIX 2.1 Marking Definition (6ac9db2)
• Converting custom ACS marking Galaxy Clusters to STIX 2.0 custom marking objects (b8c5469)
• Converting attributes with to_ids flag as both Indicator + Observed Data (09c59d3)
• Converting MISP objects to Observable objects + extracting to_ids attributes to generate Indicators (099b600)
• Converting network-socket & process objects to both Observed Data & Indicator (d0a720e)
• Handling references for populating reference fields instead of generating relationship objects (a610ed0)

Tests

• Unit tests for indicators converted to MISP Attributes (01b0af8)
• External STIX 2.0 & 2.1 Indicator samples (29ec46c, e38226d)
• Tests for STIX 2.0 & 2.1 Indicators converted to MISP Objects (523bdae, bc352df, acf8ca8)
• Tests for standalone Observable objects and related Indicators (7cc5f55)
• Tests for STIX 2.0 & 2.1 Observed Data and related Indicators (88a086c, 04f2228)
• Tests for large batches of multiple STIX 2.0 & 2.1 observable objects (ef9a065, 9d69583)
• Tests for ACS Marking Definition extension objects (985a6a7)
• Tests for unreferenced objects handling (611dcb3)
• Additional unittests for attributes converted from observable objects (408a719)
• Tests for standalone Network Traffic Observable objects from STIX 2.1 (d77c5a3)
• Tests for Observable objects import from STIX 2.1 (29b3668)
• Generating Bundles with single Observed Data containing all Observable objects (ad616b1)

Changes

STIX 2 Import

• Splitting Grouping & Report objects from the rest while loading STIX Bundles (a81aaec)
• Clarification of relationship type for domain name references (2f0b359)
• Created abstract parent class for all parsers (9b90d49)

STIX 2 Export

• Making Relationship object IDs deterministic (no longer entirely random) (eada035)
• Using Attribute validation method from pymisp tools (1aae965)
• Removed labels mentioning the to_ids flag (96e7915)
• Using property to reach the relationships storage variable (b37aeca)
• Simplified typings; comprehension dicts/lists for for loops (8b9c437)
• Default MISP event validation before export (1e0e39d)

Tests & Documentation

• Extended tests for ZMQ feed Attributes export to STIX 2.1 (cf9aa96)
• Consistent UUID usage across all test samples for reproducible documentation (91c0939, ca77af7, b95c3c4)
• Regenerated mapping documentation across all STIX versions (d3e17bf, 78b1237, 5e9fd82, 053b93d, bf8f7a9, 33a949b)
• Updated automated documentation generation (d2f4f1c, 5fa9d5f, 5507aa1, dfd7b70)

Package

• New version (65d7832)
• Updated submodules to latest version (3c59612)
• Bumped poetry lock file with latest versions (1a587f8)

Bug Fixes

STIX 2 Import — Indicator Pattern Parsing

• Properly parsing x509 indicators with hash property handling (48402c8)
• Properly parsing process indicators using attribute handling method (3cdbcaf)
• Properly parsing registry key values with list index support (c958bbf)
• Fixed pattern parser to keep indexes for lists of embedded values (672b36d)
• Properly parsing socket-ext patterns (e938056)
• Properly parsing network-socket and network-traffic (6ca073b)
• Better parsing mutex indicators (fd03b7b)
• Better parsing PE extension from file indicators (a2d1890)
• Properly parsing email-message patterns for email objects (518a9e1)
• Fixed domain-name and IP pattern handling for domain-ip Object or domain Attribute (277a9d6)
• Fixed autonomous-system pattern parsing (e5fb1ba)
• Fixed file hashes mapping for indicators conversion (777bfee)

