<commit_before># STIX XML -> HTML Transform v1

~~~
Copyright (c) 2014 - The MITRE Corporation
All rights reserved. See LICENSE.txt for complete terms.
~~~

~~~
BY USING THE STIX XML to HTML TRANSFORM, YOU SIGNIFY YOUR ACCEPTANCE OF THE 
TERMS AND CONDITIONS OF USE.  IF YOU DO NOT AGREE TO THESE TERMS, DO NOT USE 
THE STIX XML to HTML TRANSFORM.

For more information, please refer to the terms.txt file.
~~~

## STIX XML to HTML transform v1.0beta4
Compatible with STIX v1.0.1

This is an xslt to transform a stix 1.0/1.0.1/1.1 document containing metadata and
different categories of top level items into html for easy viewing.

The first two tables on the output html page are 1) a metadata table
showing information about the input document and when the content was
converted, and 2) information obtained from the stix header element.

Regarding the stix header, we only include very simple support for
the handling instructions for this release.  It will include the text contents
of the simpleMarking:Statement.  The marking:Controlled_Structure with its
xpath is not used yet. 

Currently we support the following top level entities and sub-entities:
- **Observables**
  - All (except no support for MAEC objects yet)
- **Indicators**
  - Title
  - Description
  - Valid_Time_Position
  - Suggested_COAs
  - Alternative_ID
  - Observable
  - Composite_Indicator_Expression
  - Indicated_TTP
  - Kill_Chain_Phases
  - Confidence
  - Sighting
  - Test_Mechanisms
  - Likely_Impact
  - Suggested_COAs
  - Handling
  - Related_Indicators
  - Producer
- **TTPs**
  - Description
  - Intended_Effect
  - Behavior
  - Resources
  - Victim_Targeting
  - Exploit_Targets
  - Related_TTPs
  - Kill_Chain_Phases
  - Information_Source
  - Handling
- **Exploit Targets**
  - Title
  - Vulnerability
  - Weakness
  - Configuration
  - Potential_COAs
  - Information_Source
  - Handling
- **Incidents**
  - Time
  - Description
  - Categories
  - Reporter
  - Responder
  - Coordinator
  - Victim
  - Affected_Assets
  - Impact_Assessment
  - Status
  - Related_Indicators
  - Related_Observables
  - Leveraged_TTPs
  - Attributed_Threat_Actors
  - Intended_Effect
  - Security_Compromise
  - Discovery_Method
  - Related_Incidents
  - COA_Requested
  - COA_Taken
  - Confidence
  - Contact
  - History
  - Handling
- **Courses of Action**
  - Stage
  - Type
  - Description
  - Objective
  - Structured_COA
  - Impact
  - Cost
  - Efficacy
  - Handling
- **Campaigns**
  - Title
  - Names
  - Status
  - Intended_Effect
  - Related_Incidents
  - Related_TTPs
  - Related_Indicators
  - Attribution
  - Associated_Campaigns
  - Confidence
  - Activity
  - Information_Source
  - Handling
- **Threat Actors**
  - Title
  - Identity
  - Type
  - Motivation
  - Intended_Effect
  - Planning_And_Operational_Support
  - Observed_TTPs
  - Associated_Campaign
  - Associated_Actors
  - Handling
  - Confidence
  - Information_Source

Each category of top level "items" is turned into a main table on the page.
The item itself is expandable and other nested content pointing to other
"items" and objects are also expandable.

At the moment, "items" are expandable when they have inline content with an
id attribute or when it references content in another part of the document with
an idref attribute.  (Content "item" without an id or idref is displayed
inline.)

Indicator and observable composition is supported.

The contents of description elements are treated as text.  This release does
not handle embedded html documents; they will be displayed as escaped text.

This is a work in progress.  Feedback is most welcome!

requirements:
 - XSLT 2.0 engine (this has been tested with Saxon 9.5)
 - a STIX 1.0/1.0.1/1.1 input xml document

## Releases
### current release<commit_msg>adding maec elements that are supported<commit_after># STIX XML -> HTML Transform v1

~~~
Copyright (c) 2014 - The MITRE Corporation
All rights reserved. See LICENSE.txt for complete terms.
~~~

~~~
BY USING THE STIX XML to HTML TRANSFORM, YOU SIGNIFY YOUR ACCEPTANCE OF THE 
TERMS AND CONDITIONS OF USE.  IF YOU DO NOT AGREE TO THESE TERMS, DO NOT USE 
THE STIX XML to HTML TRANSFORM.

For more information, please refer to the terms.txt file.
~~~

## STIX XML to HTML transform v1.0b5 alpha
Compatible with STIX v1.1

This is an xslt to transform a stix 1.0/1.0.1/1.1 document containing metadata and
different categories of top level items into html for easy viewing.

