ctipilot.ch

STIX 2.1 bundles

The knowledge base as machine-readable STIX 2.1, rebuilt on every publish and consumed on a pull model like the RSS feeds. One report per entry; registry entities as intrusion-set / campaign / malware / tool / incident (trends as grouping, policy items as report); one shared vulnerability per CVE; cited techniques as MITRE's canonical attack-pattern objects; the curated entity relationships as SROs. No indicators and no observables · this store is IOC-free by design.

Endpoints

  • Full corpus/stix/bundle.json

    Every exported object: one report per entry, the entity SDOs, one vulnerability per analysed CVE, the cited ATT&CK attack-patterns, the curated relationships, and correction notes. 3242 objects

  • Recent · last 35 days/stix/recent.json

    Reports first published or updated inside the rolling window, plus everything they reference (reference closure). The endpoint to poll. 1489 objects

  • Entity graph/stix/entities.json

    The registry's actors (intrusion sets), campaigns, malware, tools and incidents with the curated typed relationships between them — no reports. 742 objects

  • Sector · Public sector/stix/sector-public-sector.json

    Items affecting public-sector environments (national / cantonal / communal administration, emergency services, police, armed forces, public-sector technology suppliers). 2438 objects

Identity & versioning guarantees

  • Stable ids. Every STIX id is UUIDv5 over the permanent store key (entry id, registry key, CVE id), so one finding / entity / CVE keeps one id forever and re-ingestion is idempotent. Two reports touching the same actor or CVE reference the same object — that shared-object graph is how a consuming platform connects coverage across briefs without duplicates.
  • Versioning. A report's modified follows the entry's changelog (every update, correction or improvement); corrections additionally ship as note objects attached to the report. Objects are never deleted; superseded registry entities are merged into their canonical object.
  • Confidence. confidence maps the entry's NATO Admiralty credibility digit per STIX 2.1 Appendix A (1→90, 2→70, 3→50, 4→30, 5→10; 6 and unrated → omitted). The reliability letter, verification tier, kind, priority and permanent ids travel in a property extension (schema: /stix/extension-schema.json).
  • Marking. Everything is TLP:WHITE.

Ingesting

Poll /stix/recent.json (reference-closed · never a dangling ref) on your schedule and import it as a standard STIX 2.1 bundle; seed once from /stix/bundle.json. For OpenCTI, a minimal external-import connector fetching the URL and pushing the bundle via pycti is all that's needed — deterministic ids make every re-import an upsert. These are plain JSON files on a static host: there is no TAXII server here (a static host cannot satisfy the TAXII 2.1 media-type and header requirements), and no authentication.