STIX 2 Import — Observable Objects

• Fixed conversion for Identity objects back to legal-entity, news-agency & person MISP objects (29ec2dc)
• Fixed undefined variable when parsing IP addresses in AS observable objects (5642edf)
• Properly handling email address observable objects referenced by email messages (2bb68b3)
• Properly handling Observable objects referenced by Network Traffic objects (69dcb8c)
• Properly handling multiple observable objects (bdb3b04)
• Fixed STIX 2.0 multiple Observable objects fetching from Observed Data (835256c)
• Better embedded observable objects references handling (fdf149e)
• Properly parsing creator_user_ref from registry key observable objects (f31909b)
• Harmonised file Observable objects conversion between converters (d0aa438)
• Made directory Observable objects conversion more straightforward (5874fcc)
• Properly parsing email-message observable objects fields and references (4320793)
• Properly parsing email-address with display name support (1836da4)
• Fixed DomainName observable objects conversion from STIX 2.0 Observed Data (dae1014)
• Parsing artifact payload refs in network traffic observable objects (2e24b7b)
• Avoiding duplicated parsing of Observable objects referenced by email messages (39e4e18)
• Avoiding observable objects in...

MISP-STIX Spring Release

We're excited to share a new set of updates to misp-stix, bringing better STIX 2.x compatibility, smarter Galaxy Cluster handling, and improved validation — all wrapped up with stronger test coverage and smoother tooling.

Highlights of recent misp-stix changes (Jan–June 2025)

STIX 2.x compatibility improvements

• Enhanced import/export of custom Galaxy Clusters (Campaign, Threat Actor, Malware, Tool, Attack Pattern, etc.)
• Support for TLP 2.0 and improved parsing of ACS Marking and access privileges
• Better meta field mapping, labels, and synonym handling for SDOs

Validation & standard compliance

• Initial use of stix2validator to validate country codes was replaced by pycountry for more reliable handling

Bug fixes and stability

• Resolved issues with malformed or missing fields (name, object_refs, country, custom fields)
• Improved fallback logic and inheritance handling in mapping methods

Tests & coverage

• Broadened test suite for custom STIX object conversions
• Added regression tests and more comprehensive sample coverage

Packaging & tooling

• Regular dependency updates (poetry, lockfiles, submodules)
• Cleanup and consistency improvements in CLI options and argument naming

Detailed changelog

2025.6.12 - 2025-06-12

Chg

• [package, poetry] Updated version

Fix

• [stix2 export] Improving the categorisation of MISP as JSON content to call the right conversion to STIX 2.x method
• [stix2 import] Fixed mapping inheritance to avoid unavailability of a mapping method

2025.5.13 - 2025-05-13

Add

• [stix2 import] Mapping TLP 2 definitions

Chg

• [package] New version
• [submodules] Bumped latest mitre/cti & misp-galaxies versions

Fix

• [stix2 export] Making sure Identity objects are not raise any exception because of a custom field
• [stix2 import] Fixed access privilege parsing from ACS marking extension definitions

2025.4.30 - 2025-04-30

Add

• [test] Tests for custom Campaign Galaxy Clusters export to STIX 2.x
• [stix2 export] Converting Custom Galaxy Clusters imported from STIX 2.x Campaign objects, back to STIX 2.x

Chg

• [poetry, package] Bumped latest version
• [stix2 export] Validating country values while converting country galaxy clusters and custom location galaxy clusters
• [poetry] Bumped latest versions in lock file
• [tests] Updated test samples for Campaign objects import as Custom Galaxy

