Repository: oasis-open/cti-stix-elevator (language: python)

Issue:
Thread safety?
Love this project. Awesome, guys!

I was wondering, if I were to try to use this as a library, would it be thread-safe? I see some module-level dictionaries, which is why I ask.

If thread-safety isn't a goal for this project, I understand.

Thanks!


Discussion / hints:
As a proof of concept we didn't consider parallel execution or thread safety.  However, it is something to keep in mind - so we will keep this issue open


Fix patch:
diff --git a/docs/warnings.rst b/docs/warnings.rst
index 0bc36077..7794cd0f 100644
--- a/docs/warnings.rst
+++ b/docs/warnings.rst
@@ -51,9 +51,9 @@ Missing property *property_name* of *id* is ignored
 Used custom property for *property_name* of *id*                                                                               308     warn
 Missing property *property_name* of *id* is ignored, because there is no description property                                  309     warn
 The Short_Description property in *id* is not supported in STIX 2.x.                                                           310     info
-Used an extension for objective of *id*                                                                                        311     warn
+``Not in use``                                                                                                                 311     warn
 No extension-definition was found for STIX 1 type *type* in *id*                                                               312     warn
-Used extension property for *property_name* of *id*                                                                            313     warn
+Used an extension property for *property_name* of *id*                                                                         313     warn
 Property *property_name* of *id* is ignored, because it can't be represented in an extension                                   314     warn
 New extension-definition id *id* was generated for *type*. *id*                                                                315     warn
 Custom Content *property_name* of *id* is ignored                                                                              316     warn
@@ -97,7 +97,7 @@ No pattern term was created from *id*
 Could not resolve Marking Structure *id*                                                                                                       425     warn
 MAEC content in *id* cannot be represented in STIX 2.x                                                                                         426     warn
 The *relationship name* relationship involving *id* is not explicitly supported in STIX 2.x                                                    427     warn
-``roles`` is not a property of a 2.x identity (*id*).  Perhaps the roles are associated with a related Threat Actor                            428     warn
+``roles`` is not a property of a 2.0 identity (*id*).  Perhaps the roles are associated with a related Threat Actor                            428     warn
 ``HTTPServerResponse`` type is not supported in STIX 2.x                                                                                       429     warn
 The confidence value *value* is not found on one of the confidence scales from the specification. No confidence can be inferred                430     warn
 The confidence value *value* is not between 0 and 100, which is required for STIX 2.1. No confidence can be inferred                           431     warn
@@ -236,7 +236,7 @@ CybOX object *object* not handled yet
 Email *property* not handled yet                                                                                                            806  warn
 ``file:extended_properties:windows_pebinary_ext:optional_header`` is not implemented yet                                                    807  warn
 *object* found in *id* cannot be converted to a pattern, yet.                                                                               808  warn
-Related Objects of cyber observables for *id* are not handled yet. ``Not currently in use.``                                                809  warn
+``Not in use``                                                                                                                              809  warn
 Negation of *id* is not handled yet                                                                                                         810  warn
 Custom object with no name cannot be handled yet                                                                                            811  warn
 Condition *condition* on a hive property not handled.                                                                                       812  warn
diff --git a/extension-definition-schemas/acs-data-markings b/extension-definition-schemas/acs-data-markings
new file mode 120000
index 00000000..07f5c96c
--- /dev/null
+++ b/extension-definition-schemas/acs-data-markings
@@ -0,0 +1,1 @@
+/Users/rpiazza/git/stix/cti-stix-common-objects/extension-definition-specifications/acs-data-markings/
\ No newline at end of file
diff --git a/extension-definition-schemas/stix-1x b/extension-definition-schemas/stix-1x
new file mode 120000
index 00000000..8c5bcb11
--- /dev/null
+++ b/extension-definition-schemas/stix-1x
@@ -0,0 +1,1 @@
+/Users/rpiazza/git/stix/cti-stix-common-objects/extension-definition-specifications/stix-1x/
\ No newline at end of file
diff --git a/idioms-json-2.0-custom/Mandiant_APT1_Report.json b/idioms-json-2.0-custom/Mandiant_APT1_Report.json
index 36ab7dda..24476a7e 100644
--- a/idioms-json-2.0-custom/Mandiant_APT1_Report.json
+++ b/idioms-json-2.0-custom/Mandiant_APT1_Report.json
@@ -654,7 +654,8 @@
                     "value": "Unauthorized Access"
                 }
             ],
-            "x_elevator_title": "Privilege Escalation"
+            "x_elevator_title": "Privilege Escalation",
+            "x_elevator_vendor": "unknown"
         },
         {
             "created": "2015-05-15T09:00:00.000Z",
diff --git a/idioms-json-2.0-custom/ais-marking-a-e-f.json b/idioms-json-2.0-custom/ais-marking-a-e-f.json
index a4d02bff..f23b739c 100644
--- a/idioms-json-2.0-custom/ais-marking-a-e-f.json
+++ b/idioms-json-2.0-custom/ais-marking-a-e-f.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--03f7b7d2-1a83-4a5e-8a1f-3a54ae060798",
             "id": "report--11b3f19f-5c2a-4fb2-adb7-d6347ed6df82",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0-custom/ais-marking-a-e-t.json b/idioms-json-2.0-custom/ais-marking-a-e-t.json
index 79f756d0..84587219 100644
--- a/idioms-json-2.0-custom/ais-marking-a-e-t.json
+++ b/idioms-json-2.0-custom/ais-marking-a-e-t.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--2d40bb9c-9b82-4782-bd5d-8ed6459a50f4",
             "id": "report--91cdb955-b7b3-4a1b-bf3d-c8e5a6a417b5",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0-custom/ais-marking-a-n-f.json b/idioms-json-2.0-custom/ais-marking-a-n-f.json
index 82cbb61f..1918e72c 100644
--- a/idioms-json-2.0-custom/ais-marking-a-n-f.json
+++ b/idioms-json-2.0-custom/ais-marking-a-n-f.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--17234b36-f749-4e34-9cf0-cbe1d189ca3d",
             "id": "report--e7cf3c28-5100-4ca9-afad-10f60cab5528",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0-custom/ais-marking-a-n-t.json b/idioms-json-2.0-custom/ais-marking-a-n-t.json
index a13bc47f..25b0c924 100644
--- a/idioms-json-2.0-custom/ais-marking-a-n-t.json
+++ b/idioms-json-2.0-custom/ais-marking-a-n-t.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--299d2b54-1472-4ecc-8af8-00c8cf5b33df",
             "id": "report--8ae4a391-01e8-4633-adba-625c80579224",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0-custom/ais-marking-a-u-f.json b/idioms-json-2.0-custom/ais-marking-a-u-f.json
index 0b67bed7..74450620 100644
--- a/idioms-json-2.0-custom/ais-marking-a-u-f.json
+++ b/idioms-json-2.0-custom/ais-marking-a-u-f.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--c5a2d5b7-3752-46bf-9fd5-daff6b43a359",
             "id": "report--dbcaa3d2-33ad-4b7b-b5c0-3de296791d0f",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0-custom/ais-marking-a-u-t.json b/idioms-json-2.0-custom/ais-marking-a-u-t.json
index 1fb5b4aa..c6c5373f 100644
--- a/idioms-json-2.0-custom/ais-marking-a-u-t.json
+++ b/idioms-json-2.0-custom/ais-marking-a-u-t.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--993bf121-c399-4c4f-bd60-4c7c6e0326b3",
             "id": "report--8e4c94e3-04e6-4fa8-af4b-06de19c8f577",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0-custom/ais-marking-g-e-f.json b/idioms-json-2.0-custom/ais-marking-g-e-f.json
index 00f8b276..b2b1d783 100644
--- a/idioms-json-2.0-custom/ais-marking-g-e-f.json
+++ b/idioms-json-2.0-custom/ais-marking-g-e-f.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--14759210-4a33-4437-ba11-e52a28bf14de",
             "id": "report--de4fcdf7-5a04-41b8-b659-144673f1d866",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0-custom/ais-marking-g-e-t.json b/idioms-json-2.0-custom/ais-marking-g-e-t.json
index abd274ca..1c1fc99a 100644
--- a/idioms-json-2.0-custom/ais-marking-g-e-t.json
+++ b/idioms-json-2.0-custom/ais-marking-g-e-t.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--393db73d-0f15-4298-bef1-758f29740d84",
             "id": "report--dfee5358-874c-43fc-b6c5-24bc4fc5c78a",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0-custom/ais-marking-g-n-f.json b/idioms-json-2.0-custom/ais-marking-g-n-f.json
index d49642bf..1195896c 100644
--- a/idioms-json-2.0-custom/ais-marking-g-n-f.json
+++ b/idioms-json-2.0-custom/ais-marking-g-n-f.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--0543c662-f9ad-4532-81ec-d0bfb94f58ef",
