examples.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [],
   "source": [
    "import stix_notebook"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Simplest Example\n",
    "\n",
    "The simplest thing you can generate is a single STIX object. Do this by specifying the object type name, capitalized and with spaces replaced by underscores. All statements must be terminated with a period."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <svg id='chart0' style=\"border: 2px solid #ababab;width:800px;height:600px;\"></svg>\n",
       "\n",
       "    <script type=\"text/javascript\">\n",
       "        require([\"nbextensions/stix2viz/stix2viz\"], function(stix2viz) {\n",
       "            chart = $('#chart0')[0];\n",
       "            visualizer0 = new stix2viz.Viz(chart, {\"width\": 800, \"height\": 600,\n",
       "                \"iconDir\": \"/nbextensions/stix2viz/icons\", \"id\": 0});\n",
       "            visualizer0.vizStix({\n",
       "    \"type\": \"threat-actor\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"threat-actor--2e2784af-58a1-4d06-9daf-a82cfb6debeb\",\n",
       "    \"created\": \"2022-10-27T12:48:44.789469Z\",\n",
       "    \"modified\": \"2023-04-04T20:37:55.52453Z\",\n",
       "    \"name\": \"manage\",\n",
       "    \"description\": \"Which after social must mention agent.\",\n",
       "    \"aliases\": [\n",
       "        \"you\",\n",
       "        \"guy\"\n",
       "    ],\n",
       "    \"goals\": [\n",
       "        \"instead\",\n",
       "        \"those\",\n",
       "        \"general\"\n",
       "    ],\n",
       "    \"sophistication\": \"expert\",\n",
       "    \"primary_motivation\": \"organizational-gain\",\n",
       "    \"personal_motivations\": [\n",
       "        \"revenge\"\n",
       "    ],\n",
       "    \"external_references\": [\n",
       "        {\n",
       "            \"source_name\": \"wife\",\n",
       "            \"url\": \"http://www.ramos-mendez.info/\",\n",
       "            \"external_id\": \"IDylwHSEX\"\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"keep\",\n",
       "            \"description\": \"Help national perhaps specific have scientist inside.\",\n",
       "            \"url\": \"http://simpson.com/\"\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"myself\",\n",
       "            \"description\": \"Could sign table new deal ok.\"\n",
       "        }\n",
       "    ]\n",
       "}, {\"userLabels\": {}});\n",
       "        });\n",
       "    </script>\n",
       "    <style type=\"text/css\">pre { line-height: 125%; }\n",
       "td.linenos pre { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "td.linenos pre.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       ".highlight .hll { background-color: #ffffcc }\n",
       ".highlight { background: #f8f8f8; }\n",
       ".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
       ".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
       ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
       ".highlight .o { color: #666666 } /* Operator */\n",
       ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
       ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
       ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
       ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
       ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
       ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
       ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
       ".highlight .ge { font-style: italic } /* Generic.Emph */\n",
       ".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
       ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
       ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
       ".highlight .go { color: #888888 } /* Generic.Output */\n",
       ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
       ".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
       ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
       ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
       ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
       ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
       ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
       ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
       ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
       ".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
       ".highlight .m { color: #666666 } /* Literal.Number */\n",
       ".highlight .s { color: #BA2121 } /* Literal.String */\n",
       ".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
       ".highlight .nb { color: #008000 } /* Name.Builtin */\n",
       ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
       ".highlight .no { color: #880000 } /* Name.Constant */\n",
       ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
       ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
       ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
       ".highlight .nf { color: #0000FF } /* Name.Function */\n",
       ".highlight .nl { color: #A0A000 } /* Name.Label */\n",
       ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
       ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
       ".highlight .nv { color: #19177C } /* Name.Variable */\n",
       ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
       ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
       ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
       ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
       ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
       ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
       ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
       ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
       ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
       ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
       ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
       ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
       ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
       ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
       ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
       ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
       ".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
       ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
       ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
       ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
       ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
       ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
       ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
       ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
       ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
       ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
       ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;threat-actor&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;threat-actor--2e2784af-58a1-4d06-9daf-a82cfb6debeb&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-10-27T12:48:44.789469Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2023-04-04T20:37:55.52453Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;manage&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Which after social must mention agent.&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;aliases&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;you&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;guy&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;goals&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;instead&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;those&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;general&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;sophistication&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;expert&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;primary_motivation&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;organizational-gain&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;personal_motivations&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;revenge&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;external_references&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;wife&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;url&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;http://www.ramos-mendez.info/&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;IDylwHSEX&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;keep&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Help national perhaps specific have scientist inside.&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;url&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;http://simpson.com/&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;myself&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Could sign table new deal ok.&quot;</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">]</span>\n",
       "<span class=\"p\">}</span>\n",
       "</pre></div>\n"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "execution_count": 2,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%stix\n",
    "Threat_Actor."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "In addition to STIX Domain Objects (SDOs), we can also generate STIX Cyber Observables (SCOs)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <svg id='chart1' style=\"border: 2px solid #ababab;width:800px;height:600px;\"></svg>\n",
       "\n",
       "    <script type=\"text/javascript\">\n",
       "        require([\"nbextensions/stix2viz/stix2viz\"], function(stix2viz) {\n",
       "            chart = $('#chart1')[0];\n",
       "            visualizer1 = new stix2viz.Viz(chart, {\"width\": 800, \"height\": 600,\n",
       "                \"iconDir\": \"/nbextensions/stix2viz/icons\", \"id\": 1});\n",
       "            visualizer1.vizStix({\n",
       "    \"type\": \"domain-name\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"domain-name--9b3170fc-1e52-49b1-9e69-d42092cafa78\",\n",
       "    \"value\": \"foster.com\"\n",
       "}, {\"userLabels\": {}});\n",
       "        });\n",
       "    </script>\n",
       "    <style type=\"text/css\">pre { line-height: 125%; }\n",
       "td.linenos pre { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "td.linenos pre.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       ".highlight .hll { background-color: #ffffcc }\n",
       ".highlight { background: #f8f8f8; }\n",
       ".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
       ".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
       ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
       ".highlight .o { color: #666666 } /* Operator */\n",
       ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
       ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
       ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
       ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
       ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
       ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
       ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
       ".highlight .ge { font-style: italic } /* Generic.Emph */\n",
       ".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
       ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
       ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
       ".highlight .go { color: #888888 } /* Generic.Output */\n",
       ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
       ".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
       ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
       ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
       ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
       ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
       ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
       ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
       ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
       ".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
       ".highlight .m { color: #666666 } /* Literal.Number */\n",
       ".highlight .s { color: #BA2121 } /* Literal.String */\n",
       ".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
       ".highlight .nb { color: #008000 } /* Name.Builtin */\n",
       ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
       ".highlight .no { color: #880000 } /* Name.Constant */\n",
       ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
       ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
       ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
       ".highlight .nf { color: #0000FF } /* Name.Function */\n",
       ".highlight .nl { color: #A0A000 } /* Name.Label */\n",
       ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
       ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
       ".highlight .nv { color: #19177C } /* Name.Variable */\n",
       ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
       ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
       ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
       ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
       ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
       ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
       ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
       ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
       ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
       ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
       ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
       ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
       ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
       ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
       ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
       ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
       ".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
       ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
       ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
       ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
       ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
       ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
       ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
       ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
       ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
       ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
       ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;domain-name&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;domain-name--9b3170fc-1e52-49b1-9e69-d42092cafa78&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;value&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;foster.com&quot;</span>\n",
       "<span class=\"p\">}</span>\n",
       "</pre></div>\n"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "execution_count": 3,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%stix\n",
    "Domain_Name."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Relationships\n",
    "\n",
    "You can create relationships by giving the capitalized source object type, followed by the lowercase relationship type, followed by the target object type. If the relationship type has a space in it, replace it with a hyphen (\"-\")."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {
    "scrolled": false
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <svg id='chart2' style=\"border: 2px solid #ababab;width:800px;height:600px;\"></svg>\n",
       "\n",
       "    <script type=\"text/javascript\">\n",
       "        require([\"nbextensions/stix2viz/stix2viz\"], function(stix2viz) {\n",
       "            chart = $('#chart2')[0];\n",
       "            visualizer2 = new stix2viz.Viz(chart, {\"width\": 800, \"height\": 600,\n",
       "                \"iconDir\": \"/nbextensions/stix2viz/icons\", \"id\": 2});\n",
       "            visualizer2.vizStix([{\n",
       "    \"type\": \"malware\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"malware--e9140892-5f2f-439b-928d-4e87345fe07a\",\n",
       "    \"created\": \"2021-06-07T20:50:38.26351Z\",\n",
       "    \"modified\": \"2022-03-14T03:12:18.19898Z\",\n",
       "    \"name\": \"than\",\n",
       "    \"is_family\": true,\n",
       "    \"labels\": [\n",
       "        \"alone\"\n",
       "    ]\n",
       "},\n",
       "{\n",
       "    \"type\": \"indicator\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"indicator--8926a394-5c2b-4fad-9353-b0e7c9f3a5a3\",\n",
       "    \"created\": \"2021-04-24T23:53:38.862826Z\",\n",
       "    \"modified\": \"2022-04-14T10:01:39.145508Z\",\n",
       "    \"pattern\": \"[(x509-certificate:validity_not_after < t'2021-12-22T01:45:37.005466Z') AND x509-certificate:validity_not_after NOT = t'2021-07-07T18:26:05.389631Z'] AND ([email-addr:value >= 'bking@yahoo.com'])\",\n",
       "    \"pattern_type\": \"stix\",\n",
       "    \"pattern_version\": \"2.1\",\n",
       "    \"valid_from\": \"2022-08-11T06:11:38.710813Z\",\n",
       "    \"confidence\": 69\n",
       "},\n",
       "{\n",
       "    \"type\": \"relationship\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"relationship--1b9f02a9-2239-4d28-a55d-0e36ab7064c3\",\n",
       "    \"created\": \"2021-12-20T12:39:22.417899Z\",\n",
       "    \"modified\": \"2022-07-03T20:00:09.969896Z\",\n",
       "    \"relationship_type\": \"indicates\",\n",
       "    \"source_ref\": \"malware--e9140892-5f2f-439b-928d-4e87345fe07a\",\n",
       "    \"target_ref\": \"indicator--8926a394-5c2b-4fad-9353-b0e7c9f3a5a3\",\n",
       "    \"confidence\": 55\n",
       "}], {\"userLabels\": {}});\n",
       "        });\n",
       "    </script>\n",
       "    <style type=\"text/css\">pre { line-height: 125%; }\n",
       "td.linenos pre { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "td.linenos pre.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       ".highlight .hll { background-color: #ffffcc }\n",
       ".highlight { background: #f8f8f8; }\n",
       ".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
       ".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
       ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
       ".highlight .o { color: #666666 } /* Operator */\n",
       ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
       ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
       ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
       ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
       ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
       ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
       ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
       ".highlight .ge { font-style: italic } /* Generic.Emph */\n",
       ".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
       ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
       ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
       ".highlight .go { color: #888888 } /* Generic.Output */\n",
       ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
       ".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
       ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
       ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
       ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
       ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
       ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
       ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
       ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
       ".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
       ".highlight .m { color: #666666 } /* Literal.Number */\n",
       ".highlight .s { color: #BA2121 } /* Literal.String */\n",
       ".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
       ".highlight .nb { color: #008000 } /* Name.Builtin */\n",
       ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
       ".highlight .no { color: #880000 } /* Name.Constant */\n",
       ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
       ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
       ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
       ".highlight .nf { color: #0000FF } /* Name.Function */\n",
       ".highlight .nl { color: #A0A000 } /* Name.Label */\n",
       ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
       ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
       ".highlight .nv { color: #19177C } /* Name.Variable */\n",
       ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
       ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
       ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
       ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
       ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
       ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
       ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
       ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
       ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
       ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
       ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
       ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
       ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
       ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
       ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
       ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
       ".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
       ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
       ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
       ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
       ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
       ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
       ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
       ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
       ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
       ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
       ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">[{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware--e9140892-5f2f-439b-928d-4e87345fe07a&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-06-07T20:50:38.26351Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-03-14T03:12:18.19898Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;than&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;is_family&quot;</span><span class=\"p\">:</span> <span class=\"kc\">true</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;labels&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;alone&quot;</span>\n",
       "    <span class=\"p\">]</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--8926a394-5c2b-4fad-9353-b0e7c9f3a5a3&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-04-24T23:53:38.862826Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-04-14T10:01:39.145508Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;[(x509-certificate:validity_not_after &lt; t&#39;2021-12-22T01:45:37.005466Z&#39;) AND x509-certificate:validity_not_after NOT = t&#39;2021-07-07T18:26:05.389631Z&#39;] AND ([email-addr:value &gt;= &#39;bking@yahoo.com&#39;])&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;stix&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;valid_from&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-08-11T06:11:38.710813Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;confidence&quot;</span><span class=\"p\">:</span> <span class=\"mi\">69</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship--1b9f02a9-2239-4d28-a55d-0e36ab7064c3&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-12-20T12:39:22.417899Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-07-03T20:00:09.969896Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;relationship_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicates&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;source_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware--e9140892-5f2f-439b-928d-4e87345fe07a&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;target_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--8926a394-5c2b-4fad-9353-b0e7c9f3a5a3&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;confidence&quot;</span><span class=\"p\">:</span> <span class=\"mi\">55</span>\n",
       "<span class=\"p\">}]</span>\n",
       "</pre></div>\n"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "execution_count": 4,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%stix\n",
    "Malware indicates Indicator."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Counts\n",
    "\n",
    "You can create multiple objects of the same type using a numeral before the object type name."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {
    "scrolled": false
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <svg id='chart3' style=\"border: 2px solid #ababab;width:800px;height:600px;\"></svg>\n",
       "\n",
       "    <script type=\"text/javascript\">\n",
       "        require([\"nbextensions/stix2viz/stix2viz\"], function(stix2viz) {\n",
       "            chart = $('#chart3')[0];\n",
       "            visualizer3 = new stix2viz.Viz(chart, {\"width\": 800, \"height\": 600,\n",
       "                \"iconDir\": \"/nbextensions/stix2viz/icons\", \"id\": 3});\n",
       "            visualizer3.vizStix([{\n",
       "    \"type\": \"domain-name\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"domain-name--25920675-8af5-4da9-a894-e920c64b1610\",\n",
       "    \"value\": \"hicks.info\"\n",
       "},\n",
       "{\n",
       "    \"type\": \"domain-name\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"domain-name--9279d7f5-4171-476d-a311-dbf9ed9952c5\",\n",
       "    \"value\": \"young.biz\"\n",
       "}], {\"userLabels\": {}});\n",
       "        });\n",
       "    </script>\n",
       "    <style type=\"text/css\">pre { line-height: 125%; }\n",
       "td.linenos pre { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "td.linenos pre.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       ".highlight .hll { background-color: #ffffcc }\n",
       ".highlight { background: #f8f8f8; }\n",
       ".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
       ".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
       ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
       ".highlight .o { color: #666666 } /* Operator */\n",
       ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
       ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
       ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
       ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
       ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
       ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
       ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
       ".highlight .ge { font-style: italic } /* Generic.Emph */\n",
       ".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
       ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
       ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
       ".highlight .go { color: #888888 } /* Generic.Output */\n",
       ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
       ".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
       ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
       ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
       ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
       ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
       ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
       ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
       ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
       ".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
       ".highlight .m { color: #666666 } /* Literal.Number */\n",
       ".highlight .s { color: #BA2121 } /* Literal.String */\n",
       ".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
       ".highlight .nb { color: #008000 } /* Name.Builtin */\n",
       ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
       ".highlight .no { color: #880000 } /* Name.Constant */\n",
       ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
       ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
       ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
       ".highlight .nf { color: #0000FF } /* Name.Function */\n",
       ".highlight .nl { color: #A0A000 } /* Name.Label */\n",
       ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
       ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
       ".highlight .nv { color: #19177C } /* Name.Variable */\n",
       ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
       ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
       ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
       ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
       ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
       ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
       ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
       ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
       ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
       ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
       ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
       ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
       ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
       ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
       ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
       ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
       ".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
       ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
       ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
       ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
       ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
       ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
       ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
       ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
       ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
       ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
       ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">[{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;domain-name&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;domain-name--25920675-8af5-4da9-a894-e920c64b1610&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;value&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;hicks.info&quot;</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;domain-name&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;domain-name--9279d7f5-4171-476d-a311-dbf9ed9952c5&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;value&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;young.biz&quot;</span>\n",
       "<span class=\"p\">}]</span>\n",
       "</pre></div>\n"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "execution_count": 5,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%stix\n",
    "2 Domain_Name."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "To create multiple object types at once, you can use multiple statements, each terminated with a period."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {
    "scrolled": false
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <svg id='chart4' style=\"border: 2px solid #ababab;width:800px;height:600px;\"></svg>\n",
       "\n",
       "    <script type=\"text/javascript\">\n",
       "        require([\"nbextensions/stix2viz/stix2viz\"], function(stix2viz) {\n",
       "            chart = $('#chart4')[0];\n",
       "            visualizer4 = new stix2viz.Viz(chart, {\"width\": 800, \"height\": 600,\n",
       "                \"iconDir\": \"/nbextensions/stix2viz/icons\", \"id\": 4});\n",
       "            visualizer4.vizStix([{\n",
       "    \"type\": \"campaign\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"campaign--00070e50-e468-475d-b38c-45da6634c040\",\n",
       "    \"created\": \"2022-09-03T15:45:06.264992Z\",\n",
       "    \"modified\": \"2023-08-23T06:13:19.482628Z\",\n",
       "    \"name\": \"mission\",\n",
       "    \"aliases\": [\n",
       "        \"performance\",\n",
       "        \"per\"\n",
       "    ],\n",
       "    \"first_seen\": \"2022-05-13T22:24:06.523065Z\"\n",
       "},\n",
       "{\n",
       "    \"type\": \"indicator\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"indicator--d8e5fe35-fcee-4c53-a0d6-c746d8842036\",\n",
       "    \"created\": \"2021-11-12T03:43:58.543686Z\",\n",
       "    \"modified\": \"2022-10-07T22:23:57.413327Z\",\n",
       "    \"pattern\": \"[(ipv6-addr:defanged = false) AND ipv6-addr:defanged = false] AND [mutex:defanged = false]\",\n",
       "    \"pattern_type\": \"stix\",\n",
       "    \"pattern_version\": \"2.1\",\n",
       "    \"valid_from\": \"2021-07-07T01:52:07.766222Z\",\n",
       "    \"valid_until\": \"2021-12-31T10:30:43.926939Z\",\n",
       "    \"labels\": [\n",
       "        \"of\"\n",
       "    ],\n",
       "    \"lang\": \"en\"\n",
       "},\n",
       "{\n",
       "    \"type\": \"indicator\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"indicator--93309982-df1b-4397-9bd0-1e8dccebde56\",\n",
       "    \"created\": \"2021-11-28T09:24:56.370287Z\",\n",