Fix

• [stix2 import] Using the right method to parse malware sample refs
• [stix2 import] Properly adding Galaxy with Cluster when converting Malware object both as MISP object and Cluster
• [stix2 import] Avoiding issues with missing name field in SDOs converted from STIX 2.x to MISP Galaxy Clusters
• [stix2 export] Catching exceptions on invalid country value
• [tests] Added tests for custom Vulnerability Galaxy Cluster export to STIX 2.x
• [stix2 import] Removed empty line
• [tests] Covering all fields in tests for custom Tool Galaxy Cluster
• [stix2 export] Avoiding issues with custom stix objects id in object_refs field of a Note
• [tests] Tests for Custom Threat Actor Galaxy export to STIX 2.x
• [stix2 export] Typo on the Threat Actor meta fields mapping
• [stix2 import] Added missing mapping for STIX 2.1 Threat Actor fields
• [tests] Better tests for custom Attack Pattern Clusters meta fields & added tests for custom Malware Clusters export to STIX 2.x
• [stix2 export] Better labels and malware/threat actor/tool types field handling
• [stix2 export] Better meta fields mapping handling
• [stix2 export] Added missing country code warning
• [stix2 import] Fixed STIX 2.1 Malware object to cluster meta fields mapping
• [stix2 export] Converting custom location Galaxy Clusters to STIX 2.1 Location objects
• [stix2 export] Updated Galaxy Clusters mapping & generic meta fields list
• [poetry, package] Added stix2validator dependency and updated lock file accordingly
• [tests] Updated tests for location clusters export to STIX 2.1
• [stix2 export] Passing meta values without making them a list when they are single values
• [tests] Better tests for Intrusion Set objects conversion in both directions
• [stix2 export] Better intrusion set clusters conversion
• [tests] Better tests for Campaign objects conversion
• [stix2 import] Parsing all Campaign object fields
• [tests] Better tests for Attack Pattern objects
• [stix2 export] Added missing parsing of attack pattern synonyms converted as aliases in STIX 2.1 Attack Pattern objects
• [stix2 export] Typo missing stix version to populate custom galaxies mapping
• [stix2 export] Typo in SDO types exported from galaxy clusters
• [stix2 export] Enabling the ability to export to any STIX 2.x version the custom galaxy clusters previously generated during the conversion from STIX 2.x
• [stix2 import] Properly parsing access privileges

2025.4.10 - 2025-04-11

Chg

• [package] Bumped latest version
• [poetry] Bumped lock file with latest versions
• [poetry] Updated lock file with latest versions

Fix

• [stix2 import] Made the Observable objects fetching method available for all standalone Observable objects conversion classes
• [stix2 import] Avoiding KeyError exxception when trying to fetch an observable object based on its id referenced in an observed data

2025.4.4 - 2025-04-04

Chg

• [package, poetry] New library version
• [submodules] Bumped latest versions
• [poetry] Bumped lock file with latest versions

Fix

• [tests] Updated test following the updated galaxy & cluster definition
• [stix2 import] Avoiding issues with Sighting objects

2025.03.04 - 2025-03-13

Chg

• [poetry, package] Library version bump
• [poetry] Bumped latest lock file

Fix

• [stix2 import] Passing the cluster distribution value to galaxy definitions too
• [stix2 import] Making Python 3.9 happy with my return typings being str or None
• [tests] Updated tests following recent change on the location objects conversion
• [stix2 import] Fixed imports
• [stix2 import] Converting STIX 2.1 Location objects with only global region, country or area attributes as custom galaxy
• [stix2 import] Removed unused mapping methods
• [stix2 import] Removed mapping that was move to converters

2025.02.14 - 2025-02-14

Chg

• [package] Bumped version
• [poetry] Bumped lock file
• [poetry] Replaced deprecated section name

Fix

• [stix2 import] Keeping UUID from Custom objects used to describe a Galaxy Cluster which we import back to MISP
• [stix2 import] Replaced undefined methods with actual error message handling

2025.01.10 - 2025-01-10

Chg

• [poetry, package] Bumped versions
• [stix2 import] Aligned the force contextual data argument to its naming on MISP

2025.01.09 - 2025-01-09

Add

• [stix2 import] New argument to force the conversion of a STIX 2.x SDO as Galaxy Cluster

Chg

• [readme] Updated package information, CLI description & updated active period information
• [poetry] Bumped lock file with latest versions
• [poetry, package] Bumped package version

misp-stix 2025.01.09 - New Year release including support of Analyst Data

This new release introduces changes to support the conversion between MISP Analyst Data and the STIX 2.x Note & Opinion objects.