             "id": "report--5536adf4-9497-41ca-b0c3-dcfd4999907b",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0-custom/ais-marking-g-n-t.json b/idioms-json-2.0-custom/ais-marking-g-n-t.json
index 03460043..9c10b412 100644
--- a/idioms-json-2.0-custom/ais-marking-g-n-t.json
+++ b/idioms-json-2.0-custom/ais-marking-g-n-t.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--051666ad-cf93-4dfa-838b-45522f9538cc",
             "id": "report--8217d86d-bc23-4865-b7ea-3da46014bde7",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0-custom/ais-marking-g-u-f.json b/idioms-json-2.0-custom/ais-marking-g-u-f.json
index 963ee237..c4a961e0 100644
--- a/idioms-json-2.0-custom/ais-marking-g-u-f.json
+++ b/idioms-json-2.0-custom/ais-marking-g-u-f.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--2a2bf390-b7bb-4ff3-94cf-dfa77db35ad9",
             "id": "report--f7e257d6-3e10-4453-a844-b69e64568356",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0-custom/ais-marking-g-u-t.json b/idioms-json-2.0-custom/ais-marking-g-u-t.json
index b6acf59b..e68a82d8 100644
--- a/idioms-json-2.0-custom/ais-marking-g-u-t.json
+++ b/idioms-json-2.0-custom/ais-marking-g-u-t.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--587626a0-7943-4645-a517-b89d2729adb6",
             "id": "report--405c09d7-0fa5-4b7b-a066-52429243ae63",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0-custom/ais-marking-w-e-f.json b/idioms-json-2.0-custom/ais-marking-w-e-f.json
index 92a4bdc2..05c24a2a 100644
--- a/idioms-json-2.0-custom/ais-marking-w-e-f.json
+++ b/idioms-json-2.0-custom/ais-marking-w-e-f.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--0c87b291-ae81-4399-a9d5-778a6d461241",
             "id": "report--cf7259c4-9366-4327-9610-a3bd88f1169d",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0-custom/ais-marking-w-e-t.json b/idioms-json-2.0-custom/ais-marking-w-e-t.json
index 2d15550b..317c6a29 100644
--- a/idioms-json-2.0-custom/ais-marking-w-e-t.json
+++ b/idioms-json-2.0-custom/ais-marking-w-e-t.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--36301cba-80a7-4555-8925-0f62c2380d35",
             "id": "report--0cb17546-4b35-4386-b4ff-2af582b95875",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0-custom/ais-marking-w-n-f.json b/idioms-json-2.0-custom/ais-marking-w-n-f.json
index ab65796f..76b01d6a 100644
--- a/idioms-json-2.0-custom/ais-marking-w-n-f.json
+++ b/idioms-json-2.0-custom/ais-marking-w-n-f.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--eda4783e-2f68-4f8a-a3b7-7c0f322d5dbf",
             "id": "report--701ba51f-9cfd-43ba-b2a0-bef05d89e8ba",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0-custom/ais-marking-w-n-t.json b/idioms-json-2.0-custom/ais-marking-w-n-t.json
index e5184fca..b17d5bd6 100644
--- a/idioms-json-2.0-custom/ais-marking-w-n-t.json
+++ b/idioms-json-2.0-custom/ais-marking-w-n-t.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--9b7f4202-da60-4564-a8e5-1a95d8a5c1f4",
             "id": "report--c83b2ad2-fa0e-4ac7-ab56-bae73e5d5f5c",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0-custom/ais-marking-w-u-f.json b/idioms-json-2.0-custom/ais-marking-w-u-f.json
index e16d0e14..2be3d55c 100644
--- a/idioms-json-2.0-custom/ais-marking-w-u-f.json
+++ b/idioms-json-2.0-custom/ais-marking-w-u-f.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--b570110d-712d-4ec3-a4d3-b780745d6c01",
             "id": "report--1ba0d23a-eab8-4605-bda7-f8027eebaa64",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0-custom/ais-marking-w-u-t.json b/idioms-json-2.0-custom/ais-marking-w-u-t.json
index 65921205..301b6a01 100644
--- a/idioms-json-2.0-custom/ais-marking-w-u-t.json
+++ b/idioms-json-2.0-custom/ais-marking-w-u-t.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--42735051-d396-4b12-a900-51a2a20150ff",
             "id": "report--2295392b-7ecf-4445-92aa-653afaa9348c",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0-custom/block-network-traffic.json b/idioms-json-2.0-custom/block-network-traffic.json
index a4afa02c..a7976261 100644
--- a/idioms-json-2.0-custom/block-network-traffic.json
+++ b/idioms-json-2.0-custom/block-network-traffic.json
@@ -19,7 +19,7 @@
             "x_elevator_objective": "Block communication between the PIVY agents and the C2 Server",
             "x_elevator_objective_confidence": "High",
             "x_elevator_parameter_expression": "ipv4-addr:value = '10.10.10.10'",
-            "x_elevator_stage": "Response"
+            "x_elevator_stage": "response"
         }
     ],
     "spec_version": "2.0",
diff --git a/idioms-json-2.0-custom/campaign-v-actors.json b/idioms-json-2.0-custom/campaign-v-actors.json
index 23a62022..a4a24045 100644
--- a/idioms-json-2.0-custom/campaign-v-actors.json
+++ b/idioms-json-2.0-custom/campaign-v-actors.json
@@ -21,6 +21,26 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--fcf8ddb8-d48c-4fe8-8ce5-a2e79c39e101",
+            "description": "Fred",
+            "external_references": [
+                {
+                    "source_name": "unknown",
+                    "url": "http://foo.com/bar"
+                }
+            ],
+            "id": "identity--d4109448-48eb-4771-b04a-9659090b93f9",
+            "modified": "2014-08-08T15:50:10.983Z",
+            "name": "not provided",
+            "type": "identity",
+            "x_elevator_roles": [
+                "aggregator",
+                "initial-author"
+            ]
+        },
+        {
+            "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--d4109448-48eb-4771-b04a-9659090b93f9",
             "id": "identity--2d1c6ab3-5e4e-48ac-a32b-f0c01c2836a8",
             "identity_class": "unknown",
             "modified": "2014-08-08T15:50:10.983Z",
@@ -35,6 +55,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--d4109448-48eb-4771-b04a-9659090b93f9",
             "goals": [
                 "Theft",
                 "Theft - Theft of Proprietary Information"
@@ -57,27 +78,18 @@
                 "NewsBeef"
             ],
             "created": "2014-08-08T15:50:10.983Z",
-            "description": "Fred",
-            "external_references": [
-                {
-                    "source_name": "unknown",
-                    "url": "http://foo.com/bar"
-                }
-            ],
+            "created_by_ref": "identity--99b3fd65-9393-42e8-baf6-3075d9f3bf02",
             "id": "campaign--e5268b6e-4931-42f1-b379-87f48eb41b1e",
             "modified": "2014-08-08T15:50:10.983Z",
             "name": "Compromise of ATM Machines",
             "object_marking_refs": [
                 "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da"
             ],
-            "type": "campaign",
-            "x_elevator_information_source_roles": [
-                "Aggregator",
-                "Initial Author"
-            ]
+            "type": "campaign"
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--d4109448-48eb-4771-b04a-9659090b93f9",
             "id": "relationship--12635606-0e38-4a76-9c26-ad8a69e43005",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -90,6 +102,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--d4109448-48eb-4771-b04a-9659090b93f9",
             "id": "relationship--fb16da1e-d79f-409a-97b9-424af61988c3",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -102,6 +115,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--d4109448-48eb-4771-b04a-9659090b93f9",
             "id": "relationship--435ae8d9-9d40-4a2a-8a8f-b0f8671648b0",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -114,6 +128,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--d4109448-48eb-4771-b04a-9659090b93f9",
             "id": "relationship--d7678d44-b698-4e09-b108-9311f90a7398",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -126,6 +141,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--d4109448-48eb-4771-b04a-9659090b93f9",
             "id": "relationship--d90d5db8-e6b9-4d5d-b449-7775438a876e",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -138,6 +154,7 @@
         },
         {
             "created": "2022-09-12T14:59:34.099Z",
+            "created_by_ref": "identity--99b3fd65-9393-42e8-baf6-3075d9f3bf02",
             "description": "Foo\nBar\nFred\nBarney",
             "id": "report--4e2fa6ba-822c-445a-95c1-b3e93cf9bd9b",
             "labels": [
@@ -148,6 +165,7 @@
             "name": "regression-test-08-Elevator02",
             "object_refs": [
                 "identity--99b3fd65-9393-42e8-baf6-3075d9f3bf02",
+                "identity--d4109448-48eb-4771-b04a-9659090b93f9",
                 "identity--2d1c6ab3-5e4e-48ac-a32b-f0c01c2836a8",
                 "threat-actor--56f3f0db-b5d5-431c-ae56-c18f02caf500",
                 "campaign--e5268b6e-4931-42f1-b379-87f48eb41b1e",
diff --git a/idioms-json-2.0-custom/coa_ind_malicious_file.json b/idioms-json-2.0-custom/coa_ind_malicious_file.json
index e4817d4b..951ba459 100644
--- a/idioms-json-2.0-custom/coa_ind_malicious_file.json
+++ b/idioms-json-2.0-custom/coa_ind_malicious_file.json
@@ -67,6 +67,7 @@
         },
         {
             "created": "9999-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--3e006f10-d8a8-4c9a-8cb3-953bf5014433",
             "id": "report--99cd62a2-a762-46d2-9305-4fa5d89c43fe",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0-custom/custom_object.json b/idioms-json-2.0-custom/custom_object.json
index f8b5b0bb..be14f49b 100644
--- a/idioms-json-2.0-custom/custom_object.json
+++ b/idioms-json-2.0-custom/custom_object.json
@@ -3,6 +3,14 @@
     "objects": [
         {
             "created": "2015-07-31T11:24:39.090Z",
+            "id": "identity--12e8fa05-9995-4fa8-b7ff-979d355ab26a",
+            "modified": "2015-07-31T11:24:39.090Z",
+            "name": "not provided",
+            "type": "identity"
+        },
+        {
+            "created": "2015-07-31T11:24:39.090Z",
+            "created_by_ref": "identity--12e8fa05-9995-4fa8-b7ff-979d355ab26a",
             "id": "course-of-action--3dbfccad-1fbb-4e9f-8307-f2d1a5c651cc",
