STIX Viewer

The five views

The dossier gives one page to each campaign, intrusion set, threat actor, malware family or report. A campaign’s malware, the infrastructure behind it, and any report about it fold into that one page, so all its indicators land in a single table you can filter and copy from.

The graph draws relationships and sightings as a network. Objects with only one link are grouped by type, so a malware family with 300 hashes shows up as one counted node. An indicator tied to two campaigns keeps its own node, which makes shared infrastructure easy to spot.

The matrix sets each campaign or actor against each indicator type. Some entries carry hashes and domains you can block; others only name things. The matrix shows which is which.

The timeline places entries on their first-seen or published date.

The object browser shows the raw JSON. References to other objects in the bundle are links, and every object lists what points at it. Use it to check a feed you publish.

What it accepts

STIX 2.1 bundles, TAXII 2.1 envelopes, plain arrays of objects, or one object on its own. Files up to 64 MB.

If the bundle references ids it does not contain, or repeats an id, the viewer lists that above the results. It does not replace a schema validator. For that, use the OASIS STIX validator.

Why it only takes pasted JSON

The viewer does not fetch bundles from a URL. Fetching a URL someone gives you from inside your browser can reach hosts on your network that the outside world cannot, and a TAXII server usually needs credentials that do not belong in a web page. Download the bundle with the tool you already trust, then open the file here.

Both example bundles are made up, and so are their domains, addresses and hashes. The every-type bundle holds one or more of each STIX 2.1 object type, including all 18 observable types and five detection rule formats, for checking how a tool handles the whole specification.