# STIX 2.1 and Structured Intelligence Objects

> Read, write and validate STIX 2.1 objects, relationships, sightings, patterns and TLP markings.

Canonical: https://codelivly.com/rooms/cti-stix-2-1-objects
Last updated: 2026-10-28

| | |
|---|---|
| Level | Intermediate |
| Category | Cybersecurity |
| Lessons | 6 |
| XP | 100 |

**Purpose.** Give analysts a working command of STIX 2.1, the OASIS language most threat intelligence platforms and sharing communities use to exchange structured intelligence.

**Prerequisites.** Learning Paths 1 to 3 of this career path (or equivalent): intelligence lifecycle, indicator types, ATT&CK mapping and campaign tracking. Comfort reading JSON.

**Outcomes.** By the end of the module you can:
- identify SDOs, SCOs, SROs and meta objects in a bundle and explain the graph they form
- check common properties, identifiers and version history for validity
- choose specification-defined relationship types in the correct direction
- write STIX patterns with correct operators and qualifiers
- apply TLP 2.0 markings with the right marking-definition ids

**Practical completion objective.** In the lab, parse a synthetic ISAC bundle, answer relationship and validity questions from the data, and submit a findings note with a valid STIX pattern.

## Lessons

1. How STIX 2.1 Models Threat Intelligence (15 min)
2. Common Properties, Identifiers and Versioning (15 min)
3. Domain Objects, Observables, Relationships and Sightings (15 min)
4. STIX Patterning for Indicators (15 min)
5. Data Markings and TLP 2.0 in STIX (15 min)
6. Lab: Interrogate a STIX 2.1 Bundle (50 min)

## Related

- [Learning path: Threat Intelligence Operations and Sharing](https://codelivly.com/learning-paths/cti-operations-and-sharing)
- [All rooms](https://codelivly.com/rooms)