             "labels": [
                 "perimeter-blocking"
@@ -16,10 +24,11 @@
             },
             "x_elevator_objective": "Block outbound traffic",
             "x_elevator_objective_confidence": "High",
-            "x_elevator_stage": "Response"
+            "x_elevator_stage": "response"
         },
         {
             "created": "2015-07-31T11:24:39.090Z",
+            "created_by_ref": "identity--12e8fa05-9995-4fa8-b7ff-979d355ab26a",
             "id": "indicator--2cb76e88-2734-4a6c-a28c-52ae05f627be",
             "labels": [
                 "ftp"
@@ -32,6 +41,7 @@
         },
         {
             "created": "2015-07-31T11:24:39.090Z",
+            "created_by_ref": "identity--12e8fa05-9995-4fa8-b7ff-979d355ab26a",
             "id": "relationship--b7e4e7c3-36b6-4e93-bc47-e6e65fc21168",
             "modified": "2015-07-31T11:24:39.090Z",
             "relationship_type": "investigates",
diff --git a/idioms-json-2.0-custom/hostname.json b/idioms-json-2.0-custom/hostname.json
index 4b826d9d..38a0f86a 100644
--- a/idioms-json-2.0-custom/hostname.json
+++ b/idioms-json-2.0-custom/hostname.json
@@ -52,6 +52,7 @@
         },
         {
             "created": "2021-08-06T14:04:41.000Z",
+            "created_by_ref": "identity--fa9e6dae-baf1-42bb-8c2c-b582cb0ae604",
             "id": "report--b9879910-5e2b-49f8-931c-ca2bb914e6ec",
             "labels": [
                 "indicator"
diff --git a/idioms-json-2.0-custom/icmp_observable.json b/idioms-json-2.0-custom/icmp_observable.json
index 03646fdf..b23130d9 100644
--- a/idioms-json-2.0-custom/icmp_observable.json
+++ b/idioms-json-2.0-custom/icmp_observable.json
@@ -14,7 +14,7 @@
             "icmp-ext": {
               "icmp_code_hex": "00",
               "icmp_type_hex": "08",
-              "x_elevator_checksum": "97c02164528d"
+              "x_elevator_checksum_hex": "97c02164528d"
             }
           },
           "protocols": [
diff --git a/idioms-json-2.0-custom/incident-malware.json b/idioms-json-2.0-custom/incident-malware.json
index 11cb7b68..a720d774 100644
--- a/idioms-json-2.0-custom/incident-malware.json
+++ b/idioms-json-2.0-custom/incident-malware.json
@@ -37,8 +37,8 @@
                 "identity--be9c05a3-63db-4087-bb30-b1975a813630"
             ],
             "x_elevator_discovery_methods": [
-                "Log Review",
-                "Antivirus"
+                "log-review",
+                "antivirus"
             ],
             "x_elevator_intended_effects": [
                 {
@@ -46,8 +46,8 @@
                     "value": "Degradation of Service"
                 }
             ],
-            "x_elevator_security_compromise": "Suspected",
-            "x_elevator_status": "Containment Achieved",
+            "x_elevator_security_compromise": "suspected",
+            "x_elevator_status": "containment-achieved",
             "x_elevator_time_when_containment_achieved": "2014-05-07T08:00:00.000000Z",
             "x_elevator_time_of_incident_discovery": "2014-05-02T02:10:16.000000Z",
             "x_elevator_time_when_incident_reported": "2014-05-07T02:00:00.000000Z"
diff --git a/idioms-json-2.0-custom/issue-239.json b/idioms-json-2.0-custom/issue-239.json
index f1157c0e..0fc0ebe5 100644
--- a/idioms-json-2.0-custom/issue-239.json
+++ b/idioms-json-2.0-custom/issue-239.json
@@ -55,6 +55,7 @@
         },
         {
             "created": "2020-11-23T14:26:05.000Z",
+            "created_by_ref": "identity--43b246e7-1b50-4756-a075-6577dfacb1a8",
             "description": "This is the package overview",
             "id": "report--22ed36e0-949e-40d2-81ea-906dbe255c43",
             "labels": [
diff --git a/idioms-json-2.0-custom/marking_information_source.json b/idioms-json-2.0-custom/marking_information_source.json
index 2e440722..8d4fa07b 100644
--- a/idioms-json-2.0-custom/marking_information_source.json
+++ b/idioms-json-2.0-custom/marking_information_source.json
@@ -21,6 +21,7 @@
         },
         {
             "created": "2015-05-15T09:00:00.000Z",
+            "created_by_ref": "identity--a7c52e81-4525-4b87-a7b3-3f7d40cb8e24",
             "description": "This is a cyber threat indicator for instances of US-China_Q14 phishing attempts.",
             "id": "indicator--93bee00f-a1cb-4e2a-84e5-6d11a37f3662",
             "labels": [
@@ -39,6 +40,7 @@
         },
         {
             "created": "2014-05-08T09:00:00.000Z",
+            "created_by_ref": "identity--a7c52e81-4525-4b87-a7b3-3f7d40cb8e24",
             "id": "report--e53649c7-8362-405c-9158-7e4c01af4bcb",
             "labels": [
                 "indicator-watchlist"
diff --git a/idioms-json-2.0-custom/network-socket-observable.json b/idioms-json-2.0-custom/network-socket-observable.json
index de7dd7f0..583fec75 100644
--- a/idioms-json-2.0-custom/network-socket-observable.json
+++ b/idioms-json-2.0-custom/network-socket-observable.json
@@ -10,6 +10,7 @@
       "number_observed": 1,
       "objects": {
         "0": {
+          "dst_ref": "1",
           "extensions": {
             "socket-ext": {
               "address_family": "AF_INET",
@@ -17,13 +18,17 @@
               "options": {
                 "IP_MULTICAST_LOOP": 1
               },
-              "x_elevator_local_address": "198.51.100.2"
+              "protocol_family": "PF_APPLETALK"
             }
           },
           "protocols": [
             "tcp"
           ],
           "type": "network-traffic"
+        },
+        "1": {
+          "type": "ipv4-addr",
+          "value": "198.51.100.2"
         }
       },
       "type": "observed-data"
diff --git a/idioms-json-2.0-custom/victim-targeting.json b/idioms-json-2.0-custom/victim-targeting.json
index 63bccf09..75fbd4bc 100644
--- a/idioms-json-2.0-custom/victim-targeting.json
+++ b/idioms-json-2.0-custom/victim-targeting.json
@@ -3,14 +3,15 @@
     "objects": [
         {
             "created": "2014-05-08T09:00:00.000Z",
-            "id": "campaign--c831ab93-ff84-9cda-2bd8-b094004da969",
+            "id": "campaign--c831ab93-ff84-4cda-8bd8-b094004da969",
             "modified": "2014-05-08T09:00:00.000Z",
             "name": "Operation Alpha",
-            "type": "campaign"
+            "type": "campaign",
+            "x_elevator_status": "ongoing"
         },
         {
             "created": "2014-05-08T09:00:00.000Z",
-            "id": "identity--4fde045a-b25f-f035-e8d0-29c9d5130cd9",
+            "id": "identity--4fde045a-b25f-4035-88d0-29c9d5130cd9",
             "identity_class": "unknown",
             "modified": "2014-05-08T09:00:00.000Z",
             "name": "Victim Targeting: Customer PII and Financial Data",
@@ -26,8 +27,8 @@
             "id": "relationship--09ae7018-6967-4436-8599-d9f9cbffc58f",
             "modified": "2014-05-08T09:00:00.000Z",
             "relationship_type": "targets",
-            "source_ref": "campaign--c831ab93-ff84-9cda-2bd8-b094004da969",
-            "target_ref": "identity--4fde045a-b25f-f035-e8d0-29c9d5130cd9",
+            "source_ref": "campaign--c831ab93-ff84-4cda-8bd8-b094004da969",
+            "target_ref": "identity--4fde045a-b25f-4035-88d0-29c9d5130cd9",
             "type": "relationship"
         }
     ],
diff --git a/idioms-json-2.0-valid/archive-file.json b/idioms-json-2.0-valid/archive-file.json
new file mode 100644
index 00000000..b4dc934d
--- /dev/null
+++ b/idioms-json-2.0-valid/archive-file.json
@@ -0,0 +1,50 @@
+{
+    "id": "bundle--cc0ca596-70e6-4dac-9bef-603166d17db8",
+    "objects": [
+        {
+            "created": "2019-12-19T15:46:59.473Z",
+            "first_observed": "2019-12-19T15:46:59.473Z",
+            "id": "observed-data--c8c32b6e-2ea8-4678-8446-7f5218072f27",
+            "last_observed": "2019-12-19T15:46:59.473Z",
+            "modified": "2019-12-19T15:46:59.473Z",
+            "number_observed": 1,
+            "objects": {
+                "0": {
+                    "extensions": {
+                        "archive-ext": {
+                            "contains_refs": [
+                                "1",
+                                "3"
+                            ],
+                            "version": "1.2"
+                        }
+                    },
+                    "name": "iprip32.zip",
+                    "parent_directory_ref": "2",
+                    "type": "file"
+                },
+                "1": {
+                    "hashes": {
+                        "SHA-256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+                    },
+                    "name": "fred.doc",
+                    "parent_directory_ref": "2",
+                    "type": "file"
+                },
+                "2": {
+                    "path": "/usr/local",
+                    "type": "directory"
+                },
+                "3": {
+                    "hashes": {
+                        "MD5": "5d8129be965fab8115eca34fc84bd7f0"
+                    },
+                    "type": "file"
+                }
+            },
+            "type": "observed-data"
+        }
+    ],
+    "spec_version": "2.0",
+    "type": "bundle"
+}
diff --git a/idioms-json-2.0/Mandiant_APT1_Report.json b/idioms-json-2.0/Mandiant_APT1_Report.json
index 417da2e3..40f2c223 100644
--- a/idioms-json-2.0/Mandiant_APT1_Report.json
+++ b/idioms-json-2.0/Mandiant_APT1_Report.json
@@ -573,7 +573,7 @@
         {
             "created": "2015-05-15T09:00:00.000Z",
             "created_by_ref": "identity--457f7913-c000-48ec-9394-67d777e7d586",
-            "description": "<!DOCTYPE html>\n\t\t\t\t\t\t<html><body>\n\t\t\t\t\t\t\t\t<p>Windows password hash dumper.</P>\n\t\t\t\t\t\t\t\t<p>http://www.foofus.net/fizzgig/fgdump/</P>\n\t\t\t\t\t\t</body></html>\n\nINTENDED_EFFECT:Unauthorized Access: Escalating privileges involves acquiring items (most\n\t\t\t\toften usernames and passwords) that will allow access to more resources within\n\t\t\t\tthe network. \n\nTITLE:\n\tPrivilege Escalation",