       "    \"modified\": \"2022-11-11T07:48:24.182349Z\",\n",
       "    \"name\": \"end\",\n",
       "    \"pattern\": \"[network-traffic:defanged = true] FOLLOWEDBY [url:defanged = false]\",\n",
       "    \"pattern_type\": \"stix\",\n",
       "    \"pattern_version\": \"2.1\",\n",
       "    \"valid_from\": \"2021-04-07T11:14:41.324634Z\",\n",
       "    \"valid_until\": \"2021-12-24T02:20:45.70289Z\",\n",
       "    \"labels\": [\n",
       "        \"someone\"\n",
       "    ],\n",
       "    \"external_references\": [\n",
       "        {\n",
       "            \"source_name\": \"property\",\n",
       "            \"description\": \"Evidence scientist entire say economic near.\",\n",
       "            \"url\": \"https://www.bean-shepard.com/\"\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"away\",\n",
       "            \"url\": \"http://martinez.com/\"\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"positive\",\n",
       "            \"description\": \"College reality argue put matter beat consumer effect.\",\n",
       "            \"hashes\": {\n",
       "                \"SHA-1\": \"90d50c60bfedf9731d1b668473060ddb00a3451f\",\n",
       "                \"SHA-256\": \"efda086ac662f91766bf11897e11ad2d07d2a2d0dd577a2babe08dfe5af6d47c\",\n",
       "                \"SHA-512\": \"9160cd7e48bc74a31e5e70d00bc7591e00ef0374c449879731cd40e0270e90f60e72e05c67e3ab5caa7ad04e46c7a8947fe74363a3a2649c1a27938230cc3acf\",\n",
       "                \"SHA3-256\": \"f2144bfc85285caa1381add25bb6d56c851d38782c68077fcbe42c80ed17f819\"\n",
       "            }\n",
       "        }\n",
       "    ]\n",
       "}], {\"userLabels\": {}});\n",
       "        });\n",
       "    </script>\n",
       "    <style type=\"text/css\">pre { line-height: 125%; }\n",
       "td.linenos pre { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "td.linenos pre.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       ".highlight .hll { background-color: #ffffcc }\n",
       ".highlight { background: #f8f8f8; }\n",
       ".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
       ".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
       ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
       ".highlight .o { color: #666666 } /* Operator */\n",
       ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
       ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
       ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
       ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
       ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
       ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
       ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
       ".highlight .ge { font-style: italic } /* Generic.Emph */\n",
       ".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
       ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
       ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
       ".highlight .go { color: #888888 } /* Generic.Output */\n",
       ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
       ".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
       ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
       ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
       ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
       ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
       ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
       ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
       ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
       ".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
       ".highlight .m { color: #666666 } /* Literal.Number */\n",
       ".highlight .s { color: #BA2121 } /* Literal.String */\n",
       ".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
       ".highlight .nb { color: #008000 } /* Name.Builtin */\n",
       ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
       ".highlight .no { color: #880000 } /* Name.Constant */\n",
       ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
       ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
       ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
       ".highlight .nf { color: #0000FF } /* Name.Function */\n",
       ".highlight .nl { color: #A0A000 } /* Name.Label */\n",
       ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
       ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
       ".highlight .nv { color: #19177C } /* Name.Variable */\n",
       ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
       ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
       ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
       ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
       ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
       ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
       ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
       ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
       ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
       ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
       ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
       ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
       ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
       ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
       ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
       ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
       ".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
       ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
       ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
       ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
       ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
       ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
       ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
       ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
       ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
       ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
       ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">[{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;campaign&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;campaign--00070e50-e468-475d-b38c-45da6634c040&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-09-03T15:45:06.264992Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2023-08-23T06:13:19.482628Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;mission&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;aliases&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;performance&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;per&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;first_seen&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-05-13T22:24:06.523065Z&quot;</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--d8e5fe35-fcee-4c53-a0d6-c746d8842036&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-11-12T03:43:58.543686Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-10-07T22:23:57.413327Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;[(ipv6-addr:defanged = false) AND ipv6-addr:defanged = false] AND [mutex:defanged = false]&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;stix&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;valid_from&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-07-07T01:52:07.766222Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;valid_until&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-12-31T10:30:43.926939Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;labels&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;of&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;lang&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;en&quot;</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--93309982-df1b-4397-9bd0-1e8dccebde56&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-11-28T09:24:56.370287Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-11-11T07:48:24.182349Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;end&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;[network-traffic:defanged = true] FOLLOWEDBY [url:defanged = false]&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;stix&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;valid_from&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-04-07T11:14:41.324634Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;valid_until&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-12-24T02:20:45.70289Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;labels&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;someone&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;external_references&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;property&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Evidence scientist entire say economic near.&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;url&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;https://www.bean-shepard.com/&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;away&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;url&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;http://martinez.com/&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;positive&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;College reality argue put matter beat consumer effect.&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;hashes&quot;</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
       "                <span class=\"nt\">&quot;SHA-1&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;90d50c60bfedf9731d1b668473060ddb00a3451f&quot;</span><span class=\"p\">,</span>\n",
       "                <span class=\"nt\">&quot;SHA-256&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;efda086ac662f91766bf11897e11ad2d07d2a2d0dd577a2babe08dfe5af6d47c&quot;</span><span class=\"p\">,</span>\n",
       "                <span class=\"nt\">&quot;SHA-512&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;9160cd7e48bc74a31e5e70d00bc7591e00ef0374c449879731cd40e0270e90f60e72e05c67e3ab5caa7ad04e46c7a8947fe74363a3a2649c1a27938230cc3acf&quot;</span><span class=\"p\">,</span>\n",
       "                <span class=\"nt\">&quot;SHA3-256&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;f2144bfc85285caa1381add25bb6d56c851d38782c68077fcbe42c80ed17f819&quot;</span>\n",
       "            <span class=\"p\">}</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">]</span>\n",
       "<span class=\"p\">}]</span>\n",
       "</pre></div>\n"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "execution_count": 6,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%stix\n",
    "Campaign. 2 Indicator."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "You can also generate multiple objects by surrounding them in parentheses:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {
    "scrolled": false
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <svg id='chart5' style=\"border: 2px solid #ababab;width:800px;height:600px;\"></svg>\n",
       "\n",
       "    <script type=\"text/javascript\">\n",
       "        require([\"nbextensions/stix2viz/stix2viz\"], function(stix2viz) {\n",
       "            chart = $('#chart5')[0];\n",
       "            visualizer5 = new stix2viz.Viz(chart, {\"width\": 800, \"height\": 600,\n",
       "                \"iconDir\": \"/nbextensions/stix2viz/icons\", \"id\": 5});\n",
       "            visualizer5.vizStix([{\n",
       "    \"type\": \"campaign\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"campaign--e106c1ab-29a1-4aba-9aed-05f70124b8e1\",\n",
       "    \"created\": \"2022-10-08T20:36:21.734654Z\",\n",
       "    \"modified\": \"2023-07-31T01:23:44.991918Z\",\n",
       "    \"name\": \"should\",\n",
       "    \"objective\": \"Face fine subject wrong.\",\n",
       "    \"confidence\": 56,\n",
       "    \"lang\": \"en\"\n",
       "},\n",
       "{\n",
       "    \"type\": \"indicator\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"indicator--0af1566b-4369-473c-bdd5-187d159b3a33\",\n",
       "    \"created\": \"2022-10-04T23:14:45.042915Z\",\n",
       "    \"modified\": \"2023-07-28T17:08:31.645042Z\",\n",
       "    \"description\": \"Else sure perhaps break ask statement.\",\n",
       "    \"indicator_types\": [\n",
       "        \"attribution\",\n",
       "        \"benign\",\n",
       "        \"unknown\"\n",
       "    ],\n",
       "    \"pattern\": \"[url:defanged NOT = false] FOLLOWEDBY ([email-message:received_lines[0] NOT = 'LEAkeeAHZLdnk'])\",\n",
       "    \"pattern_type\": \"stix\",\n",
       "    \"pattern_version\": \"2.1\",\n",
       "    \"valid_from\": \"2021-06-23T04:07:55.269619Z\",\n",
       "    \"labels\": [\n",
       "        \"run\",\n",
       "        \"professor\",\n",
       "        \"according\"\n",
       "    ],\n",
       "    \"confidence\": 6,\n",
       "    \"lang\": \"en\"\n",
       "},\n",
       "{\n",
       "    \"type\": \"indicator\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"indicator--5d4262c5-3888-47ae-9253-4c43d01fda67\",\n",
       "    \"created\": \"2021-10-03T11:00:24.685258Z\",\n",
       "    \"modified\": \"2022-06-16T10:34:37.306519Z\",\n",
       "    \"pattern\": \"[network-traffic:dst_ref.value NOT = '2d22:277e:e73:78d0:6d81:c310:ece3:8c7'] FOLLOWEDBY [ipv6-addr:value = 'f1c4:cef4:4fd8:cc5f:567b:c676:9e8f:a810'] FOLLOWEDBY ([(process:pid >= 33246) AND process:is_hidden NOT = true])\",\n",
       "    \"pattern_type\": \"stix\",\n",
       "    \"pattern_version\": \"2.1\",\n",
       "    \"valid_from\": \"2021-09-30T15:54:29.697766Z\",\n",
       "    \"valid_until\": \"2022-06-18T18:24:08.651196Z\",\n",
       "    \"kill_chain_phases\": [\n",
       "        {\n",
       "            \"kill_chain_name\": \"lockheed-martin-cyber-kill-chain\",\n",
       "            \"phase_name\": \"command and control\"\n",
       "        }\n",
       "    ],\n",
       "    \"lang\": \"en\"\n",
       "}], {\"userLabels\": {}});\n",
       "        });\n",
       "    </script>\n",
       "    <style type=\"text/css\">pre { line-height: 125%; }\n",
       "td.linenos pre { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "td.linenos pre.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       ".highlight .hll { background-color: #ffffcc }\n",
       ".highlight { background: #f8f8f8; }\n",
       ".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
       ".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
       ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
       ".highlight .o { color: #666666 } /* Operator */\n",
       ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
       ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
       ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
       ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
       ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
       ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
       ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
       ".highlight .ge { font-style: italic } /* Generic.Emph */\n",
       ".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
       ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
       ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
       ".highlight .go { color: #888888 } /* Generic.Output */\n",
       ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
       ".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
       ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
       ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
       ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
       ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
       ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
       ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
       ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
       ".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
       ".highlight .m { color: #666666 } /* Literal.Number */\n",
       ".highlight .s { color: #BA2121 } /* Literal.String */\n",
       ".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
       ".highlight .nb { color: #008000 } /* Name.Builtin */\n",
       ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
       ".highlight .no { color: #880000 } /* Name.Constant */\n",
       ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
       ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
       ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
       ".highlight .nf { color: #0000FF } /* Name.Function */\n",
       ".highlight .nl { color: #A0A000 } /* Name.Label */\n",
       ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
       ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
       ".highlight .nv { color: #19177C } /* Name.Variable */\n",
       ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
       ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
       ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
       ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
       ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
       ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
       ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
       ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
       ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
       ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
       ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
       ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
       ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
       ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
       ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
       ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
       ".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
       ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
       ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
       ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
       ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
       ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
       ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
       ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
       ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
       ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
       ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">[{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;campaign&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;campaign--e106c1ab-29a1-4aba-9aed-05f70124b8e1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-10-08T20:36:21.734654Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2023-07-31T01:23:44.991918Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;should&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;objective&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Face fine subject wrong.&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;confidence&quot;</span><span class=\"p\">:</span> <span class=\"mi\">56</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;lang&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;en&quot;</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--0af1566b-4369-473c-bdd5-187d159b3a33&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-10-04T23:14:45.042915Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2023-07-28T17:08:31.645042Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Else sure perhaps break ask statement.&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;indicator_types&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;attribution&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;benign&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;unknown&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;pattern&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;[url:defanged NOT = false] FOLLOWEDBY ([email-message:received_lines[0] NOT = &#39;LEAkeeAHZLdnk&#39;])&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;stix&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;valid_from&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-06-23T04:07:55.269619Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;labels&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;run&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;professor&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;according&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;confidence&quot;</span><span class=\"p\">:</span> <span class=\"mi\">6</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;lang&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;en&quot;</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--5d4262c5-3888-47ae-9253-4c43d01fda67&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-10-03T11:00:24.685258Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-06-16T10:34:37.306519Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;[network-traffic:dst_ref.value NOT = &#39;2d22:277e:e73:78d0:6d81:c310:ece3:8c7&#39;] FOLLOWEDBY [ipv6-addr:value = &#39;f1c4:cef4:4fd8:cc5f:567b:c676:9e8f:a810&#39;] FOLLOWEDBY ([(process:pid &gt;= 33246) AND process:is_hidden NOT = true])&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;stix&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;valid_from&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-09-30T15:54:29.697766Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;valid_until&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-06-18T18:24:08.651196Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;kill_chain_phases&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;kill_chain_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;lockheed-martin-cyber-kill-chain&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;phase_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;command and control&quot;</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;lang&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;en&quot;</span>\n",
       "<span class=\"p\">}]</span>\n",
       "</pre></div>\n"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "execution_count": 7,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%stix\n",
    "(Campaign 2 Indicator)."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Relationships With Counts\n",
    "\n",
    "You can create multiple relationships at once as well."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {
    "scrolled": false
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <svg id='chart6' style=\"border: 2px solid #ababab;width:800px;height:600px;\"></svg>\n",
       "\n",
       "    <script type=\"text/javascript\">\n",
       "        require([\"nbextensions/stix2viz/stix2viz\"], function(stix2viz) {\n",
       "            chart = $('#chart6')[0];\n",
       "            visualizer6 = new stix2viz.Viz(chart, {\"width\": 800, \"height\": 600,\n",
       "                \"iconDir\": \"/nbextensions/stix2viz/icons\", \"id\": 6});\n",
       "            visualizer6.vizStix([{\n",
       "    \"type\": \"attack-pattern\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"attack-pattern--92e5db8d-f417-4538-bb85-9418ecced9ab\",\n",
       "    \"created\": \"2021-05-12T23:35:09.21179Z\",\n",
       "    \"modified\": \"2021-12-21T02:52:23.113203Z\",\n",
       "    \"name\": \"trial\",\n",
       "    \"description\": \"Box cup in agreement ok receive activity.\",\n",
       "    \"aliases\": [\n",
       "        \"mission\",\n",
       "        \"practice\"\n",
       "    ],\n",
       "    \"confidence\": 12,\n",
       "    \"external_references\": [\n",
       "        {\n",
       "            \"source_name\": \"tax\",\n",
       "            \"description\": \"View own certain focus.\",\n",
       "            \"url\": \"https://www.smith-moore.biz/\"\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"feel\",\n",
       "            \"url\": \"https://www.higgins-combs.com/\"\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"act\",\n",
       "            \"external_id\": \"lCOZwgOWQdEMM\"\n",
       "        }\n",
       "    ]\n",
       "},\n",
       "{\n",
       "    \"type\": \"malware\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"malware--a1155280-0acb-4ff4-a167-da08741f180e\",\n",
       "    \"created\": \"2022-01-14T16:24:39.017318Z\",\n",
       "    \"modified\": \"2022-06-16T01:06:32.329894Z\",\n",
       "    \"name\": \"his\",\n",
       "    \"is_family\": true,\n",
       "    \"first_seen\": \"2022-12-01T09:10:11.19573Z\",\n",
       "    \"labels\": [\n",
       "        \"attention\"\n",
       "    ],\n",
       "    \"confidence\": 57,\n",
       "    \"lang\": \"en\"\n",
       "},\n",
       "{\n",
       "    \"type\": \"relationship\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"relationship--62587f5d-0239-4693-b600-bc14e51527b6\",\n",
       "    \"created\": \"2022-12-16T06:21:02.960058Z\",\n",
       "    \"modified\": \"2022-12-31T11:36:48.695617Z\",\n",
       "    \"relationship_type\": \"uses\",\n",
       "    \"description\": \"Power painting trouble certainly many improve. Finally tell its relate hold down from. Ball tend public. Candidate nation western five pattern positive clearly particularly.\",\n",
       "    \"source_ref\": \"attack-pattern--92e5db8d-f417-4538-bb85-9418ecced9ab\",\n",
       "    \"target_ref\": \"malware--a1155280-0acb-4ff4-a167-da08741f180e\",\n",
       "    \"start_time\": \"2022-03-26T21:05:18.352549Z\",\n",
       "    \"lang\": \"en\"\n",
       "},\n",
       "{\n",
       "    \"type\": \"relationship\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"relationship--f8e72f24-fbe8-4cd0-9466-f9f0577fbe83\",\n",
       "    \"created\": \"2022-07-02T07:46:57.192573Z\",\n",
       "    \"modified\": \"2022-08-11T20:21:12.998933Z\",\n",
       "    \"relationship_type\": \"uses\",\n",
       "    \"source_ref\": \"attack-pattern--92e5db8d-f417-4538-bb85-9418ecced9ab\",\n",
       "    \"target_ref\": \"malware--a1155280-0acb-4ff4-a167-da08741f180e\",\n",
       "    \"labels\": [\n",
       "        \"hair\"\n",
       "    ],\n",
       "    \"confidence\": 40,\n",
       "    \"external_references\": [\n",
       "        {\n",
       "            \"source_name\": \"model\",\n",
       "            \"external_id\": \"tyKgnkcsLIeLIxXXVBDL\"\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"eight\",\n",
       "            \"url\": \"http://www.kirk.net/\",\n",
       "            \"hashes\": {\n",
       "                \"SHA-1\": \"6fcb32f6d87e88f6407f8bacc24554e485ebdaa1\",\n",
       "                \"SHA-256\": \"cb89921b0dc8d6e952aab515e0792575de734ef8028ba80d17d5c2a52e5c7fbb\",\n",
       "                \"SHA3-256\": \"15a621fc0d7b31db84ad8b86ade3d0077512e10836071a28c33e4ce57c111c98\",\n",
       "                \"SHA3-512\": \"160492e6cb5494b3979cd1858b302b7146a759d52f07b4b3b9a9cfabe69200239fce4ce01ca6c25c1a261b9b40d4f4558661188b4949819d7f73ece0da362e77\"\n",
       "            }\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"rule\",\n",
       "            \"description\": \"Increase that class.\",\n",
       "            \"external_id\": \"uOSaRbLIdkWAvsbFQo\"\n",
       "        }\n",
       "    ]\n",
       "}], {\"userLabels\": {}});\n",
       "        });\n",
       "    </script>\n",
       "    <style type=\"text/css\">pre { line-height: 125%; }\n",
       "td.linenos pre { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "td.linenos pre.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       ".highlight .hll { background-color: #ffffcc }\n",
       ".highlight { background: #f8f8f8; }\n",
       ".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
       ".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
       ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
       ".highlight .o { color: #666666 } /* Operator */\n",
       ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
       ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
       ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
       ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
       ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
       ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
       ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
       ".highlight .ge { font-style: italic } /* Generic.Emph */\n",
       ".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
       ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
       ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
       ".highlight .go { color: #888888 } /* Generic.Output */\n",
       ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
       ".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
       ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
       ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
       ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
       ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
       ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
       ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
       ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
       ".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
       ".highlight .m { color: #666666 } /* Literal.Number */\n",
       ".highlight .s { color: #BA2121 } /* Literal.String */\n",
       ".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
       ".highlight .nb { color: #008000 } /* Name.Builtin */\n",
       ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
       ".highlight .no { color: #880000 } /* Name.Constant */\n",
       ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
       ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
       ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
       ".highlight .nf { color: #0000FF } /* Name.Function */\n",
       ".highlight .nl { color: #A0A000 } /* Name.Label */\n",
       ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
       ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
       ".highlight .nv { color: #19177C } /* Name.Variable */\n",
       ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
       ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
       ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
       ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
       ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
       ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
       ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
       ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
       ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
       ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
       ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
       ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
       ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
       ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
       ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
       ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
       ".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
       ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
       ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
       ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
       ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
       ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
       ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
       ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
       ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
       ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
       ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">[{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;attack-pattern&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;attack-pattern--92e5db8d-f417-4538-bb85-9418ecced9ab&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-05-12T23:35:09.21179Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-12-21T02:52:23.113203Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;trial&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Box cup in agreement ok receive activity.&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;aliases&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;mission&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;practice&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;confidence&quot;</span><span class=\"p\">:</span> <span class=\"mi\">12</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;external_references&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;tax&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;View own certain focus.&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;url&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;https://www.smith-moore.biz/&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;feel&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;url&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;https://www.higgins-combs.com/&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;act&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;lCOZwgOWQdEMM&quot;</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">]</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware--a1155280-0acb-4ff4-a167-da08741f180e&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-01-14T16:24:39.017318Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-06-16T01:06:32.329894Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;his&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;is_family&quot;</span><span class=\"p\">:</span> <span class=\"kc\">true</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;first_seen&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-12-01T09:10:11.19573Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;labels&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;attention&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;confidence&quot;</span><span class=\"p\">:</span> <span class=\"mi\">57</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;lang&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;en&quot;</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship--62587f5d-0239-4693-b600-bc14e51527b6&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-12-16T06:21:02.960058Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-12-31T11:36:48.695617Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;relationship_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;uses&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Power painting trouble certainly many improve. Finally tell its relate hold down from. Ball tend public. Candidate nation western five pattern positive clearly particularly.&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;source_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;attack-pattern--92e5db8d-f417-4538-bb85-9418ecced9ab&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;target_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware--a1155280-0acb-4ff4-a167-da08741f180e&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;start_time&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-03-26T21:05:18.352549Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;lang&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;en&quot;</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship--f8e72f24-fbe8-4cd0-9466-f9f0577fbe83&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-07-02T07:46:57.192573Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-08-11T20:21:12.998933Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;relationship_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;uses&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;source_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;attack-pattern--92e5db8d-f417-4538-bb85-9418ecced9ab&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;target_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware--a1155280-0acb-4ff4-a167-da08741f180e&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;labels&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;hair&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;confidence&quot;</span><span class=\"p\">:</span> <span class=\"mi\">40</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;external_references&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;model&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;tyKgnkcsLIeLIxXXVBDL&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;eight&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;url&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;http://www.kirk.net/&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;hashes&quot;</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
       "                <span class=\"nt\">&quot;SHA-1&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;6fcb32f6d87e88f6407f8bacc24554e485ebdaa1&quot;</span><span class=\"p\">,</span>\n",
       "                <span class=\"nt\">&quot;SHA-256&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;cb89921b0dc8d6e952aab515e0792575de734ef8028ba80d17d5c2a52e5c7fbb&quot;</span><span class=\"p\">,</span>\n",
       "                <span class=\"nt\">&quot;SHA3-256&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;15a621fc0d7b31db84ad8b86ade3d0077512e10836071a28c33e4ce57c111c98&quot;</span><span class=\"p\">,</span>\n",
       "                <span class=\"nt\">&quot;SHA3-512&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;160492e6cb5494b3979cd1858b302b7146a759d52f07b4b3b9a9cfabe69200239fce4ce01ca6c25c1a261b9b40d4f4558661188b4949819d7f73ece0da362e77&quot;</span>\n",
       "            <span class=\"p\">}</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;rule&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Increase that class.&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;uOSaRbLIdkWAvsbFQo&quot;</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">]</span>\n",
       "<span class=\"p\">}]</span>\n",
       "</pre></div>\n"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "execution_count": 8,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%stix\n",
    "Attack_Pattern 2 uses Malware."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {
    "scrolled": false
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <svg id='chart7' style=\"border: 2px solid #ababab;width:800px;height:600px;\"></svg>\n",
       "\n",
       "    <script type=\"text/javascript\">\n",
       "        require([\"nbextensions/stix2viz/stix2viz\"], function(stix2viz) {\n",
       "            chart = $('#chart7')[0];\n",
       "            visualizer7 = new stix2viz.Viz(chart, {\"width\": 800, \"height\": 600,\n",
       "                \"iconDir\": \"/nbextensions/stix2viz/icons\", \"id\": 7});\n",
       "            visualizer7.vizStix([{\n",
       "    \"type\": \"campaign\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"campaign--79f74c0b-f0d7-4c33-a14e-d15850a20f8b\",\n",
       "    \"created\": \"2021-05-01T06:32:02.305725Z\",\n",
       "    \"modified\": \"2021-09-04T10:58:12.914206Z\",\n",
       "    \"name\": \"financial\"\n",
       "},\n",
       "{\n",
       "    \"type\": \"identity\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"identity--1ea9f800-947e-4a2e-ac10-ec496672ea45\",\n",
       "    \"created\": \"2023-02-25T20:37:47.805064Z\",\n",
       "    \"modified\": \"2023-06-06T02:02:23.658739Z\",\n",
       "    \"name\": \"Lopez-Byrd\",\n",
       "    \"description\": \"Cross-platform hybrid utilization\",\n",
       "    \"identity_class\": \"system\",\n",
       "    \"labels\": [\n",
       "        \"today\",\n",
       "        \"result\"\n",
       "    ],\n",
       "    \"lang\": \"en\"\n",
       "},\n",
       "{\n",
       "    \"type\": \"vulnerability\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"vulnerability--bad9bf2c-d61b-441a-9eed-1fc50f8d5bef\",\n",
       "    \"created\": \"2022-12-20T11:13:20.725937Z\",\n",
       "    \"modified\": \"2023-10-27T22:07:33.254127Z\",\n",
       "    \"name\": \"recent\",\n",
       "    \"external_references\": [\n",
       "        {\n",
       "            \"source_name\": \"sound\",\n",
       "            \"description\": \"Garden identify wife voice anyone edge decade.\",\n",
       "            \"external_id\": \"JjTlpaSMzS\"\n",
       "        }\n",
       "    ]\n",
       "},\n",
       "{\n",
       "    \"type\": \"relationship\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"relationship--bb2c740c-198a-43ae-870f-14675ac09b22\",\n",
       "    \"created\": \"2022-12-22T19:29:49.615456Z\",\n",
       "    \"modified\": \"2023-08-02T01:32:50.217324Z\",\n",
       "    \"relationship_type\": \"targets\",\n",
       "    \"description\": \"Simple customer stay fly friend less.\",\n",
       "    \"source_ref\": \"campaign--79f74c0b-f0d7-4c33-a14e-d15850a20f8b\",\n",
       "    \"target_ref\": \"identity--1ea9f800-947e-4a2e-ac10-ec496672ea45\",\n",
       "    \"labels\": [\n",
       "        \"entire\",\n",
       "        \"factor\"\n",
       "    ]\n",
       "},\n",
       "{\n",
       "    \"type\": \"relationship\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"relationship--d6da8a36-9793-4724-8f05-06f7dd177007\",\n",
       "    \"created\": \"2022-03-16T00:05:56.610795Z\",\n",
       "    \"modified\": \"2022-05-04T20:25:14.880593Z\",\n",
       "    \"relationship_type\": \"targets\",\n",
       "    \"source_ref\": \"campaign--79f74c0b-f0d7-4c33-a14e-d15850a20f8b\",\n",
       "    \"target_ref\": \"vulnerability--bad9bf2c-d61b-441a-9eed-1fc50f8d5bef\"\n",
       "}], {\"userLabels\": {}});\n",
       "        });\n",
       "    </script>\n",
       "    <style type=\"text/css\">pre { line-height: 125%; }\n",
       "td.linenos pre { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "td.linenos pre.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       ".highlight .hll { background-color: #ffffcc }\n",
       ".highlight { background: #f8f8f8; }\n",
       ".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
       ".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
       ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
       ".highlight .o { color: #666666 } /* Operator */\n",
       ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
       ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
       ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
       ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
       ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
       ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
       ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
       ".highlight .ge { font-style: italic } /* Generic.Emph */\n",
       ".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
       ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
       ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
       ".highlight .go { color: #888888 } /* Generic.Output */\n",
       ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
       ".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
       ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
       ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
       ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
       ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
       ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
       ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
       ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
       ".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
       ".highlight .m { color: #666666 } /* Literal.Number */\n",
       ".highlight .s { color: #BA2121 } /* Literal.String */\n",
       ".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
       ".highlight .nb { color: #008000 } /* Name.Builtin */\n",
       ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
       ".highlight .no { color: #880000 } /* Name.Constant */\n",
       ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
       ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
       ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
       ".highlight .nf { color: #0000FF } /* Name.Function */\n",
       ".highlight .nl { color: #A0A000 } /* Name.Label */\n",
       ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
       ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
       ".highlight .nv { color: #19177C } /* Name.Variable */\n",
       ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
       ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
       ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
       ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
       ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
       ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
       ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
       ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
       ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
       ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
       ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
       ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
       ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
       ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
       ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
       ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
       ".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
       ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
       ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
       ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
       ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
       ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
       ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
       ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
       ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
       ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
       ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">[{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;campaign&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;campaign--79f74c0b-f0d7-4c33-a14e-d15850a20f8b&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-05-01T06:32:02.305725Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-09-04T10:58:12.914206Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;financial&quot;</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;identity&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;identity--1ea9f800-947e-4a2e-ac10-ec496672ea45&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2023-02-25T20:37:47.805064Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2023-06-06T02:02:23.658739Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Lopez-Byrd&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Cross-platform hybrid utilization&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;identity_class&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;system&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;labels&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;today&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;result&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;lang&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;en&quot;</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;vulnerability&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;vulnerability--bad9bf2c-d61b-441a-9eed-1fc50f8d5bef&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-12-20T11:13:20.725937Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2023-10-27T22:07:33.254127Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;recent&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;external_references&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;sound&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Garden identify wife voice anyone edge decade.&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;JjTlpaSMzS&quot;</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">]</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship--bb2c740c-198a-43ae-870f-14675ac09b22&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-12-22T19:29:49.615456Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2023-08-02T01:32:50.217324Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;relationship_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;targets&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Simple customer stay fly friend less.&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;source_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;campaign--79f74c0b-f0d7-4c33-a14e-d15850a20f8b&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;target_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;identity--1ea9f800-947e-4a2e-ac10-ec496672ea45&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;labels&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;entire&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;factor&quot;</span>\n",
       "    <span class=\"p\">]</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship--d6da8a36-9793-4724-8f05-06f7dd177007&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-03-16T00:05:56.610795Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-05-04T20:25:14.880593Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;relationship_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;targets&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;source_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;campaign--79f74c0b-f0d7-4c33-a14e-d15850a20f8b&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;target_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;vulnerability--bad9bf2c-d61b-441a-9eed-1fc50f8d5bef&quot;</span>\n",
       "<span class=\"p\">}]</span>\n",
       "</pre></div>\n"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "execution_count": 9,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%stix\n",
    "Campaign targets (Identity Vulnerability)."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Variables\n",
    "\n",
    "You can give names to specific instances of objects by using a colon after the name, which must be lowercase. This lets you refer to them in other relationships, so the same object can be referenced multiple times."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {
    "scrolled": false
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <svg id='chart8' style=\"border: 2px solid #ababab;width:800px;height:600px;\"></svg>\n",
       "\n",
       "    <script type=\"text/javascript\">\n",
       "        require([\"nbextensions/stix2viz/stix2viz\"], function(stix2viz) {\n",
       "            chart = $('#chart8')[0];\n",
       "            visualizer8 = new stix2viz.Viz(chart, {\"width\": 800, \"height\": 600,\n",
       "                \"iconDir\": \"/nbextensions/stix2viz/icons\", \"id\": 8});\n",
       "            visualizer8.vizStix([{\n",
       "    \"type\": \"threat-actor\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"threat-actor--b460a091-a3ff-4731-93e2-9004978a410e\",\n",
       "    \"created\": \"2022-10-02T22:31:34.37629Z\",\n",
       "    \"modified\": \"2023-08-31T03:52:58.181051Z\",\n",
       "    \"name\": \"nor\",\n",
       "    \"sophistication\": \"strategic\",\n",
       "    \"confidence\": 38,\n",
       "    \"lang\": \"en\",\n",
       "    \"x_viz_variable_name\": \"sam\"\n",
       "},\n",
       "{\n",
       "    \"type\": \"attack-pattern\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"attack-pattern--4c3b4594-c6d6-4bd4-a478-15fcde58bdaf\",\n",
       "    \"created\": \"2022-08-11T20:47:34.995149Z\",\n",
       "    \"modified\": \"2023-07-26T09:05:11.08685Z\",\n",
       "    \"name\": \"try\",\n",
       "    \"kill_chain_phases\": [\n",
       "        {\n",
       "            \"kill_chain_name\": \"lockheed-martin-cyber-kill-chain\",\n",
       "            \"phase_name\": \"reconnaissance\"\n",
       "        },\n",
       "        {\n",
       "            \"kill_chain_name\": \"lockheed-martin-cyber-kill-chain\",\n",
       "            \"phase_name\": \"weaponization\"\n",
       "        },\n",
       "        {\n",
       "            \"kill_chain_name\": \"lockheed-martin-cyber-kill-chain\",\n",
       "            \"phase_name\": \"exploitation\"\n",
       "        }\n",
       "    ],\n",
       "    \"confidence\": 18,\n",
       "    \"lang\": \"en\"\n",
       "},\n",
       "{\n",
       "    \"type\": \"relationship\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"relationship--f68e719c-8880-4c90-ab2d-2733b3e3cea3\",\n",
       "    \"created\": \"2022-06-07T21:51:28.219579Z\",\n",
       "    \"modified\": \"2022-07-01T21:14:55.24159Z\",\n",
       "    \"relationship_type\": \"uses\",\n",
       "    \"description\": \"Member part interest world keep summer who. One final policy enough protect. Without street name view television him among. All approach question top four window value.\",\n",
       "    \"source_ref\": \"threat-actor--b460a091-a3ff-4731-93e2-9004978a410e\",\n",
       "    \"target_ref\": \"attack-pattern--4c3b4594-c6d6-4bd4-a478-15fcde58bdaf\",\n",
       "    \"confidence\": 72\n",
       "},\n",
       "{\n",
       "    \"type\": \"identity\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"identity--d187760d-71dc-47be-9b98-5d86264be482\",\n",
       "    \"created\": \"2021-04-09T06:07:58.982312Z\",\n",
       "    \"modified\": \"2022-02-05T21:52:27.046039Z\",\n",
       "    \"name\": \"Reed, Hill and Thompson\",\n",
       "    \"description\": \"Future-proofed even-keeled structure\",\n",
       "    \"roles\": [\n",
       "        \"too\",\n",
       "        \"million\",\n",
       "        \"economy\"\n",
       "    ],\n",
       "    \"lang\": \"en\"\n",
       "},\n",
       "{\n",
       "    \"type\": \"relationship\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"relationship--fe2305c5-4657-440a-93a2-7de3e4d35afd\",\n",
       "    \"created\": \"2022-05-19T22:28:34.053003Z\",\n",
       "    \"modified\": \"2022-12-29T14:55:53.636193Z\",\n",
       "    \"relationship_type\": \"attributed-to\",\n",
       "    \"source_ref\": \"threat-actor--b460a091-a3ff-4731-93e2-9004978a410e\",\n",
       "    \"target_ref\": \"identity--d187760d-71dc-47be-9b98-5d86264be482\",\n",
       "    \"confidence\": 91,\n",
       "    \"external_references\": [\n",
       "        {\n",
       "            \"source_name\": \"just\",\n",
       "            \"external_id\": \"QXvqtW\"\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"American\",\n",
       "            \"description\": \"Likely letter strategy live.\"\n",
       "        }\n",
       "    ]\n",
       "},\n",
       "{\n",
       "    \"type\": \"threat-actor\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"threat-actor--2a8dbad5-7fdb-4bab-8160-9a00da79b3f8\",\n",
       "    \"created\": \"2021-12-08T19:17:34.564198Z\",\n",
       "    \"modified\": \"2022-08-16T01:25:05.662363Z\",\n",
       "    \"name\": \"treat\",\n",
       "    \"description\": \"Room cell summer.\",\n",
       "    \"threat_actor_types\": [\n",
       "        \"insider-accidental\",\n",
       "        \"unknown\"\n",
       "    ],\n",
       "    \"aliases\": [\n",
       "        \"former\"\n",
       "    ],\n",
       "    \"first_seen\": \"2022-11-21T13:01:12.240415Z\",\n",
       "    \"secondary_motivations\": [\n",
       "        \"personal-satisfaction\"\n",
       "    ],\n",
       "    \"personal_motivations\": [\n",
       "        \"accidental\"\n",
       "    ],\n",
       "    \"lang\": \"en\"\n",
       "},\n",
       "{\n",
       "    \"type\": \"threat-actor\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"threat-actor--aa0b264b-f18b-4314-a878-1e182561aa1d\",\n",
       "    \"created\": \"2022-05-01T13:40:44.572962Z\",\n",
       "    \"modified\": \"2022-07-07T12:12:00.129835Z\",\n",
       "    \"name\": \"house\",\n",
       "    \"aliases\": [\n",
       "        \"simply\"\n",
       "    ],\n",
       "    \"first_seen\": \"2022-08-16T14:06:04.684843Z\",\n",
       "    \"roles\": [\n",
       "        \"malware-author\",\n",
       "        \"malware-author\",\n",
       "        \"sponsor\"\n",
       "    ],\n",
       "    \"sophistication\": \"strategic\",\n",
       "    \"resource_level\": \"contest\",\n",
       "    \"primary_motivation\": \"dominance\"\n",
       "},\n",
       "{\n",
       "    \"type\": \"malware\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"malware--2a48cdad-2d8f-4955-ab3b-3fb812890350\",\n",
       "    \"created\": \"2022-04-30T12:25:06.951524Z\",\n",
       "    \"modified\": \"2022-09-22T18:49:04.285244Z\",\n",
       "    \"name\": \"huge\",\n",
       "    \"description\": \"Success attention nor theory expect.\",\n",
       "    \"is_family\": false,\n",
       "    \"kill_chain_phases\": [\n",
       "        {\n",
       "            \"kill_chain_name\": \"lockheed-martin-cyber-kill-chain\",\n",
       "            \"phase_name\": \"actions on objective\"\n",
       "        },\n",
       "        {\n",
       "            \"kill_chain_name\": \"lnZrmoI\",\n",
       "            \"phase_name\": \"yUWbQuBRzdrewypIP\"\n",
       "        },\n",
       "        {\n",
       "            \"kill_chain_name\": \"lockheed-martin-cyber-kill-chain\",\n",
       "            \"phase_name\": \"command and control\"\n",
       "        }\n",
       "    ],\n",
       "    \"first_seen\": \"2022-04-06T19:03:24.909698Z\",\n",
       "    \"lang\": \"en\",\n",
       "    \"external_references\": [\n",
       "        {\n",
       "            \"source_name\": \"every\",\n",
       "            \"description\": \"Couple population research fish general.\",\n",
       "            \"external_id\": \"AoWaDXnwPojojcPWXkFz\"\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"computer\",\n",
       "            \"url\": \"http://evans.com/\",\n",
       "            \"external_id\": \"CdygVtoFPguG\"\n",
       "        }\n",
       "    ]\n",
       "},\n",
       "{\n",
       "    \"type\": \"relationship\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"relationship--c80cb047-6e98-4ef0-a622-e15b5eaa7d51\",\n",
       "    \"created\": \"2021-08-14T16:25:01.710031Z\",\n",
       "    \"modified\": \"2021-10-04T19:58:18.272719Z\",\n",
       "    \"relationship_type\": \"uses\",\n",
       "    \"source_ref\": \"threat-actor--b460a091-a3ff-4731-93e2-9004978a410e\",\n",
       "    \"target_ref\": \"malware--2a48cdad-2d8f-4955-ab3b-3fb812890350\",\n",
       "    \"stop_time\": \"2021-07-18T02:48:19.349815Z\",\n",
       "    \"lang\": \"en\"\n",
       "},\n",
       "{\n",
       "    \"type\": \"relationship\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"relationship--db85ebd0-a782-48ba-9b07-bf9ece7ea6dc\",\n",
       "    \"created\": \"2021-12-15T09:41:27.017618Z\",\n",
       "    \"modified\": \"2022-10-23T21:44:42.276185Z\",\n",
       "    \"relationship_type\": \"uses\",\n",
       "    \"source_ref\": \"threat-actor--2a8dbad5-7fdb-4bab-8160-9a00da79b3f8\",\n",
       "    \"target_ref\": \"malware--2a48cdad-2d8f-4955-ab3b-3fb812890350\",\n",
       "    \"stop_time\": \"2022-02-15T14:03:44.21754Z\",\n",
       "    \"labels\": [\n",
       "        \"wish\",\n",
       "        \"debate\"\n",
       "    ],\n",
       "    \"confidence\": 20\n",
       "},\n",
       "{\n",
       "    \"type\": \"relationship\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"relationship--1163c02d-8850-436f-aa4f-2f02ddb6b54a\",\n",
       "    \"created\": \"2022-01-15T10:41:49.558654Z\",\n",
       "    \"modified\": \"2023-01-12T21:40:08.705051Z\",\n",
       "    \"relationship_type\": \"uses\",\n",
       "    \"source_ref\": \"threat-actor--aa0b264b-f18b-4314-a878-1e182561aa1d\",\n",
       "    \"target_ref\": \"malware--2a48cdad-2d8f-4955-ab3b-3fb812890350\",\n",
       "    \"stop_time\": \"2022-06-27T17:48:44.187953Z\",\n",
       "    \"confidence\": 89,\n",
       "    \"lang\": \"en\",\n",
       "    \"external_references\": [\n",
       "        {\n",
       "            \"source_name\": \"high\",\n",
       "            \"external_id\": \"NpNtdTz\"\n",
       "        }\n",
       "    ]\n",
       "}], {\"userLabels\": {\"threat-actor--b460a091-a3ff-4731-93e2-9004978a410e\": \"sam\"}});\n",
       "        });\n",
       "    </script>\n",
       "    <style type=\"text/css\">pre { line-height: 125%; }\n",
       "td.linenos pre { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "td.linenos pre.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       ".highlight .hll { background-color: #ffffcc }\n",
       ".highlight { background: #f8f8f8; }\n",
       ".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
       ".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
       ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
       ".highlight .o { color: #666666 } /* Operator */\n",
       ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
       ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
       ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
       ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
       ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
       ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
       ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
       ".highlight .ge { font-style: italic } /* Generic.Emph */\n",
       ".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
       ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
       ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
       ".highlight .go { color: #888888 } /* Generic.Output */\n",
       ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
       ".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
       ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
       ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
       ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
       ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
       ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
       ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
       ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
       ".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
       ".highlight .m { color: #666666 } /* Literal.Number */\n",
       ".highlight .s { color: #BA2121 } /* Literal.String */\n",
       ".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
       ".highlight .nb { color: #008000 } /* Name.Builtin */\n",
       ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
       ".highlight .no { color: #880000 } /* Name.Constant */\n",
       ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
       ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
       ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
       ".highlight .nf { color: #0000FF } /* Name.Function */\n",
       ".highlight .nl { color: #A0A000 } /* Name.Label */\n",
       ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
       ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
       ".highlight .nv { color: #19177C } /* Name.Variable */\n",
       ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
       ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
       ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
       ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
       ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
       ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
       ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
       ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
       ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
       ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
       ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
       ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
       ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
       ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
       ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
       ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
       ".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
       ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
       ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
       ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
       ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
       ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
       ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
       ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
       ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
       ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
       ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">[{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;threat-actor&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;threat-actor--b460a091-a3ff-4731-93e2-9004978a410e&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-10-02T22:31:34.37629Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2023-08-31T03:52:58.181051Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;nor&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;sophistication&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;strategic&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;confidence&quot;</span><span class=\"p\">:</span> <span class=\"mi\">38</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;lang&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;en&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;x_viz_variable_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;sam&quot;</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;attack-pattern&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;attack-pattern--4c3b4594-c6d6-4bd4-a478-15fcde58bdaf&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-08-11T20:47:34.995149Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2023-07-26T09:05:11.08685Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;try&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;kill_chain_phases&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;kill_chain_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;lockheed-martin-cyber-kill-chain&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;phase_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;reconnaissance&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;kill_chain_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;lockheed-martin-cyber-kill-chain&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;phase_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;weaponization&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;kill_chain_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;lockheed-martin-cyber-kill-chain&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;phase_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;exploitation&quot;</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;confidence&quot;</span><span class=\"p\">:</span> <span class=\"mi\">18</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;lang&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;en&quot;</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship--f68e719c-8880-4c90-ab2d-2733b3e3cea3&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-06-07T21:51:28.219579Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-07-01T21:14:55.24159Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;relationship_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;uses&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Member part interest world keep summer who. One final policy enough protect. Without street name view television him among. All approach question top four window value.&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;source_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;threat-actor--b460a091-a3ff-4731-93e2-9004978a410e&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;target_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;attack-pattern--4c3b4594-c6d6-4bd4-a478-15fcde58bdaf&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;confidence&quot;</span><span class=\"p\">:</span> <span class=\"mi\">72</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;identity&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;identity--d187760d-71dc-47be-9b98-5d86264be482&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-04-09T06:07:58.982312Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-02-05T21:52:27.046039Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Reed, Hill and Thompson&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Future-proofed even-keeled structure&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;roles&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;too&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;million&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;economy&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;lang&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;en&quot;</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship--fe2305c5-4657-440a-93a2-7de3e4d35afd&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-05-19T22:28:34.053003Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-12-29T14:55:53.636193Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;relationship_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;attributed-to&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;source_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;threat-actor--b460a091-a3ff-4731-93e2-9004978a410e&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;target_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;identity--d187760d-71dc-47be-9b98-5d86264be482&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;confidence&quot;</span><span class=\"p\">:</span> <span class=\"mi\">91</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;external_references&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;just&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;QXvqtW&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;American&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Likely letter strategy live.&quot;</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">]</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;threat-actor&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;threat-actor--2a8dbad5-7fdb-4bab-8160-9a00da79b3f8&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-12-08T19:17:34.564198Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-08-16T01:25:05.662363Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;treat&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Room cell summer.&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;threat_actor_types&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;insider-accidental&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;unknown&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;aliases&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;former&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;first_seen&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-11-21T13:01:12.240415Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;secondary_motivations&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;personal-satisfaction&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;personal_motivations&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;accidental&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;lang&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;en&quot;</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;threat-actor&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;threat-actor--aa0b264b-f18b-4314-a878-1e182561aa1d&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-05-01T13:40:44.572962Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-07-07T12:12:00.129835Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;house&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;aliases&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;simply&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;first_seen&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-08-16T14:06:04.684843Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;roles&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;malware-author&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;malware-author&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;sponsor&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;sophistication&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;strategic&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;resource_level&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;contest&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;primary_motivation&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;dominance&quot;</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware--2a48cdad-2d8f-4955-ab3b-3fb812890350&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-04-30T12:25:06.951524Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-09-22T18:49:04.285244Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;huge&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Success attention nor theory expect.&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;is_family&quot;</span><span class=\"p\">:</span> <span class=\"kc\">false</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;kill_chain_phases&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;kill_chain_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;lockheed-martin-cyber-kill-chain&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;phase_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;actions on objective&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;kill_chain_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;lnZrmoI&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;phase_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;yUWbQuBRzdrewypIP&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;kill_chain_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;lockheed-martin-cyber-kill-chain&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;phase_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;command and control&quot;</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;first_seen&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-04-06T19:03:24.909698Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;lang&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;en&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;external_references&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;every&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Couple population research fish general.&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;AoWaDXnwPojojcPWXkFz&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;computer&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;url&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;http://evans.com/&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;CdygVtoFPguG&quot;</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">]</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship--c80cb047-6e98-4ef0-a622-e15b5eaa7d51&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-08-14T16:25:01.710031Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-10-04T19:58:18.272719Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;relationship_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;uses&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;source_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;threat-actor--b460a091-a3ff-4731-93e2-9004978a410e&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;target_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware--2a48cdad-2d8f-4955-ab3b-3fb812890350&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;stop_time&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-07-18T02:48:19.349815Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;lang&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;en&quot;</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship--db85ebd0-a782-48ba-9b07-bf9ece7ea6dc&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-12-15T09:41:27.017618Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-10-23T21:44:42.276185Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;relationship_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;uses&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;source_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;threat-actor--2a8dbad5-7fdb-4bab-8160-9a00da79b3f8&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;target_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware--2a48cdad-2d8f-4955-ab3b-3fb812890350&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;stop_time&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-02-15T14:03:44.21754Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;labels&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;wish&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;debate&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;confidence&quot;</span><span class=\"p\">:</span> <span class=\"mi\">20</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship--1163c02d-8850-436f-aa4f-2f02ddb6b54a&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-01-15T10:41:49.558654Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2023-01-12T21:40:08.705051Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;relationship_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;uses&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;source_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;threat-actor--aa0b264b-f18b-4314-a878-1e182561aa1d&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;target_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware--2a48cdad-2d8f-4955-ab3b-3fb812890350&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;stop_time&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-06-27T17:48:44.187953Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;confidence&quot;</span><span class=\"p\">:</span> <span class=\"mi\">89</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;lang&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;en&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;external_references&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;high&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;NpNtdTz&quot;</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">]</span>\n",
       "<span class=\"p\">}]</span>\n",
       "</pre></div>\n"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "execution_count": 10,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%stix\n",
    "sam: Threat_Actor.\n",
    "sam uses Attack_Pattern.\n",
    "sam attributed-to Identity.\n",
    "(sam 2 Threat_Actor) uses Malware."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Variables can refer to groups of objects as well. Note that the count goes before the variable name."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {
    "scrolled": false
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <svg id='chart9' style=\"border: 2px solid #ababab;width:800px;height:600px;\"></svg>\n",
       "\n",
       "    <script type=\"text/javascript\">\n",
       "        require([\"nbextensions/stix2viz/stix2viz\"], function(stix2viz) {\n",
       "            chart = $('#chart9')[0];\n",
       "            visualizer9 = new stix2viz.Viz(chart, {\"width\": 800, \"height\": 600,\n",
       "                \"iconDir\": \"/nbextensions/stix2viz/icons\", \"id\": 9});\n",
       "            visualizer9.vizStix([{\n",
       "    \"type\": \"indicator\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"indicator--021b0712-a625-417c-ae74-99d0ad5036b1\",\n",
       "    \"created\": \"2021-09-02T06:38:19.194562Z\",\n",
       "    \"modified\": \"2022-08-23T13:01:40.254473Z\",\n",
       "    \"pattern\": \"[autonomous-system:number NOT = -749] OR [url:defanged = false] START t'2021-10-01T21:12:16.906195Z' STOP t'2022-12-24T19:21:50.989964Z'\",\n",
       "    \"pattern_type\": \"stix\",\n",
       "    \"pattern_version\": \"2.1\",\n",
       "    \"valid_from\": \"2022-12-04T10:46:03.659167Z\",\n",
       "    \"lang\": \"en\",\n",
       "    \"external_references\": [\n",
       "        {\n",
       "            \"source_name\": \"detail\",\n",
       "            \"url\": \"https://www.dennis-torres.info/\"\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"easy\",\n",
       "            \"description\": \"Hospital defense of.\",\n",
       "            \"external_id\": \"ApBqAk\"\n",
       "        }\n",
       "    ],\n",
       "    \"x_viz_variable_name\": \"group\"\n",
       "},\n",
       "{\n",
       "    \"type\": \"indicator\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"indicator--08bf9be3-1624-449e-9157-38264d7a7058\",\n",
       "    \"created\": \"2022-10-20T04:48:47.744697Z\",\n",
       "    \"modified\": \"2023-01-02T12:47:19.60761Z\",\n",
       "    \"pattern\": \"(([file:ctime > t'2022-04-18T13:57:19.753054Z']) AND [(url:value > 'http://schneider.com/') AND url:value >= 'http://mayer.info/'] AND [artifact:encryption_algorithm < 'AES-256-GCM'] AND [ipv6-addr:value < '4f66:93f1:ad8d:7c47:54ad:5791:d2aa:2dd3'])\",\n",
       "    \"pattern_type\": \"stix\",\n",
       "    \"pattern_version\": \"2.1\",\n",
       "    \"valid_from\": \"2020-11-01T21:09:21.732446Z\",\n",
       "    \"valid_until\": \"2021-10-31T19:24:25.370912Z\",\n",
       "    \"external_references\": [\n",
       "        {\n",
       "            \"source_name\": \"place\",\n",
       "            \"description\": \"Artist bill degree school act truth.\",\n",
       "            \"url\": \"https://www.petersen.com/\"\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"your\",\n",
       "            \"description\": \"Audience region sit voice again.\",\n",
       "            \"url\": \"https://www.davis.biz/\"\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"million\",\n",
       "            \"external_id\": \"SvTikg\"\n",
       "        }\n",
       "    ],\n",
       "    \"x_viz_variable_name\": \"group\"\n",
       "},\n",
       "{\n",
       "    \"type\": \"malware\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"malware--4956770f-f1dc-4271-bd37-090eb56fa836\",\n",
       "    \"created\": \"2022-08-29T15:28:45.970111Z\",\n",
       "    \"modified\": \"2023-02-03T06:22:45.585324Z\",\n",
       "    \"name\": \"ten\",\n",
       "    \"malware_types\": [\n",
       "        \"rootkit\",\n",
       "        \"worm\"\n",
       "    ],\n",
       "    \"is_family\": false,\n",
       "    \"kill_chain_phases\": [\n",
       "        {\n",
       "            \"kill_chain_name\": \"nInqyUuEjXOGlVyw\",\n",
       "            \"phase_name\": \"wCWNOHlYUsVOio\"\n",
       "        },\n",
       "        {\n",
       "            \"kill_chain_name\": \"Ehzub\",\n",
       "            \"phase_name\": \"fATJpFKlPT\"\n",
       "        }\n",
       "    ],\n",
       "    \"implementation_languages\": [\n",
       "        \"java\",\n",
       "        \"typescript\"\n",
       "    ],\n",
       "    \"capabilities\": [\n",
       "        \"exfiltrates-data\",\n",
       "        \"self-modifies\"\n",
       "    ],\n",
       "    \"lang\": \"en\"\n",
       "},\n",
       "{\n",
       "    \"type\": \"relationship\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"relationship--0a710a90-59ae-4805-941c-bdd001e6cf0d\",\n",
       "    \"created\": \"2022-10-15T20:59:03.240149Z\",\n",
       "    \"modified\": \"2023-06-08T00:20:08.478201Z\",\n",
       "    \"relationship_type\": \"indicates\",\n",
       "    \"source_ref\": \"indicator--021b0712-a625-417c-ae74-99d0ad5036b1\",\n",
       "    \"target_ref\": \"malware--4956770f-f1dc-4271-bd37-090eb56fa836\"\n",
       "},\n",
       "{\n",
       "    \"type\": \"relationship\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"relationship--010dfc6a-890c-4177-961c-b292445a3408\",\n",
       "    \"created\": \"2022-09-11T09:46:50.091516Z\",\n",
       "    \"modified\": \"2022-12-17T18:27:12.906218Z\",\n",
       "    \"relationship_type\": \"indicates\",\n",
       "    \"description\": \"Difference up really information night. Child than institution arrive physical power least. True office rate thank paper test. That ahead reason difficult training property much have.\",\n",
       "    \"source_ref\": \"indicator--08bf9be3-1624-449e-9157-38264d7a7058\",\n",
       "    \"target_ref\": \"malware--4956770f-f1dc-4271-bd37-090eb56fa836\",\n",
       "    \"start_time\": \"2021-12-31T23:46:35.366087Z\"\n",
       "}], {\"userLabels\": {\"indicator--021b0712-a625-417c-ae74-99d0ad5036b1\": \"group\", \"indicator--08bf9be3-1624-449e-9157-38264d7a7058\": \"group\"}});\n",
       "        });\n",
       "    </script>\n",
       "    <style type=\"text/css\">pre { line-height: 125%; }\n",
       "td.linenos pre { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "td.linenos pre.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       ".highlight .hll { background-color: #ffffcc }\n",
       ".highlight { background: #f8f8f8; }\n",
       ".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
       ".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
       ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
       ".highlight .o { color: #666666 } /* Operator */\n",
       ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
       ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
       ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
       ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
       ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
       ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
       ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
       ".highlight .ge { font-style: italic } /* Generic.Emph */\n",
       ".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
       ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
       ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
       ".highlight .go { color: #888888 } /* Generic.Output */\n",
       ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
       ".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
       ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
       ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
       ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
       ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
       ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
       ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
       ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
       ".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
       ".highlight .m { color: #666666 } /* Literal.Number */\n",
       ".highlight .s { color: #BA2121 } /* Literal.String */\n",
       ".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
       ".highlight .nb { color: #008000 } /* Name.Builtin */\n",
       ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
       ".highlight .no { color: #880000 } /* Name.Constant */\n",
       ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
       ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
       ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
       ".highlight .nf { color: #0000FF } /* Name.Function */\n",
       ".highlight .nl { color: #A0A000 } /* Name.Label */\n",
       ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
       ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
       ".highlight .nv { color: #19177C } /* Name.Variable */\n",
       ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
       ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
       ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
       ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
       ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
       ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
       ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
       ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
       ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
       ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
       ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
       ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
       ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
       ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
       ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
       ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
       ".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
       ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
       ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
       ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
       ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
       ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
       ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
       ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
       ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
       ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
       ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">[{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--021b0712-a625-417c-ae74-99d0ad5036b1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-09-02T06:38:19.194562Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-08-23T13:01:40.254473Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;[autonomous-system:number NOT = -749] OR [url:defanged = false] START t&#39;2021-10-01T21:12:16.906195Z&#39; STOP t&#39;2022-12-24T19:21:50.989964Z&#39;&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;stix&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;valid_from&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-12-04T10:46:03.659167Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;lang&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;en&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;external_references&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;detail&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;url&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;https://www.dennis-torres.info/&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;easy&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Hospital defense of.&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;ApBqAk&quot;</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;x_viz_variable_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;group&quot;</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--08bf9be3-1624-449e-9157-38264d7a7058&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-10-20T04:48:47.744697Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2023-01-02T12:47:19.60761Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;(([file:ctime &gt; t&#39;2022-04-18T13:57:19.753054Z&#39;]) AND [(url:value &gt; &#39;http://schneider.com/&#39;) AND url:value &gt;= &#39;http://mayer.info/&#39;] AND [artifact:encryption_algorithm &lt; &#39;AES-256-GCM&#39;] AND [ipv6-addr:value &lt; &#39;4f66:93f1:ad8d:7c47:54ad:5791:d2aa:2dd3&#39;])&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;stix&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;valid_from&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2020-11-01T21:09:21.732446Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;valid_until&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-10-31T19:24:25.370912Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;external_references&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;place&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Artist bill degree school act truth.&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;url&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;https://www.petersen.com/&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;your&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Audience region sit voice again.&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;url&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;https://www.davis.biz/&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;million&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;SvTikg&quot;</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;x_viz_variable_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;group&quot;</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware--4956770f-f1dc-4271-bd37-090eb56fa836&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-08-29T15:28:45.970111Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2023-02-03T06:22:45.585324Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;ten&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;malware_types&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;rootkit&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;worm&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;is_family&quot;</span><span class=\"p\">:</span> <span class=\"kc\">false</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;kill_chain_phases&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;kill_chain_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;nInqyUuEjXOGlVyw&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;phase_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;wCWNOHlYUsVOio&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;kill_chain_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Ehzub&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;phase_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;fATJpFKlPT&quot;</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;implementation_languages&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;java&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;typescript&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;capabilities&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;exfiltrates-data&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;self-modifies&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;lang&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;en&quot;</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship--0a710a90-59ae-4805-941c-bdd001e6cf0d&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-10-15T20:59:03.240149Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2023-06-08T00:20:08.478201Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;relationship_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicates&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;source_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--021b0712-a625-417c-ae74-99d0ad5036b1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;target_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware--4956770f-f1dc-4271-bd37-090eb56fa836&quot;</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship--010dfc6a-890c-4177-961c-b292445a3408&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-09-11T09:46:50.091516Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-12-17T18:27:12.906218Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;relationship_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicates&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Difference up really information night. Child than institution arrive physical power least. True office rate thank paper test. That ahead reason difficult training property much have.&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;source_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--08bf9be3-1624-449e-9157-38264d7a7058&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;target_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware--4956770f-f1dc-4271-bd37-090eb56fa836&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;start_time&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-12-31T23:46:35.366087Z&quot;</span>\n",
       "<span class=\"p\">}]</span>\n",
       "</pre></div>\n"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "execution_count": 11,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%stix\n",
    "2 group: Indicator.\n",
    "group indicates Malware."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Specific Property Values\n",
    "\n",
    "You can set properties to specific values by inserting a block of properties after the object type or variable. This block is surrounded by curly braces, and contains a property name followed by a colon and then the value for that property. Multiple properties are separated by commas.\n",
    "\n",
    "For example, to specify the name of an Identity instead of randomly generating a name:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {
    "scrolled": false
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <svg id='chart10' style=\"border: 2px solid #ababab;width:800px;height:600px;\"></svg>\n",
       "\n",
       "    <script type=\"text/javascript\">\n",
       "        require([\"nbextensions/stix2viz/stix2viz\"], function(stix2viz) {\n",
       "            chart = $('#chart10')[0];\n",
       "            visualizer10 = new stix2viz.Viz(chart, {\"width\": 800, \"height\": 600,\n",
       "                \"iconDir\": \"/nbextensions/stix2viz/icons\", \"id\": 10});\n",
       "            visualizer10.vizStix({\n",
       "    \"type\": \"identity\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"identity--ab4872c5-ae47-4325-95b0-f22b20e2e80b\",\n",
       "    \"created\": \"2021-07-26T14:37:17.690937Z\",\n",
       "    \"modified\": \"2022-07-14T06:20:09.09882Z\",\n",
       "    \"name\": \"Agent Smith\",\n",
       "    \"description\": \"Synergistic 24/7 groupware\",\n",
       "    \"confidence\": 36\n",
       "}, {\"userLabels\": {}});\n",
       "        });\n",
       "    </script>\n",
       "    <style type=\"text/css\">pre { line-height: 125%; }\n",
       "td.linenos pre { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "td.linenos pre.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       ".highlight .hll { background-color: #ffffcc }\n",
       ".highlight { background: #f8f8f8; }\n",
       ".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
       ".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
       ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
       ".highlight .o { color: #666666 } /* Operator */\n",
       ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
       ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
       ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
       ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
       ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
       ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
       ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
       ".highlight .ge { font-style: italic } /* Generic.Emph */\n",
       ".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
       ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
       ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
       ".highlight .go { color: #888888 } /* Generic.Output */\n",
       ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
       ".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
       ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
       ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
       ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
       ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
       ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
       ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
       ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
       ".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
       ".highlight .m { color: #666666 } /* Literal.Number */\n",
       ".highlight .s { color: #BA2121 } /* Literal.String */\n",
       ".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
       ".highlight .nb { color: #008000 } /* Name.Builtin */\n",
       ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
       ".highlight .no { color: #880000 } /* Name.Constant */\n",
       ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
       ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
       ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
       ".highlight .nf { color: #0000FF } /* Name.Function */\n",
       ".highlight .nl { color: #A0A000 } /* Name.Label */\n",
       ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
       ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
       ".highlight .nv { color: #19177C } /* Name.Variable */\n",
       ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
       ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
       ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
       ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
       ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
       ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
       ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
       ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
       ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
       ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
       ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
       ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
       ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
       ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
       ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
       ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
       ".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
       ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
       ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
       ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
       ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
       ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
       ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
       ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
       ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
       ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
       ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;identity&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;identity--ab4872c5-ae47-4325-95b0-f22b20e2e80b&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-07-26T14:37:17.690937Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-07-14T06:20:09.09882Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Agent Smith&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Synergistic 24/7 groupware&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;confidence&quot;</span><span class=\"p\">:</span> <span class=\"mi\">36</span>\n",
       "<span class=\"p\">}</span>\n",
       "</pre></div>\n"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "execution_count": 12,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%stix\n",
    "Identity {name: \"Agent Smith\"}."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Here is an example specifying multiple properties:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <svg id='chart11' style=\"border: 2px solid #ababab;width:800px;height:600px;\"></svg>\n",
       "\n",
       "    <script type=\"text/javascript\">\n",
       "        require([\"nbextensions/stix2viz/stix2viz\"], function(stix2viz) {\n",
       "            chart = $('#chart11')[0];\n",
       "            visualizer11 = new stix2viz.Viz(chart, {\"width\": 800, \"height\": 600,\n",
       "                \"iconDir\": \"/nbextensions/stix2viz/icons\", \"id\": 11});\n",
       "            visualizer11.vizStix({\n",
       "    \"type\": \"identity\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"identity--5e3eb547-9f33-4271-9c92-43cd3c78b722\",\n",
       "    \"created\": \"2022-07-20T13:55:06.782355Z\",\n",
       "    \"modified\": \"2022-10-31T06:25:23.889427Z\",\n",
       "    \"name\": \"Agent Smith\",\n",
       "    \"roles\": [\n",
       "        \"popular\"\n",
       "    ],\n",
       "    \"sectors\": [\n",
       "        \"technology\"\n",
       "    ]\n",
       "}, {\"userLabels\": {}});\n",
       "        });\n",
       "    </script>\n",
       "    <style type=\"text/css\">pre { line-height: 125%; }\n",
       "td.linenos pre { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "td.linenos pre.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       ".highlight .hll { background-color: #ffffcc }\n",
       ".highlight { background: #f8f8f8; }\n",
       ".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
       ".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
       ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
       ".highlight .o { color: #666666 } /* Operator */\n",
       ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
       ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
       ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
       ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
       ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
       ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
       ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
       ".highlight .ge { font-style: italic } /* Generic.Emph */\n",
       ".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
       ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
       ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
       ".highlight .go { color: #888888 } /* Generic.Output */\n",
       ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
       ".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
       ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
       ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
       ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
       ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
       ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
       ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
       ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
       ".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
       ".highlight .m { color: #666666 } /* Literal.Number */\n",
       ".highlight .s { color: #BA2121 } /* Literal.String */\n",
       ".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
       ".highlight .nb { color: #008000 } /* Name.Builtin */\n",
       ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
       ".highlight .no { color: #880000 } /* Name.Constant */\n",
       ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
       ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
       ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
       ".highlight .nf { color: #0000FF } /* Name.Function */\n",
       ".highlight .nl { color: #A0A000 } /* Name.Label */\n",
       ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
       ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
       ".highlight .nv { color: #19177C } /* Name.Variable */\n",
       ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
       ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
       ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
       ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
       ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
       ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
       ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
       ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
       ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
       ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
       ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
       ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
       ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
       ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
       ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
       ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
       ".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
       ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
       ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
       ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
       ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
       ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
       ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
       ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
       ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
       ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
       ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;identity&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;identity--5e3eb547-9f33-4271-9c92-43cd3c78b722&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-07-20T13:55:06.782355Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-10-31T06:25:23.889427Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Agent Smith&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;roles&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;popular&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;sectors&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;technology&quot;</span>\n",
       "    <span class=\"p\">]</span>\n",
       "<span class=\"p\">}</span>\n",
       "</pre></div>\n"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "execution_count": 13,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%stix\n",
    "Identity {name: \"Agent Smith\", sectors: [\"technology\"]}."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Note that the property block must go before the colon when declared on a variable."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <svg id='chart12' style=\"border: 2px solid #ababab;width:800px;height:600px;\"></svg>\n",
       "\n",
       "    <script type=\"text/javascript\">\n",
       "        require([\"nbextensions/stix2viz/stix2viz\"], function(stix2viz) {\n",
       "            chart = $('#chart12')[0];\n",
       "            visualizer12 = new stix2viz.Viz(chart, {\"width\": 800, \"height\": 600,\n",
       "                \"iconDir\": \"/nbextensions/stix2viz/icons\", \"id\": 12});\n",
       "            visualizer12.vizStix({\n",
       "    \"type\": \"indicator\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"indicator--391fc698-426a-4912-ab28-ea181e119606\",\n",
       "    \"created\": \"2022-10-16T05:17:14.169347Z\",\n",
       "    \"modified\": \"2023-05-05T22:23:37.497918Z\",\n",
       "    \"name\": \"example.com\",\n",
       "    \"pattern\": \"[url:value = 'http://example.com/']\",\n",
       "    \"pattern_type\": \"stix\",\n",
       "    \"pattern_version\": \"2.1\",\n",
       "    \"valid_from\": \"2023-02-20T00:46:42.030523Z\",\n",
       "    \"confidence\": 89,\n",
       "    \"x_viz_variable_name\": \"example\"\n",
       "}, {\"userLabels\": {\"indicator--391fc698-426a-4912-ab28-ea181e119606\": \"example\"}});\n",
       "        });\n",
       "    </script>\n",
       "    <style type=\"text/css\">pre { line-height: 125%; }\n",
       "td.linenos pre { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "td.linenos pre.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       ".highlight .hll { background-color: #ffffcc }\n",
       ".highlight { background: #f8f8f8; }\n",
       ".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
       ".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
       ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
       ".highlight .o { color: #666666 } /* Operator */\n",
       ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
       ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
       ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
       ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
       ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
       ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
       ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
       ".highlight .ge { font-style: italic } /* Generic.Emph */\n",
       ".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
       ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
       ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
       ".highlight .go { color: #888888 } /* Generic.Output */\n",
       ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
       ".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
       ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
       ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
       ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
       ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
       ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
       ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
       ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
       ".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
       ".highlight .m { color: #666666 } /* Literal.Number */\n",
       ".highlight .s { color: #BA2121 } /* Literal.String */\n",
       ".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
       ".highlight .nb { color: #008000 } /* Name.Builtin */\n",
       ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
       ".highlight .no { color: #880000 } /* Name.Constant */\n",
       ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
       ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
       ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
       ".highlight .nf { color: #0000FF } /* Name.Function */\n",
       ".highlight .nl { color: #A0A000 } /* Name.Label */\n",
       ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
       ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
       ".highlight .nv { color: #19177C } /* Name.Variable */\n",
       ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
       ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
       ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
       ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
       ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
       ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
       ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
       ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
       ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
       ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
       ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
       ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
       ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
       ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
       ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
       ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
       ".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
       ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
       ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
       ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
       ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
       ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
       ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
       ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
       ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
       ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
       ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--391fc698-426a-4912-ab28-ea181e119606&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-10-16T05:17:14.169347Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2023-05-05T22:23:37.497918Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;example.com&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;[url:value = &#39;http://example.com/&#39;]&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;stix&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;valid_from&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2023-02-20T00:46:42.030523Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;confidence&quot;</span><span class=\"p\">:</span> <span class=\"mi\">89</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;x_viz_variable_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;example&quot;</span>\n",
       "<span class=\"p\">}</span>\n",
       "</pre></div>\n"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "execution_count": 14,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%stix\n",
    "example {name: \"example.com\", pattern: \"[url:value = 'http://example.com/']\"}: Indicator."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Special Relationships\n",
    "\n",
    "Some relationships constitute special cases that are handled slightly differently than other relationships.\n",
    "\n",
    "### object_refs\n",
    "Objects that have an `object_refs` property, such as Report or Opinion, can populate this property using the \"on\" keyword. "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {
    "scrolled": false
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <svg id='chart13' style=\"border: 2px solid #ababab;width:800px;height:600px;\"></svg>\n",
       "\n",
       "    <script type=\"text/javascript\">\n",
       "        require([\"nbextensions/stix2viz/stix2viz\"], function(stix2viz) {\n",
       "            chart = $('#chart13')[0];\n",
       "            visualizer13 = new stix2viz.Viz(chart, {\"width\": 800, \"height\": 600,\n",
       "                \"iconDir\": \"/nbextensions/stix2viz/icons\", \"id\": 13});\n",
       "            visualizer13.vizStix([{\n",
       "    \"type\": \"report\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"report--ebbf004d-871e-4c14-a71e-4db1d8e46c9d\",\n",
       "    \"created\": \"2022-08-01T14:23:08.589433Z\",\n",
       "    \"modified\": \"2022-08-25T13:43:19.708759Z\",\n",
       "    \"name\": \"arm\",\n",
       "    \"published\": \"2022-03-19T13:13:54.402526Z\",\n",
       "    \"object_refs\": [\n",
       "        \"indicator--a684f265-fba0-4b3c-a8c0-5e9b7e2aea97\",\n",
       "        \"indicator--b5707eec-b275-435d-b33e-c0201b6a7e5e\",\n",
       "        \"indicator--5c8707fe-7622-4567-bc26-f6ae0fd4fe2d\"\n",
       "    ],\n",
       "    \"confidence\": 28\n",
       "},\n",
       "{\n",
       "    \"type\": \"indicator\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"indicator--a684f265-fba0-4b3c-a8c0-5e9b7e2aea97\",\n",
       "    \"created\": \"2021-06-19T13:39:52.551554Z\",\n",
       "    \"modified\": \"2021-08-31T10:48:48.762529Z\",\n",
       "    \"indicator_types\": [\n",
       "        \"unknown\",\n",
       "        \"compromised\"\n",
       "    ],\n",
       "    \"pattern\": \"(((([software:name NOT = 'XbZQhEW'] FOLLOWEDBY [software:name = 'RrSfECaq']))))\",\n",
       "    \"pattern_type\": \"stix\",\n",
       "    \"pattern_version\": \"2.1\",\n",
       "    \"valid_from\": \"2021-06-27T01:43:49.056745Z\",\n",
       "    \"valid_until\": \"2022-06-09T01:37:45.90886Z\",\n",
       "    \"external_references\": [\n",
       "        {\n",
       "            \"source_name\": \"world\",\n",
       "            \"description\": \"Cup letter result from doctor.\",\n",
       "            \"url\": \"http://www.gibson.org/\",\n",
       "            \"hashes\": {\n",
       "                \"SHA-1\": \"b3ff1bbe52e02c3d113bc923231236c8bf313140\",\n",
       "                \"SHA-256\": \"3c55652f6702caeba8eb1966fdb5a336dea367e7e376cb8f6787f052582ec28c\",\n",
       "                \"SHA-512\": \"23bb641a91dfee9b309c45c3ef06ef747bf4089d113c633003c0bb97f418758d93f6bc0504c6cc0ef9153cf05d59838ad8b714585a0c87d8d8f268a18ed28e94\",\n",
       "                \"SHA3-512\": \"5644659110336b7cfa41203c6cb00ba821726fcc0fdb42fd541b64762cb5d934ae901efd2693b0a9469d0a4ee7c5a22d3f0f6f6a1557488a2af841b9dec971bb\"\n",
       "            },\n",
       "            \"external_id\": \"QqAIUjKOTLl\"\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"must\",\n",
       "            \"description\": \"Sort third write standard purpose natural wall.\",\n",
       "            \"external_id\": \"kkPdjobXvKBpcZsOoQ\"\n",
       "        }\n",
       "    ]\n",
       "},\n",
       "{\n",
       "    \"type\": \"indicator\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"indicator--b5707eec-b275-435d-b33e-c0201b6a7e5e\",\n",
       "    \"created\": \"2021-09-06T08:19:30.998611Z\",\n",
       "    \"modified\": \"2022-03-20T03:58:33.576214Z\",\n",
       "    \"name\": \"police\",\n",
       "    \"indicator_types\": [\n",
       "        \"unknown\",\n",
       "        \"compromised\",\n",
       "        \"unknown\"\n",
       "    ],\n",
       "    \"pattern\": \"[ipv4-addr:defanged = false] OR ((([x509-certificate:defanged NOT = false] FOLLOWEDBY ([ipv4-addr:defanged = false]))))\",\n",
       "    \"pattern_type\": \"stix\",\n",
       "    \"pattern_version\": \"2.1\",\n",
       "    \"valid_from\": \"2021-06-19T08:39:55.074688Z\",\n",
       "    \"lang\": \"en\",\n",
       "    \"external_references\": [\n",
       "        {\n",
       "            \"source_name\": \"light\",\n",
       "            \"description\": \"Recent hold science part example source.\",\n",
       "            \"external_id\": \"JPBZvyYVaXbEJJU\"\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"third\",\n",
       "            \"url\": \"http://www.nicholson.org/\"\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"argue\",\n",
       "            \"description\": \"Lawyer model science itself key food vote.\",\n",
       "            \"url\": \"https://french.com/\",\n",
       "            \"hashes\": {\n",
       "                \"SHA-256\": \"b1603a75f22395cd8148dc7a691a00b07a1405a6faa7d5be2a6bf7e0cbfd414c\",\n",
       "                \"SHA-512\": \"6380d7190c5cf21a3034c8d04b9c8f3212f3630d4d9c0b376edee48f2f331d1d54e23bc5daad4cddadbcbd8140c03152b88e03c15c809d9b83932ef27a187d26\"\n",
       "            },\n",
       "            \"external_id\": \"xRYtGoSKqmITWyuZmhNr\"\n",
       "        }\n",
       "    ]\n",
       "},\n",
       "{\n",
       "    \"type\": \"indicator\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"indicator--5c8707fe-7622-4567-bc26-f6ae0fd4fe2d\",\n",
       "    \"created\": \"2021-05-17T17:39:39.420281Z\",\n",
       "    \"modified\": \"2022-01-30T12:05:18.07704Z\",\n",
       "    \"pattern\": \"[ipv6-addr:defanged = false]\",\n",
       "    \"pattern_type\": \"stix\",\n",
       "    \"pattern_version\": \"2.1\",\n",
       "    \"valid_from\": \"2021-04-08T14:34:54.1709Z\"\n",
       "}], {\"userLabels\": {}});\n",
       "        });\n",
       "    </script>\n",
       "    <style type=\"text/css\">pre { line-height: 125%; }\n",
       "td.linenos pre { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "td.linenos pre.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       ".highlight .hll { background-color: #ffffcc }\n",
       ".highlight { background: #f8f8f8; }\n",
       ".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
       ".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
       ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
       ".highlight .o { color: #666666 } /* Operator */\n",
       ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
       ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
       ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
       ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
       ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
       ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
       ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
       ".highlight .ge { font-style: italic } /* Generic.Emph */\n",
       ".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
       ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
       ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
       ".highlight .go { color: #888888 } /* Generic.Output */\n",
       ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
       ".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
       ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
       ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
       ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
       ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
       ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
       ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
       ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
       ".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
       ".highlight .m { color: #666666 } /* Literal.Number */\n",
       ".highlight .s { color: #BA2121 } /* Literal.String */\n",
       ".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
       ".highlight .nb { color: #008000 } /* Name.Builtin */\n",
       ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
       ".highlight .no { color: #880000 } /* Name.Constant */\n",
       ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
       ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
       ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
       ".highlight .nf { color: #0000FF } /* Name.Function */\n",
       ".highlight .nl { color: #A0A000 } /* Name.Label */\n",
       ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
       ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
       ".highlight .nv { color: #19177C } /* Name.Variable */\n",
       ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
       ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
       ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
       ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
       ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
       ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
       ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
       ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
       ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
       ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
       ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
       ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
       ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
       ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
       ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
       ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
       ".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
       ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
       ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
       ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
       ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
       ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
       ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
       ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
       ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
       ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
       ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">[{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;report&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;report--ebbf004d-871e-4c14-a71e-4db1d8e46c9d&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-08-01T14:23:08.589433Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-08-25T13:43:19.708759Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;arm&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;published&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-03-19T13:13:54.402526Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;object_refs&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;indicator--a684f265-fba0-4b3c-a8c0-5e9b7e2aea97&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;indicator--b5707eec-b275-435d-b33e-c0201b6a7e5e&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;indicator--5c8707fe-7622-4567-bc26-f6ae0fd4fe2d&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;confidence&quot;</span><span class=\"p\">:</span> <span class=\"mi\">28</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--a684f265-fba0-4b3c-a8c0-5e9b7e2aea97&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-06-19T13:39:52.551554Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-08-31T10:48:48.762529Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;indicator_types&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;unknown&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;compromised&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;pattern&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;(((([software:name NOT = &#39;XbZQhEW&#39;] FOLLOWEDBY [software:name = &#39;RrSfECaq&#39;]))))&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;stix&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;valid_from&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-06-27T01:43:49.056745Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;valid_until&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-06-09T01:37:45.90886Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;external_references&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;world&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Cup letter result from doctor.&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;url&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;http://www.gibson.org/&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;hashes&quot;</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
       "                <span class=\"nt\">&quot;SHA-1&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;b3ff1bbe52e02c3d113bc923231236c8bf313140&quot;</span><span class=\"p\">,</span>\n",
       "                <span class=\"nt\">&quot;SHA-256&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;3c55652f6702caeba8eb1966fdb5a336dea367e7e376cb8f6787f052582ec28c&quot;</span><span class=\"p\">,</span>\n",
       "                <span class=\"nt\">&quot;SHA-512&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;23bb641a91dfee9b309c45c3ef06ef747bf4089d113c633003c0bb97f418758d93f6bc0504c6cc0ef9153cf05d59838ad8b714585a0c87d8d8f268a18ed28e94&quot;</span><span class=\"p\">,</span>\n",
       "                <span class=\"nt\">&quot;SHA3-512&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;5644659110336b7cfa41203c6cb00ba821726fcc0fdb42fd541b64762cb5d934ae901efd2693b0a9469d0a4ee7c5a22d3f0f6f6a1557488a2af841b9dec971bb&quot;</span>\n",
       "            <span class=\"p\">},</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;QqAIUjKOTLl&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;must&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Sort third write standard purpose natural wall.&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;kkPdjobXvKBpcZsOoQ&quot;</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">]</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--b5707eec-b275-435d-b33e-c0201b6a7e5e&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-09-06T08:19:30.998611Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-03-20T03:58:33.576214Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;police&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;indicator_types&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;unknown&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;compromised&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;unknown&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;pattern&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;[ipv4-addr:defanged = false] OR ((([x509-certificate:defanged NOT = false] FOLLOWEDBY ([ipv4-addr:defanged = false]))))&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;stix&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;valid_from&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-06-19T08:39:55.074688Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;lang&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;en&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;external_references&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;light&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Recent hold science part example source.&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;JPBZvyYVaXbEJJU&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;third&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;url&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;http://www.nicholson.org/&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;argue&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Lawyer model science itself key food vote.&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;url&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;https://french.com/&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;hashes&quot;</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
       "                <span class=\"nt\">&quot;SHA-256&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;b1603a75f22395cd8148dc7a691a00b07a1405a6faa7d5be2a6bf7e0cbfd414c&quot;</span><span class=\"p\">,</span>\n",
       "                <span class=\"nt\">&quot;SHA-512&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;6380d7190c5cf21a3034c8d04b9c8f3212f3630d4d9c0b376edee48f2f331d1d54e23bc5daad4cddadbcbd8140c03152b88e03c15c809d9b83932ef27a187d26&quot;</span>\n",