It includes the following features:

• Improvement on the support of STIX 2 Note & Opinion objects that are now converted into MISP Analyst Data
• Supporting the export of MISP Analyst Data that is now converted into STIX 2 Note & Opinion objects
• A few fixes on the command line feature and some edge cases
• The argument to force the conversion of STIX 2.x SDOs as Galaxy Cluster

Here’s the detailed list of changes with the complete changelog:

[2025.01.09] - 2025-01-09

Add

• [stix2 import] New argument to force the conversion of a STIX 2.x SDO as Galaxy Cluster

Chg

• [readme] Updated package information, CLI description & updated active period information
• [poetry] Bumped lock file with latest versions
• [poetry, package] Bumped package version
• [CLI] In long argument names, replaced underscores with dashes

Fix

• [CLI] Fixed confusion between single_output and single_event arguments

[2025.01.07] - 2025-01-07

Chg

• [poetry, package] New tag version
• [poetry] Bumped lock file with latest versions
• [poetry, package] Updated versions

Fix

• [CLI] Fixed argument confusion between the import & export command line feature

[2024.12.20] - 2024-12-20

Add

• [stix2 import] Adding to the Event the information on the producer using the producer galaxy
• [stix2 import] Adding to the Event the information on the producer using the producer galaxy
• [tests] Tests for Analyst Data import from STIX 2.x content generated from MISP
• [tests] Better report/grouping references handling in STIX2 Bundle samples
• [tests] Tests for Event Report import
• [tests] Testing the Note & Opinion objects type for Analyst Data exported to STIX 2.x
• [stix2 export] Added labels to Notes and Opinions objects converted from Analyst Data or Event Report
• [tests] Added tests for Analyst Data export to STIX 2.0
• [tests] Added tests for Event Report export to STIX 2.0
• [tests] Added tests with Analyst Data attached to a MISP object
• [misp_stix_converter] Making available the method to check the origin of STIX 1 files
• [stix1 import] STIX 1 to MISP automation methods added
• [tests] Tests for STIX 2.x Bundle import with specific producer or title set by user
• [misp_stix_converter] Added title argument to prefix Event info field with some title
• [readme] Added instructions on the producer argument
• [misp_stix_converter, stix2 import] Added producer argument to add in the Events converted from STIX 2.x the name of the producer
• [misp_stix_converter] Extended the command line feature to allow to push Events on MISP from the conversion of STIX 2.x Bundles
• [tests] Tests for Analyst Data export to STIX 2.1

Chg

• [poetry] Bumped lock file
• [stix2 import] Converting report or grouping description as MISP Event Report
• [stix2 import] Adding Analyst Data to Attributes, Objects and Event
• [stix2 import] Improved the Note & Opinion objects parsing
• [tests] Updated samples & tests for analyst data export with content exported to Observed Data
• [stix2 export] Making Analyst Data export to STIX 2.0 available
• [stix2 export] Exporting Event Reports also to STIX 2.0
• [stix2 import] More specific name for the method to check is a STIX 2.x file was generated from MISP
• [stix2 import] Better error and warning messages handling
• [poetry] Bumped lock file with latest versions
• [stix2 import] Defining a separate abstract class for methods related to external STIX only
• [stix2 import] Excluding the producer from the event info title
• [stix2 import] Better handling of the STIX2 Parser class arguments
• [stix2 import] Added separation in the generic Event info field, between the title and information on the producer
• [stix2 import] Adding producer - when provided - to the generic info field
• [misp_stix_converter] Getting the current user organisation uuid to use it for the Custom Clusters creation
• [readme] Updated instruction for the command line feature
• [stix2 export] Converting Analyst Notes and Opinions to STIX 2.1 Note & Opinion objects