+            "description": "<!DOCTYPE html>\n\t\t\t\t\t\t<html><body>\n\t\t\t\t\t\t\t\t<p>Windows password hash dumper.</P>\n\t\t\t\t\t\t\t\t<p>http://www.foofus.net/fizzgig/fgdump/</P>\n\t\t\t\t\t\t</body></html>\n\nVENDOR:\n\tunknown\n\nINTENDED_EFFECT:Unauthorized Access: Escalating privileges involves acquiring items (most\n\t\t\t\toften usernames and passwords) that will allow access to more resources within\n\t\t\t\tthe network. \n\nTITLE:\n\tPrivilege Escalation",
             "id": "tool--a9d6a1de-423f-4944-af89-4e11e6f5f10e",
             "kill_chain_phases": [
                 {
diff --git a/idioms-json-2.0/ais-marking-a-e-f.json b/idioms-json-2.0/ais-marking-a-e-f.json
index 0634f4f7..dbb52008 100644
--- a/idioms-json-2.0/ais-marking-a-e-f.json
+++ b/idioms-json-2.0/ais-marking-a-e-f.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--8d9a4848-0713-4ad9-9e81-c7bf59ba8a6b",
             "id": "report--ae482977-f781-4256-a0a9-29b6d5a0b4af",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0/ais-marking-a-e-t.json b/idioms-json-2.0/ais-marking-a-e-t.json
index c66ce2de..c74aa4ef 100644
--- a/idioms-json-2.0/ais-marking-a-e-t.json
+++ b/idioms-json-2.0/ais-marking-a-e-t.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--08306b2d-483c-48b9-a35c-abcb97bf5668",
             "id": "report--e74fd953-f4bf-464e-9d82-ff9bc7edd972",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0/ais-marking-a-n-f.json b/idioms-json-2.0/ais-marking-a-n-f.json
index 6bb525ce..a457ac72 100644
--- a/idioms-json-2.0/ais-marking-a-n-f.json
+++ b/idioms-json-2.0/ais-marking-a-n-f.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--35fba929-1360-471e-bb16-34dffe877598",
             "id": "report--ddf79967-7ebb-45bb-9c87-4bea5bd06c35",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0/ais-marking-a-n-t.json b/idioms-json-2.0/ais-marking-a-n-t.json
index 7b67f0ab..93fce544 100644
--- a/idioms-json-2.0/ais-marking-a-n-t.json
+++ b/idioms-json-2.0/ais-marking-a-n-t.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--e19a4291-c6f7-4f52-848b-aeb7a2e109e4",
             "id": "report--25bb27f6-04ce-4f91-8f4f-f8232349705e",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0/ais-marking-a-u-f.json b/idioms-json-2.0/ais-marking-a-u-f.json
index 2c87c421..5f492d42 100644
--- a/idioms-json-2.0/ais-marking-a-u-f.json
+++ b/idioms-json-2.0/ais-marking-a-u-f.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--0ef2e96e-8cf3-4f4c-a2f7-c1179b0748e7",
             "id": "report--336bd3ef-e559-4723-bd81-a2161ca9aaa6",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0/ais-marking-a-u-t.json b/idioms-json-2.0/ais-marking-a-u-t.json
index b6308156..9c4d2303 100644
--- a/idioms-json-2.0/ais-marking-a-u-t.json
+++ b/idioms-json-2.0/ais-marking-a-u-t.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--40b6aa3b-3bd4-4999-b304-4e901e6607c3",
             "id": "report--90d84959-aba3-48de-9eb2-0a45185f4c34",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0/ais-marking-g-e-f.json b/idioms-json-2.0/ais-marking-g-e-f.json
index 14d2bc10..b3190962 100644
--- a/idioms-json-2.0/ais-marking-g-e-f.json
+++ b/idioms-json-2.0/ais-marking-g-e-f.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--8687a170-d9f9-445f-9509-ea49a616a0ef",
             "id": "report--66dd2e1f-8684-4ccd-995a-774251bec1ad",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0/ais-marking-g-e-t.json b/idioms-json-2.0/ais-marking-g-e-t.json
index d9236552..98926bc6 100644
--- a/idioms-json-2.0/ais-marking-g-e-t.json
+++ b/idioms-json-2.0/ais-marking-g-e-t.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--7e4a8e90-cdcc-4348-9f60-c2a939ed538a",
             "id": "report--338407b7-9601-4b65-84bc-ab0010f05317",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0/ais-marking-g-n-f.json b/idioms-json-2.0/ais-marking-g-n-f.json
index 120081aa..4a1e2d87 100644
--- a/idioms-json-2.0/ais-marking-g-n-f.json
+++ b/idioms-json-2.0/ais-marking-g-n-f.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--51340d84-5658-4b46-82c1-d5ac932a2d2f",
             "id": "report--0f08ac4e-349b-47bc-914d-ada9d4578a00",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0/ais-marking-g-n-t.json b/idioms-json-2.0/ais-marking-g-n-t.json
index 55cf4f79..8c09114b 100644
--- a/idioms-json-2.0/ais-marking-g-n-t.json
+++ b/idioms-json-2.0/ais-marking-g-n-t.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--d269de82-c9b2-42db-90cc-1a7a9a535c72",
             "id": "report--de1454ae-8dc6-44d3-b451-1efe6740eae2",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0/ais-marking-g-u-f.json b/idioms-json-2.0/ais-marking-g-u-f.json
index bb019f94..b26b2e41 100644
--- a/idioms-json-2.0/ais-marking-g-u-f.json
+++ b/idioms-json-2.0/ais-marking-g-u-f.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--6a2662c6-b411-4997-b691-17dda6731250",
             "id": "report--a2ab9a3a-84c2-45fd-be69-1a028c6d197e",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0/ais-marking-g-u-t.json b/idioms-json-2.0/ais-marking-g-u-t.json
index d3fe6d92..4199ff1a 100644
--- a/idioms-json-2.0/ais-marking-g-u-t.json
+++ b/idioms-json-2.0/ais-marking-g-u-t.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--f00fe7be-fdc7-4b94-8882-e095c93cc0a0",
             "id": "report--5cc8e027-8840-4170-bcba-ae01e86162ef",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0/ais-marking-w-e-f.json b/idioms-json-2.0/ais-marking-w-e-f.json
index e901d684..d4673245 100644
--- a/idioms-json-2.0/ais-marking-w-e-f.json
+++ b/idioms-json-2.0/ais-marking-w-e-f.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--fcc0c6cb-c9c5-41ce-885f-a1cba8787c8a",
             "id": "report--f6ae3163-0689-44e0-847b-75a6f5d2961c",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0/ais-marking-w-e-t.json b/idioms-json-2.0/ais-marking-w-e-t.json
index 08652fd2..01e75aad 100644
--- a/idioms-json-2.0/ais-marking-w-e-t.json
+++ b/idioms-json-2.0/ais-marking-w-e-t.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--a2797b07-c1cb-41ea-8523-5c9c0b5644c1",
             "id": "report--e4a8b419-a360-4cdf-98ad-300ba13267af",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0/ais-marking-w-n-f.json b/idioms-json-2.0/ais-marking-w-n-f.json
index 4619a5b1..1de89e5d 100644
--- a/idioms-json-2.0/ais-marking-w-n-f.json
+++ b/idioms-json-2.0/ais-marking-w-n-f.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--80114e62-9a23-4cad-9d65-08865fec1e0a",
             "id": "report--159ce9f1-47bc-47b2-821f-a99b412d6cf3",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0/ais-marking-w-n-t.json b/idioms-json-2.0/ais-marking-w-n-t.json
index ed013458..390f8028 100644
--- a/idioms-json-2.0/ais-marking-w-n-t.json
+++ b/idioms-json-2.0/ais-marking-w-n-t.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--a9f12df7-4d26-4ede-aaaf-736e5ce0c6f2",
             "id": "report--9c5560eb-0fd5-479a-84c5-2cbfdc92c8c5",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0/ais-marking-w-u-f.json b/idioms-json-2.0/ais-marking-w-u-f.json
index 8ff435e1..d1751053 100644
--- a/idioms-json-2.0/ais-marking-w-u-f.json
+++ b/idioms-json-2.0/ais-marking-w-u-f.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--6478387d-18e2-4255-a725-f2d7a85cf02f",
             "id": "report--eaa9c2e4-499b-4f97-9d41-e20a99231480",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0/ais-marking-w-u-t.json b/idioms-json-2.0/ais-marking-w-u-t.json
index b4a79c7b..d2d0765c 100644
--- a/idioms-json-2.0/ais-marking-w-u-t.json
+++ b/idioms-json-2.0/ais-marking-w-u-t.json
@@ -36,6 +36,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--083185ca-d943-465c-b45a-baeccd1f9ad1",
             "id": "report--108b2f2b-5332-4a7d-b5bf-7d886895faef",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0/campaign-v-actors.json b/idioms-json-2.0/campaign-v-actors.json
index 6f981853..ff20f395 100644
--- a/idioms-json-2.0/campaign-v-actors.json
+++ b/idioms-json-2.0/campaign-v-actors.json
@@ -21,6 +21,22 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--fab3a857-80eb-4ecc-8440-d9228083e47f",
+            "description": "Fred\n\nROLES:\nAggregator,\nInitial Author",
+            "external_references": [
+                {
+                    "source_name": "unknown",
+                    "url": "http://foo.com/bar"
+                }
+            ],
+            "id": "identity--e3ae6a4c-adc3-420e-be2e-7497827cdc01",
+            "modified": "2014-08-08T15:50:10.983Z",
+            "name": "not provided",
+            "type": "identity"
+        },
+        {
+            "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--fab3a857-80eb-4ecc-8440-d9228083e47f",
             "description": "\n\nTARGETED_INFORMATION:\nInformation Assets - Financial Data",
             "id": "identity--2d1c6ab3-5e4e-48ac-a32b-f0c01c2836a8",
             "identity_class": "unknown",
@@ -33,6 +49,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--fab3a857-80eb-4ecc-8440-d9228083e47f",
             "goals": [
                 "Theft",
                 "Theft - Theft of Proprietary Information"
@@ -55,13 +72,7 @@
                 "NewsBeef"
             ],
             "created": "2014-08-08T15:50:10.983Z",
-            "description": "Fred\n\nINFORMATION_SOURCE_ROLES:\nAggregator,\nInitial Author",
-            "external_references": [
-                {
-                    "source_name": "unknown",
-                    "url": "http://foo.com/bar"
-                }
-            ],
+            "created_by_ref": "identity--57487a81-3c58-4372-a6bc-0b17004f7574",
             "id": "campaign--e5268b6e-4931-42f1-b379-87f48eb41b1e",
             "modified": "2014-08-08T15:50:10.983Z",
             "name": "Compromise of ATM Machines",
@@ -72,6 +83,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--fab3a857-80eb-4ecc-8440-d9228083e47f",
