---
title: "STIX and CybOX Parser Data Mappings KB Article | ThreatConnnect"
slug: "stix-and-cybox-parser-data-mappings"
description: "The Structured Threat Information eXpression (STIX) and CybOX parser data mappings provided in this article apply to the STIX 1.1.1 parser when configuring an inbound TAXII feed, as well as to the STIX Parser Playbook app in ThreatConnect."
updated: 2022-10-21T15:41:24Z
published: 2022-10-21T15:41:24Z
canonical: "knowledge.threatconnect.com/stix-and-cybox-parser-data-mappings"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt
> Use this file to discover all available pages before exploring further.

# STIX and CybOX Parser Data Mappings

## Overview

The Structured Threat Information eXpression (STIX™) and CybOX™ parser data mappings apply to the STIX 1.1.1 parser when [configuring an inbound TAXII feed](https://knowledge.threatconnect.com/docs/creating-an-inbound-taxii-exchange-feed), as well as to the STIX Parser Playbook App in ThreatConnect®.

## STIX 1.1.1 Data Mapping

### IndicatorType

| Key | ThreatConnect Mapping |
| --- | --- |
| @id | Indicator: Attribute: "STIX ID" Indicator: Attribute: "Description" (append to bottom) |
| Title | Indicator: Attribute: "Title" |
| Type | Indicator: Attribute: "STIX Indicator Type" |
| Description | Indicator: Attribute: "Description" |
| Short_Description | Indicator: Attribute: "Description" (append) |
| Kill_Chain_Phases | Indicator: Attribute: "Phase of Intrusion" |
| Confidence | Indicator: Confidence |
| Producer | Indicator: Attribute: "Producer" |
| Observable:id | Indicator: Attribute: "STIX Observable ID" |
| Handling | Indicator: Security Label |

### IncidentType

| Key | ThreatConnect Mapping |
| --- | --- |
| Title | Incident: Name |
| External_ID | Incident: Attribute: "External ID" |
| Description | Incident: Attribute: "Description" |
| Related_Indicators | Incident: Association: Indicators |
| Related_Observables | Incident: Association: Indicators |
| Handling | Incident: Security Label |

### ThreatActorType

| Key | ThreatConnect Mapping |
| --- | --- |
| Title | Threat: Name |
| Description | Threat: Attribute: "Description" |

## CybOX 2.1 Data Mapping

### DomainNameObjectType

| Key | ThreatConnect Mapping |
| --- | --- |
| Value | Host |

### DNSRecordObjectType

| Key | ThreatConnect Mapping |
| --- | --- |
| Domain_Name | Host |
| IP_Address | Address |
| Description | Incident: Attribute: "Description" |

### AddressObjectType

| Key | ThreatConnect Mapping |
| --- | --- |
| Address_Value (@category == cidr) | CIDR |
| Address_Value (@category == e-mail) | E-mail Address |
| Address_Value (@category == ipv4-addr) | Address |

### EmailMessageObjectType

| Key | ThreatConnect Mapping |
| --- | --- |
| Raw_Body | Email: Body |
| Raw_Header | Email: Header |
| Links | URL Email: Association |
| EmailHeaderType:To | Email: To |
| EmailHeaderType:From | Email: From Indicator: E-mail Address |
| EmailHeaderType:Subject | Email: Subject Indicator: Email Subject |
| AttachmentsType:File | File Email: Association |

### LinkObjectType

| Key | ThreatConnect Mapping |
| --- | --- |
| Link | URL |

### MutexObjectType

| Key | ThreatConnect Mapping |
| --- | --- |
| Mutex | Mutex |

### HostnameObjectType

| Key | ThreatConnect Mapping |
| --- | --- |
| @is_domain_name | if false, drop object. |
| Hostname_Value | Host |

### URLObjectType

| Key | ThreatConnect Mapping |
| --- | --- |
| @type | If URL, save URL Indicator. If domain name, save Host Indicator. |
| Value | URL or Host |

---

*ThreatConnect® is a registered trademark of ThreatConnect, Inc. CybOX™ and STIX™ are trademarks of the MITRE Corporation.*

20082-01 v.01.C

## Related

- [Creating an Inbound TAXII Exchange Feed](/creating-an-inbound-taxii-exchange-feed.md)
- [Creating an Outbound TAXII Exchange Feed](/creating-an-outbound-taxii-exchange-feed.md)
- [Using the ThreatConnect TAXII Server](/using-the-threatconnect-taxii-server.md)
- [Using the ThreatConnect TAXII 2.1 Server (App Version 1.0)](/taxii-21-server.md)