STIX Bundle Explorer

In STIX, a relationship is an object in its own right. That makes a bundle an edge list rather than a tree, and it makes the interesting part — who uses what, what indicates what — a set of UUID pairs pointing elsewhere in the same file. Resolving both ends of every edge to a type and a name is the whole job here.

Sightings are edges too

A sighting links the thing seen to where it was seen. It has no single target the way a relationship does, so the first where_sighted_refs entry is shown as the far end rather than inventing a node that is not in the data.

The two things worth looking for

Dangling edges point at an object that is not in this bundle. That is legal — the object may live in another bundle — but it means nothing here resolves it, and a bundle shared as self-contained evidence generally should not have any.

Orphans are objects no relationship touches. In a bundle assembled by hand or trimmed for sharing, an orphan is often the actual finding: an indicator that was meant to be tied to a campaign and never was, so nothing downstream will ever connect the two.

The sample bundle has one edge — a fictional actor uses a fictional malware family — and two observables that nothing points at. Both observables are reported as orphans, which is exactly the shape of a bundle where indicators were collected but never related to anything.