Downloads
Download XARF resources including JSON schemas, example reports, documentation, and reference implementations.
JSON Schemas
Official JSON Schema files for validating XARF reports.
XARF v4.0.0 Schemas
Individual Schemas by Type
Connection (8 types)
- connection-ddos.json
- connection-infected-host.json
- connection-login-attack.json
- connection-port-scan.json
- connection-reconnaissance.json
- connection-scraping.json
- connection-sql-injection.json
- connection-vulnerability-scan.json
Content (9 types)
- content-phishing.json
- content-malware.json
- content-csam.json
- content-csem.json
- content-exposed-data.json
- content-brand_infringement.json
- content-fraud.json
- content-remote_compromise.json
- content-suspicious_registration.json
Copyright (6 types)
- copyright-copyright.json
- copyright-p2p.json
- copyright-cyberlocker.json
- copyright-ugc-platform.json
- copyright-link-site.json
- copyright-usenet.json
Infrastructure (2 types)
Messaging (2 types)
Reputation (2 types)
Vulnerability (3 types)
Example Reports
Sample XARF reports demonstrating each event type.
Example Report Collections
Example Reports by Category
Connection
Content
Messaging
Vulnerability
Documentation
Complete XARF documentation in various formats.
Code Templates
Ready-to-use code snippets and templates.
Integration Templates
Python Template
Basic XARF report creation and validation
from xarf import XARFReport
from datetime import datetime
def create_abuse_report(source_ip, abuse_type):
"""Create a basic XARF abuse report"""
report = XARFReport(
xarf_version="4.0.0",
report_id=str(uuid.uuid4()),
timestamp=datetime.utcnow().isoformat() + "Z",
reporter={
"org": "Your Organization",
"contact": "[email protected]",
"domain": "example.com"
},
sender={
"org": "Your Organization",
"contact": "[email protected]",
"domain": "example.com"
},
source_identifier=source_ip,
category="connection",
type=abuse_type
)
if report.validate():
return report.to_json()
else:
raise ValueError(report.validation_errors)Flask API Template
REST API endpoint for receiving XARF reports
from flask import Flask, request, jsonify
from xarf import XARFReport, ValidationError
app = Flask(__name__)
@app.route('/xarf/submit', methods=['POST'])
def submit_report():
try:
report = XARFReport.from_json(request.get_json())
report.validate(strict=True)
# Process report
process_abuse_report(report)
return jsonify({'status': 'accepted', 'report_id': report.report_id}), 202
except ValidationError as e:
return jsonify({'status': 'invalid', 'errors': e.errors}), 400Evidence Handler Template
Evidence collection and hashing
import hashlib
import base64
def add_evidence_to_report(report, file_path, description):
"""Add evidence file to XARF report with SHA-256 hash"""
with open(file_path, 'rb') as f:
data = f.read()
# Calculate hash
sha256_hash = hashlib.sha256(data).hexdigest()
# Encode to base64
payload = base64.b64encode(data).decode('utf-8')
report.add_evidence(
content_type="application/octet-stream",
description=description,
payload=payload,
hash={
"algorithm": "sha256",
"value": sha256_hash
}
)Tools and Utilities
Standalone tools for working with XARF.
Python Library
Full-featured Python library with CLI tools
View on GitHub
pip install git+https://github.com/xarf/xarf-python.git
Previous Versions
Access older XARF specification versions.
| Version | Release Date | Status | Downloads |
|---|---|---|---|
| v4.0.0 | Q1 2026 | Current | Schemas | Examples | Docs |
| v3.1.0 | Q2 2025 | Deprecated | Archived repo (abusix/xarf) |
| v3.0.0 | Q4 2024 | Deprecated | Archived repo (abusix/xarf) |
License
All XARF resources are released under the MIT License.
- Schemas: MIT License
- Examples: CC0 1.0 Universal
- Documentation: CC BY 4.0
Need Help?
- Implementation Guide - Step-by-step integration
- GitHub Discussions - Ask questions
- GitHub Issues - Report problems