Export an incident in STIX format

You can export incidents as STIX 2.1 (Structured Threat Information eXpression) JSON bundles. The exported file contains the full incident object graph, including observables, MITRE ATT&CK technique mappings, and TLP 2.0 data markings, and can be shared with CSIRT/CERT networks, threat intelligence platforms, or ingested directly by MISP- and TAXII-compatible tools.

Each exported bundle is structured as a STIX Report with linked objects, including:

• Files, file hashes, directories
• Processes and user accounts
• IP addresses, URLs, and domain names
• Windows registry keys
• MITRE ATT&CK attack patterns (automatically mapped)
• YARA indicators and detection-rule references

To export an incident in STIX format

1. In the Cyber Protect console, go to Protection > Incidents.

   The Incident list is displayed.

2. Click the incident that you want to export.

   The details for the selected incident are displayed.

3. Click Export STIX Report.

   The Export STIX Report dialog is displayed.

4. In the Report type field, select a NIS2-aligned preset for the report:

   • Early Warning: For initial notifications within 24 hours of detecting an incident.
   • Incident Notification: For detailed notifications within 72 hours of detecting an incident.
   • Final Report: For comprehensive incident reports submitted within one month of detecting an incident.

5. In the TLP marking field, select the Traffic Light Protocol (TLP) 2.0 marking that controls how the exported data can be shared:

   • TLP:CLEAR: No restriction on sharing; information can be shared publicly.
   • TLP:GREEN: For sharing within the community; not for public disclosure.
   • TLP:AMBER (default): Limited sharing on a need-to-know basis within an organization and its clients.
   • TLP:AMBER+STRICT: Limited sharing within the organization only; not to be shared with clients.
   • TLP:RED: Not for disclosure; for use by named recipients only.
6. Click Export. The STIX 2.1 JSON bundle is downloaded to your computer.