🥮 mooncakes.io

    moonstix

    OASIS STIX 2.1 cyber threat intelligence objects, bundles, and patterning for MoonBit

    stix
    stix2
    cti
    threat-intelligence
    bundle
    Download zip
    Version
    0.1.1
    License
    Apache-2.0
    Repository
    Last updated
    last month
    Downloads
    34

    No dependencies

    #MoonStix

    OASIS STIX 2.1 cyber threat intelligence objects, bundles, and patterning for MoonBit.

    The library parses STIX JSON, checks property tables for the core 2.1 SDOs, SROs, SCOs and metadata objects, walks identifier references inside a Bundle, and parses the STIX patterning grammar. It does not speak TAXII, download ATT&CK, store CVEs, or scan files with YARA.

    Package name: 2200732518gjy/moonstix. License: Apache-2.0, with BSD-3-Clause attribution for the Python STIX libraries in THIRD_PARTY.md.

    #Install

    Install from mooncakes.io and use MoonBit moonc >= 0.10.14 (wasm-gc is the preferred target):

    moon add 2200732518gjy/moonstix
moon check --target wasm-gc --deny-warn
moon build --target wasm-gc --deny-warn
moon test --target wasm-gc

    #Use

    let parsed = @stix.parse_and_validate(text).unwrap()
    let doc = parsed.0
    let issues = parsed.1
    let _ = @stix.parse_pattern("[ipv4-addr:value = '203.0.113.10']")

    issues is empty when the document matches the built-in 2.1 tables. Pattern parse errors on an indicator with pattern_type stix are reported as pattern issues. stringify_document round-trips the parsed JSON.

    Public entry points also include parse_document, validate_document, parse_stix_id, parse_timestamp, lookup_type_spec, known_type_names, and the IPv4/IPv6/MAC/email helpers.

    #Examples

    moon run examples/parse_bundle --target wasm-gc
moon run examples/validate_indicator --target wasm-gc
moon run examples/sighting_graph --target wasm-gc

    • parse_bundle loads a four-object bundle (identity, malware, indicator, relationship) and prints type/id pairs when issues=0.
    • validate_indicator shows a STIX pattern that is missing [...] and prints a pattern issue.
    • sighting_graph checks a self-contained sighting, observed-data, and file SCO graph.

    #Scope

    Supported: STIX 2.1 Bundle; 18 SDOs; relationship and sighting; 18 SCOs; marking-definition, language-content, extension-definition; common properties; a STIX patterning subset (AND/OR/FOLLOWEDBY, START/STOP/WITHIN/REPEATS, IN/LIKE/MATCHES/ISSUBSET/ISSUPERSET/EXISTS).

    Not supported: TAXII 2.x transport, MITRE ATT&CK catalog sync, CVE/NVD storage, live pattern evaluation against telemetry, STIX 2.0 observed-data.objects dictionaries.

    #Verify

    python tools/check_moonc_version.py --minimum 0.10.14
python tools/count_effective_moonbit.py --check-core 2000
moon fmt --check
moon check --target wasm-gc --deny-warn
moon build --target wasm-gc --deny-warn
moon test --target wasm-gc

    #License

    Apache-2.0. See LICENSE and THIRD_PARTY.md. AI assistance is disclosed in AI_USAGE.md. The library does not open network sockets or read host telemetry. GitHub Actions repeats formatting, the 2,000-line source threshold, four backend checks, a wasm-gc build, three backend test runs, and all three examples.

    CompOp

    source
    pub(all) enum CompOp {
      Eq
      Ne
      Gt
      Lt
      Ge
      Le
    } derive(Eq, 
    Debug    )

    Comparison operator in a STIX observation.

