What is a STIX viewer?

A STIX viewer turns a STIX 2.1 bundle into something you can see: a map of threat actors, malware, indicators, infrastructure, and the relationships between them.

STIX, the Structured Threat Information Expression language, is how a lot of threat intelligence gets written down. It is precise and machine-readable, which is exactly what makes it hard to read as raw JSON. A viewer is the missing layer between a bundle and a person trying to understand it.

What STIX 2.1 actually describes

A STIX bundle is JSON containing three kinds of objects. Domain objects (SDOs) describe the intelligence itself: threat actors, intrusion sets, campaigns, malware, tools, attack patterns, vulnerabilities, indicators, infrastructure, reports, and identities. Relationship objects (SROs) connect them, so a threat actor can be attributed to a campaign that uses a piece of malware that exploits a vulnerability. Cyber-observable objects (SCOs) cover the technical evidence: IP addresses, domain names, files, processes, and similar artifacts.

That structure is the point. A single indicator means little on its own. An indicator linked to a malware family, a campaign, and an actor is a story. Reading that story out of nested JSON is slow, which is the gap a viewer fills.

What a STIX viewer does

• Parses a bundle and draws every object as a node, styled by type.
• Draws relationships as edges, so the graph shows how objects connect.
• Lets you click a node to read its properties and external references.
• Exposes the shape of a bundle: clusters, hubs, and objects with nothing attached.

In practice people use a viewer to triage a new feed before ingesting it, to check a bundle they are about to publish, to brief an analyst or a manager who does not want to read JSON, or to teach how STIX objects fit together.

How to visualize a STIX bundle

1. Open the STIX Viewer. A sample bundle loads automatically so you can see the layout before uploading anything.
2. Drag a .json bundle onto the page, or use the Upload button.
3. Use Append if you want to merge a second bundle into the current graph.
4. Click any node to inspect it. Drag to pan, scroll to zoom, and re-run the layout if the graph gets crowded.

STIX viewer or threat intelligence platform?

A viewer is a read-only lens on one bundle at a time. It does not store intelligence, deduplicate it, score it, or collect it from feeds. A threat intelligence platform does those things, and normally adds enrichment, sharing over TAXII, and reporting.

Most teams need both: a platform to collect and manage intelligence, and a viewer to look at a bundle quickly without importing it anywhere.