STIX/CybOX/MAEC Example

example.json

{
	"type": "package",
	"spec_version": "stix-2.0",
	"threat_actors": [
		{
			"type": "ThreatActor",
			"id": "threatactor--1",
			"spec_version": "stix-2.0",
			"created_at": "2016-03-21T01:01:01Z"
		}
	],
	"observations": [
		{
			"type": "observation",
			"id": "observation--1",
			"spec_version": "stix-2.0",
			"created_at": "2016-03-21T01:01:01Z",
			"observed_at": "2016-03-20T12:33:22Z",
			"cybox": {
				"objects": [
					{
						"type": "ipv4-addr-object",
						"id": "ip-address--1",
						"spec_version": "cybox-3.0",
						"value": "1.2.3.4"
					}
				]
			}
		},
		{
			"type": "observation",
			"id": "observation--2",
			"spec_version": "stix-2.0",
			"created_at": "2016-03-21T01:01:01Z",
			"observed_at": "2016-03-20T12:33:22Z",
			"cybox": {
				"actions": [{
					"id": "action--1",
					"type": "cybox-action",
					"name": "create network connection",
					"associated_objects": [
						{
							"type": "associated-object",
							"object_ref": "network-connection--1",
							"association": "output of"
						},
						{
								"type": "associated-object",
							"object_ref": "process-object--1",
							"association": "initiator of"
						}
					]
				}],
				"objects": [
					{
						"type": "network-connection",
						"id": "network-connection--1",
						"spec_version": "cybox-3.0",
						"protocols":{"layer7":"http"}
					},
					{
						"type": "ipv4-addr-object",
						"id": "ip-address--1",
						"spec_version": "cybox-3.0",
						"value": "1.2.3.4"
					},
					{
						"type": "domain-name-object",
						"id": "domain-name--1",
						"spec_version": "cybox-3.0",
						"value": "http://foo.bar.com"
					},
					{
						"type": "email-message-object",
						"id": "email-message--1",
						"spec_version": "cybox-3.0",
						"from": "[email protected]",
						"subject": "Check this out!"
					},
					{
						"type": "file-object",
						"id": "file-object--1",
						"hashes": {"md5": "B4D33B0C7306351B9ED96578465C5579"}
					},
					{
						"type": "file-object",
						"id": "file-object--2",
						"hashes": {"md5": "FFCCAADC7306351B9ED96578465C5579"}
					},
					{
						"type": "process-object",
						"id": "process-object--1",
						"pid":1234
					}
				],
				"relationships": [
					{
						"type": "object-relationship",
						"id": "object-relationship--1",
						"spec_version": "cybox-3.0",
						"source_ref": "email-message--1",
						"target_ref": "file-object--1",
						"kind_of_relationship": "has-attachment"
					},
					{	
						"type": "object-relationship",
						"id": "object-relationship--2",
						"spec_version": "cybox-3.0",
						"source_ref": "file-object--1",
						"target_ref": "file-object--2",
						"kind_of_relationship": "contains"
					},
					{
						"type": "object-relationship",
						"id": "object-relationship--3",
						"spec_version": "cybox-3.0",
						"source_ref": "file-object--2",
						"target_ref": "proces-object--1",
						"kind_of_relationship": "image-of"
					},
					{
						"type": "object-relationship",
						"id": "object-relationship--4",
						"spec_version": "cybox-3.0",
						"source_ref": "domain-name--1",
						"target_ref": "network-connection--1",
						"kind_of_relationship": "destination-of"
					},
					{
						"type": "object-relationship",
						"id": "object-relationship--5",
						"spec_version": "cybox-3.0",
						"source_ref": "domain-name--1",
						"target_ref": "ip-address--1",
						"kind_of_relationship": "resolves-to"
					}
				]
			}
		}
	],
	"relationships": [
		{
			"type": "relationship",
			"id": "relationship--1",
			"spec_version": "stix-2.0",
			"source_ref": "threatactor--1",
			"target_ref": "observation--1",
			"kind_of_relationship": "owns"
		},
		{
			"type": "relationship",
			"id": "relationship--2",
			"spec_version": "stix-2.0",
			"source_ref": "observation--2",
			"target_ref": "observation--1",
			"kind_of_relationship": "contains"
		}
	]
}