Stix to html transformed explained

What is the Purpose of STIX-to-HTML?

STIX-to-HTML is designed to provide a more human readable view of STIX XML data that can more easily be read in a document-like fashion while still portraying the hierarchies and relationships in the source document.

Generally references to other parts of the document are expandable inline to be able to see the information at the point where it is being mentioned.

The transform is accomplished by using some complex XSLT manipulations to convert the source STIX XML document into the resulting HTML document.

How Does STIX-to-HTML Work?

The transformation runs on any XSLT 2.0 transformation engine.

The transformation happens in two phases:

1. Normalization
2. HTML Output

And then after the HTML is produced, some work is done at display time -- mainly the expanding/collapsing of expandable content. The HTML file for a given html fragment (either the base document or the html for an expandable segment) only contains the html down to the next expandable node child.

Think of this as a tree. The html only for the root document only contains the html down to the individual items in the top level tables. That means that the main html contains the Observables table and the expandable link for the each observable, but not the html for the observable itself.

Then when a user clicks to expand an item (say an observable), the html for that observable is looked up in the "reference" list and copied and inserted into the HTML DOM inside the expandable link.

Normalization

Normalization is responsible for cleaning up source xml document to make it a bit easier for the XSLT transformation to easily perform its work. These changes are for XSLT processing and are not compliant with the stix schema. This entails three things.

First, it cleans up any id references and renames id reference attributes to always be renamed to @idref. This includes changing @object_reference to @idref.

Second, the "reference" list is built up. Every item in the source xml that had an id attribute, will result in an entry in the reference list. The content of that entry will be all the xml for that item down to any child id references or id content. Id content will be changed to idrefs and the child content will be removed (since it will now be expandable).

Third, the main xml for the root document will be normalized. Similar to above, the main xml content will be adjusted to only contain the xml down to any id or idef content. Any content with idrefs is already ok. Content with ids will again be changed to idref and its children dropped (again, it is now expandable).

HTML Output

The second phase of the transformation (post normalization) is to actually convert the XML into the desired HTML output.