Cyber Threat Intelligence Python Packages

stix2-patterns

OASIS TC Open Repository: Validate patterns used to express cyber observable content in STIX Indicators

stix2

OASIS TC Open Repository: Python APIs for STIX 2

taxii2-client

OASIS TC Open Repository: TAXII 2 Client Library Written in Python

mitreattack-python

A python module for working with ATT&CK

stix2-validator

OASIS TC Open Repository: Validator for STIX 2.0 JSON normative requirements and best practices

stix2-elevator

OASIS Cyber Threat Intelligence (CTI) TC Open Repository: Convert STIX 1.2 XML to STIX 2.x JSON

cortexutils

Cortex Analyzers Repository

ziran

ZIRAN finds the vulnerabilities in AI agents that come from tools combining, not from any single prompt. Graph-based tool chain discovery, execution-level side-effect detection, multi-phase campaigns.

medallion

OASIS TC Open Repository: TAXII 2 Server Library Written in Python

misp-lib-stix2

OASIS TC Open Repository: Python APIs for STIX 2

txt2stix

Extracts IoCs, TTPs and the relationships between them. Outputs a STIX 2.1 bundle.

threatcluster-mcp

MCP server for the ThreatCluster threat intelligence API: incident clusters, IOCs, CVEs, ransomware leak-site victims and entity profiles as tools for Claude, Cursor, VS Code and any MCP client. Python and npm.

uhbs

Universal Honeypot Benchmarking Standard (UHBS) v5.0.x — open-source framework for vendor-neutral honeypot / deception evaluation

opentaxii

TAXII server implementation in Python from EclecticIQ

stix2-generator

OASIS Cyber Threat Intelligence (CTI) TC: A tool for generating STIX content for prototyping and testing. https://github.com/oasis-open/cti-stix-generator

mcp-cyberbro

Using MCP is fun with Cyberbro!

mallorymcp

Mallory - Cyber Threat Intelligence MCP Server

mseep-malloryai-mcp-server

Mallory - Cyber Threat Intelligence MCP Server

stix2-slider

OASIS TC Open Repository: The repository cti-stix-slider supports development of a Python application to convert STIX 2.0 content to STIX 1.x content

iflow-mcp-malloryai-mallory-mcp-server

Mallory - Cyber Threat Intelligence MCP Server

rekos

Terminal-native passive OSINT CLI for local-first public-source investigations, evidence correlation, and case management.

metemcyber

Decentralized Cyber Threat Intelligence Kaizen Framework

jupyter-widget-stixview

STIX2 graph widget for Jupyter notebooks, powered by stixview library

attack-stix-lookup

STIX data representing MITRE ATT&CK