def convert_to_stix(indicators: list):
    """
    converts crowdstrike indicators of compromise to stix 2.1 format
    """

    stix_batch = []

    for indicator in indicators:
        stix_object = {
            "id": f"indicator--{generate_uuid(indicator['indicator'])}",
            "spec_version": "2.1",
            "type": "indicator",
            "created": datetime.fromtimestamp(indicator["published_date"]).isoformat(),
            "modified": datetime.fromtimestamp(indicator["last_updated"]).isoformat(),
            "name": indicator["indicator"],
            "descripton": "",
            "indicator_types": indicator["threat_types"],
            "pattern_type": "stix",
            "valid_from": datetime.fromtimestamp(
                indicator["published_date"]
            ).isoformat(),
            "kill_chain_phases": [
                {"kill_chain_name": "crowdstrike-falcon-killchain", "phase_name": x}
                for x in indicator["kill_chains"]
            ],
            "labels": (
                [x["name"] for x in indicator["labels"]]
                if indicator.get("labels")
                else []
            ),
            "lang": "en",
            "confidence": CONFIDENCE_MAPPING.get(indicator["malicious_confidence"], 10),
            "pattern": f"[{STIX_PATTERN_MAPPING[indicator['type']]} = '{indicator['indicator']}']",
            "revoked": indicator["deleted"],
            "extensions": {
                "crowdstrike-ext": {
                    "vulnerabilities": indicator["vulnerabilities"],
                    "targets": indicator["targets"],
                    "reports": indicator["reports"],
                    "actors": indicator["actors"],
                }
            },
        }

        stix_batch.append(stix_object)

    return stix_batch

    converts crowdstrike indicators of compromise to stix 2.1 format
    
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeFalconAdversaryIntelligence/CrowdStrikeFalconThreatIntelConnector/__init__.py