    CompOp::equal

    source
    fn CompOp::equal(CompOp, CompOp) -> Bool

    CompOp::not_equal

    source
    fn CompOp::not_equal(x : CompOp, y : CompOp) -> Bool

    CompOp::to_repr

    source

    ComparisonExpr

    source
    pub(all) enum ComparisonExpr {
      Compare(ObjectPath, CompOp, PatternValue)
      In(ObjectPath, Array[PatternValue])
      Like(ObjectPath, String)
      Matches(ObjectPath, String)
      IsSubset(ObjectPath, String)
      IsSuperset(ObjectPath, String)
      Exists(ObjectPath)
      Not(ComparisonExpr)
      And(ComparisonExpr, ComparisonExpr)
      Or(ComparisonExpr, ComparisonExpr)
    } derive(Eq, 
    Debug    )

    Boolean comparison expression inside [...].

    ComparisonExpr::equal

    source

    ComparisonExpr::not_equal

    source
    fn ComparisonExpr::not_equal(x : ComparisonExpr, y : ComparisonExpr) -> Bool

    ComparisonExpr::to_repr

    source

    Document

    source
    pub(all) enum Document {
      Bundle(StixBundle)
      Object(StixObject)
    } derive(
    Debug    )

    A document is either a bundle or a single object.

    Document::to_repr

    source

    FieldSpec

    source
    pub(all) struct FieldSpec {
      name : String
      required : Bool
      shape : ValueShape
    } derive(Eq, 
    Debug    )

    One named property in a type table.

    FieldSpec::equal

    source
    fn FieldSpec::equal(FieldSpec, FieldSpec) -> Bool

    FieldSpec::not_equal

    source
    fn FieldSpec::not_equal(x : FieldSpec, y : FieldSpec) -> Bool

    FieldSpec::to_repr

    source

    Issue

    source
    pub(all) struct Issue {
      code : String
      path : String
      message : String
    } derive(Eq, 
    Debug    )

    Diagnostic collected while parsing or validating STIX JSON.

    Issue::at

    source
    fn Issue::at(self : Issue) -> String

    Issue::code_name

    source
    fn Issue::code_name(self : Issue) -> String

    Issue::equal

    source
    fn Issue::equal(Issue, Issue) -> Bool

    Issue::not_equal

    source
    fn Issue::not_equal(x : Issue, y : Issue) -> Bool

    Issue::to_repr

    source

    ObjectKind

    source
    pub(all) enum ObjectKind {
      Sdo
      Sro
      Sco
      Meta
      Bundle
      Custom
    } derive(Eq, 
    Debug    )

    High-level STIX object family.

    ObjectKind::equal

    source
    fn ObjectKind::equal(ObjectKind, ObjectKind) -> Bool

    ObjectKind::not_equal

    source
    fn ObjectKind::not_equal(x : ObjectKind, y : ObjectKind) -> Bool

    ObjectKind::to_repr

    source

    ObjectPath

    source
    pub(all) struct ObjectPath {
      object_type : String
      steps : Array[PathStep]
    } derive(Eq, 
    Debug    )

    type:property... path used by STIX patterning.

    ObjectPath::equal

    source
    fn ObjectPath::equal(ObjectPath, ObjectPath) -> Bool

    ObjectPath::not_equal

    source
    fn ObjectPath::not_equal(x : ObjectPath, y : ObjectPath) -> Bool

    ObjectPath::to_repr

    source

    PathStep

    source
    pub(all) enum PathStep {
      Property(String)
      Index(Int)
      AnyIndex
    } derive(Eq, 
    Debug    )

    One step of an object path after the type name.

    PathStep::equal

    source
    fn PathStep::equal(PathStep, PathStep) -> Bool

    PathStep::not_equal

    source
    fn PathStep::not_equal(x : PathStep, y : PathStep) -> Bool

    PathStep::to_repr

    source

    PatternExpr

    source
    pub(all) enum PatternExpr {
      Observation(ComparisonExpr)
      And(PatternExpr, PatternExpr)
      Or(PatternExpr, PatternExpr)
      FollowedBy(PatternExpr, PatternExpr)
      StartStop(PatternExpr, String, String)
      Within(PatternExpr, String)
      Repeats(PatternExpr, String)
    } derive(Eq, 
    Debug    )

    Observation expression tree, including qualifiers.

