[Enterprise STIX Objects] custom objects showing as type <class dict> rather than STIX object type

[Cyb3rWard0g]

Good afternoon Team,

I was updating my python wrapper to collect information in STIX from the public TAXII server and started to do some exploring of each technology-domain. I decided to query the enterprise collection and explore the available objects in it:

Im using a Jupyter Notebook:

In [27]: from taxii2client import Collection                                                                                                                                                
In [28]: from stix2 import TAXIICollectionSource, Filter                                                                                                                                    
In [29]: ATTCK_STIX_COLLECTIONS = "https://cti-taxii.mitre.org/stix/collections/"                                                                                                           
In [30]: ENTERPRISE_ATTCK = "95ecc380-afe9-11e4-9b6c-751b66dd541e"                                                                                                                          
In [31]: ENTERPRISE_COLLECTION = Collection(ATTCK_STIX_COLLECTIONS + ENTERPRISE_ATTCK + "/")                                                                                                
In [32]: TC_ENTERPRISE_SOURCE = TAXIICollectionSource(ENTERPRISE_COLLECTION)                                                                                                                
In [33]: enterprise_objects = TC_ENTERPRISE_SOURCE.query()                                                                                                                                  
In [34]: type(enterprise_objects)                                                                                                                                                           
Out[34]: list
In [35]: enterprise_list = []                                                                                                                                                               
In [36]: for o in enterprise_objects: 
    ...:     enterprise_list.append(o['type']) 
    ...:                                                                                                                                                                               
In [37]: from collections import Counter                                                                                                                                                    
In [38]: Counter(enterprise_list)                                                                                                                                                           
Out[38]: 
Counter({'relationship': 4852,
         'course-of-action': 241,
         'attack-pattern': 244,
         'malware': 278,
         'tool': 56,
         'intrusion-set': 88,
         'x-mitre-tactic': 12,
         'x-mitre-matrix': 1,
         'identity': 1,
         'marking-definition': 1})
In [39]:     

As you can see in output 38, I was able to aggregate each object and show the number of times the object is present.

Now, when I perform a loop through the enterprise available objects and inspect the type of data I am dealing with, I get STIX object types which is what I expect. However, when I inspect the type of the object x-mitre-tactic, it returns a dict type.

In [41]: for e in enterprise_objects: 
    ...:     if e['type'] == "x-mitre-tactic": 
    ...:         print(e['name']) 
    ...:         print(type(e)) 
    ...:         print("-----") 
    ...:                                                                                                                                                                                    
Impact
<class 'dict'>
-----
Credential Access
<class 'dict'>
-----
Defense Evasion
<class 'dict'>
-----
Initial Access
<class 'dict'>
-----
Command and Control
<class 'dict'>
-----
Exfiltration
<class 'dict'>
-----
Privilege Escalation
<class 'dict'>
-----
Collection
<class 'dict'>
-----
Execution
<class 'dict'>
-----
Persistence
<class 'dict'>
-----
Discovery
<class 'dict'>
-----
Lateral Movement
<class 'dict'>
-----

Is there a reason why the custom STIX objects are of type dict and not STIX?

Thank you in advance!

[emmanvg]

Hi @Cyb3rWard0g, good question. The reason why you see this is because you are dealing with custom objects not defined (or registered) on the stix2 library. In order to not fail hard, the library will just treat them as regular dictionaries.

If you want or need custom object instances you would need to define and register them (examples here). The extra benefit comes from validating your instances, but as far as I know extensions for x-mitre-tactic and x-mitre-matrix are not avaiable.

Are you encountering a specific issue or just curious about the approach?

[Cyb3rWard0g]

Thank you very much @emmanvg ! that makes perfect sense. I will add that to my documentation. I appreciate the help and quick response 👍

[Cyb3rWard0g]

Sorry I didn't answer your last question. I was just curious about the approach 👍 Thank you again for all the information and your time !