Fix

• [poetry] Updated lock file with missing dependencies
• [poetry] Trying to fix setuptools dependency on Python 3.12 & 13
• [github actions] Updated Github actions setup
• [stix2 import] Trying to fix Python 3.9
• [poetry] Trying to fix missing setuptools dependency
• [poetry] Bumped latest PyMISP version
• [poetry] Bumped latest lock file with the right python versions and some library updates
• [github] Updated Python versions
• [poetry] Updated Python versions
• [stix2 import] Removed duplicated property method already present in a parent class
• [stix2 import] Quick clean-up
• [poetry] Bumped lock file
• [stix2 import] Utilising the set of creator id references to skip parsing identity objects that are mentioned is STIX objects with the created_by_ref field
• [stix2 import] Avoiding issues with event tags variable when we are parsing STIX documents with no report or grouping
• [stix2 import] Avoiding KeyError exceptions while parsing standalone STIX 2.1 observable objects
• [stix2 import] Better parsing for observables referenced in malwares objects
• [stix2 import] Fixed missing method name
• [stix2 import] Utilising the set of creator id references to skip parsing identity objects that are mentioned is STIX objects with the created_by_ref field
• [stix2 import] Avoiding issues with event tags variable when we are parsing STIX documents with no report or grouping
• [stix2 import] Avoiding KeyError exceptions while parsing standalone STIX 2.1 observable objects
• [stix2 import] Better parsing for observables referenced in malwares objects
• [stix2 import] Fixed missing method name
• [tests] Fixed created_by_ref identity id
• [stix2 import] Avoiding issues while attaching Data Analyst to the different MISP data layers
• [stix2 import] Better Analyst Data information loading and parsing
• [stix2 import] Properly importing Analyst Notes and Opinions attached to Event Reports
• [stix2 import] Added missing opinion value for Analyst Opinion imported from STIX 2.1 generated from MISP
• [tests] Updated tests for STIX 2 External content conversion to MISP
• [stix2 import] Simplifying some typings, avoiding missing variable
• [stix2 import] Variable name fixed
• [stix2 import] Converting Event Reports from STIX 2.0 Custom x-misp-event-report objects and STIX 2.1 Note objects
• [stix2 import] Added missing Event Report import feature
• [stix2 import] Removed unused import
• [stix2 import] Simplification of the converters declaration
• [stix2 import] Fixed Analyst Data authors fields that is a string in MISP
• [stix2 import] Fixed call to warning handling which taking place in the main parser and not in the converters
• [stix2 import] Removed duplicated property for MISP Event
• [stix2 import] Fixed a quick issue coming from the last conflicts resolving
• [stix1 import] Making python 3.8 & 3.9 happy with typings
• [tests] Quick fix on the tests for event report export as STIX 2.0
• [stix2 import] Added missing import
• [tests] Cleaned up tests for analyst data export
• [stix2 export] Fixed Note and Opinion objects arguments
• [stix2 export] Adding Note and Opinion IDs used at Event level to the object_refs list of references within the Report or Grouping object
• [stix2 export] Parsing analyst data related to Observed Data objects & added a few missing typings
• [tests] Avoiding issues with test samples being altered
• [stix2 export] Fixed Event Report references fetching
• [stix2 export] Making the methods related to event reports part of the parent STIX 2 export class
• [tests] Added fallback test to avoid issues with datetime values
• [stix2 export] Removed non existing comment field in Analyst Note
• [stix2 import] Added typing in external mapping and made different variable checks easier
• [stix2 export] Better Analyst Note & Opinion conversion
• [stix1 import] Fixing the email object handling and a few other clean-up changes
• [stix2 import] Fixed synonyms_mapping call
• [stix2 import] Fixed synonyms_mapping call
• [stix2 import] Removed unused part of the datetime to timestamp conversion method
• [stix2 import] Fixed test on indicator version
• [stix2 import] Code monkey typo fixed
• [stix2 import] Making the MISP_org_uuid available while putting its declaration at the right place
• [poetry] Bumped fixed version
• [stix2 import] Fixed the method to directly load and parse STIX Bundle giving a filename
• [stix2 import] Fixed the method to directly load and parse STIX Bundle giving a filename
• [misp_stix_converter] Fixed some argparse help values
• [tests] Fixed tests for STIX 2.x Bundles imported as MISP Events where producer and info values are set by user
• [stix2 import] Fixed generic info field to use the title set by users
• [stix2 export] Avoiding issues with Note objects referencing Custom objects
• [stix2 import] Avoiding issue with getattr which isn't able to check whether a __ prefixed variable exists or not
• [misp_stix_converter] Handling cases where url or authentication key is not provided to connect to MISP
• [stix2 import] Added missing producer argument
• [misp_stix_converter] Updated command-line import arguments
• [stix2 import] Added bundle id to the generic Event info field used when there is no Report or Grouping to parse
• [misp_stix_converter] Quick fixes on the command-line feature
• [misp_stix_converter] Providing default value to the version and distribution arguments with the command line feature
• [stix2 import] Checking if internal STIX 2.1 Note object has labels
• [stix2 import] Avoiding issues with the Event tags variable
• [ex...