             "id": "relationship--48820520-b033-4a28-8c95-3e41e85c00bf",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -84,6 +96,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--fab3a857-80eb-4ecc-8440-d9228083e47f",
             "id": "relationship--f6276957-0503-4e05-91e7-53d25b4f0898",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -96,6 +109,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--fab3a857-80eb-4ecc-8440-d9228083e47f",
             "id": "relationship--aa75836f-b40a-4117-be13-fd1c5cbb11d0",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -108,6 +122,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--fab3a857-80eb-4ecc-8440-d9228083e47f",
             "id": "relationship--791a93ce-4726-4a83-99d4-bafcb015baa1",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -120,6 +135,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--fab3a857-80eb-4ecc-8440-d9228083e47f",
             "id": "relationship--457e4df5-2852-4f77-bee4-8d77db2be81c",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -132,6 +148,7 @@
         },
         {
             "created": "2022-09-13T12:03:29.688Z",
+            "created_by_ref": "identity--57487a81-3c58-4372-a6bc-0b17004f7574",
             "description": "Foo\nBar\nFred\nBarney",
             "id": "report--eb25c367-aaea-48b3-9daa-fe96504e5bc3",
             "labels": [
@@ -142,6 +159,7 @@
             "name": "regression-test-08-Elevator02",
             "object_refs": [
                 "identity--57487a81-3c58-4372-a6bc-0b17004f7574",
+                "identity--fab3a857-80eb-4ecc-8440-d9228083e47f",
                 "identity--2d1c6ab3-5e4e-48ac-a32b-f0c01c2836a8",
                 "threat-actor--56f3f0db-b5d5-431c-ae56-c18f02caf500",
                 "campaign--e5268b6e-4931-42f1-b379-87f48eb41b1e",
diff --git a/idioms-json-2.0/coa_ind_malicious_file.json b/idioms-json-2.0/coa_ind_malicious_file.json
index c16ec42c..0a673eb5 100644
--- a/idioms-json-2.0/coa_ind_malicious_file.json
+++ b/idioms-json-2.0/coa_ind_malicious_file.json
@@ -67,6 +67,7 @@
         },
         {
             "created": "9999-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--27903cf2-a534-49fc-a509-c8e04131b956",
             "id": "report--c996fc26-d42b-4fcd-9c17-d5cd4da6e2e5",
             "labels": [
                 "threat-report",
diff --git a/idioms-json-2.0/custom_object.json b/idioms-json-2.0/custom_object.json
index 4ad64615..7bff0eda 100644
--- a/idioms-json-2.0/custom_object.json
+++ b/idioms-json-2.0/custom_object.json
@@ -3,6 +3,14 @@
     "objects": [
         {
             "created": "2015-07-31T11:24:39.090Z",
+            "id": "identity--d61bf54b-09b1-4417-8c96-659ca6f1a3b2",
+            "modified": "2015-07-31T11:24:39.090Z",
+            "name": "not provided",
+            "type": "identity"
+        },
+        {
+            "created": "2015-07-31T11:24:39.090Z",
+            "created_by_ref": "identity--d61bf54b-09b1-4417-8c96-659ca6f1a3b2",
             "description": "\n\nSTAGE:\n\tResponse\n\nOBJECTIVE: Block outbound traffic\n\nOBJECTIVE CONFIDENCE: High\n\nIMPACT:Medium: Some description about the indicator.",
             "id": "course-of-action--3dbfccad-1fbb-4e9f-8307-f2d1a5c651cc",
             "labels": [
@@ -14,6 +22,7 @@
         },
         {
             "created": "2015-07-31T11:24:39.090Z",
+            "created_by_ref": "identity--d61bf54b-09b1-4417-8c96-659ca6f1a3b2",
             "description": "\n\nLIKELY_IMPACT:Medium",
             "id": "indicator--2cb76e88-2734-4a6c-a28c-52ae05f627be",
             "labels": [
@@ -26,6 +35,7 @@
         },
         {
             "created": "2015-07-31T11:24:39.090Z",
+            "created_by_ref": "identity--d61bf54b-09b1-4417-8c96-659ca6f1a3b2",
             "id": "relationship--573863e0-8550-4e48-a82e-396551a49a16",
             "modified": "2015-07-31T11:24:39.090Z",
             "relationship_type": "investigates",
diff --git a/idioms-json-2.0/hostname.json b/idioms-json-2.0/hostname.json
index bb30fd28..d568bccc 100644
--- a/idioms-json-2.0/hostname.json
+++ b/idioms-json-2.0/hostname.json
@@ -52,6 +52,7 @@
         },
         {
             "created": "2021-08-06T14:04:41.000Z",
+            "created_by_ref": "identity--2016d781-f864-4060-b4b0-58ab84ef3a41",
             "id": "report--d859102c-6482-4a6c-ade7-039ec29e68b5",
             "labels": [
                 "indicator"
diff --git a/idioms-json-2.0/issue-239.json b/idioms-json-2.0/issue-239.json
index 20a0df53..d8ff172d 100644
--- a/idioms-json-2.0/issue-239.json
+++ b/idioms-json-2.0/issue-239.json
@@ -55,6 +55,7 @@
         },
         {
             "created": "2020-11-23T14:26:05.000Z",
+            "created_by_ref": "identity--0c96e802-de0f-4f2c-9ad3-0a67aedda24c",
             "description": "This is the package overview",
             "id": "report--99da9d67-355c-492e-924d-7f31ffe501ca",
             "labels": [
diff --git a/idioms-json-2.0/marking_information_source.json b/idioms-json-2.0/marking_information_source.json
index c11d9c57..089a84e9 100644
--- a/idioms-json-2.0/marking_information_source.json
+++ b/idioms-json-2.0/marking_information_source.json
@@ -21,6 +21,7 @@
         },
         {
             "created": "2015-05-15T09:00:00.000Z",
+            "created_by_ref": "identity--330f78d6-c2e7-4204-85bd-804bafb3c7c5",
             "description": "This is a cyber threat indicator for instances of US-China_Q14 phishing attempts.\n\nCONFIDENCE: High",
             "id": "indicator--62f0709b-5cb7-4dce-9ee1-aab27d0dd191",
             "labels": [
@@ -38,6 +39,7 @@
         },
         {
             "created": "2014-05-08T09:00:00.000Z",
+            "created_by_ref": "identity--330f78d6-c2e7-4204-85bd-804bafb3c7c5",
             "id": "report--c645a139-eadd-4507-8c70-70fc17a1b73a",
             "labels": [
                 "indicator-watchlist"
diff --git a/idioms-json-2.0/network-socket-observable.json b/idioms-json-2.0/network-socket-observable.json
index 84206dbd..a0ee8de4 100644
--- a/idioms-json-2.0/network-socket-observable.json
+++ b/idioms-json-2.0/network-socket-observable.json
@@ -1,33 +1,39 @@
 {
-  "id": "bundle--8005dcb9-398c-4f61-b44c-18133199d145",
-  "objects": [
-    {
-      "created": "2018-07-24T16:07:55.291Z",
-      "first_observed": "2018-07-24T16:07:55.291Z",
-      "id": "observed-data--175e561f-3ced-4cf7-8a17-654ca651ff97",
-      "last_observed": "2018-07-24T16:07:55.291Z",
-      "modified": "2018-07-24T16:07:55.291Z",
-      "number_observed": 1,
-      "objects": {
-        "0": {
-          "extensions": {
-            "socket-ext": {
-              "address_family": "AF_INET",
-              "is_listening": true,
-              "options": {
-                "IP_MULTICAST_LOOP": 1
-              }
-            }
-          },
-          "protocols": [
-            "tcp"
-          ],
-          "type": "network-traffic"
+    "id": "bundle--8005dcb9-398c-4f61-b44c-18133199d145",
+    "objects": [
+        {
+            "created": "2023-02-27T14:29:03.770Z",
+            "first_observed": "2023-02-27T14:29:03.770Z",
+            "id": "observed-data--175e561f-3ced-4cf7-8a17-654ca651ff97",
+            "last_observed": "2023-02-27T14:29:03.770Z",
+            "modified": "2023-02-27T14:29:03.770Z",
+            "number_observed": 1,
+            "objects": {
+                "0": {
+                    "dst_ref": "1",
+                    "extensions": {
+                        "socket-ext": {
+                            "address_family": "AF_INET",
+                            "is_listening": true,
+                            "options": {
+                                "IP_MULTICAST_LOOP": 1
+                            },
+                            "protocol_family": "PF_APPLETALK"
+                        }
+                    },
+                    "protocols": [
+                        "tcp"
+                    ],
+                    "type": "network-traffic"
+                },
+                "1": {
+                    "type": "ipv4-addr",
+                    "value": "198.51.100.2"
+                }
+            },
+            "type": "observed-data"
         }
-      },
-      "type": "observed-data"
-    }
-  ],
-  "spec_version": "2.0",
-  "type": "bundle"
-}
+    ],
+    "spec_version": "2.0",
+    "type": "bundle"
+}
\ No newline at end of file
diff --git a/idioms-json-2.0/victim-targeting.json b/idioms-json-2.0/victim-targeting.json
index 2638a7b9..87157252 100644
--- a/idioms-json-2.0/victim-targeting.json
+++ b/idioms-json-2.0/victim-targeting.json
@@ -3,7 +3,8 @@
     "objects": [
         {
             "created": "2014-05-08T09:00:00.000Z",
-            "id": "campaign--c831ab93-ff84-9cda-2bd8-b094004da969",
+                        "description": "\n\nSTATUS:\n\tOngoing",
+            "id": "campaign--c831ab93-ff84-4cda-8bd8-b094004da969",
             "modified": "2014-05-08T09:00:00.000Z",
             "name": "Operation Alpha",
             "type": "campaign"
@@ -11,7 +12,7 @@
         {
             "created": "2014-05-08T09:00:00.000Z",
             "description": "\n\nTARGETED_INFORMATION:\nInformation Assets - Customer PII,\nInformation Assets - Financial Data",
-            "id": "identity--4fde045a-b25f-f035-e8d0-29c9d5130cd9",
+            "id": "identity--4fde045a-b25f-4035-88d0-29c9d5130cd9",
             "identity_class": "unknown",
             "modified": "2014-05-08T09:00:00.000Z",
             "name": "Victim Targeting: Customer PII and Financial Data",
@@ -23,8 +24,8 @@
             "id": "relationship--93211624-3c4f-4060-b525-ea3394a48bf4",
             "modified": "2014-05-08T09:00:00.000Z",
             "relationship_type": "targets",
-            "source_ref": "campaign--c831ab93-ff84-9cda-2bd8-b094004da969",
-            "target_ref": "identity--4fde045a-b25f-f035-e8d0-29c9d5130cd9",
+            "source_ref": "campaign--c831ab93-ff84-4cda-8bd8-b094004da969",
