[an error occurred while processing this directive] STIX - STIX Language: Version 1.0 (Official) 

Structured Threat Information eXpression

A Structured Language for Cyber Threat Intelligence Information

STIX Language — Version 1.2
[an error occurred while processing this directive] Version 1.0 (Official)

Version 1.0 (Archive)

This page provides information on the 1.0 release of the STIX Language. All information about the version is included in this centralized location. Join the STIX Community to participate in the next version of STIX.


Core and Components
File Name Version Schema Documentation
All Files 1.0 ZIP
All Files (offline) 1.0 ZIP
Core 1.0 XSD HTML
Common 1.0 XSD HTML
Default Vocabularies 1.0.0 XSD HTML
Campaign 1.0 XSD HTML
Course Of Action 1.0 XSD HTML
Data Marking 1.0 XSD HTML
Exploit Target 1.0 XSD HTML
Incident 1.0 XSD HTML
Indicator 2.0 XSD HTML
Threat Actor 1.0 XSD HTML
Extension Name Extension Point Version Schema Documentation
CIQ Version 3.0 Address Address 1.0 XSD HTML
CAPEC 2.5 Attack Pattern 1.0 XSD HTML
CIQ Version 3.0 Identity Identity 1.0 XSD HTML
MAEC 4.0 Malware 1.0 XSD HTML
Simple Marking Marking 1.0 XSD HTML
TLP Marking 1.0 XSD HTML
Generic COA Structured COA 1.0 XSD HTML
Generic Test Mechanism Test Mechanism 1.0 XSD HTML
OpenIOC (release 2010) Test Mechanism 1.0 XSD HTML
OVAL 5.10 Test Mechanism 1.0 XSD HTML
Snort Test Mechanism 1.0 XSD HTML
YARA Test Mechanism 1.0 XSD HTML
CVRF Vulnerability 1.0 XSD HTML

Data Dictionaires
Dictionary Name Download
Core, Common, Vocabularies, and Components stix_data_dictionary.xlsx
Extensions stix_extensions_data_dictionary.xlsx
OASIS CIQ (External) oasis_ciq__data_dictionary.xlsx
Profile Name Download
STIX Profile Template XLSX
CybOX Object Profile Template Tabs XLSX

Release Notes

The major highlights of Version 1.0 are listed below:

  • Moved references to external schemas from core and components to a set of extensions
  • More loosely coupled STIX components with each other and with core
  • Moved many usages of enumerations and strings to controlled vocabularies with STIX-provided defaults as well as extension mechanisms
  • Added more depth to the Threat Actor component thanks to a contribution from iSight Partners, Inc

There are also full release notes available.


Sample content for STIX 1.0 is constantly being developed and released. The latest release was on April 8, 2013 and can be downloaded in a single zip file: stix_v1.0_samples_20130408.zip


13 February 2012 19 December 2012 08 April 2013

Status Reports

Status updates are included below. You may also review the STIX Community Discussion Archives for discussions about Version 1.0.

Version 1.0 of the STIX Language is now available. This release includes a number of improvements, as listed in the Release Notes section above. Please send any comments or concerns about this release to the STIX Community Discussion List, or directly to stix@mitre.org.
Page Last Updated: October 03, 2013