       "            <span class=\"p\">},</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;xRYtGoSKqmITWyuZmhNr&quot;</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">]</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--5c8707fe-7622-4567-bc26-f6ae0fd4fe2d&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-05-17T17:39:39.420281Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-01-30T12:05:18.07704Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;[ipv6-addr:defanged = false]&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;stix&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;valid_from&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-04-08T14:34:54.1709Z&quot;</span>\n",
       "<span class=\"p\">}]</span>\n",
       "</pre></div>\n"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "execution_count": 15,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%stix\n",
    "Report on 3 Indicator."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {
    "scrolled": false
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <svg id='chart14' style=\"border: 2px solid #ababab;width:800px;height:600px;\"></svg>\n",
       "\n",
       "    <script type=\"text/javascript\">\n",
       "        require([\"nbextensions/stix2viz/stix2viz\"], function(stix2viz) {\n",
       "            chart = $('#chart14')[0];\n",
       "            visualizer14 = new stix2viz.Viz(chart, {\"width\": 800, \"height\": 600,\n",
       "                \"iconDir\": \"/nbextensions/stix2viz/icons\", \"id\": 14});\n",
       "            visualizer14.vizStix([{\n",
       "    \"type\": \"opinion\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"opinion--e40362fe-38bd-45c6-8683-26cdb9811ba7\",\n",
       "    \"created\": \"2022-07-06T15:18:39.841067Z\",\n",
       "    \"modified\": \"2022-11-21T10:16:26.599052Z\",\n",
       "    \"explanation\": \"Theory serve although. Each throughout walk benefit.\",\n",
       "    \"authors\": [\n",
       "        \"describe\"\n",
       "    ],\n",
       "    \"opinion\": \"strongly-disagree\",\n",
       "    \"object_refs\": [\n",
       "        \"campaign--45e2c5a5-c545-4098-abb7-b5d29221a5f9\",\n",
       "        \"indicator--1a82a28f-37da-4a78-8835-202efd421e14\",\n",
       "        \"indicator--0a16db6c-2db5-4173-927d-bf07bbb61645\"\n",
       "    ],\n",
       "    \"labels\": [\n",
       "        \"couple\",\n",
       "        \"property\",\n",
       "        \"adult\"\n",
       "    ],\n",
       "    \"external_references\": [\n",
       "        {\n",
       "            \"source_name\": \"best\",\n",
       "            \"description\": \"Tough compare success shake loss.\",\n",
       "            \"hashes\": {\n",
       "                \"MD5\": \"f7ade4a9bf6f14c2ad979150600c8734\",\n",
       "                \"SHA-1\": \"e1eea2e468e2dadeb76240888442296c30628b28\",\n",
       "                \"SHA3-256\": \"2ea8bce243d1a9e1909e151bec78edca3c97084b55b5d1970dbfbe91c58fd494\",\n",
       "                \"SHA3-512\": \"fe85133a4e6c086d815577c181926156ff50fd274cff9f14229df62e35dd6c82c31d414ccad5254b0e6577d64aaf04c2ecceefa1312e82287fbb13ae2267809f\"\n",
       "            },\n",
       "            \"external_id\": \"XlIcsJWLByBASmpwFxb\"\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"public\",\n",
       "            \"hashes\": {\n",
       "                \"SHA-1\": \"32d889c449ba80d66ecc6168c91201b996d1cc1d\",\n",
       "                \"SHA-256\": \"92e5360d7a19a80d6e8227dc4bb6689737ea9266b5f265eec3d4d5a947e2767a\",\n",
       "                \"SHA3-256\": \"b34029138845a885da4c73a2edcf614e597443493943643535d4e37eb43d88d4\"\n",
       "            },\n",
       "            \"external_id\": \"RcMpKGEhniyhm\"\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"pressure\",\n",
       "            \"hashes\": {\n",
       "                \"SHA-256\": \"b42102dce5db06e347fdc3bbb8397831cc444971b4ce3a6d0c29cf904a07e1b9\"\n",
       "            },\n",
       "            \"external_id\": \"iDqOTgsURLn\"\n",
       "        }\n",
       "    ]\n",
       "},\n",
       "{\n",
       "    \"type\": \"campaign\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"campaign--45e2c5a5-c545-4098-abb7-b5d29221a5f9\",\n",
       "    \"created\": \"2023-03-02T03:42:20.353953Z\",\n",
       "    \"modified\": \"2023-06-18T02:08:12.0513Z\",\n",
       "    \"name\": \"computer\",\n",
       "    \"labels\": [\n",
       "        \"likely\",\n",
       "        \"huge\",\n",
       "        \"power\"\n",
       "    ],\n",
       "    \"external_references\": [\n",
       "        {\n",
       "            \"source_name\": \"everyone\",\n",
       "            \"description\": \"Laugh buy rich writer toward another.\",\n",
       "            \"url\": \"http://johnson.com/\"\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"sit\",\n",
       "            \"url\": \"https://dillon-collier.org/\",\n",
       "            \"external_id\": \"nylnCtlGkhaXfg\"\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"tree\",\n",
       "            \"external_id\": \"VsANLfFubA\"\n",
       "        }\n",
       "    ]\n",
       "},\n",
       "{\n",
       "    \"type\": \"indicator\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"indicator--1a82a28f-37da-4a78-8835-202efd421e14\",\n",
       "    \"created\": \"2022-06-01T00:32:43.984266Z\",\n",
       "    \"modified\": \"2022-09-02T15:28:46.172744Z\",\n",
       "    \"name\": \"news\",\n",
       "    \"pattern\": \"(((([domain-name:defanged = false] OR ([directory:defanged NOT = false] REPEATS 8 TIMES))) WITHIN 3 SECONDS))\",\n",
       "    \"pattern_type\": \"stix\",\n",
       "    \"pattern_version\": \"2.1\",\n",
       "    \"valid_from\": \"2021-10-26T18:46:07.546264Z\",\n",
       "    \"valid_until\": \"2022-04-08T02:30:47.467313Z\",\n",
       "    \"labels\": [\n",
       "        \"available\"\n",
       "    ],\n",
       "    \"confidence\": 55\n",
       "},\n",
       "{\n",
       "    \"type\": \"indicator\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"indicator--0a16db6c-2db5-4173-927d-bf07bbb61645\",\n",
       "    \"created\": \"2022-11-04T19:23:19.433856Z\",\n",
       "    \"modified\": \"2023-09-02T08:40:40.394821Z\",\n",
       "    \"indicator_types\": [\n",
       "        \"malicious-activity\",\n",
       "        \"compromised\",\n",
       "        \"attribution\"\n",
       "    ],\n",
       "    \"pattern\": \"([ipv4-addr:value <= '126.45.49.136'] WITHIN 5 SECONDS) OR [windows-registry-key:defanged = false]\",\n",
       "    \"pattern_type\": \"stix\",\n",
       "    \"pattern_version\": \"2.1\",\n",
       "    \"valid_from\": \"2022-05-09T08:15:57.575894Z\",\n",
       "    \"kill_chain_phases\": [\n",
       "        {\n",
       "            \"kill_chain_name\": \"qisNkPAylQ\",\n",
       "            \"phase_name\": \"BGtpjMzsPgvWyfkp\"\n",
       "        },\n",
       "        {\n",
       "            \"kill_chain_name\": \"lockheed-martin-cyber-kill-chain\",\n",
       "            \"phase_name\": \"exploitation\"\n",
       "        }\n",
       "    ]\n",
       "}], {\"userLabels\": {}});\n",
       "        });\n",
       "    </script>\n",
       "    <style type=\"text/css\">pre { line-height: 125%; }\n",
       "td.linenos pre { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "td.linenos pre.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       ".highlight .hll { background-color: #ffffcc }\n",
       ".highlight { background: #f8f8f8; }\n",
       ".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
       ".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
       ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
       ".highlight .o { color: #666666 } /* Operator */\n",
       ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
       ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
       ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
       ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
       ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
       ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
       ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
       ".highlight .ge { font-style: italic } /* Generic.Emph */\n",
       ".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
       ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
       ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
       ".highlight .go { color: #888888 } /* Generic.Output */\n",
       ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
       ".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
       ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
       ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
       ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
       ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
       ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
       ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
       ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
       ".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
       ".highlight .m { color: #666666 } /* Literal.Number */\n",
       ".highlight .s { color: #BA2121 } /* Literal.String */\n",
       ".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
       ".highlight .nb { color: #008000 } /* Name.Builtin */\n",
       ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
       ".highlight .no { color: #880000 } /* Name.Constant */\n",
       ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
       ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
       ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
       ".highlight .nf { color: #0000FF } /* Name.Function */\n",
       ".highlight .nl { color: #A0A000 } /* Name.Label */\n",
       ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
       ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
       ".highlight .nv { color: #19177C } /* Name.Variable */\n",
       ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
       ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
       ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
       ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
       ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
       ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
       ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
       ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
       ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
       ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
       ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
       ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
       ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
       ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
       ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
       ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
       ".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
       ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
       ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
       ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
       ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
       ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
       ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
       ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
       ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
       ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
       ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">[{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;opinion&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;opinion--e40362fe-38bd-45c6-8683-26cdb9811ba7&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-07-06T15:18:39.841067Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-11-21T10:16:26.599052Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;explanation&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Theory serve although. Each throughout walk benefit.&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;authors&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;describe&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;opinion&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;strongly-disagree&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;object_refs&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;campaign--45e2c5a5-c545-4098-abb7-b5d29221a5f9&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;indicator--1a82a28f-37da-4a78-8835-202efd421e14&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;indicator--0a16db6c-2db5-4173-927d-bf07bbb61645&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;labels&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;couple&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;property&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;adult&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;external_references&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;best&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Tough compare success shake loss.&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;hashes&quot;</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
       "                <span class=\"nt\">&quot;MD5&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;f7ade4a9bf6f14c2ad979150600c8734&quot;</span><span class=\"p\">,</span>\n",
       "                <span class=\"nt\">&quot;SHA-1&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;e1eea2e468e2dadeb76240888442296c30628b28&quot;</span><span class=\"p\">,</span>\n",
       "                <span class=\"nt\">&quot;SHA3-256&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2ea8bce243d1a9e1909e151bec78edca3c97084b55b5d1970dbfbe91c58fd494&quot;</span><span class=\"p\">,</span>\n",
       "                <span class=\"nt\">&quot;SHA3-512&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;fe85133a4e6c086d815577c181926156ff50fd274cff9f14229df62e35dd6c82c31d414ccad5254b0e6577d64aaf04c2ecceefa1312e82287fbb13ae2267809f&quot;</span>\n",
       "            <span class=\"p\">},</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;XlIcsJWLByBASmpwFxb&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;public&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;hashes&quot;</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
       "                <span class=\"nt\">&quot;SHA-1&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;32d889c449ba80d66ecc6168c91201b996d1cc1d&quot;</span><span class=\"p\">,</span>\n",
       "                <span class=\"nt\">&quot;SHA-256&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;92e5360d7a19a80d6e8227dc4bb6689737ea9266b5f265eec3d4d5a947e2767a&quot;</span><span class=\"p\">,</span>\n",
       "                <span class=\"nt\">&quot;SHA3-256&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;b34029138845a885da4c73a2edcf614e597443493943643535d4e37eb43d88d4&quot;</span>\n",
       "            <span class=\"p\">},</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;RcMpKGEhniyhm&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;pressure&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;hashes&quot;</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
       "                <span class=\"nt\">&quot;SHA-256&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;b42102dce5db06e347fdc3bbb8397831cc444971b4ce3a6d0c29cf904a07e1b9&quot;</span>\n",
       "            <span class=\"p\">},</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;iDqOTgsURLn&quot;</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">]</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;campaign&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;campaign--45e2c5a5-c545-4098-abb7-b5d29221a5f9&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2023-03-02T03:42:20.353953Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2023-06-18T02:08:12.0513Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;computer&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;labels&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;likely&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;huge&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;power&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;external_references&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;everyone&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Laugh buy rich writer toward another.&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;url&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;http://johnson.com/&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;sit&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;url&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;https://dillon-collier.org/&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;nylnCtlGkhaXfg&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;tree&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;VsANLfFubA&quot;</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">]</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--1a82a28f-37da-4a78-8835-202efd421e14&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-06-01T00:32:43.984266Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-09-02T15:28:46.172744Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;news&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;(((([domain-name:defanged = false] OR ([directory:defanged NOT = false] REPEATS 8 TIMES))) WITHIN 3 SECONDS))&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;stix&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;valid_from&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-10-26T18:46:07.546264Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;valid_until&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-04-08T02:30:47.467313Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;labels&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;available&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;confidence&quot;</span><span class=\"p\">:</span> <span class=\"mi\">55</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--0a16db6c-2db5-4173-927d-bf07bbb61645&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-11-04T19:23:19.433856Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2023-09-02T08:40:40.394821Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;indicator_types&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;malicious-activity&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;compromised&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;attribution&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;pattern&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;([ipv4-addr:value &lt;= &#39;126.45.49.136&#39;] WITHIN 5 SECONDS) OR [windows-registry-key:defanged = false]&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;stix&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;valid_from&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-05-09T08:15:57.575894Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;kill_chain_phases&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;kill_chain_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;qisNkPAylQ&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;phase_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;BGtpjMzsPgvWyfkp&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;kill_chain_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;lockheed-martin-cyber-kill-chain&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;phase_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;exploitation&quot;</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">]</span>\n",
       "<span class=\"p\">}]</span>\n",
       "</pre></div>\n"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "execution_count": 16,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%stix\n",
    "Opinion on (1 Campaign 2 Indicator)."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Sightings\n",
    "\n",
    "Similarly, create sightings of objects using Sighting as the source object type and \"of\" as the relationship keyword."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {
    "scrolled": false
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <svg id='chart15' style=\"border: 2px solid #ababab;width:800px;height:600px;\"></svg>\n",
       "\n",
       "    <script type=\"text/javascript\">\n",
       "        require([\"nbextensions/stix2viz/stix2viz\"], function(stix2viz) {\n",
       "            chart = $('#chart15')[0];\n",
       "            visualizer15 = new stix2viz.Viz(chart, {\"width\": 800, \"height\": 600,\n",
       "                \"iconDir\": \"/nbextensions/stix2viz/icons\", \"id\": 15});\n",
       "            visualizer15.vizStix([{\n",
       "    \"type\": \"indicator\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"indicator--75c2ead4-b613-4566-b216-22ce639fe3b8\",\n",
       "    \"created\": \"2021-07-31T20:38:41.158393Z\",\n",
       "    \"modified\": \"2022-01-17T04:12:07.664093Z\",\n",
       "    \"pattern\": \"[email-addr:value = 'charleszimmerman@rowland-simpson.com' AND (email-addr:defanged = false)]\",\n",
       "    \"pattern_type\": \"stix\",\n",
       "    \"pattern_version\": \"2.1\",\n",
       "    \"valid_from\": \"2021-12-05T07:04:47.787843Z\",\n",
       "    \"valid_until\": \"2022-08-12T09:07:06.56191Z\",\n",
       "    \"confidence\": 95,\n",
       "    \"external_references\": [\n",
       "        {\n",
       "            \"source_name\": \"seek\",\n",
       "            \"url\": \"http://cooper.net/\",\n",
       "            \"external_id\": \"waOncERNIJwTMyuSWjt\"\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"assume\",\n",
       "            \"description\": \"Collection certain certain which.\",\n",
       "            \"external_id\": \"HmYfi\"\n",
       "        }\n",
       "    ]\n",
       "},\n",
       "{\n",
       "    \"type\": \"sighting\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"sighting--b16c3c57-25e7-41f0-9b69-b5f0ed5cdedc\",\n",
       "    \"created\": \"2021-09-24T21:25:02.318391Z\",\n",
       "    \"modified\": \"2022-04-05T17:22:27.68411Z\",\n",
       "    \"count\": 604957125,\n",
       "    \"sighting_of_ref\": \"indicator--75c2ead4-b613-4566-b216-22ce639fe3b8\",\n",
       "    \"summary\": true,\n",
       "    \"labels\": [\n",
       "        \"read\",\n",
       "        \"movie\",\n",
       "        \"community\"\n",
       "    ],\n",
       "    \"lang\": \"en\"\n",
       "}], {\"userLabels\": {}});\n",
       "        });\n",
       "    </script>\n",
       "    <style type=\"text/css\">pre { line-height: 125%; }\n",
       "td.linenos pre { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "td.linenos pre.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       ".highlight .hll { background-color: #ffffcc }\n",
       ".highlight { background: #f8f8f8; }\n",
       ".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
       ".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
       ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
       ".highlight .o { color: #666666 } /* Operator */\n",
       ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
       ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
       ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
       ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
       ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
       ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
       ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
       ".highlight .ge { font-style: italic } /* Generic.Emph */\n",
       ".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
       ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
       ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
       ".highlight .go { color: #888888 } /* Generic.Output */\n",
       ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
       ".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
       ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
       ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
       ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
       ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
       ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
       ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
       ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
       ".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
       ".highlight .m { color: #666666 } /* Literal.Number */\n",
       ".highlight .s { color: #BA2121 } /* Literal.String */\n",
       ".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
       ".highlight .nb { color: #008000 } /* Name.Builtin */\n",
       ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
       ".highlight .no { color: #880000 } /* Name.Constant */\n",
       ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
       ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
       ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
       ".highlight .nf { color: #0000FF } /* Name.Function */\n",
       ".highlight .nl { color: #A0A000 } /* Name.Label */\n",
       ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
       ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
       ".highlight .nv { color: #19177C } /* Name.Variable */\n",
       ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
       ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
       ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
       ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
       ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
       ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
       ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
       ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
       ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
       ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
       ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
       ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
       ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
       ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
       ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
       ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
       ".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
       ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
       ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
       ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
       ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
       ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
       ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
       ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
       ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
       ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
       ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">[{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--75c2ead4-b613-4566-b216-22ce639fe3b8&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-07-31T20:38:41.158393Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-01-17T04:12:07.664093Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;[email-addr:value = &#39;charleszimmerman@rowland-simpson.com&#39; AND (email-addr:defanged = false)]&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;stix&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;pattern_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;valid_from&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-12-05T07:04:47.787843Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;valid_until&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-08-12T09:07:06.56191Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;confidence&quot;</span><span class=\"p\">:</span> <span class=\"mi\">95</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;external_references&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;seek&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;url&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;http://cooper.net/&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;waOncERNIJwTMyuSWjt&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;assume&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Collection certain certain which.&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;HmYfi&quot;</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">]</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;sighting&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;sighting--b16c3c57-25e7-41f0-9b69-b5f0ed5cdedc&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-09-24T21:25:02.318391Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-04-05T17:22:27.68411Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;count&quot;</span><span class=\"p\">:</span> <span class=\"mi\">604957125</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;sighting_of_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--75c2ead4-b613-4566-b216-22ce639fe3b8&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;summary&quot;</span><span class=\"p\">:</span> <span class=\"kc\">true</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;labels&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;read&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;movie&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;community&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;lang&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;en&quot;</span>\n",
       "<span class=\"p\">}]</span>\n",
       "</pre></div>\n"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "execution_count": 17,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%stix\n",
    "Sighting of Indicator."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Embedded Relationships\n",
    "\n",
    "Embedded relationships can be set like any other property, using the curly brace syntax with multiple embedded relationships separated by commas."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {
    "scrolled": false
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <svg id='chart16' style=\"border: 2px solid #ababab;width:800px;height:600px;\"></svg>\n",
       "\n",
       "    <script type=\"text/javascript\">\n",
       "        require([\"nbextensions/stix2viz/stix2viz\"], function(stix2viz) {\n",
       "            chart = $('#chart16')[0];\n",
       "            visualizer16 = new stix2viz.Viz(chart, {\"width\": 800, \"height\": 600,\n",
       "                \"iconDir\": \"/nbextensions/stix2viz/icons\", \"id\": 16});\n",
       "            visualizer16.vizStix([{\n",
       "    \"type\": \"identity\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"identity--30c2d7f3-e0ba-4ee0-8474-70510afd7b6e\",\n",
       "    \"created\": \"2021-10-21T15:23:52.099987Z\",\n",
       "    \"modified\": \"2022-09-20T13:17:20.181913Z\",\n",
       "    \"name\": \"Sanchez, Anderson and Johnson\",\n",
       "    \"sectors\": [\n",
       "        \"entertainment\",\n",
       "        \"infrastructure\"\n",
       "    ]\n",
       "},\n",
       "{\n",
       "    \"type\": \"observed-data\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"observed-data--8ebd544f-6ea3-4bf0-9afe-d0b6acb4d0b2\",\n",
       "    \"created\": \"2022-06-21T20:01:40.012175Z\",\n",
       "    \"modified\": \"2022-09-03T21:28:56.337201Z\",\n",
       "    \"first_observed\": \"2023-01-29T21:24:59.486484Z\",\n",
       "    \"last_observed\": \"2023-03-28T12:49:32.204534Z\",\n",
       "    \"number_observed\": 943000755,\n",
       "    \"objects\": {\n",
       "        \"x509-certificate--8bf34b55-376f-4967-a95c-b136a3f28fd3\": {\n",
       "            \"type\": \"x509-certificate\",\n",
       "            \"spec_version\": \"2.1\",\n",
       "            \"id\": \"x509-certificate--8bf34b55-376f-4967-a95c-b136a3f28fd3\",\n",
       "            \"is_self_signed\": false,\n",
       "            \"hashes\": {\n",
       "                \"MD5\": \"394c746cc3e06f65fae4082dcbbf5a36\",\n",
       "                \"SHA-512\": \"84a57881057cf1fc18a1466df3d66ecb2477c7cc173d14aee25ee81d0bf47ce5a2f16a7b9d08009b4e9265ff56ed15c7c353107fa42f9fd9428193fe805cfb6d\"\n",
       "            },\n",
       "            \"signature_algorithm\": \"respond\",\n",
       "            \"issuer\": \"Morrison and Sons\",\n",
       "            \"subject_public_key_modulus\": \"669881280031097900613139615860\"\n",
       "        }\n",
       "    }\n",
       "},\n",
       "{\n",
       "    \"type\": \"malware\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"malware--b50092d0-af4d-4b56-86e3-6167bc08c8f7\",\n",
       "    \"created\": \"2021-11-28T09:02:05.207194Z\",\n",
       "    \"modified\": \"2022-02-01T04:24:16.653206Z\",\n",
       "    \"name\": \"through\",\n",
       "    \"is_family\": true,\n",
       "    \"aliases\": [\n",
       "        \"meet\",\n",
       "        \"experience\"\n",
       "    ],\n",
       "    \"last_seen\": \"2022-06-05T14:46:16.623985Z\",\n",
       "    \"implementation_languages\": [\n",
       "        \"c#\",\n",
       "        \"scala\"\n",
       "    ],\n",
       "    \"labels\": [\n",
       "        \"it\"\n",
       "    ],\n",
       "    \"confidence\": 34,\n",
       "    \"lang\": \"en\"\n",
       "},\n",
       "{\n",
       "    \"type\": \"sighting\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"sighting--fca99473-63ba-4b92-a3c7-75b071ab9d46\",\n",
       "    \"created_by_ref\": \"identity--30c2d7f3-e0ba-4ee0-8474-70510afd7b6e\",\n",
       "    \"created\": \"2022-11-22T15:36:52.261319Z\",\n",
       "    \"modified\": \"2023-01-12T12:47:16.91287Z\",\n",
