STIX Validator
Check a STIX 2.1 bundle for structural and required-property errors.
Paste a bundle on the left.
How it works
This checks structure, not full schema conformance, and the difference is worth stating plainly before you rely on a clean result.
What it checks
That every object states a type; that its id is in {type}--{UUID} form
and that the prefix repeats the type; that identifiers are unique within the bundle; that
created and modified are RFC 3339 timestamps and appear in that order; that a
relationship names its relationship_type and both endpoints; and that every reference is a
well-formed identifier.
What it does not check
The per-type required-property tables from the specification, and the open vocabularies. Encoding those from memory is how a validator ends up asserting a property is required when the spec says otherwise, and a confident wrong answer from a validator is worse than a narrower right one. A clean result here means the structure holds — not that the bundle is specification-complete.
Observables are not Domain Objects
A Cyber-observable Object such as file or ipv4-addr carries no created or
modified: its identity is its content. Requiring timestamps on one would fail every correct bundle of
observables, so the register each type belongs to is checked first.
Dangling references are warnings
A reference to an object that is not in the bundle is reported as a warning rather than an error, because STIX explicitly permits it — the object may legitimately live in another bundle. It is a fact about this bundle's completeness, not a defect in it.
Example
The second action button loads a bundle with four deliberate defects: an identifier whose prefix contradicts its
type, a duplicated id, a modified earlier than its created, and a relationship pointing
at an object that is not present.
It produces five findings, not four, and the extra one is the interesting part. Corrupting the threat actor's
identifier also breaks the relationship whose source_ref pointed at the original — so one edit to one
object leaves two objects unresolvable. That cascade is the practical reason identifiers get checked before
anything else: a single bad id quietly detaches everything downstream of it.
Frequently asked questions
Does a clean result mean my bundle is valid STIX?
It means the structure holds: types stated, identifiers well formed and unique, timestamps real and in order, relationships complete. It does not cover the per-type required-property tables or the open vocabularies. Those were left out deliberately rather than approximated — a validator that asserts a property is required when the specification says otherwise is worse than one with a stated boundary.
Why is a reference to a missing object only a warning?
Because STIX permits it. An object may legitimately live in a different bundle, so a dangling reference is a fact about this bundle’s completeness rather than a defect in it. Whether it matters depends on whether the bundle was meant to be self-contained.
Why does it not require created and modified on my observables?
A Cyber-observable Object has neither: its identity is its content, not a version history. Only Domain and Relationship objects carry those timestamps, so the register a type belongs to is checked before the timestamps are.
It says my id prefix does not match the type. What does that mean?
A STIX identifier is {type}--{UUID}, and the prefix repeats the object’s own type. An object typed threat-actor whose id begins malware-- is contradicting itself, which usually means an id was copied from a neighbouring object.
Related tools
STIX Viewer
Read a STIX 2.1 bundle as structured objects instead of raw JSON.
LocalSTIX Bundle Explorer
Trace the relationship graph inside a STIX bundle object by object.
LocalYARA Syntax Viewer
Break a YARA rule into its meta, strings and condition sections.
LocalYARA Rule Formatter
Reformat a YARA rule to consistent indentation and section order.
LocalSigma Syntax Viewer
Read a Sigma detection rule as structured logsource and detection blocks.
LocalSigma Rule Formatter
Reorder a Sigma rule’s top-level keys to the conventional sequence.
Local