{"id":10268,"library":"stix2-validator","title":"STIX 2.x Validator","description":"The stix2-validator library provides APIs and scripts for validating STIX 2.x documents against the official STIX specifications. It is currently at version 3.2.0 and receives regular updates, typically with minor releases addressing fixes and dependency updates, and less frequent major releases for specification updates and significant feature enhancements.","status":"active","version":"3.2.0","language":"en","source_language":"en","source_url":"https://github.com/oasis-open/cti-stix-validator","tags":["stix","cti","security","cybersecurity","validation","json-schema"],"install":[{"cmd":"pip install stix2-validator","lang":"bash","label":"Install latest version"}],"dependencies":[{"reason":"Core dependency for schema validation, frequently updated.","package":"jsonschema","optional":false},{"reason":"Utility library, updated in 3.1.4 to resolve dependency issues.","package":"attrs","optional":false}],"imports":[{"symbol":"Validator","correct":"from stix2validator import Validator"}],"quickstart":{"code":"from stix2validator import Validator\nimport json\n\n# Example STIX 2.1 Indicator object for validation\nstix_object = {\n    \"type\": \"indicator\",\n    \"spec_version\": \"2.1\",\n    \"id\": \"indicator--a79f0462-8789-4b67-8c0c-52643a2d1d07\",\n    \"created\": \"2024-01-01T12:00:00.000Z\",\n    \"modified\": \"2024-01-01T12:00:00.000Z\",\n    \"pattern\": \"[file:hashes.MD5 = 'd41d8cd98f00b204e9800998ecf8427e']\",\n    \"pattern_type\": \"stix\",\n    \"valid_from\": \"2024-01-01T12:00:00.000Z\"\n}\n\n# Initialize the validator\nvalidator = Validator()\n\n# Validate a STIX dictionary (e.g., loaded from JSON)\nresults = validator.validate(stix_object)\n\nif not results:\n    print(\"STIX object is valid.\")\nelse:\n    print(\"STIX object has validation issues:\")\n    for result in results:\n        print(f\"  - {result}\")\n\n# For more detailed output, instantiate with verbose=True\nverbose_validator = Validator(verbose=True)\nverbose_results = verbose_validator.validate(stix_object)\nif verbose_results:\n    print(\"\\nVerbose validation results:\")\n    for result in verbose_results:\n        print(f\"  - {result}\")\n","lang":"python","description":"This quickstart demonstrates how to initialize the `Validator` and use it to validate a STIX object represented as a Python dictionary. It shows both standard and verbose validation output. To validate a STIX document from a file, load its JSON content into a dictionary first."},"warnings":[{"fix":"Upgrade your Python environment to 3.7 or newer to use stix2-validator versions 3.0.0+.","message":"Python 3.5 and 3.6 are no longer supported. Version 3.0.0 dropped support for Python 3.5, and version 3.1.0 dropped support for Python 3.6.","severity":"breaking","affected_versions":">=3.0.0"},{"fix":"Ensure that `request_header` values within network-traffic extension objects are provided as a list of strings, even if only one header is present (e.g., `['Host: example.com']`).","message":"The `network-traffic.http-request-ext.request_header` property must now be a list of strings. Previously, it could be a singular string, which is no longer compliant.","severity":"breaking","affected_versions":">=3.2.0"},{"fix":"When initializing `Validator` or calling `validate()`, specify the `stix_version` parameter (e.g., `Validator(stix_version='2.0')` or `validator.validate(obj, stix_version='2.0')`) to ensure validation against the correct STIX specification version.","message":"When validating STIX documents against older specification versions, or documents that mix object `spec_version` values, the validator might default to the latest specification rules. Explicitly configure `stix_version` if you encounter unexpected errors for older STIX documents.","severity":"gotcha","affected_versions":"All"},{"fix":"Upgrade `stix2-validator` to version 3.1.3 or newer, which includes fixes to address these `jsonschema` deprecation warnings by updating internal schema references.","message":"Older versions of `jsonschema` used by `stix2-validator` might log deprecation warnings related to `jsonschema.draft202012_format_checker` due to changes in `jsonschema` itself.","severity":"deprecated","affected_versions":"<3.1.3"}],"env_vars":null,"last_verified":"2026-04-17T00:00:00.000Z","next_check":"2026-07-16T00:00:00.000Z","problems":[{"fix":"Carefully review the STIX object against the relevant STIX specification (e.g., STIX 2.1) to ensure all mandatory properties are present and correctly formatted. For custom schemas, verify the schema definition itself.","cause":"A STIX object or a custom extension schema is missing a required property according to the STIX specification or its own schema definition.","error":"jsonschema.exceptions.ValidationError: 'properties' is a required property"},{"fix":"Ensure the library is installed with `pip install stix2-validator` and that the import statement is exactly `from stix2validator import Validator`. Check your Python environment if using virtual environments.","cause":"Attempting to import `Validator` from an incorrect module path, or `stix2-validator` is not installed or installed in a different environment.","error":"ImportError: cannot import name 'Validator' from 'stix2validator'"},{"fix":"If you have a list of STIX objects, iterate through the list and validate each object individually. If it's meant to be a STIX Bundle, ensure it's structured as a dictionary with 'type': 'bundle' and an 'objects' list.","cause":"Attempting to validate a list of STIX objects directly with `validator.validate()`. The `validate` method expects a single STIX object (dictionary) or a STIX bundle (which is also a dictionary).","error":"AttributeError: 'list' object has no attribute 'get'"}]}