faker-cti

Faker providers for cyber threat intelligence test data: STIX 2.1 objects and identifiers, TLP/PAP markings, MITRE ATT&CK, vulnerabilities, threat names, plus the payloads exchanged by OpenCTI connectors and OpenAEV injectors/collectors.

Everything is built for unit tests with factory_boy: values are reproducible with Faker.seed() / factory.random.reseed_random(), and ids are the ids the real tools compute. Deterministic STIX ids match the stix2 library, and domain-object ids match pycti generate_id, so an id in a fixture is the id OpenCTI would store.

faker-cti does not reimplement anything Faker already has. IP addresses, domains, URLs, emails, host names, MAC addresses and MD5/SHA hashes come from Faker's built-in providers.

>>> from faker import Faker
>>> from faker_cti import CtiProvider
>>> fake = Faker()
>>> fake.add_provider(CtiProvider)

>>> fake.stix_id("ipv4-addr", value="1.2.3.4")        # same as stix2.IPv4Address(value=...).id
'ipv4-addr--0198f97b-e65d-5025-87e5-58bc39d4bdb4'
>>> fake.tlp_marking_id("amber+strict")
'marking-definition--826578e1-40ad-459f-bc73-ede076f81f37'
>>> fake.stix_pattern("domain-name")
"[domain-name:value = 'jones.com']"
>>> fake.mitre_attack_technique()
{'external_id': 'T1059.001', 'name': 'PowerShell', 'phase_name': 'execution',
 'url': 'https://attack.mitre.org/techniques/T1059/001'}
>>> fake.openaev_implant_name()
'oaev-implant-bfe4440e-60fc-47fa-bf8b-1baa47158a7e-agent-309944e2-f5b5-4934-8106-bb058f332483'

Installation

pip install faker-cti        # or: uv add --dev faker-cti

Requires Python 3.10+ and Faker 20+. No other runtime dependency (stix2 and pycti are only used in this project's own tests to check the output).

Providers

You can register CtiProvider to get every formatter, or register only the layer you need. Each provider includes the ones before it:

Faker(includes=["faker_cti"]) and the Faker CLI (faker -i faker_cti stix_id) also work.

Threat intelligence

STIX 2.1

Every object formatter accepts **extra keyword arguments, which are merged into the result (confidence=80, created_by_ref=…, x_opencti_score=…).

OpenCTI

OpenAEV

Use with factory_boy

Register the provider once (for example in conftest.py), then use factory.Faker:

import factory
from faker_cti import CtiProvider

factory.Faker.add_provider(CtiProvider)


class StixIpv4EntityFactory(factory.DictFactory):
    value = factory.Faker("ipv4")
    # the id follows the value, even when the test overrides it
    id = factory.Faker("stix_id", stix_type="ipv4-addr", value=factory.SelfAttribute("..value"))
    x_opencti_score = factory.Faker("opencti_score")
    object_marking_refs = factory.List([factory.Faker("tlp_marking_id", level="amber")])


class EnrichmentMessageFactory(factory.DictFactory):
    class Params:
        entity_type = "IPv4-Addr"
        value = None

    message = factory.Faker(
        "opencti_enrichment_message",
        entity_type=factory.SelfAttribute("..entity_type"),
        value=factory.SelfAttribute("..value"),
    )

    @classmethod
    def _create(cls, model_class, *args, **kwargs):
        return kwargs["message"]


StixIpv4EntityFactory(value="1.2.3.4")["id"]  # 'ipv4-addr--0198f97b-…'
EnrichmentMessageFactory(entity_type="Domain-Name")

The examples/ folder has complete, tested examples based on the factories of real connectors and collectors:

• opencti_enrichment: an internal enrichment connector (replaces the ~500-line Censys / ReversingLabs factory files).
• openaev_collector: an EDR collector matching alerts against expectations (Cortex XDR / XSOAR style).
• stix_bundle: an external import connector producing a coherent bundle (author, marking, intrusion set, malware, attack pattern, relationships).

Demo

uv run python examples/demo.py               # one sample of every formatter
uv run python examples/demo.py stix --seed 1 # filter + reproducible
faker -i faker_cti -r 3 stix_pattern         # with Faker's own CLI

Development

uv sync
uv run pytest                     # tests + examples, with stix2 cross-checks
uv run --with pycti pytest -k pycti   # also cross-check ids against pycti
uv run ruff check . && uv run ruff format --check .

License

Apache-2.0