+            "target_ref": "identity--4fde045a-b25f-4035-88d0-29c9d5130cd9",
             "type": "relationship"
         }
     ],
diff --git a/idioms-json-2.1-custom/Mandiant_APT1_Report.json b/idioms-json-2.1-custom/Mandiant_APT1_Report.json
index 081eee1b..cc3e6222 100644
--- a/idioms-json-2.1-custom/Mandiant_APT1_Report.json
+++ b/idioms-json-2.1-custom/Mandiant_APT1_Report.json
@@ -84,12 +84,12 @@
             "object_marking_refs": [
                 "marking-definition--85daa1d8-c895-4d75-92fb-dabb3f8648fe"
             ],
-            "spec_version": "2.1",
-            "type": "identity",
-            "x_elevator_information_source_roles": [
+            "roles": [
                 "Nation-State",
                 "Military"
-            ]
+            ],
+            "spec_version": "2.1",
+            "type": "identity"
         },
         {
             "aliases": [
@@ -210,11 +210,11 @@
             "object_marking_refs": [
                 "marking-definition--85daa1d8-c895-4d75-92fb-dabb3f8648fe"
             ],
-            "spec_version": "2.1",
-            "type": "identity",
-            "x_elevator_information_source_roles": [
+            "roles": [
                 "Research and Development"
-            ]
+            ],
+            "spec_version": "2.1",
+            "type": "identity"
         },
         {
             "created": "2015-05-15T09:00:00.000Z",
@@ -443,12 +443,11 @@
             "name": "Communist Part of China",
             "object_marking_refs": [
                 "marking-definition--85daa1d8-c895-4d75-92fb-dabb3f8648fe"
+            ],"roles": [
+                "Nation-State"
             ],
             "spec_version": "2.1",
-            "type": "identity",
-            "x_elevator_information_source_roles": [
-                "Nation-State"
-            ]
+            "type": "identity"
         },
         {
             "created": "2015-05-15T09:00:00.000Z",
@@ -487,11 +486,11 @@
             "object_marking_refs": [
                 "marking-definition--85daa1d8-c895-4d75-92fb-dabb3f8648fe"
             ],
-            "spec_version": "2.1",
-            "type": "identity",
-            "x_elevator_information_source_roles": [
+            "roles": [
                 "State-influenced Commercial Entity"
-            ]
+            ],
+            "spec_version": "2.1",
+            "type": "identity"
         },
         {
             "created": "2015-05-15T09:00:00.000Z",
@@ -1272,7 +1271,8 @@
                     "value": "Unauthorized Access"
                 }
             ],
-            "x_elevator_title": "Privilege Escalation"
+            "x_elevator_title": "Privilege Escalation",
+            "x_elevator_vendor": "unknown"
         },
         {
             "created": "2015-05-15T09:00:00.000Z",
diff --git a/idioms-json-2.1-custom/ais-marking-a-e-f.json b/idioms-json-2.1-custom/ais-marking-a-e-f.json
index 00bffc38..d9df382b 100644
--- a/idioms-json-2.1-custom/ais-marking-a-e-f.json
+++ b/idioms-json-2.1-custom/ais-marking-a-e-f.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--109ec069-c971-45a8-adb2-ac10c8690cb9",
             "id": "report--a7c5728f-df0e-4142-b7ac-cef0ab325bbc",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-custom/ais-marking-a-e-t.json b/idioms-json-2.1-custom/ais-marking-a-e-t.json
index 7589aab3..f9852f7e 100644
--- a/idioms-json-2.1-custom/ais-marking-a-e-t.json
+++ b/idioms-json-2.1-custom/ais-marking-a-e-t.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--3449eec4-8b58-468e-a80d-79a8bffa3ed7",
             "id": "report--a7f5e2e5-16e6-4d54-a32e-617c59c0ae5d",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-custom/ais-marking-a-n-f.json b/idioms-json-2.1-custom/ais-marking-a-n-f.json
index 9f983d15..8122cde9 100644
--- a/idioms-json-2.1-custom/ais-marking-a-n-f.json
+++ b/idioms-json-2.1-custom/ais-marking-a-n-f.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--6524a5b9-cba1-4f44-b29a-a463bfc28407",
             "id": "report--8701a3d2-de1e-4551-a0bf-5caa38d130f8",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-custom/ais-marking-a-n-t.json b/idioms-json-2.1-custom/ais-marking-a-n-t.json
index 402dcd23..31ee4375 100644
--- a/idioms-json-2.1-custom/ais-marking-a-n-t.json
+++ b/idioms-json-2.1-custom/ais-marking-a-n-t.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--6441701b-b657-4964-9f24-9ed9bb3a661d",
             "id": "report--bc8139bb-a266-47e4-92f5-5c7028e5c381",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-custom/ais-marking-a-u-f.json b/idioms-json-2.1-custom/ais-marking-a-u-f.json
index cb4c4c11..349fef71 100644
--- a/idioms-json-2.1-custom/ais-marking-a-u-f.json
+++ b/idioms-json-2.1-custom/ais-marking-a-u-f.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--a6f5506e-80c6-4368-96ea-1365f49b09df",
             "id": "report--1ab6552f-cf97-4405-ae8f-3ffc9abddd2b",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-custom/ais-marking-a-u-t.json b/idioms-json-2.1-custom/ais-marking-a-u-t.json
index 3958652e..ef264dcc 100644
--- a/idioms-json-2.1-custom/ais-marking-a-u-t.json
+++ b/idioms-json-2.1-custom/ais-marking-a-u-t.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--b1c23c2f-20b9-40f9-86a2-7ac791734ee3",
             "id": "report--e78a5223-1a19-4c85-86f4-edb57d1be9a9",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-custom/ais-marking-g-e-f.json b/idioms-json-2.1-custom/ais-marking-g-e-f.json
index ca261968..affa1430 100644
--- a/idioms-json-2.1-custom/ais-marking-g-e-f.json
+++ b/idioms-json-2.1-custom/ais-marking-g-e-f.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--b5a5b551-9f11-48c0-a317-010a2be7ad6a",
             "id": "report--af159115-32fe-43d5-8044-b2a8b29e0bb2",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-custom/ais-marking-g-e-t.json b/idioms-json-2.1-custom/ais-marking-g-e-t.json
index fffd1128..8ae4441a 100644
--- a/idioms-json-2.1-custom/ais-marking-g-e-t.json
+++ b/idioms-json-2.1-custom/ais-marking-g-e-t.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--eed7c3ba-425a-4992-9ebc-323baab5ad3b",
             "id": "report--6a96fc81-93b4-4b50-bf01-939402f6147b",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-custom/ais-marking-g-n-f.json b/idioms-json-2.1-custom/ais-marking-g-n-f.json
index 0af08493..ba8f33e0 100644
--- a/idioms-json-2.1-custom/ais-marking-g-n-f.json
+++ b/idioms-json-2.1-custom/ais-marking-g-n-f.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--ad6c0bcb-41fc-42c6-9d6f-3faa2c85dc4c",
             "id": "report--1d8d5787-d69b-4afd-ba94-1f24b31ec690",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-custom/ais-marking-g-n-t.json b/idioms-json-2.1-custom/ais-marking-g-n-t.json
index 0af08493..ba8f33e0 100644
--- a/idioms-json-2.1-custom/ais-marking-g-n-t.json
+++ b/idioms-json-2.1-custom/ais-marking-g-n-t.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--ad6c0bcb-41fc-42c6-9d6f-3faa2c85dc4c",
             "id": "report--1d8d5787-d69b-4afd-ba94-1f24b31ec690",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-custom/ais-marking-g-u-f.json b/idioms-json-2.1-custom/ais-marking-g-u-f.json
index 2c7bf7d9..ce5cfb96 100644
--- a/idioms-json-2.1-custom/ais-marking-g-u-f.json
+++ b/idioms-json-2.1-custom/ais-marking-g-u-f.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--c55d2bad-3d94-4c0e-9479-fc110c8c619b",
             "id": "report--a7a174af-25ae-45fb-9d7c-5eb437d43258",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-custom/ais-marking-g-u-t.json b/idioms-json-2.1-custom/ais-marking-g-u-t.json
index f73f7e28..7d078581 100644
--- a/idioms-json-2.1-custom/ais-marking-g-u-t.json
+++ b/idioms-json-2.1-custom/ais-marking-g-u-t.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--44489856-fcf3-49fb-a8ee-722d24c0c8a6",
             "id": "report--4fb3c2a7-a0c0-4335-b5b4-d7dba5600fc4",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-custom/ais-marking-w-e-f.json b/idioms-json-2.1-custom/ais-marking-w-e-f.json
index 93c829ad..a95a8492 100644
--- a/idioms-json-2.1-custom/ais-marking-w-e-f.json
+++ b/idioms-json-2.1-custom/ais-marking-w-e-f.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--e5e176db-cf0f-4af5-a059-28d7c1bae78a",
             "id": "report--1806736c-38a7-4764-acda-86aa91d65504",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-custom/ais-marking-w-e-t.json b/idioms-json-2.1-custom/ais-marking-w-e-t.json
index 08bae4f0..c1597841 100644
--- a/idioms-json-2.1-custom/ais-marking-w-e-t.json
+++ b/idioms-json-2.1-custom/ais-marking-w-e-t.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--e18e08bd-f02f-4755-b862-62bc03ee17a7",
             "id": "report--2006669e-b58c-4ea0-a804-de070a5e0793",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-custom/ais-marking-w-n-f.json b/idioms-json-2.1-custom/ais-marking-w-n-f.json
index 491aa763..5d48bb3c 100644
--- a/idioms-json-2.1-custom/ais-marking-w-n-f.json
+++ b/idioms-json-2.1-custom/ais-marking-w-n-f.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--39722621-dfd6-48dd-9b6d-8688bdf853f6",
             "id": "report--d801bfab-8447-4a47-8651-b15b125226e4",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-custom/ais-marking-w-n-t.json b/idioms-json-2.1-custom/ais-marking-w-n-t.json
index 9ebae81d..e911b1b9 100644
--- a/idioms-json-2.1-custom/ais-marking-w-n-t.json
+++ b/idioms-json-2.1-custom/ais-marking-w-n-t.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--0bf4affa-e3d4-4aa2-80b7-c19503404eeb",
             "id": "report--1e113810-730d-499f-8483-931036081252",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-custom/ais-marking-w-u-f.json b/idioms-json-2.1-custom/ais-marking-w-u-f.json
index b17ab3ea..b32a205a 100644
--- a/idioms-json-2.1-custom/ais-marking-w-u-f.json
+++ b/idioms-json-2.1-custom/ais-marking-w-u-f.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--e72f88b3-6c16-4bd3-991f-295f89d12d1b",
