diff --git a/pkgs/development/python-modules/cybox/default.nix b/pkgs/development/python-modules/cybox/default.nix
new file mode 100644
index 000000000000..24c991a05862
--- /dev/null
+++ b/pkgs/development/python-modules/cybox/default.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  fetchpatch,
+  lxml,
+  mixbox,
+  pytestCheckHook,
+  python-dateutil,
+  pythonOlder,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "cybox";
+  version = "2.1.0.21";
+  pyproject = true;
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "CybOXProject";
+    repo = "python-cybox";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Gn/gH7pvvOqLIGExgCNa5KswPazIZUZXdQe3LRAUVjw=";
+  };
+
+  patches = [
+    # Import ABC from collections.abc for Python 3 compatibility, https://github.com/CybOXProject/python-cybox/pull/332
+    (fetchpatch {
+      name = "collections-abc.patch";
+      url = "https://github.com/CybOXProject/python-cybox/commit/fd4631dac12943d89e9ea2e94105cbc3b81d52f9.patch";
+      hash = "sha256-dXEsJujtbU/SuUBge8abWgMPeYO1ZR3c5758Bd0dnwE=";
+    })
+  ];
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    lxml
+    mixbox
+    python-dateutil
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "cybox" ];
+
+  meta = {
+    description = "Library for parsing, manipulating, and generating CybOX content";
+    homepage = "https://github.com/CybOXProject/python-cybox/";
+    changelog = "https://github.com/CybOXProject/python-cybox/blob/${src.rev}/CHANGES.txt";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/maec/default.nix b/pkgs/development/python-modules/maec/default.nix
new file mode 100644
index 000000000000..2c29be54289f
--- /dev/null
+++ b/pkgs/development/python-modules/maec/default.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  buildPythonPackage,
+  cybox,
+  distutils,
+  fetchFromGitHub,
+  lxml,
+  mixbox,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "maec";
+  version = "4.1.0.17";
+  pyproject = true;
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "MAECProject";
+    repo = "python-maec";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-I2Ov2AQiC9D8ivHqn7owcTsNS7Kw+CWVyijK3VO52Og=";
+  };
+
+  build-system = [
+    distutils
+    setuptools
+  ];
+
+  dependencies = [
+    cybox
+    lxml
+    mixbox
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "maec" ];
+
+  meta = {
+    description = "Library for parsing, manipulating, and generating MAEC content";
+    homepage = "https://github.com/MAECProject/python-maec/";
+    changelog = "https://github.com/MAECProject/python-maec/blob/${src.rev}/CHANGES.txt";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/mixbox/default.nix b/pkgs/development/python-modules/mixbox/default.nix
new file mode 100644
index 000000000000..7e348f8bc676
--- /dev/null
+++ b/pkgs/development/python-modules/mixbox/default.nix
@@ -0,0 +1,54 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  lxml,
+  ordered-set,
+  pytestCheckHook,
+  python-dateutil,
+  pythonOlder,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "mixbox";
+  version = "1.0.5";
+  pyproject = true;
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "CybOXProject";
+    repo = "mixbox";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-qK3cKOf0s345M1pVFro5NFhDj4lch12UegOY1ZUEOBQ=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    lxml
+    ordered-set
+    python-dateutil
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "mixbox" ];
+
+  pytestFlagsArray = [ "test/*.py" ];
+
+  disabledTests = [
+    # Tests are out-dated
+    "test_serialize_datetime_as_date"
+    "test_preferred_prefixes"
+  ];
+
+  meta = {
+    description = "Library of common code leveraged by cybox, maec and stix";
+    homepage = "https://github.com/CybOXProject/mixbox";
+    changelog = "https://github.com/CybOXProject/mixbox/releases/tag/v${version}";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/stix2-validator/default.nix b/pkgs/development/python-modules/stix2-validator/default.nix
new file mode 100644
index 000000000000..105e11713d0e
--- /dev/null
+++ b/pkgs/development/python-modules/stix2-validator/default.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  buildPythonPackage,
+  colorama,
+  cpe,
+  fetchFromGitHub,
+  jsonschema,
+  python-dateutil,
+  pythonOlder,
+  requests,
+  setuptools,
+  simplejson,
+  stix2-patterns,
+}:
+
+buildPythonPackage rec {
+  pname = "stix2-validator";
+  version = "3.2.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "oasis-open";
+    repo = "cti-stix-validator";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-OI1SXILyCRGl1ZsoyYDl+/RsBhTP24eqECtW3uazS2k=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    colorama
+    cpe
+    jsonschema
+    python-dateutil
+    requests
+    simplejson
+    stix2-patterns
+  ];
+
+  # Tests need more work
+  # Exception: Could not deserialize ATN with version  (expected 4).
+  doCheck = false;
+
+  # nativeCheckInputs = [ pytestCheckHook ];
+
+  meta = {
+    description = "Validator for STIX 2.0 JSON normative requirements and best practices";
+    homepage = "https://github.com/oasis-open/cti-stix-validator/";
+    changelog = "https://github.com/oasis-open/cti-stix-validator/blob/${src.rev}/CHANGELOG";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/taxii2-client/default.nix b/pkgs/development/python-modules/taxii2-client/default.nix
new file mode 100644
index 000000000000..49ad9b891630
--- /dev/null
+++ b/pkgs/development/python-modules/taxii2-client/default.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pythonOlder,
+  pytz,
+  requests,
+  setuptools,
+  six,
+}:
+
+buildPythonPackage rec {
+  pname = "taxii2-client";
+  version = "2.3.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "oasis-open";
+    repo = "cti-taxii-client";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-e22bJdLAlm30vv/xIgLSjcwmzfN0Pwt2JydLgEbA+Is=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    pytz
+    requests
+    six
+  ];
+
+  pythonImportsCheck = [ "taxii2client" ];
+
+  meta = {
+    description = "TAXII 2 client library";
+    homepage = "https://github.com/oasis-open/cti-taxii-client/";
+    changelog = "https://github.com/oasis-open/cti-taxii-client/blob/${src.rev}/CHANGES.txt";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 9fcdd35560cc..50bacdf012dc 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2767,6 +2767,8 @@ self: super: with self; {
 
