STIX 2.1 Export
STIX object mappings, Y2 extension fields, identifiers, and timestamps.
The export represents a subject's ledger view as an OASIS STIX 2.1 bundle. The ledger remains the source record. Repeating the same export produces the same object IDs.
The endpoint rejects incomplete results when a subject exceeds its read limit. The export guide describes local export from a complete log.
Mapping
| Ledger | STIX 2.1 |
|---|---|
person subject | identity, identity_class: individual |
organization subject | identity, identity_class: organization |
system subject | identity, identity_class: system |
| Live preferred label | identity.name. An unlabeled subject is named by its ledger ID. |
| Other published names and pseudonyms | designated_names in the extension. No alias-only threat-actor is created. |
external-id designations | identity.external_references (sec-edgar-cik, lei, wikidata, mitre-attack) |
ticker designations | identity.external_references with source_name: ticker and MIC:SYMBOL |
email | email-addr |
handle | user-account with account_login and account_type from the namespace. No credentials or login history. |
domain, hostname | domain-name |
url | url |
asn | autonomous-system |
designated-by to an observable | relationship of type designated-by |
| Other claims | relationship with the predicate as its type, confidence, start_time, and stop_time |
Unconfirmed same-as | relationship of type related-to, described as a hypothesis |
follows | relationship of type follows between two user-account objects |
| Cited observations | external_references on the relationship: method as source_name, URL, excerpt as description, hashes.SHA-256 |
| Retracted claim | Omitted by default. With history=true, a relationship with revoked: true. |
duplicate-of and attributed-to are never emitted: identity is not confirmed by the ledger.
Extension
Every exported identity and relationship carries a property extension defined in the bundle:
{
"type": "extension-definition",
"spec_version": "2.1",
"name": "Y2 passive entity ledger",
"schema": "https://y2.dev/docs/ontology/reference/stix-export",
"version": "0.1.0",
"extension_types": ["property-extension"]
}| Property | On | Meaning |
|---|---|---|
ledger_subject_id | identity | The sbj_… ID |
designated_names | identity | Names other than the label |
ledger_claim_id | relationship | The head line's clm_… ID |
claim_key | relationship | `predicate |
predicate | relationship | The ledger predicate, even when the type is related-to |
verification | relationship | The ladder state |
qualifier, note | relationship | When present |
A Y2 producer identity is the created_by_ref of the extension, identities, and relationships.
Identifiers and timestamps
STIX IDs have the form type--UUID.
Y2 formats SHA-256 digest inputs as version 8 UUIDs:
| Object | Digest input |
|---|---|
| Cyber observable | Object type and STIX ID-contributing properties |
| Identity | Object type, a one-way workspace scope, and ledger subject ID |
| Relationship | Object type, workspace scope, and claim key |
Equal observables have equal IDs across exports. The workspace ID itself is not exported.
A relationship's created time comes from the first record for its claim key.
Its modified time comes from the current head.
An identity's modified time includes its opening, designation, and label records, including retractions.
STIX revocation is permanent.
Reasserting a retracted claim creates a new relationship ID and created time.
Later corrections retain that new ID. The extension preserves the original claim key.
An explicit validAt cursor becomes part of the identity and relationship ID scope.
This separates snapshots with different valid-time contents.
The ledger subject ID in the extension connects those snapshots.
A bundle ID includes the full exported content in its digest. An unchanged export produces the same bundle ID.