    PatternExpr::equal

    source
    fn PatternExpr::equal(PatternExpr, PatternExpr) -> Bool

    PatternExpr::not_equal

    source
    fn PatternExpr::not_equal(x : PatternExpr, y : PatternExpr) -> Bool

    PatternExpr::to_repr

    source

    PatternValue

    source
    pub(all) enum PatternValue {
      String(String)
      Bool(Bool)
      Number(String)
      Timestamp(String)
      Null
    } derive(Eq, 
    Debug    )

    Constant on the right-hand side of a comparison.

    PatternValue::equal

    source

    PatternValue::not_equal

    source
    fn PatternValue::not_equal(x : PatternValue, y : PatternValue) -> Bool

    PatternValue::to_repr

    source

    StixBundle

    source
    pub(all) struct StixBundle {
      id : String
      objects : Array[StixObject]
      raw : Json
    } derive(
    Debug    )

    Bundle of STIX objects.

    StixBundle::to_repr

    source

    StixError

    source
    pub(all) enum StixError {
      JsonSyntax(String)
      NotObject
      UnexpectedRoot(String)
      Pattern(String)
    } derive(Eq, 
    Debug    )

    Fatal document-level failure. Property problems are reported as Issue.

    StixError::equal

    source
    fn StixError::equal(StixError, StixError) -> Bool

    StixError::message

    source
    fn StixError::message(self : StixError) -> String

    StixError::not_equal

    source
    fn StixError::not_equal(x : StixError, y : StixError) -> Bool

    StixError::to_repr

    source

    StixId

    source
    pub(all) struct StixId {
      type_name : String
      uuid : String
      text : String
    } derive(Eq, 
    Debug    )

    Parsed STIX identifier: <type>--<uuid>.

    StixId::equal

    source
    fn StixId::equal(StixId, StixId) -> Bool

    StixId::not_equal

    source
    fn StixId::not_equal(x : StixId, y : StixId) -> Bool

    StixId::to_repr

    source

    StixObject

    source
    pub(all) struct StixObject {
      stix_type : String
      id : String
      spec_version : String
      kind : ObjectKind
      properties : Map[String, Json]
      raw : Json
    } derive(
    Debug    )

    One STIX object, including custom x-* types.

    StixObject::to_repr

    source

    Timestamp

    source
    pub(all) struct Timestamp {
      year : Int
      month : Int
      day : Int
      hour : Int
      minute : Int
      second : Int
      fraction : String
      offset_minutes : Int
      text : String
    } derive(Eq, 
    Debug    )

    Parsed RFC 3339 timestamp used by STIX 2.1 datetime properties.

    Timestamp::equal

    source
    fn Timestamp::equal(Timestamp, Timestamp) -> Bool

    Timestamp::not_equal

    source
    fn Timestamp::not_equal(x : Timestamp, y : Timestamp) -> Bool

    Timestamp::to_repr

    source

    Tok

    source
    pub(all) enum Tok {
      Eof
      Ident(String)
      String(String)
      Number(String)
      Timestamp(String)
      LBrack
      RBrack
      LParen
      RParen
      Colon
      Dot
      Star
      Comma
      Eq
      Ne
      Gt
      Lt
      Ge
      Le
    } derive(Eq, 
    Debug    )

    Tokens produced by the STIX patterning lexer.

    Tok::equal

    source
    fn Tok::equal(Tok, Tok) -> Bool

    Tok::not_equal

    source
    fn Tok::not_equal(x : Tok, y : Tok) -> Bool

    Tok::to_repr

    source

    TypeSpec

    source
    pub(all) struct TypeSpec {
      type_name : String
      kind : ObjectKind
      fields : Array[FieldSpec]
      require_any : Array[String]
    } derive(Eq, 
    Debug    )

    Per-type property table used by the validator.

