This repository is an actual vault, not an application scaffold. It contains analyst workflow notes, Obsidian Canvas space, all standard STIX 2.1 note templates, and the official OASIS APT1 threat-report Bundle as a realistic worked example.

No .obsidian directory, plugin installation, personal settings, generated exports, credentials, or operational intelligence is committed. Obsidian creates local settings when you open your copy, and Git ignores them.

Start with the APT1 report

1. Create your own copy with Use this template or Download ZIP.
2. Open that directory as an Obsidian vault.
3. Install and enable CTI STIX Workbench.
4. Open Examples/OASIS APT1/Generated Notes/Import Overview.md to browse all 76 linked objects immediately.
5. Open Examples/OASIS APT1/APT1 Investigation.canvas to explore its 46 visible objects and 30 labeled STIX relationships.
6. Open Examples/OASIS APT1/apt1.json, then run Open in STIX viewer to inspect the canonical Bundle without importing it.
7. When you want an editable copy, run Import STIX Bundle as notes, choose a destination, and review the 76-object preview before confirming.
8. Validate and export the imported folder to verify the semantic round trip.

The source Bundle includes APT1, related actors and identities, indicators, malware, tools, attack patterns, one Report, and 30 explicit Relationships. It also demonstrates nested kill-chain phases and external references. It is the public OASIS validation example, not project-authored intelligence; its BSD 3-Clause attribution is included beside the JSON file.

What is included

Area	Purpose
00 Home/	Vault map and current plugin workflow.
01 Intelligence Requirements/	Questions, priorities, and collection direction.
02 Investigations/	Working cases, hypotheses, timelines, gaps, and next actions.
03 STIX Objects/	Reusable domain objects, relationships, observables, markings, and extensions.
04 Reports/	Review-ready and finished intelligence products.
05 Sources/	Evidence, provenance, reports, feeds, and collection notes.
Canvases/	Workspace for visual investigation boards you create with Obsidian Canvas.
Examples/OASIS APT1/	Official OASIS Bundle, license, 76 generated browseable notes, and a generated investigation Canvas.
Templates/CTI Workflows/	23 practical templates, including the versioned 15-workflow analyst lifecycle library.
Templates/STIX 2.1/	All 42 standalone object types and 12 predefined SCO extensions.
Exports/	Local Bundle output; generated JSON is ignored.

Work in plain Markdown

The vault remains useful without the plugin. Write the intelligence question, track sources and judgments, keep reusable STIX concepts in separate notes, and connect context with ordinary [[wiki links]].

The plugin adds schema-aware creation and editing, local Bundle import, graph validation, visualization, object versioning, revocation, and export from an active graph, Canvas, folder, or the whole vault. Exportable relationships are always explicit:

- stix:uses [[Target note]]

Ordinary links are contextual and are never silently converted into STIX Relationships. Directed Canvas edges follow the same stix:<relationship-type> rule.

Bundle import creates typed Markdown notes and an import overview. Run Generate canvas from current folder from that overview when you want an editable visual scope, or run Generate canvas from active STIX graph from a typed note. Generated Canvases use file nodes and labeled relationship edges; rearranging the Workbench viewer itself never changes Canvas files.

Template integrity

The 54 files under Templates/STIX 2.1/ are generated from the pinned catalog in the plugin repository. .cti-template-manifest.json records the SHA-256 digest of every generated template. Updates arrive as reviewable pull requests limited to the template tree, manifest, and attributed APT1 example. The APT1 generated-note snapshot has its own checksum manifest so CI can prove that every committed note still matches the pinned source Bundle.

The 15 templates introduced across workflow library versions 1.3.0 through 1.5.0 are also generated from the plugin's canonical workflow definitions. .cti-workflow-manifest.json records their individual SHA-256 digests and must agree with VERSION.

Keep real work private

The public APT1 sample contains historical threat-intelligence data. Keep your own operational vault private and apply its handling markings. Never commit credentials, customer information, restricted reporting, personal data, malware samples, or exploit payloads to a public copy.

Support and license

Issues and focused pull requests are welcome. If the vault saves setup time, you can support maintenance through GitHub Sponsors.

Vault-authored notes, templates, and Canvases use CC BY 4.0. The APT1 example retains the OASIS BSD 3-Clause license. The plugin is a separate Apache-2.0 project.