             "id": "report--028015ec-f7c1-4bcd-9e8b-809d4f580423",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-custom/ais-marking-w-u-t.json b/idioms-json-2.1-custom/ais-marking-w-u-t.json
index 40b56ce2..252573ca 100644
--- a/idioms-json-2.1-custom/ais-marking-w-u-t.json
+++ b/idioms-json-2.1-custom/ais-marking-w-u-t.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--33da7c66-28ef-451a-9060-9a1d5d9ab945",
             "id": "report--53b038c8-1ddd-4bd7-a6b4-fc63933e1521",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-custom/block-network-traffic.json b/idioms-json-2.1-custom/block-network-traffic.json
index 066cfc78..a0510174 100644
--- a/idioms-json-2.1-custom/block-network-traffic.json
+++ b/idioms-json-2.1-custom/block-network-traffic.json
@@ -20,7 +20,7 @@
             "x_elevator_objective": "Block communication between the PIVY agents and the C2 Server",
             "x_elevator_objective_confidence": "High",
             "x_elevator_parameter_expression": "ipv4-addr:value = '10.10.10.10'",
-            "x_elevator_stage": "Response"
+            "x_elevator_stage": "response"
         }
     ],
     "type": "bundle"
diff --git a/idioms-json-2.1-custom/campaign-v-actors.json b/idioms-json-2.1-custom/campaign-v-actors.json
index e4e914bb..76e9c5f0 100644
--- a/idioms-json-2.1-custom/campaign-v-actors.json
+++ b/idioms-json-2.1-custom/campaign-v-actors.json
@@ -49,6 +49,27 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--430b334f-0107-4fa4-b26a-b28a81d10338",
+            "description": "Fred",
+            "external_references": [
+                {
+                    "source_name": "unknown",
+                    "url": "http://foo.com/bar"
+                }
+            ],
+            "id": "identity--d19cedc9-9e0e-452d-a344-86c7564429a3",
+            "modified": "2014-08-08T15:50:10.983Z",
+            "name": "not provided",
+            "roles": [
+                "Aggregator",
+                "Initial Author"
+            ],
+            "spec_version": "2.1",
+            "type": "identity"
+        },
+        {
+            "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--d19cedc9-9e0e-452d-a344-86c7564429a3",
             "id": "identity--2d1c6ab3-5e4e-48ac-a32b-f0c01c2836a8",
             "identity_class": "unknown",
             "modified": "2014-08-08T15:50:10.983Z",
@@ -64,6 +85,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--d19cedc9-9e0e-452d-a344-86c7564429a3",
             "goals": [
                 "Theft",
                 "Theft - Theft of Proprietary Information"
@@ -84,13 +106,7 @@
                 "NewsBeef"
             ],
             "created": "2014-08-08T15:50:10.983Z",
-            "description": "Fred",
-            "external_references": [
-                {
-                    "source_name": "unknown",
-                    "url": "http://foo.com/bar"
-                }
-            ],
+            "created_by_ref": "identity--430b334f-0107-4fa4-b26a-b28a81d10338",
             "id": "campaign--e5268b6e-4931-42f1-b379-87f48eb41b1e",
             "modified": "2014-08-08T15:50:10.983Z",
             "name": "Compromise of ATM Machines",
@@ -98,14 +114,11 @@
                 "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da"
             ],
             "spec_version": "2.1",
-            "type": "campaign",
-            "x_elevator_information_source_roles": [
-                "Aggregator",
-                "Initial Author"
-            ]
+            "type": "campaign"
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--d19cedc9-9e0e-452d-a344-86c7564429a3",
             "id": "relationship--a8905796-6daa-4790-ac56-66010a2e2856",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -119,6 +132,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--d19cedc9-9e0e-452d-a344-86c7564429a3",
             "id": "relationship--bc0355af-0d5a-450a-9c03-262017cb3481",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -132,6 +146,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--d19cedc9-9e0e-452d-a344-86c7564429a3",
             "id": "relationship--9e64d46e-3531-4016-bc8c-220c20a4d4f3",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -145,6 +160,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--d19cedc9-9e0e-452d-a344-86c7564429a3",
             "id": "relationship--08ddd8a1-57e4-4b42-b643-4c0b831eecda",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -158,6 +174,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--d19cedc9-9e0e-452d-a344-86c7564429a3",
             "id": "relationship--9d662b1b-3e5c-48bf-9ce7-0e65b42a312f",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -171,6 +188,7 @@
         },
         {
             "created": "2022-09-15T12:13:21.811Z",
+            "created_by_ref": "identity--d19cedc9-9e0e-452d-a344-86c7564429a3",
             "description": "Foo\nBar\nFred\nBarney",
             "id": "report--15631da7-3766-4ebc-ae4c-1eb5910c9dc3",
             "modified": "2022-09-15T12:13:21.811Z",
@@ -179,6 +197,7 @@
                 "location--7929ff7d-9ae2-46a6-95e8-84b776a83ed2",
                 "relationship--d75fc7b2-4be0-4be4-bd14-353a1ff9d3db",
                 "identity--430b334f-0107-4fa4-b26a-b28a81d10338",
+                "identity--d19cedc9-9e0e-452d-a344-86c7564429a3",
                 "identity--2d1c6ab3-5e4e-48ac-a32b-f0c01c2836a8",
                 "threat-actor--56f3f0db-b5d5-431c-ae56-c18f02caf500",
                 "campaign--e5268b6e-4931-42f1-b379-87f48eb41b1e",
diff --git a/idioms-json-2.1-custom/coa_ind_malicious_file.json b/idioms-json-2.1-custom/coa_ind_malicious_file.json
index c3b95712..91f1a9cf 100644
--- a/idioms-json-2.1-custom/coa_ind_malicious_file.json
+++ b/idioms-json-2.1-custom/coa_ind_malicious_file.json
@@ -96,6 +96,7 @@
         },
         {
             "created": "9999-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--c8fe89cf-ffd5-4bbd-b616-519bdb3c9683",
             "id": "report--d6cf3b05-f77b-48ae-be14-77b291177568",
             "modified": "9999-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-custom/custom_object.json b/idioms-json-2.1-custom/custom_object.json
index 088864fb..b2173c34 100644
--- a/idioms-json-2.1-custom/custom_object.json
+++ b/idioms-json-2.1-custom/custom_object.json
@@ -8,6 +8,15 @@
         },
         {
             "created": "2015-07-31T11:24:39.090Z",
+            "id": "identity--ba593c47-8cea-4bd3-8e6d-97c2f101c1ac",
+            "modified": "2015-07-31T11:24:39.090Z",
+            "name": "not provided",
+            "spec_version": "2.1",
+            "type": "identity"
+        },
+        {
+            "created": "2015-07-31T11:24:39.090Z",
+            "created_by_ref": "identity--ba593c47-8cea-4bd3-8e6d-97c2f101c1ac",
             "id": "course-of-action--3dbfccad-1fbb-4e9f-8307-f2d1a5c651cc",
             "labels": [
                 "perimeter-blocking"
@@ -22,10 +31,11 @@
             },
             "x_elevator_objective": "Block outbound traffic",
             "x_elevator_objective_confidence": "High",
-            "x_elevator_stage": "Response"
+            "x_elevator_stage": "response"
         },
         {
             "created": "2015-07-31T11:24:39.090Z",
+            "created_by_ref": "identity--ba593c47-8cea-4bd3-8e6d-97c2f101c1ac",
             "id": "indicator--2cb76e88-2734-4a6c-a28c-52ae05f627be",
             "indicator_types": [
                 "ftp"
@@ -40,6 +50,7 @@
         },
         {
             "created": "2015-07-31T11:24:39.090Z",
+            "created_by_ref": "identity--ba593c47-8cea-4bd3-8e6d-97c2f101c1ac",
             "id": "relationship--0bc85414-caf4-4831-8816-a204328cf317",
             "modified": "2015-07-31T11:24:39.090Z",
             "relationship_type": "investigates",
diff --git a/idioms-json-2.1-custom/hostname.json b/idioms-json-2.1-custom/hostname.json
index 291566bc..dc26df51 100644
--- a/idioms-json-2.1-custom/hostname.json
+++ b/idioms-json-2.1-custom/hostname.json
@@ -83,6 +83,7 @@
         },
         {
             "created": "2021-08-06T14:04:41.000Z",
+            "created_by_ref": "identity--780286aa-dddb-4781-8b99-a09fab77a062",
             "id": "report--1ae03ebd-b9c5-456a-94c1-77c84a8a3551",
             "modified": "2021-08-06T14:04:41.000Z",
             "name": "NCCIC:STIX_Package-75d3aca8-3a82-46fc-8965-c0d1958c9790",
diff --git a/idioms-json-2.1-custom/icmp_observable.json b/idioms-json-2.1-custom/icmp_observable.json
index cafb16c0..8f5f6b39 100644
--- a/idioms-json-2.1-custom/icmp_observable.json
+++ b/idioms-json-2.1-custom/icmp_observable.json
@@ -6,10 +6,10 @@
                 "icmp-ext": {
                     "icmp_code_hex": "00",
                     "icmp_type_hex": "08",
-                    "x_elevator_checksum": "97c02164528d"
+                    "x_elevator_checksum_hex": "97c02164528d"
                 }
             },
-            "id": "network-traffic--efcc1043-9c92-5351-b57f-e80702999f39",
+            "id": "network-traffic--45f40cb7-7956-5cf6-9075-18fcaf17156d",
             "protocols": [
                 "icmp"
             ],
@@ -23,7 +23,7 @@
             "modified": "2019-08-21T11:06:25.214Z",
             "number_observed": 1,
             "object_refs": [
-                "network-traffic--efcc1043-9c92-5351-b57f-e80702999f39"
+                "network-traffic--45f40cb7-7956-5cf6-9075-18fcaf17156d"
             ],
             "spec_version": "2.1",
             "type": "observed-data"
diff --git a/idioms-json-2.1-custom/incident-malware.json b/idioms-json-2.1-custom/incident-malware.json
index ae351196..b52a0145 100644
--- a/idioms-json-2.1-custom/incident-malware.json
+++ b/idioms-json-2.1-custom/incident-malware.json
@@ -38,8 +38,8 @@
                 "identity--bc176edc-a181-49c4-ad6e-21881cf4412c"
             ],
             "x_elevator_discovery_methods": [
-                "Log Review",
-                "Antivirus"
+                "log-review",
+                "antivirus"
