A TypeDB schema for representing STIX 2.1 cyber threat intelligence data, enabling structured querying of threat actors, malware, and infrastructure.
TypeDB STIX Schema is an open-source TypeDB schema that implements the STIX 2.1 standard for cyber threat intelligence. It allows security teams to model and query threat intelligence data—such as threat actors, malware campaigns, and infrastructure—using TypeDB's type system and TypeQL query language. The schema maps STIX objects and relationships into TypeDB entities and relations, enabling complex graph-based analysis of threat data.
Security engineers, threat intelligence analysts, and developers building cyber threat intelligence platforms who need to store, query, and analyze STIX-formatted data in a structured database.
It provides a faithful, queryable implementation of the STIX 2.1 standard in TypeDB, enabling complex relationship tracing and threat analysis that would be difficult with traditional databases, while offering sample data and queries for immediate usability.
Open Source Threat Intelligence Platform
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Maps all STIX Domain Objects and Cyber-observable Objects into TypeDB entities with proper attributes, ensuring compliance with the official specification as detailed in schema files like domain_objects.tql and cyber_observable_objects.tql.
Implements STIX relationships as TypeDB relations, enabling complex, graph-based queries to trace threat actor attributions or malware delivery chains, as demonstrated in the sample TypeQL queries.
Provides sample STIX bundles like Salt Typhoon and accompanying TypeQL scripts, offering a hands-on way to explore and validate the schema without starting from scratch.
Leverages TypeDB's entity-relation model to represent STIX objects more directly than flat attribute storage, enhancing data integrity and query flexibility, as emphasized in the schema's philosophy.
Admits missing components like granular markings and ordered lists (e.g., email.received-line) due to TypeDB's lack of native ordered list support, which limits full STIX 2.1 compliance.
Requires setting up and running a TypeDB Server, plus manual schema initialization through scripts or console commands, adding overhead compared to standalone libraries or cloud-based solutions.
Uses approximations for dictionaries with no enforcement of unique keys, as TypeDB doesn't have first-class dictionary support, potentially leading to data integrity issues in scenarios like hash value storage.