From 4ff8d66812940df2a187cea4f2b115474b808f1c Mon Sep 17 00:00:00 2001
From: Rudy Celekli <rudy@gradiahq.com>
Date: Wed, 7 Oct 2026 18:54:29 -0400
Subject: [PATCH] fix(security): match admitted IOC types in STIX exports

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
---
 .../security-threat-intelligence-analyst.md   | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/security/security-threat-intelligence-analyst.md b/security/security-threat-intelligence-analyst.md
index 4922f46a..ddc47f1a 100644
--- a/security/security-threat-intelligence-analyst.md
+++ b/security/security-threat-intelligence-analyst.md
@@ -394,11 +394,18 @@ class IOC:
     def to_stix(self) -> dict:
         """Convert to STIX 2.1 indicator object."""
         pattern_map = {
-            IOCType.IPV4: f"[ipv4-addr:value = '{self.value}']",
-            IOCType.DOMAIN: f"[domain-name:value = '{self.value}']",
-            IOCType.SHA256: f"[file:hashes.'SHA-256' = '{self.value}']",
-            IOCType.URL: f"[url:value = '{self.value}']",
+            IOCType.IPV4: "ipv4-addr:value",
+            IOCType.IPV6: "ipv6-addr:value",
+            IOCType.DOMAIN: "domain-name:value",
+            IOCType.SHA256: "file:hashes.'SHA-256'",
+            IOCType.SHA1: "file:hashes.'SHA-1'",
+            IOCType.MD5: "file:hashes.MD5",
+            IOCType.EMAIL: "email-addr:value",
+            IOCType.URL: "url:value",
         }
+        # STIX string literals escape backslashes and apostrophes separately
+        # from JSON encoding, preserving the exact admitted indicator value.
+        literal = self.value.replace("\\", "\\\\").replace("'", "\\'")
         return {
             "type": "indicator",
             "spec_version": "2.1",
@@ -406,7 +413,7 @@ class IOC:
             "created": self.first_seen.isoformat(),
             "modified": self.last_seen.isoformat(),
             "name": f"{self.ioc_type.value}: {self.value}",
-            "pattern": pattern_map.get(self.ioc_type, f"[artifact:payload_bin = '{self.value}']"),
+            "pattern": f"[{pattern_map[self.ioc_type]} = '{literal}']",
             "pattern_type": "stix",
             "valid_from": self.first_seen.isoformat(),
             "confidence": int(self.confidence * 100),
@@ -645,4 +652,4 @@ You're successful when:
 
 ---
 
-**Instructions Reference**: Your analytical methodology is grounded in the Intelligence Community Directive 203 (Analytic Standards), Sherman Kent's principles of intelligence analysis, the Diamond Model of Intrusion Analysis, the Cyber Kill Chain, and MITRE ATT&CK — adapted for the speed and scale of modern cyber threats.
\ No newline at end of file
+**Instructions Reference**: Your analytical methodology is grounded in the Intelligence Community Directive 203 (Analytic Standards), Sherman Kent's principles of intelligence analysis, the Diamond Model of Intrusion Analysis, the Cyber Kill Chain, and MITRE ATT&CK — adapted for the speed and scale of modern cyber threats.