> ## Documentation Index > Fetch the complete documentation index at: https://docs.onefirewall.com/llms.txt > Use this file to discover all available pages before exploring further. # Turning a Malicious IP into Structured Intelligence > How a single indicator becomes a machine-readable STIX2 graph that other security tools can consume automatically This graph is a STIX2 bundle generated from a single flagged IP: six objects, four relationships, structured for automated consumption rather than manual reading. *** ## Graph structure A OneFirewall Threat Report object sits at the top as the container. It points to an Indicator — the malicious IP — which "indicates" three Attack Pattern objects: Network Service Discovery, Vulnerability Scanning, and Active Scanning. A Course of Action object, Network Service Scanning Mitigation, connects to one of those patterns through a "mitigates" relationship. Four typed relationships, using standard STIX2 vocabulary: indicates, mitigates. ## Purpose of the format STIX2 (Structured Threat Information Expression) is a standard specifically so threat intelligence doesn't remain a paragraph in a written report. A SOAR platform, TIP, or SIEM correlation engine can ingest this bundle directly, without an analyst transcribing "this IP is doing recon" into a separate schema. The relationship types carry meaning a flat IOC list doesn't: this indicator specifically indicates reconnaissance-stage activity, and a defined mitigation is already attached to it. ## Kill-chain stage Network Service Discovery, Vulnerability Scanning, and Active Scanning are early kill-chain activity — mapping exposed services before deciding how to proceed. Structuring intelligence at this stage means downstream automation can act on the reconnaissance itself, rather than waiting for a later, more damaging stage to trigger a response. *** Proof of Value engagements generate structured intelligence of this kind from a client's own indicators. [Start a Proof of Value](https://onefirewall.com/proof-of-value).