Add STIX 2.1 export profile for threatScenarios / attackPaths

[github-actions]

Motivation

RDX already models threatScenarios and structured attackPaths (RDX-017, RDX-019) but many consumers (MDR, CTI teams, SOCs, government CERTs) exchange threat intelligence using STIX/TAXII. A lightweight, documented STIX 2.1 export profile that deterministically maps RDX threat/attack objects to STIX 2.1 types (intrusion-set/threat-actor, attack-pattern, course-of-action, indicator, relationship, observed-data) will enable operational sharing of TARA outputs into existing CTI workflows without changing the RDX canonical model.

Benefits:

• Enables automated consumption of RDX threat artifacts by CTI platforms and SIEMs.
• Preserves traceability (rdx documentId, object ids, references) when exchanging with external CTI ecosystems.
• Leverages MITRE ATT&CK mapping where available so attack patterns can be linked to ATT&CK technique IDs for prioritization.

Proposed change

1. New export profile document: profiles/stix-2.1-export.md that specifies a deterministic mapping from RDX objects → STIX objects. The profile MUST include:

   • Mapping table: RDX type → STIX type + attributes (example: RDX.threatScenario -> stix:intrusion-set/threat-actor OR stix:attack-pattern depending on fields; RDX.attackPath -> stix:attack-pattern & stix:relationship entries for step ordering).
   • Canonical transformation rules for fields (e.g., how rdx.documentId and rdx.objectId map to STIX id and external_references) and how to include RDX IDs in stix 'external_references' and 'x_rdX_*' extension properties.
   • Rules for including MITRE ATT&CK technique IDs if the attack step includes an att&ckId field (or a mapping table is provided by the producer).
   • Policy for timestamps, confidence and severity translation (map RDX.band/score → STIX 'confidence' / 'severity' conventions).
   • Relationship semantics: how RDX.relationships (causes, mitigates, implements, threatens, protects) map to STIX relationships (uses, mitigates, targets, indicates, related-to).
   • Privacy/PII handling: guidance when PII/observables are present (omit or redaction rules) and how to package sensitive STIX bundles.

2. Add an example exporter implementation (reference interpreter) under tools/stix_exporter/ that reads examples/rdx-relationships-example.json and emits a STIX 2.1 bundle (JSON). The exporter must be accompanied by at least two test vectors in tests/stix/ demonstrating: (a) threatScenario → Attack Pattern + ATT&CK link, and (b) multi-step attackPath → stix:attack-pattern + ordered relationships.

3. Extend examples/ with examples/rdx-stix-export-example.json (RDX file) and examples/rdx-stix-bundle-example.json (resulting STIX bundle) and add a CI job (.github/workflows/stix-export-validate.yml) that runs the exporter and validates the STIX output with a STIX validator (or schema checks).

4. Update REQUIREMENTS.md with a new requirement: RDX-120: "Provide a normative STIX 2.1 export profile for RDX threat and attack objects to enable CTI/STIX integration" (new requirement).

Backward compatibility: this is an export/profile only; it does not change the RDX canonical JSON/XML schema.

References

• STIX 2.1 standard (OASIS). https://www.oasis-open.org/standard/stix-version-2-1/.
• MITRE ATT&CK / ATT&CK data model (mapping guidance for attack techniques). https://mitre-attack.github.io/attack-data-model/schemas/.
• STIX Profiles guidance (profiling STIX bundles to reduce scope). https://stixproject.github.io/documentation/profiles/.

Acceptance criteria

1. Add profiles/stix-2.1-export.md with a field-by-field mapping and canonicalization rules.
2. Commit tools/stix_exporter/ reference implementation that converts RDX → STIX 2.1 and is runnable (python -m tools.stix_exporter --input examples/rdx-stix-export-example.json --output out/stix-bundle.json).
3. Include two signed test vectors in tests/stix/ (RDX input + expected STIX JSON) and a small validator script that verifies the produced STIX bundle matches expected object types and contains RDX IDs in external_references.
4. Add examples/rdx-stix-export-example.json and examples/rdx-stix-bundle-example.json demonstrating ATT&CK linking and ordered attack-step relationships.
5. Update REQUIREMENTS.md with RDX-120 (new requirement) and reference the new profile and test vectors.
6. CI must run the exporter and fail if the produced STIX bundle does not validate as STIX 2.1 or omits RDX ID traceability fields.

---

Generated by tools/ai_idea_scout.py via the AI Idea Scout workflow.
Review the proposal, refine the title/body/labels, and close if not desired.