       "    \"sighting_of_ref\": \"malware--b50092d0-af4d-4b56-86e3-6167bc08c8f7\",\n",
       "    \"observed_data_refs\": [\n",
       "        \"observed-data--8ebd544f-6ea3-4bf0-9afe-d0b6acb4d0b2\"\n",
       "    ]\n",
       "}], {\"userLabels\": {}});\n",
       "        });\n",
       "    </script>\n",
       "    <style type=\"text/css\">pre { line-height: 125%; }\n",
       "td.linenos pre { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "td.linenos pre.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       ".highlight .hll { background-color: #ffffcc }\n",
       ".highlight { background: #f8f8f8; }\n",
       ".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
       ".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
       ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
       ".highlight .o { color: #666666 } /* Operator */\n",
       ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
       ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
       ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
       ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
       ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
       ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
       ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
       ".highlight .ge { font-style: italic } /* Generic.Emph */\n",
       ".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
       ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
       ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
       ".highlight .go { color: #888888 } /* Generic.Output */\n",
       ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
       ".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
       ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
       ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
       ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
       ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
       ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
       ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
       ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
       ".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
       ".highlight .m { color: #666666 } /* Literal.Number */\n",
       ".highlight .s { color: #BA2121 } /* Literal.String */\n",
       ".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
       ".highlight .nb { color: #008000 } /* Name.Builtin */\n",
       ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
       ".highlight .no { color: #880000 } /* Name.Constant */\n",
       ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
       ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
       ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
       ".highlight .nf { color: #0000FF } /* Name.Function */\n",
       ".highlight .nl { color: #A0A000 } /* Name.Label */\n",
       ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
       ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
       ".highlight .nv { color: #19177C } /* Name.Variable */\n",
       ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
       ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
       ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
       ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
       ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
       ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
       ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
       ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
       ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
       ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
       ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
       ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
       ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
       ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
       ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
       ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
       ".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
       ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
       ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
       ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
       ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
       ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
       ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
       ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
       ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
       ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
       ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">[{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;identity&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;identity--30c2d7f3-e0ba-4ee0-8474-70510afd7b6e&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-10-21T15:23:52.099987Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-09-20T13:17:20.181913Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Sanchez, Anderson and Johnson&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;sectors&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;entertainment&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;infrastructure&quot;</span>\n",
       "    <span class=\"p\">]</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;observed-data&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;observed-data--8ebd544f-6ea3-4bf0-9afe-d0b6acb4d0b2&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-06-21T20:01:40.012175Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-09-03T21:28:56.337201Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;first_observed&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2023-01-29T21:24:59.486484Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;last_observed&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2023-03-28T12:49:32.204534Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;number_observed&quot;</span><span class=\"p\">:</span> <span class=\"mi\">943000755</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;objects&quot;</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
       "        <span class=\"nt\">&quot;x509-certificate--8bf34b55-376f-4967-a95c-b136a3f28fd3&quot;</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;x509-certificate&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;x509-certificate--8bf34b55-376f-4967-a95c-b136a3f28fd3&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;is_self_signed&quot;</span><span class=\"p\">:</span> <span class=\"kc\">false</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;hashes&quot;</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
       "                <span class=\"nt\">&quot;MD5&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;394c746cc3e06f65fae4082dcbbf5a36&quot;</span><span class=\"p\">,</span>\n",
       "                <span class=\"nt\">&quot;SHA-512&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;84a57881057cf1fc18a1466df3d66ecb2477c7cc173d14aee25ee81d0bf47ce5a2f16a7b9d08009b4e9265ff56ed15c7c353107fa42f9fd9428193fe805cfb6d&quot;</span>\n",
       "            <span class=\"p\">},</span>\n",
       "            <span class=\"nt\">&quot;signature_algorithm&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;respond&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;issuer&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Morrison and Sons&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;subject_public_key_modulus&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;669881280031097900613139615860&quot;</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">}</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware--b50092d0-af4d-4b56-86e3-6167bc08c8f7&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-11-28T09:02:05.207194Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-02-01T04:24:16.653206Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;through&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;is_family&quot;</span><span class=\"p\">:</span> <span class=\"kc\">true</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;aliases&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;meet&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;experience&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;last_seen&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-06-05T14:46:16.623985Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;implementation_languages&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;c#&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;scala&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;labels&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;it&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;confidence&quot;</span><span class=\"p\">:</span> <span class=\"mi\">34</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;lang&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;en&quot;</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;sighting&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;sighting--fca99473-63ba-4b92-a3c7-75b071ab9d46&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created_by_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;identity--30c2d7f3-e0ba-4ee0-8474-70510afd7b6e&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-11-22T15:36:52.261319Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2023-01-12T12:47:16.91287Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;sighting_of_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware--b50092d0-af4d-4b56-86e3-6167bc08c8f7&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;observed_data_refs&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;observed-data--8ebd544f-6ea3-4bf0-9afe-d0b6acb4d0b2&quot;</span>\n",
       "    <span class=\"p\">]</span>\n",
       "<span class=\"p\">}]</span>\n",
       "</pre></div>\n"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "execution_count": 18,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%stix\n",
    "Sighting {created_by_ref: Identity, observed_data_refs: Observed_Data} of Malware."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Chaining\n",
    "\n",
    "Objects can also be used as both a source and a target of two different relationships, effectively \"chaining\" them together."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "metadata": {
    "scrolled": false
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <svg id='chart17' style=\"border: 2px solid #ababab;width:800px;height:600px;\"></svg>\n",
       "\n",
       "    <script type=\"text/javascript\">\n",
       "        require([\"nbextensions/stix2viz/stix2viz\"], function(stix2viz) {\n",
       "            chart = $('#chart17')[0];\n",
       "            visualizer17 = new stix2viz.Viz(chart, {\"width\": 800, \"height\": 600,\n",
       "                \"iconDir\": \"/nbextensions/stix2viz/icons\", \"id\": 17});\n",
       "            visualizer17.vizStix([{\n",
       "    \"type\": \"campaign\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"campaign--85e5b288-22e0-4cef-95a2-d0ec119ea276\",\n",
       "    \"created\": \"2022-04-07T04:43:56.978461Z\",\n",
       "    \"modified\": \"2022-06-16T15:05:12.248037Z\",\n",
       "    \"name\": \"response\",\n",
       "    \"description\": \"Four whatever change present person account skill.\",\n",
       "    \"first_seen\": \"2022-07-07T12:53:36.185697Z\",\n",
       "    \"last_seen\": \"2023-02-25T02:39:27.153162Z\"\n",
       "},\n",
       "{\n",
       "    \"type\": \"malware\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"malware--d50c947c-48aa-42ab-908d-549b5559dcac\",\n",
       "    \"created\": \"2021-08-20T19:24:18.590925Z\",\n",
       "    \"modified\": \"2021-11-08T19:19:19.659374Z\",\n",
       "    \"name\": \"include\",\n",
       "    \"malware_types\": [\n",
       "        \"resource-exploitation\",\n",
       "        \"dropper\",\n",
       "        \"downloader\"\n",
       "    ],\n",
       "    \"is_family\": true,\n",
       "    \"kill_chain_phases\": [\n",
       "        {\n",
       "            \"kill_chain_name\": \"lockheed-martin-cyber-kill-chain\",\n",
       "            \"phase_name\": \"reconnaissance\"\n",
       "        }\n",
       "    ],\n",
       "    \"last_seen\": \"2023-02-22T02:16:09.55909Z\",\n",
       "    \"implementation_languages\": [\n",
       "        \"scala\"\n",
       "    ],\n",
       "    \"capabilities\": [\n",
       "        \"commits-fraud\",\n",
       "        \"exfiltrates-data\"\n",
       "    ],\n",
       "    \"external_references\": [\n",
       "        {\n",
       "            \"source_name\": \"main\",\n",
       "            \"external_id\": \"hNJutufzYBKsahIN\"\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"threat\",\n",
       "            \"url\": \"https://www.brown.com/\",\n",
       "            \"hashes\": {\n",
       "                \"MD5\": \"603d5d0d27eec6e9752da1831ea42b42\",\n",
       "                \"SHA-256\": \"3ab9e280b83f28ba76203653e7aec85a72b0c6ba5b67455de913751a21c0a37c\",\n",
       "                \"SHA3-256\": \"802ade992a6b0abd37be779968ac2e5b6350181ee671e0f2b63191f81f73ce58\"\n",
       "            }\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"community\",\n",
       "            \"description\": \"Project argue move account owner art song.\",\n",
       "            \"hashes\": {\n",
       "                \"SHA-1\": \"73edc342683972301838cc59b947869c81c39428\",\n",
       "                \"SHA-256\": \"36745e45e1d8486b83737fa703a88235e06959ac7b8fe95c0f4940648a5a9d1d\",\n",
       "                \"SHA-512\": \"f896a39f7a824d0eb733368a7ac47c985e07d28bf4515c66c943d160dfc4ad38dccc2f6d33d12e1f389305a691697f355d71e4f6fa8f928b49ce4794280ffb85\"\n",
       "            },\n",
       "            \"external_id\": \"bKeflHFQWN\"\n",
       "        }\n",
       "    ]\n",
       "},\n",
       "{\n",
       "    \"type\": \"identity\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"identity--ba4e742c-1091-4f19-9ccc-63bd12de0da3\",\n",
       "    \"created\": \"2022-03-19T22:43:16.127134Z\",\n",
       "    \"modified\": \"2023-03-04T02:24:24.759416Z\",\n",
       "    \"name\": \"Thomas-Mccormick\",\n",
       "    \"description\": \"Re-engineered global conglomeration\",\n",
       "    \"roles\": [\n",
       "        \"why\",\n",
       "        \"art\",\n",
       "        \"image\"\n",
       "    ],\n",
       "    \"identity_class\": \"class\",\n",
       "    \"contact_information\": \"16207 Henry Station Apt. 912\\nWilliamsshire, FL 46015\",\n",
       "    \"external_references\": [\n",
       "        {\n",
       "            \"source_name\": \"whole\",\n",
       "            \"description\": \"Card front mission left program.\",\n",
       "            \"url\": \"https://norris.info/\",\n",
       "            \"external_id\": \"hARqC\"\n",
       "        }\n",
       "    ]\n",
       "},\n",
       "{\n",
       "    \"type\": \"relationship\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"relationship--05cc6f9e-e1e3-4a9a-98b9-2010e26ff821\",\n",
       "    \"created\": \"2022-08-25T16:18:23.200252Z\",\n",
       "    \"modified\": \"2023-03-18T08:31:06.868852Z\",\n",
       "    \"relationship_type\": \"targets\",\n",
       "    \"description\": \"Activity adult wear common machine tax well. Ok community beat term chance follow road.\",\n",
       "    \"source_ref\": \"malware--d50c947c-48aa-42ab-908d-549b5559dcac\",\n",
       "    \"target_ref\": \"identity--ba4e742c-1091-4f19-9ccc-63bd12de0da3\",\n",
       "    \"labels\": [\n",
       "        \"among\",\n",
       "        \"understand\"\n",
       "    ]\n",
       "},\n",
       "{\n",
       "    \"type\": \"relationship\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"relationship--fc824fd6-7ea0-49ec-bca0-1e43ceaf6575\",\n",
       "    \"created\": \"2023-03-24T17:58:31.100349Z\",\n",
       "    \"modified\": \"2024-03-17T23:10:02.099877Z\",\n",
       "    \"relationship_type\": \"uses\",\n",
       "    \"source_ref\": \"campaign--85e5b288-22e0-4cef-95a2-d0ec119ea276\",\n",
       "    \"target_ref\": \"malware--d50c947c-48aa-42ab-908d-549b5559dcac\"\n",
       "}], {\"userLabels\": {}});\n",
       "        });\n",
       "    </script>\n",
       "    <style type=\"text/css\">pre { line-height: 125%; }\n",
       "td.linenos pre { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "td.linenos pre.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       ".highlight .hll { background-color: #ffffcc }\n",
       ".highlight { background: #f8f8f8; }\n",
       ".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
       ".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
       ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
       ".highlight .o { color: #666666 } /* Operator */\n",
       ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
       ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
       ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
       ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
       ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
       ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
       ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
       ".highlight .ge { font-style: italic } /* Generic.Emph */\n",
       ".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
       ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
       ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
       ".highlight .go { color: #888888 } /* Generic.Output */\n",
       ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
       ".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
       ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
       ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
       ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
       ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
       ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
       ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
       ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
       ".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
       ".highlight .m { color: #666666 } /* Literal.Number */\n",
       ".highlight .s { color: #BA2121 } /* Literal.String */\n",
       ".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
       ".highlight .nb { color: #008000 } /* Name.Builtin */\n",
       ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
       ".highlight .no { color: #880000 } /* Name.Constant */\n",
       ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
       ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
       ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
       ".highlight .nf { color: #0000FF } /* Name.Function */\n",
       ".highlight .nl { color: #A0A000 } /* Name.Label */\n",
       ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
       ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
       ".highlight .nv { color: #19177C } /* Name.Variable */\n",
       ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
       ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
       ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
       ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
       ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
       ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
       ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
       ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
       ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
       ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
       ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
       ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
       ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
       ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
       ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
       ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
       ".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
       ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
       ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
       ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
       ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
       ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
       ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
       ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
       ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
       ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
       ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">[{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;campaign&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;campaign--85e5b288-22e0-4cef-95a2-d0ec119ea276&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-04-07T04:43:56.978461Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-06-16T15:05:12.248037Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;response&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Four whatever change present person account skill.&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;first_seen&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-07-07T12:53:36.185697Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;last_seen&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2023-02-25T02:39:27.153162Z&quot;</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware--d50c947c-48aa-42ab-908d-549b5559dcac&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-08-20T19:24:18.590925Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-11-08T19:19:19.659374Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;include&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;malware_types&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;resource-exploitation&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;dropper&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;downloader&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;is_family&quot;</span><span class=\"p\">:</span> <span class=\"kc\">true</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;kill_chain_phases&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;kill_chain_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;lockheed-martin-cyber-kill-chain&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;phase_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;reconnaissance&quot;</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;last_seen&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2023-02-22T02:16:09.55909Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;implementation_languages&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;scala&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;capabilities&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;commits-fraud&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;exfiltrates-data&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;external_references&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;main&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;hNJutufzYBKsahIN&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;threat&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;url&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;https://www.brown.com/&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;hashes&quot;</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
       "                <span class=\"nt\">&quot;MD5&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;603d5d0d27eec6e9752da1831ea42b42&quot;</span><span class=\"p\">,</span>\n",
       "                <span class=\"nt\">&quot;SHA-256&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;3ab9e280b83f28ba76203653e7aec85a72b0c6ba5b67455de913751a21c0a37c&quot;</span><span class=\"p\">,</span>\n",
       "                <span class=\"nt\">&quot;SHA3-256&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;802ade992a6b0abd37be779968ac2e5b6350181ee671e0f2b63191f81f73ce58&quot;</span>\n",
       "            <span class=\"p\">}</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;community&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Project argue move account owner art song.&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;hashes&quot;</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
       "                <span class=\"nt\">&quot;SHA-1&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;73edc342683972301838cc59b947869c81c39428&quot;</span><span class=\"p\">,</span>\n",
       "                <span class=\"nt\">&quot;SHA-256&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;36745e45e1d8486b83737fa703a88235e06959ac7b8fe95c0f4940648a5a9d1d&quot;</span><span class=\"p\">,</span>\n",
       "                <span class=\"nt\">&quot;SHA-512&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;f896a39f7a824d0eb733368a7ac47c985e07d28bf4515c66c943d160dfc4ad38dccc2f6d33d12e1f389305a691697f355d71e4f6fa8f928b49ce4794280ffb85&quot;</span>\n",
       "            <span class=\"p\">},</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;bKeflHFQWN&quot;</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">]</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;identity&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;identity--ba4e742c-1091-4f19-9ccc-63bd12de0da3&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-03-19T22:43:16.127134Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2023-03-04T02:24:24.759416Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Thomas-Mccormick&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Re-engineered global conglomeration&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;roles&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;why&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;art&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;image&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;identity_class&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;class&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;contact_information&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;16207 Henry Station Apt. 912\\nWilliamsshire, FL 46015&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;external_references&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;whole&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Card front mission left program.&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;url&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;https://norris.info/&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;hARqC&quot;</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">]</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship--05cc6f9e-e1e3-4a9a-98b9-2010e26ff821&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-08-25T16:18:23.200252Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2023-03-18T08:31:06.868852Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;relationship_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;targets&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Activity adult wear common machine tax well. Ok community beat term chance follow road.&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;source_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware--d50c947c-48aa-42ab-908d-549b5559dcac&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;target_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;identity--ba4e742c-1091-4f19-9ccc-63bd12de0da3&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;labels&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;among&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;understand&quot;</span>\n",
       "    <span class=\"p\">]</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship--fc824fd6-7ea0-49ec-bca0-1e43ceaf6575&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2023-03-24T17:58:31.100349Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2024-03-17T23:10:02.099877Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;relationship_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;uses&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;source_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;campaign--85e5b288-22e0-4cef-95a2-d0ec119ea276&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;target_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware--d50c947c-48aa-42ab-908d-549b5559dcac&quot;</span>\n",
       "<span class=\"p\">}]</span>\n",
       "</pre></div>\n"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "execution_count": 19,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%stix\n",
    "Campaign uses Malware targets Identity."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "As a point of comparison, here is how the same example could be written using variables. Note that using chaining keeps the input shorter and simpler."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "metadata": {
    "scrolled": false
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <svg id='chart18' style=\"border: 2px solid #ababab;width:800px;height:600px;\"></svg>\n",
       "\n",
       "    <script type=\"text/javascript\">\n",
       "        require([\"nbextensions/stix2viz/stix2viz\"], function(stix2viz) {\n",
       "            chart = $('#chart18')[0];\n",
       "            visualizer18 = new stix2viz.Viz(chart, {\"width\": 800, \"height\": 600,\n",
       "                \"iconDir\": \"/nbextensions/stix2viz/icons\", \"id\": 18});\n",
       "            visualizer18.vizStix([{\n",
       "    \"type\": \"malware\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"malware--567dd95d-c9f4-4526-905f-5c0f930d65a5\",\n",
       "    \"created\": \"2022-07-12T19:27:51.724657Z\",\n",
       "    \"modified\": \"2022-09-20T06:32:15.912719Z\",\n",
       "    \"name\": \"street\",\n",
       "    \"malware_types\": [\n",
       "        \"resource-exploitation\",\n",
       "        \"screen-capture\"\n",
       "    ],\n",
       "    \"is_family\": false,\n",
       "    \"kill_chain_phases\": [\n",
       "        {\n",
       "            \"kill_chain_name\": \"DsaTpMui\",\n",
       "            \"phase_name\": \"PNColaKcDmtB\"\n",
       "        }\n",
       "    ],\n",
       "    \"first_seen\": \"2022-04-06T22:03:16.773451Z\",\n",
       "    \"last_seen\": \"2023-01-27T16:21:35.721987Z\",\n",
       "    \"external_references\": [\n",
       "        {\n",
       "            \"source_name\": \"right\",\n",
       "            \"description\": \"So structure cause personal discussion truth.\",\n",
       "            \"url\": \"https://www.owens-gonzales.com/\"\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"school\",\n",
       "            \"url\": \"https://www.martinez.biz/\"\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"something\",\n",
       "            \"description\": \"Rule region support cut.\",\n",
       "            \"url\": \"http://www.singleton.com/\"\n",
       "        }\n",
       "    ],\n",
       "    \"x_viz_variable_name\": \"mlwr\"\n",
       "},\n",
       "{\n",
       "    \"type\": \"campaign\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"campaign--2bedf4b4-f23b-494f-90b8-710d086235f5\",\n",
       "    \"created\": \"2021-06-09T17:04:13.573763Z\",\n",
       "    \"modified\": \"2021-07-20T01:21:16.531713Z\",\n",
       "    \"name\": \"name\",\n",
       "    \"confidence\": 10,\n",
       "    \"external_references\": [\n",
       "        {\n",
       "            \"source_name\": \"sing\",\n",
       "            \"url\": \"https://www.madden.com/\"\n",
       "        }\n",
       "    ]\n",
       "},\n",
       "{\n",
       "    \"type\": \"relationship\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"relationship--ccf3f6ec-ef3d-4978-9bff-2fe48e363f98\",\n",
       "    \"created\": \"2022-02-06T19:12:02.395023Z\",\n",
       "    \"modified\": \"2022-11-15T10:35:30.877804Z\",\n",
       "    \"relationship_type\": \"uses\",\n",
       "    \"description\": \"Series turn become chance young true author. Character bad card federal exist common. Stock better firm.\",\n",
       "    \"source_ref\": \"campaign--2bedf4b4-f23b-494f-90b8-710d086235f5\",\n",
       "    \"target_ref\": \"malware--567dd95d-c9f4-4526-905f-5c0f930d65a5\",\n",
       "    \"confidence\": 14\n",
       "},\n",
       "{\n",
       "    \"type\": \"identity\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"identity--b72eb3b3-c822-435f-a93c-b1e4102d3407\",\n",
       "    \"created\": \"2021-06-12T18:10:20.495936Z\",\n",
       "    \"modified\": \"2021-11-21T22:40:01.556428Z\",\n",
       "    \"name\": \"White Group\",\n",
       "    \"roles\": [\n",
       "        \"let\",\n",
       "        \"against\",\n",
       "        \"tree\"\n",
       "    ],\n",
       "    \"identity_class\": \"unknown\",\n",
       "    \"contact_information\": \"520 Luke Parkways\\nSouth Jeffrey, AZ 68844\",\n",
       "    \"confidence\": 16,\n",
       "    \"lang\": \"en\"\n",
       "},\n",
       "{\n",
       "    \"type\": \"relationship\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"relationship--9e506dfe-850e-43a0-a901-a7359e3b69e7\",\n",
       "    \"created\": \"2021-08-19T02:38:57.642852Z\",\n",
       "    \"modified\": \"2021-09-26T03:55:40.404289Z\",\n",
