Home

Draw Me A STIX

The CTI analyst's STIX scratchpad. You lay an investigation out on a canvas, annotate it while you think, and export a STIX 2.1 bundle when it holds up. Everything runs in your browser: there is no backend, no account, and no language model anywhere near your intel.

The tool sits in the gap between the moment an incident is in front of you and the moment it is fit for a platform. Threat intelligence platforms are where shared truth lives, not where drafts, hypotheses and dead ends belong.

Start here

Using it. A triage, start to finish follows one phishing case from a pasted block of indicators to an exported bundle. It assumes you have never opened the tool. Once the gestures are familiar, Canvas reference is the page you keep open beside the app.

Getting the result out. Exporting covers the options and what each one changes in the file. Importing into OpenCTI covers what happens next, including one thing you need to know before your first import.

Running it yourself. Self-hosting is short, because the application is a folder of static files. Enrichment sidecar is the optional part, and the only one that can make a network call.

Changing it. How it is built is the map. Contributing is the practical side: tests, CI, conventions.

When something breaks. Troubleshooting works from the actual error messages.

What is here, and what is not

This wiki deliberately does not restate the repository. Documentation that has to stay in step with the code lives next to the code, and a wiki that quietly contradicts it would be worse than no wiki at all. So:

Question	Where it is answered
What is this tool, how do I start it	README
Where does my data live, what leaves the browser	/about in the application
What is a STIX object, what links to what	/guide in the application
How a MITRE matrix is read, what one of its numbers becomes here	/attack, /f3, /atlas and /aadapt in the application
How are identifiers computed, and how do I check	docs/identifiers.md
How do I report a vulnerability, how long is data kept	SECURITY.md
What changed between versions	CHANGELOG.md

The wiki holds what those cannot: the walkthroughs, the operating knowledge, and the reasoning behind how the pieces fit together.

Two things worth knowing early

The export is the save file. An investigation lives in the IndexedDB of one browser profile, on one machine. Nothing is stored on a server, so nothing is backed up for you. The status bar says never exported for exactly that reason.

Identifiers are computed, not drawn. Every object gets an identifier derived from its own properties, so re-importing the same investigation updates rather than duplicates. That is the point of the tool, and it has a cost worth understanding before you rename anything: see Importing into OpenCTI.

Licence

Apache 2.0. Permissive, with an explicit patent grant, which is the thing a legal department looks for before a tool is allowed inside an organisation.