   cxxheaderparser = callPackage ../development/python-modules/cxxheaderparser { };
 
+  cybox = callPackage ../development/python-modules/cybox { };
+
   cycler = callPackage ../development/python-modules/cycler { };
 
   cyclonedx-python-lib = callPackage ../development/python-modules/cyclonedx-python-lib { };
@@ -7476,6 +7478,8 @@ self: super: with self; {
 
   macropy = callPackage ../development/python-modules/macropy { };
 
+  maec = callPackage ../development/python-modules/maec { };
+
   maestral = callPackage ../development/python-modules/maestral { };
 
   magic = callPackage ../development/python-modules/magic { };
@@ -7904,6 +7908,8 @@ self: super: with self; {
 
   mitogen = callPackage ../development/python-modules/mitogen { };
 
+  mixbox = callPackage ../development/python-modules/mixbox { };
+
   mixins = callPackage ../development/python-modules/mixins { };
 
   mixpanel = callPackage ../development/python-modules/mixpanel { };
@@ -14908,6 +14914,8 @@ self: super: with self; {
 
   stix2-patterns = callPackage ../development/python-modules/stix2-patterns { };
 
+  stix2-validator = callPackage ../development/python-modules/stix2-validator { };
+
   stm32loader = callPackage ../development/python-modules/stm32loader { };
 
   stone = callPackage ../development/python-modules/stone { };
@@ -15160,6 +15168,8 @@ self: super: with self; {
 
   taxi = callPackage ../development/python-modules/taxi { };
 
+  taxii2-client = callPackage ../development/python-modules/taxii2-client { };
+
   tbats = callPackage ../development/python-modules/tbats { };
 
   tblib = callPackage ../development/python-modules/tblib { };