    TypeSpec::equal

    source
    fn TypeSpec::equal(TypeSpec, TypeSpec) -> Bool

    TypeSpec::not_equal

    source
    fn TypeSpec::not_equal(x : TypeSpec, y : TypeSpec) -> Bool

    TypeSpec::to_repr

    source

    ValueShape

    source
    pub(all) enum ValueShape {
      String
      Boolean
      Integer
      NonNegativeInteger
      Timestamp
      Identifier
      IdentifierOf(String)
      StringList
      IdentifierList
      IdentifierListOf(String)
      OpenVocab(String)
      ClosedVocab(String)
      OpenVocabList(String)
      Hashes
      Dictionary
      ObjectList
      ExternalReferences
      KillChainPhases
      GranularMarkings
      Extensions
      Pattern
      HexBinary
      IPv4
      IPv6
      Mac
      Email
      Url
      Any
    } derive(Eq, 
    Debug    )

    Expected JSON shape of one property.

    ValueShape::equal

    source
    fn ValueShape::equal(ValueShape, ValueShape) -> Bool

    ValueShape::not_equal

    source
    fn ValueShape::not_equal(x : ValueShape, y : ValueShape) -> Bool

    ValueShape::to_repr

    source

    common_relationship_types

    source
    fn common_relationship_types() -> Array[String]

    Common STIX 2.1 relationship_type values.

    document_objects

    source
    fn document_objects(doc : Document) -> Array[StixObject]

    id_type_matches

    source
    fn id_type_matches(id : StixId, expected : String) -> Bool

    is_common_relationship_type

    source
    fn is_common_relationship_type(name : String) -> Bool

    is_open_vocab_value

    source
    fn is_open_vocab_value(value : String) -> Bool

    issue

    source
    fn issue(code : String, path : String, message : String) -> Issue

    known_type_names

    source
    fn known_type_names() -> Array[String]

    lookup_type_spec

    source
    fn lookup_type_spec(type_name : String) -> TypeSpec?

    object_kind_of

    source
    fn object_kind_of(type_name : String) -> ObjectKind

    parse_and_validate

    source
    fn parse_and_validate(text : String) -> Result[(Document, Array[Issue]), StixError]

    Parse JSON and collect STIX validation issues.

    parse_document

    source
    fn parse_document(text : String) -> Result[Document, StixError]

    parse_document_json

    source
    fn parse_document_json(value : Json) -> Result[Document, StixError]

    parse_pattern

    source
    fn parse_pattern(text : String) -> Result[PatternExpr, String]

    Parse a STIX 2.1 patterning expression.

    parse_stix_id

    source
    fn parse_stix_id(text : String) -> Result[StixId, String]

    parse_timestamp

    source
    fn parse_timestamp(text : String) -> Result[Timestamp, String]

    pattern_object_types

    source
    fn pattern_object_types(expr : PatternExpr) -> Array[String]

    relationship_allowed

    source
    fn relationship_allowed(source_type : String, rel : String, target_type : String) -> Bool

    Whether a (source type, relationship, target type) triple is in the built-in STIX 2.1 constraint table. "*" matches any type.

    stringify_document

    source
    fn stringify_document(doc : Document) -> String

    timestamp_is_rfc3339

    source
    fn timestamp_is_rfc3339(text : String) -> Bool

    valid_email

    source
    fn valid_email(text : String) -> Bool

    valid_hex_binary

    source
    fn valid_hex_binary(text : String) -> Bool

    valid_ipv4

    source
    fn valid_ipv4(text : String) -> Bool

    valid_ipv6

    source
    fn valid_ipv6(text : String) -> Bool

    valid_mac

    source
    fn valid_mac(text : String) -> Bool

    valid_stix_type_name

    source
    fn valid_stix_type_name(name : String) -> Bool

    valid_stix_uuid

    source
    fn valid_stix_uuid(text : String) -> Bool

    valid_url

    source
    fn valid_url(text : String) -> Bool

    validate_document

    source
    fn validate_document(doc : Document) -> Array[Issue]

    validate_pattern_paths

    source
    fn validate_pattern_paths(expr : PatternExpr) -> Array[Issue]

    vocab_contains

    source
    fn vocab_contains(name : String, value : String) -> Bool

    vocab_values

    source
    fn vocab_values(name : String) -> Array[String]

    Source Files

    Powered by MoonBit

    Site sourceReport issueModulesSkillsCLIBuild queueStatistics

    © 2026 mooncakes.io