       "    \"relationship_type\": \"targets\",\n",
       "    \"description\": \"Sound several center. Society bill rest performance stage among material.\",\n",
       "    \"source_ref\": \"malware--567dd95d-c9f4-4526-905f-5c0f930d65a5\",\n",
       "    \"target_ref\": \"identity--b72eb3b3-c822-435f-a93c-b1e4102d3407\",\n",
       "    \"labels\": [\n",
       "        \"shoulder\",\n",
       "        \"interesting\"\n",
       "    ],\n",
       "    \"external_references\": [\n",
       "        {\n",
       "            \"source_name\": \"structure\",\n",
       "            \"external_id\": \"JqQfKxOccn\"\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"hard\",\n",
       "            \"description\": \"Six seat behind floor.\",\n",
       "            \"external_id\": \"TQJDwnSkdByGC\"\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"wish\",\n",
       "            \"external_id\": \"avydHtztbZCEixoMcXY\"\n",
       "        }\n",
       "    ]\n",
       "}], {\"userLabels\": {\"malware--567dd95d-c9f4-4526-905f-5c0f930d65a5\": \"mlwr\"}});\n",
       "        });\n",
       "    </script>\n",
       "    <style type=\"text/css\">pre { line-height: 125%; }\n",
       "td.linenos pre { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos { color: #000000; background-color: #f0f0f0; padding-left: 5px; padding-right: 5px; }\n",
       "td.linenos pre.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       "span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
       ".highlight .hll { background-color: #ffffcc }\n",
       ".highlight { background: #f8f8f8; }\n",
       ".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
       ".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
       ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
       ".highlight .o { color: #666666 } /* Operator */\n",
       ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
       ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
       ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
       ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
       ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
       ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
       ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
       ".highlight .ge { font-style: italic } /* Generic.Emph */\n",
       ".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
       ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
       ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
       ".highlight .go { color: #888888 } /* Generic.Output */\n",
       ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
       ".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
       ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
       ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
       ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
       ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
       ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
       ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
       ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
       ".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
       ".highlight .m { color: #666666 } /* Literal.Number */\n",
       ".highlight .s { color: #BA2121 } /* Literal.String */\n",
       ".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
       ".highlight .nb { color: #008000 } /* Name.Builtin */\n",
       ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
       ".highlight .no { color: #880000 } /* Name.Constant */\n",
       ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
       ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
       ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
       ".highlight .nf { color: #0000FF } /* Name.Function */\n",
       ".highlight .nl { color: #A0A000 } /* Name.Label */\n",
       ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
       ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
       ".highlight .nv { color: #19177C } /* Name.Variable */\n",
       ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
       ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
       ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
       ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
       ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
       ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
       ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
       ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
       ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
       ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
       ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
       ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
       ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
       ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
       ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
       ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
       ".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
       ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
       ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
       ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
       ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
       ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
       ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
       ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
       ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
       ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
       ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">[{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware--567dd95d-c9f4-4526-905f-5c0f930d65a5&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-07-12T19:27:51.724657Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-09-20T06:32:15.912719Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;street&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;malware_types&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;resource-exploitation&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;screen-capture&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;is_family&quot;</span><span class=\"p\">:</span> <span class=\"kc\">false</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;kill_chain_phases&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;kill_chain_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;DsaTpMui&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;phase_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;PNColaKcDmtB&quot;</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;first_seen&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-04-06T22:03:16.773451Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;last_seen&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2023-01-27T16:21:35.721987Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;external_references&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;right&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;So structure cause personal discussion truth.&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;url&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;https://www.owens-gonzales.com/&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;school&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;url&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;https://www.martinez.biz/&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;something&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Rule region support cut.&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;url&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;http://www.singleton.com/&quot;</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;x_viz_variable_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;mlwr&quot;</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;campaign&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;campaign--2bedf4b4-f23b-494f-90b8-710d086235f5&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-06-09T17:04:13.573763Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-07-20T01:21:16.531713Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;name&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;confidence&quot;</span><span class=\"p\">:</span> <span class=\"mi\">10</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;external_references&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;sing&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;url&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;https://www.madden.com/&quot;</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">]</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship--ccf3f6ec-ef3d-4978-9bff-2fe48e363f98&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-02-06T19:12:02.395023Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2022-11-15T10:35:30.877804Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;relationship_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;uses&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Series turn become chance young true author. Character bad card federal exist common. Stock better firm.&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;source_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;campaign--2bedf4b4-f23b-494f-90b8-710d086235f5&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;target_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware--567dd95d-c9f4-4526-905f-5c0f930d65a5&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;confidence&quot;</span><span class=\"p\">:</span> <span class=\"mi\">14</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;identity&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;identity--b72eb3b3-c822-435f-a93c-b1e4102d3407&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-06-12T18:10:20.495936Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-11-21T22:40:01.556428Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;White Group&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;roles&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;let&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;against&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;tree&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;identity_class&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;unknown&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;contact_information&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;520 Luke Parkways\\nSouth Jeffrey, AZ 68844&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;confidence&quot;</span><span class=\"p\">:</span> <span class=\"mi\">16</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;lang&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;en&quot;</span>\n",
       "<span class=\"p\">},</span>\n",
       "<span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship--9e506dfe-850e-43a0-a901-a7359e3b69e7&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-08-19T02:38:57.642852Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-09-26T03:55:40.404289Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;relationship_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;targets&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Sound several center. Society bill rest performance stage among material.&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;source_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware--567dd95d-c9f4-4526-905f-5c0f930d65a5&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;target_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;identity--b72eb3b3-c822-435f-a93c-b1e4102d3407&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;labels&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;shoulder&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;interesting&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;external_references&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;structure&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;JqQfKxOccn&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;hard&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Six seat behind floor.&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;TQJDwnSkdByGC&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;wish&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;avydHtztbZCEixoMcXY&quot;</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">]</span>\n",
       "<span class=\"p\">}]</span>\n",
       "</pre></div>\n"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "execution_count": 20,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%stix\n",
    "mlwr: Malware.\n",
    "Campaign uses mlwr.\n",
    "mlwr targets Identity."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Configuration\n",
    "\n",
    "The generator has several options that can be configured by modifying the `config.ini` file in this directory.\n",
    "\n",
    "#### string_length_min\n",
    "Randomly generated strings can be no shorter than this many characters.\n",
    "\n",
    "#### string_length_max\n",
    "Randomly generated strings can be no longer than this many characters.\n",
    "\n",
    "#### string_chars\n",
    "Randomly generated strings can only include these characters.\n",
    "\n",
    "#### number_min\n",
    "Randomly generated numbers must be higher than this number.\n",
    "\n",
    "#### is_number_min_exclusive\n",
    "Whether randomly generated numbers can be equal to the `number_min` setting.\n",
    "\n",
    "#### number_max\n",
    "Randomly generated numbers must be lower than this number.\n",
    "\n",
    "#### is_number_max_exclusive\n",
    "Whether randomly generated numbers can be equal to the `number_max` setting.\n",
    "\n",
    "#### array_length_min\n",
    "Randomly generated array must contain at least this many items.\n",
    "\n",
    "#### array_length_max\n",
    "Randomly generated array must contain at most this many items.\n",
    "\n",
    "#### optional_property_probability\n",
    "Probability, between 0 and 1, of generating optional properties in the objects.\n",
    "\n",
    "#### minimize_ref_properties\n",
    "If True, the generator will only include `*_ref/s` properties if they are required properties, in an attempt to keep the generated graphs from ballooning in size.\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Custom Objects and Properties\n",
    "\n",
    "The generator is able to generate custom objects or custom properties on existing objects, but requires editing the `custom_registry.json` file located in this directory. This file is a mapping of object type names to a variety of options and a listing of the object's properties. By default we've added a custom property to the `User_Account` type and a custom object type called `Foobar`. You can view the specifications of all the predefined STIX 2.1 object types in `stix2generator/stix21_registry.json`. Here is what the default custom registry looks like:\n",
    "\n",
    "```json\n",
    "{\n",
    "    \"Foobar\": {\n",
    "        \"type\": \"object\",\n",
    "        \"import\": \"common-properties\",\n",
    "        \"required\": [\"id\", \"some-property\", \"type\"],\n",
    "        \"properties\": {\n",
    "            \"type\": \"x-foobar\",\n",
    "            \"id\": {\n",
    "                \"type\": \"string\",\n",
    "                \"semantics\": \"stix-id\",\n",
    "                \"stix-type\": \"x-foobar\"\n",
    "            },\n",
    "            \"some-property\": {\n",
    "                \"type\": \"string\",\n",
    "                \"semantics\": \"word\"\n",
    "            },\n",
    "            \"another-property\": {\n",
    "                \"type\": \"string\",\n",
    "                \"semantics\": \"sentence\"\n",
    "            }\n",
    "        }\n",
    "    },\n",
    "    \"User_Account\": {\n",
    "        \"type\": \"object\",\n",
    "        \"required\": [\"id\", \"type\", \"all-props-group\", \"x_foo\"],\n",
    "        \"properties\": {\n",
    "            \"x_foo\": {\n",
    "                \"type\": \"string\"\n",
    "            }\n",
    "        }\n",
    "    }\n",
    "}\n",
    "```\n",
    "\n",
    "Once we add a custom property to an existing object in the builder's registry, objects of that type will include that property."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <svg id='chart18' style=\"border: 2px solid #ababab;width:800px;height:600px;\"></svg>\n",
       "\n",
       "    <script type=\"text/javascript\">\n",
       "        require([\"nbextensions/stix2viz/stix2viz\"], function(stix2viz) {\n",
       "            chart = $('#chart18')[0];\n",
       "            visualizer18 = new stix2viz.Viz(chart, {\"width\": 800, \"height\": 600,\n",
       "                \"iconDir\": \"/nbextensions/stix2viz/icons\", \"id\": 18});\n",
       "            visualizer18.vizStix({\n",
       "    \"type\": \"user-account\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"user-account--bba73f05-6743-46fc-b7fc-bd5e7eb99b6d\",\n",
       "    \"account_type\": \"radius\",\n",
       "    \"display_name\": \"Austin Miller\",\n",
       "    \"is_service_account\": true,\n",
       "    \"is_privileged\": false,\n",
       "    \"is_disabled\": true,\n",
       "    \"credential_last_changed\": \"2021-11-23T07:18:43Z\",\n",
       "    \"account_last_login\": \"2021-10-08T07:53:26Z\"\n",
       "}, {\"userLabels\": {}});\n",
       "        });\n",
       "    </script>\n",
       "    <style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
       ".highlight  { background: #f8f8f8; }\n",
       ".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
       ".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
       ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
       ".highlight .o { color: #666666 } /* Operator */\n",
       ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
       ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
       ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
       ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
       ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
       ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
       ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
       ".highlight .ge { font-style: italic } /* Generic.Emph */\n",
       ".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
       ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
       ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
       ".highlight .go { color: #888888 } /* Generic.Output */\n",
       ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
       ".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
       ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
       ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
       ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
       ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
       ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
       ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
       ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
       ".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
       ".highlight .m { color: #666666 } /* Literal.Number */\n",
       ".highlight .s { color: #BA2121 } /* Literal.String */\n",
       ".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
       ".highlight .nb { color: #008000 } /* Name.Builtin */\n",
       ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
       ".highlight .no { color: #880000 } /* Name.Constant */\n",
       ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
       ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
       ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
       ".highlight .nf { color: #0000FF } /* Name.Function */\n",
       ".highlight .nl { color: #A0A000 } /* Name.Label */\n",
       ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
       ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
       ".highlight .nv { color: #19177C } /* Name.Variable */\n",
       ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
       ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
       ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
       ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
       ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
       ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
       ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
       ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
       ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
       ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
       ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
       ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
       ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
       ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
       ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
       ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
       ".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
       ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
       ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
       ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
       ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
       ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
       ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
       ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
       ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
       ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
       ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;user-account&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;user-account--bba73f05-6743-46fc-b7fc-bd5e7eb99b6d&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;account_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;radius&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;display_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Austin Miller&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;is_service_account&quot;</span><span class=\"p\">:</span> <span class=\"kc\">true</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;is_privileged&quot;</span><span class=\"p\">:</span> <span class=\"kc\">false</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;is_disabled&quot;</span><span class=\"p\">:</span> <span class=\"kc\">true</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;credential_last_changed&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-11-23T07:18:43Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;account_last_login&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-10-08T07:53:26Z&quot;</span>\n",
       "<span class=\"p\">}</span>\n",
       "</pre></div>\n"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "execution_count": 23,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%stix\n",
    "User_Account."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Once we've added a new object type to the builder's registry, we can generate objects of our custom type."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "metadata": {
    "scrolled": false
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <svg id='chart19' style=\"border: 2px solid #ababab;width:800px;height:600px;\"></svg>\n",
       "\n",
       "    <script type=\"text/javascript\">\n",
       "        require([\"nbextensions/stix2viz/stix2viz\"], function(stix2viz) {\n",
       "            chart = $('#chart19')[0];\n",
       "            visualizer19 = new stix2viz.Viz(chart, {\"width\": 800, \"height\": 600,\n",
       "                \"iconDir\": \"/nbextensions/stix2viz/icons\", \"id\": 19});\n",
       "            visualizer19.vizStix({\n",
       "    \"type\": \"x-foobar\",\n",
       "    \"spec_version\": \"2.1\",\n",
       "    \"id\": \"x-foobar--977c7f3d-522e-477d-bf42-4bbf1362347c\",\n",
       "    \"created\": \"2020-05-15T18:56:47.000Z\",\n",
       "    \"modified\": \"2021-01-02T06:54:13.000Z\",\n",
       "    \"some-property\": \"top\",\n",
       "    \"another-property\": \"Still probably operation popular.\",\n",
       "    \"labels\": [\n",
       "        \"close\",\n",
       "        \"night\",\n",
       "        \"ok\"\n",
       "    ],\n",
       "    \"confidence\": 19,\n",
       "    \"lang\": \"en\",\n",
       "    \"external_references\": [\n",
       "        {\n",
       "            \"source_name\": \"thousand\",\n",
       "            \"description\": \"Law assume our nor.\",\n",
       "            \"url\": \"https://www.waller-evans.org/\",\n",
       "            \"external_id\": \"gsZVm\"\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"enter\",\n",
       "            \"description\": \"Politics adult police power cost report policy.\"\n",
       "        },\n",
       "        {\n",
       "            \"source_name\": \"partner\",\n",
       "            \"description\": \"Me could west across church.\",\n",
       "            \"hashes\": {\n",
       "                \"SHA-256\": \"bd8865c7ebd43db05f2ecc7b8700992e6a948bc1bef16c578b75bcaa774c1768\",\n",
       "                \"SHA-512\": \"adacfdd458f6b933d9965a78408f79ae93bf05569e811ff8b2eac0b4a5e75b09cde9d40e3610884501766eb502ce6c2f8275c95bac32393061956c8322ab6868\",\n",
       "                \"SHA3-512\": \"169e3f523f65cffcb645b991ae5d1e1c85321dea9fa4c97755521c0530803e75e0494b9018a19d5f55f3863f4c1d8c858446e2cae00f34219e0773a8f3e5835c\"\n",
       "            }\n",
       "        }\n",
       "    ]\n",
       "}, {\"userLabels\": {}});\n",
       "        });\n",
       "    </script>\n",
       "    <style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
       ".highlight  { background: #f8f8f8; }\n",
       ".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
       ".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
       ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
       ".highlight .o { color: #666666 } /* Operator */\n",
       ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
       ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
       ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
       ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
       ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
       ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
       ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
       ".highlight .ge { font-style: italic } /* Generic.Emph */\n",
       ".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
       ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
       ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
       ".highlight .go { color: #888888 } /* Generic.Output */\n",
       ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
       ".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
       ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
       ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
       ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
       ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
       ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
       ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
       ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
       ".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
       ".highlight .m { color: #666666 } /* Literal.Number */\n",
       ".highlight .s { color: #BA2121 } /* Literal.String */\n",
       ".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
       ".highlight .nb { color: #008000 } /* Name.Builtin */\n",
       ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
       ".highlight .no { color: #880000 } /* Name.Constant */\n",
       ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
       ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
       ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
       ".highlight .nf { color: #0000FF } /* Name.Function */\n",
       ".highlight .nl { color: #A0A000 } /* Name.Label */\n",
       ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
       ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
       ".highlight .nv { color: #19177C } /* Name.Variable */\n",
       ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
       ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
       ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
       ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
       ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
       ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
       ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
       ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
       ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
       ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
       ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
       ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
       ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
       ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
       ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
       ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
       ".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
       ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
       ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
       ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
       ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
       ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
       ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
       ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
       ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
       ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
       ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
       "    <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;x-foobar&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;x-foobar--977c7f3d-522e-477d-bf42-4bbf1362347c&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2020-05-15T18:56:47.000Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2021-01-02T06:54:13.000Z&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;some-property&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;top&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;another-property&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Still probably operation popular.&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;labels&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"s2\">&quot;close&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;night&quot;</span><span class=\"p\">,</span>\n",
       "        <span class=\"s2\">&quot;ok&quot;</span>\n",
       "    <span class=\"p\">],</span>\n",
       "    <span class=\"nt\">&quot;confidence&quot;</span><span class=\"p\">:</span> <span class=\"mi\">19</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;lang&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;en&quot;</span><span class=\"p\">,</span>\n",
       "    <span class=\"nt\">&quot;external_references&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;thousand&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Law assume our nor.&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;url&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;https://www.waller-evans.org/&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;external_id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;gsZVm&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;enter&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Politics adult police power cost report policy.&quot;</span>\n",
       "        <span class=\"p\">},</span>\n",
       "        <span class=\"p\">{</span>\n",
       "            <span class=\"nt\">&quot;source_name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;partner&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Me could west across church.&quot;</span><span class=\"p\">,</span>\n",
       "            <span class=\"nt\">&quot;hashes&quot;</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
       "                <span class=\"nt\">&quot;SHA-256&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;bd8865c7ebd43db05f2ecc7b8700992e6a948bc1bef16c578b75bcaa774c1768&quot;</span><span class=\"p\">,</span>\n",
       "                <span class=\"nt\">&quot;SHA-512&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;adacfdd458f6b933d9965a78408f79ae93bf05569e811ff8b2eac0b4a5e75b09cde9d40e3610884501766eb502ce6c2f8275c95bac32393061956c8322ab6868&quot;</span><span class=\"p\">,</span>\n",
       "                <span class=\"nt\">&quot;SHA3-512&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;169e3f523f65cffcb645b991ae5d1e1c85321dea9fa4c97755521c0530803e75e0494b9018a19d5f55f3863f4c1d8c858446e2cae00f34219e0773a8f3e5835c&quot;</span>\n",
       "            <span class=\"p\">}</span>\n",
       "        <span class=\"p\">}</span>\n",
       "    <span class=\"p\">]</span>\n",
       "<span class=\"p\">}</span>\n",
       "</pre></div>\n"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "execution_count": 24,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%stix\n",
    "Foobar."
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.9.1"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}