misp-stix v2.4.196 - Summer realease including changes on the command-line feature and a few fixes

v2.4.196 - 2024-08-21

Included in the release

• A few arguments to the STIX 2 to MISP parsers have been added to give the option to set directly some of the MISP Event fields or add more contextualisation to the data that is converted to MISP
• Overall improvement of the command-line feature, supporting more arguments - some are directly related to the above mentioned new arguments
• Updated documentation explaining the newest features

Add

• [misp_stix_converter] Global version argument added
• [tests] Tests for STIX 2.x Bundle import with specific producer or title set by user
• [misp_stix_converter] Added title argument to prefix Event info field with some title
• [readme] Added instructions on the producer argument
• [misp_stix_converter, stix2 import] Added producer argument to add in the Events converted from STIX 2.x the name of the producer
• [readme] Added more instructions and examples on the command-line feature usage
• [readme] Additional instructions on the installation process
• [misp_stix_converter] Extended the command line feature to allow to push Events on MISP from the conversion of STIX 2.x Bundles

Chg

• [package] Updated version
• [stix2 import] Excluding the producer from the event info title
• [poetry] Bumped latest versions in lock file
• [stix2 import] Better handling of the STIX2 Parser class arguments
• [stix2 import] Added separation in the generic Event info field, between the title and information on the producer
• [stix2 import] Adding producer - when provided - to the generic info field
• [poetry] Bumped lock file with the latest versions
• [poetry] Bumped lock file with the latest dependencies versions
• [readme] Updated command-line import feature arguments instructions
• [misp_stix_converter] Getting the current user organisation uuid to use it for the Custom Clusters creation
• [readme] Updated instruction for the command line feature

Fix

• [poetry] Tentative to fix lock file
• [misp_stix_converter] Fixed some argparse help values
• [tests] Fixed tests for STIX 2.x Bundles imported as MISP Events where producer and info values are set by user
• [stix2 import] Fixed generic info field to use the title set by users
• [stix2 export] Avoiding issues with EventReport referencing attributes or objects exported as Custom STIX 2 Object
• [stix2 import] Avoiding issue with getattr which isn't able to check whether a __ prefixed variable exists or not
• [misp_stix_converter] Handling cases where url or authentication key is not provided to connect to MISP
• [stix2 import] Added missing producer argument
• [misp_stix_converter] Updated command-line import arguments
• [stix2 import] Added bundle id to the generic Event info field used when there is no Report or Grouping to parse
• [misp_stix_converter] Quick fixes on the command-line feature
• [misp_stix_converter] Providing default value to the version and distribution arguments with the command line feature
• [stix2 import] Avoiding issues with the Event tags variable

misp-stix v2.4.194 - A few fixes and an important change to the Tags handling to avoid duplication of Event tags into Attributes

v2.4.194 - 2024-06-21

Included in the release

• A few issues fixed
• Some clean-up of the duplicated methods after the latest Converters have been merged
• Avoiding the duplication of Event tags in Attributes
  ➡️ When an Event is tagged with a specific tag, it implies all the Attributes contained in this Event are implicitly tagged with the same tag. We do not need to explicitly tag all the Attributes with the same tag in that case.
  ❌ : As a naive approach, we were looping through Marking Definitions to tag individually each Attribute when there was a reference between the corresponding STIX object and Marking Definition
  ✅ Now we first check if a given Tag is already attached to the Event before attaching it to an Attribute

Chg

• [poetry] Updated lock file with latest versions
• [poetry] Latest version
• [stix2 export] Cleaner STIX 2.x object IDs handling

Fix

• [stix2 import] Deduplication of the Event tags that were also added to Attributes
• [stix2 import] Removed unused methods
• [stix2 import] Avoid returning an error message for marking-definition refs not parsed
• [stix2 export] Cleaner code
• [stix2 import] Differenciating the network traffic mapping to use when parsing indicators