In addition to stix documents, cybox and maec documents are also supported.

The first two tables on the output html page are 1) a metadata table
showing information about the input document and when the content was
converted, and 2) information obtained from the stix header element.

Regarding the stix header, we only include very simple support for
the handling instructions for this release.  It will include the text contents
of the simpleMarking:Statement.  The marking:Controlled_Structure with its
xpath is not used yet. 

Currently we support the following top level entities and sub-entities:
- **Observables**
  - All (except no support for MAEC objects yet)
- **Indicators**
  - Title
  - Description
  - Valid_Time_Position
  - Suggested_COAs
  - Alternative_ID
  - Observable
  - Composite_Indicator_Expression
  - Indicated_TTP
  - Kill_Chain_Phases
  - Confidence
  - Sighting
  - Test_Mechanisms
  - Likely_Impact
  - Suggested_COAs
  - Handling
  - Related_Indicators
  - Producer
- **TTPs**
  - Description
  - Intended_Effect
  - Behavior
  - Resources
  - Victim_Targeting
  - Exploit_Targets
  - Related_TTPs
  - Kill_Chain_Phases
  - Information_Source
  - Handling
- **Exploit Targets**
  - Title
  - Vulnerability
  - Weakness
  - Configuration
  - Potential_COAs
  - Information_Source
  - Handling
- **Incidents**
  - Time
  - Description
  - Categories
  - Reporter
  - Responder
  - Coordinator
  - Victim
  - Affected_Assets
  - Impact_Assessment
  - Status
  - Related_Indicators
  - Related_Observables
  - Leveraged_TTPs
  - Attributed_Threat_Actors
  - Intended_Effect
  - Security_Compromise
  - Discovery_Method
  - Related_Incidents
  - COA_Requested
  - COA_Taken
  - Confidence
  - Contact
  - History
  - Handling
- **Courses of Action**
  - Stage
  - Type
  - Description
  - Objective
  - Structured_COA
  - Impact
  - Cost
  - Efficacy
  - Handling
- **Campaigns**
  - Title
  - Names
  - Status
  - Intended_Effect
  - Related_Incidents
  - Related_TTPs
  - Related_Indicators
  - Attribution
  - Associated_Campaigns
  - Confidence
  - Activity
  - Information_Source
  - Handling
- **Threat Actors**
  - Title
  - Identity
  - Type
  - Motivation
  - Intended_Effect
  - Planning_And_Operational_Support
  - Observed_TTPs
  - Associated_Campaign
  - Associated_Actors
  - Handling
  - Confidence
  - Information_Source
- **MAEC Bundle**
  - Malware_Object_Instance_Attributes
  - AV_Classification
  - Object\
  - 
    
  - dd
  
  
- **MAEC Package**
  - Malware_Subject
    - Malware_Object_Instance_Attributes
    - Label
    - Analyses
    - Finding_Bundles
- 

Each category of top level "items" is turned into a main table on the page.
The item itself is expandable and other nested content pointing to other
"items" and objects are also expandable.

At the moment, "items" are expandable when they have inline content with an
id attribute or when it references content in another part of the document with
an idref attribute.  (Content "item" without an id or idref is displayed
inline.)

Indicator and observable composition is supported.

The contents of description elements are treated as text.  This release does
not handle embedded html documents; they will be displayed as escaped text.

This is a work in progress.  Feedback is most welcome!

requirements:
 - XSLT 2.0 engine (this has been tested with Saxon 9.5)
 - a STIX 1.0/1.0.1/1.1 input xml document

## Releases
### current release
{'fraction_non_alphanumeric': 0.060916919959473154, 'fraction_numerical': 0.007725430597771023, 'mean_word_length': 3.1982987772461455, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 2}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '551850', 'n_tokens_mistral': 2536, 'n_tokens_neox': 2414, 'n_words': 878}