             ],
             "x_elevator_intended_effects": [
                 {
@@ -47,8 +47,8 @@
                     "value": "Degradation of Service"
                 }
             ],
-            "x_elevator_security_compromise": "Suspected",
-            "x_elevator_status": "Containment Achieved",
+            "x_elevator_security_compromise": "suspected",
+            "x_elevator_status": "containment-achieved",
             "x_elevator_time_when_containment_achieved": "2014-05-07T08:00:00.000000Z",
             "x_elevator_time_of_incident_discovery": "2014-05-02T02:10:16.000000Z",
             "x_elevator_time_when_incident_reported": "2014-05-07T02:00:00.000000Z"
diff --git a/idioms-json-2.1-custom/issue-239.json b/idioms-json-2.1-custom/issue-239.json
index ff163f49..2e9a0c60 100644
--- a/idioms-json-2.1-custom/issue-239.json
+++ b/idioms-json-2.1-custom/issue-239.json
@@ -86,6 +86,7 @@
         },
         {
             "created": "2020-11-23T14:26:05.000Z",
+            "created_by_ref": "identity--0291ff9f-60db-422c-94e7-9f284983424a",
             "description": "This is the package overview",
             "id": "report--13acb1b3-e293-475c-8739-51ecefe47926",
             "modified": "2020-11-23T14:26:05.000Z",
diff --git a/idioms-json-2.1-custom/marking_information_source.json b/idioms-json-2.1-custom/marking_information_source.json
index de7d9c24..88c76182 100644
--- a/idioms-json-2.1-custom/marking_information_source.json
+++ b/idioms-json-2.1-custom/marking_information_source.json
@@ -50,6 +50,7 @@
         {
             "confidence": 85,
             "created": "2015-05-15T09:00:00.000Z",
+            "created_by_ref": "identity--363712bf-a6f3-4e55-b5a2-501a7f40cc55",
             "description": "This is a cyber threat indicator for instances of US-China_Q14 phishing attempts.",
             "id": "indicator--8ec768ff-5341-4328-b063-72b813f1437d",
             "indicator_types": [
@@ -69,6 +70,7 @@
         },
         {
             "created": "2014-05-08T09:00:00.000Z",
+            "created_by_ref": "identity--363712bf-a6f3-4e55-b5a2-501a7f40cc55",
             "id": "report--cb84eb6c-6e7c-48f0-ac02-1a3561e16d91",
             "modified": "2014-05-08T09:00:00.000Z",
             "name": "Silver Gray Owl",
diff --git a/idioms-json-2.1-custom/network-socket-observable.json b/idioms-json-2.1-custom/network-socket-observable.json
index 69d92a31..c444287a 100644
--- a/idioms-json-2.1-custom/network-socket-observable.json
+++ b/idioms-json-2.1-custom/network-socket-observable.json
@@ -2,6 +2,7 @@
     "id": "bundle--8005dcb9-398c-4f61-b44c-18133199d145",
     "objects": [
         {
+            "dst_ref": "ipv4-addr--9cf4a8ec-7640-5f40-a006-79942896168b",
             "extensions": {
                 "socket-ext": {
                     "address_family": "AF_INET",
@@ -9,15 +10,20 @@
                     "options": {
                         "IP_MULTICAST_LOOP": 1
                     },
-                    "x_elevator_local_address": "198.51.100.2"
+                    "x_elevator_protocol_family": "PF_APPLETALK"
                 }
             },
-            "id": "network-traffic--d8301f41-2ed7-599a-9851-02c19eeaca42",
+            "id": "network-traffic--cdd05437-18e8-56e2-ab08-b474ca75b370",
             "protocols": [
                 "tcp"
             ],
             "type": "network-traffic"
         },
+        {
+            "id": "ipv4-addr--9cf4a8ec-7640-5f40-a006-79942896168b",
+            "type": "ipv4-addr",
+            "value": "198.51.100.2"
+        },
         {
             "created": "2020-05-31T15:12:07.150Z",
             "first_observed": "2020-05-31T15:12:07.150Z",
@@ -26,7 +32,8 @@
             "modified": "2020-05-31T15:12:07.150Z",
             "number_observed": 1,
             "object_refs": [
-                "network-traffic--d8301f41-2ed7-599a-9851-02c19eeaca42"
+                "network-traffic--cdd05437-18e8-56e2-ab08-b474ca75b370",
+                "ipv4-addr--9cf4a8ec-7640-5f40-a006-79942896168b"
             ],
             "spec_version": "2.1",
             "type": "observed-data"
diff --git a/idioms-json-2.1-custom/victim-targeting.json b/idioms-json-2.1-custom/victim-targeting.json
index bb191a7b..5452b0ec 100644
--- a/idioms-json-2.1-custom/victim-targeting.json
+++ b/idioms-json-2.1-custom/victim-targeting.json
@@ -3,15 +3,16 @@
     "objects": [
         {
             "created": "2014-05-08T09:00:00.000Z",
-            "id": "campaign--c831ab93-ff84-9cda-2bd8-b094004da969",
+            "id": "campaign--c831ab93-ff84-4cda-2bd8-b094004da969",
             "modified": "2014-05-08T09:00:00.000Z",
             "name": "Operation Alpha",
             "spec_version": "2.1",
-            "type": "campaign"
+            "type": "campaign",
+            "x_elevator_status": "ongoing"
         },
         {
             "created": "2014-05-08T09:00:00.000Z",
-            "id": "identity--4fde045a-b25f-f035-e8d0-29c9d5130cd9",
+            "id": "identity--4fde045a-b25f-4035-e8d0-29c9d5130cd9",
             "identity_class": "unknown",
             "modified": "2014-05-08T09:00:00.000Z",
             "name": "Victim Targeting: Customer PII and Financial Data",
diff --git a/idioms-json-2.1-extensions/Mandiant_APT1_Report.json b/idioms-json-2.1-extensions/Mandiant_APT1_Report.json
index 4c9fff86..0e564605 100644
--- a/idioms-json-2.1-extensions/Mandiant_APT1_Report.json
+++ b/idioms-json-2.1-extensions/Mandiant_APT1_Report.json
@@ -77,15 +77,6 @@
         {
             "created": "2015-05-15T09:00:00.000Z",
             "created_by_ref": "identity--8358a1c8-6005-4cdc-9436-4fbdc9957f30",
-            "extensions": {
-                "extension-definition--ec1760d6-6e8a-4a13-8237-574e5bbcc785": {
-                    "extension_type": "property-extension",
-                    "information_source_roles": [
-                        "Nation-State",
-                        "Military"
-                    ]
-                }
-            },
             "id": "identity--7def5fe6-7449-44cb-9fc5-a584272faa21",
             "identity_class": "organization",
             "modified": "2015-05-15T09:00:00.000Z",
@@ -93,6 +84,10 @@
             "object_marking_refs": [
                 "marking-definition--44307ea0-3215-4da6-8ada-431a45c0ba60"
             ],
+            "roles": [
+                "Nation-State",
+                "Military"
+            ],
             "spec_version": "2.1",
             "type": "identity"
         },
@@ -208,14 +203,6 @@
         {
             "created": "2015-05-15T09:00:00.000Z",
             "created_by_ref": "identity--8358a1c8-6005-4cdc-9436-4fbdc9957f30",
-            "extensions": {
-                "extension-definition--ec1760d6-6e8a-4a13-8237-574e5bbcc785": {
-                    "extension_type": "property-extension",
-                    "information_source_roles": [
-                        "Research and Development"
-                    ]
-                }
-            },
             "id": "identity--e5c3f314-d520-43c5-9aa3-e6b788a2a14c",
             "identity_class": "individual",
             "modified": "2015-05-15T09:00:00.000Z",
@@ -223,6 +210,9 @@
             "object_marking_refs": [
                 "marking-definition--44307ea0-3215-4da6-8ada-431a45c0ba60"
             ],
+            "roles": [
+                "Research and Development"
+            ],
             "spec_version": "2.1",
             "type": "identity"
         },
@@ -447,14 +437,6 @@
         {
             "created": "2015-05-15T09:00:00.000Z",
             "created_by_ref": "identity--8358a1c8-6005-4cdc-9436-4fbdc9957f30",
-            "extensions": {
-                "extension-definition--ec1760d6-6e8a-4a13-8237-574e5bbcc785": {
-                    "extension_type": "property-extension",
-                    "information_source_roles": [
-                        "Nation-State"
-                    ]
-                }
-            },
             "id": "identity--f5ad16c7-1192-4e04-8012-8fdf330a33a8",
             "identity_class": "organization",
             "modified": "2015-05-15T09:00:00.000Z",
@@ -462,6 +444,9 @@
             "object_marking_refs": [
                 "marking-definition--44307ea0-3215-4da6-8ada-431a45c0ba60"
             ],
+            "roles": [
+                "Nation-State"
+            ],
             "spec_version": "2.1",
             "type": "identity"
         },
@@ -495,14 +480,6 @@
         {
             "created": "2015-05-15T09:00:00.000Z",
             "created_by_ref": "identity--8358a1c8-6005-4cdc-9436-4fbdc9957f30",
-            "extensions": {
-                "extension-definition--ec1760d6-6e8a-4a13-8237-574e5bbcc785": {
-                    "extension_type": "property-extension",
-                    "information_source_roles": [
-                        "State-influenced Commercial Entity"
-                    ]
-                }
-            },
             "id": "identity--167beca0-d700-427a-81f2-702a92ab1f34",
             "identity_class": "organization",
             "modified": "2015-05-15T09:00:00.000Z",
@@ -510,6 +487,9 @@
             "object_marking_refs": [
                 "marking-definition--44307ea0-3215-4da6-8ada-431a45c0ba60"
             ],
+            "roles": [
+                "State-influenced Commercial Entity"
+            ],
             "spec_version": "2.1",
             "type": "identity"
         },
@@ -1324,7 +1304,8 @@
                             "value": "unauthorized-access"
                         }
                     ],
-                    "title": "Privilege Escalation"
+                    "title": "Privilege Escalation",
+                    "vendor": "unknown"
                 }
             },
             "id": "tool--73a316da-41a6-45ca-8229-ec255522f177",
diff --git a/idioms-json-2.1-extensions/ais-marking-a-e-f.json b/idioms-json-2.1-extensions/ais-marking-a-e-f.json
index 307f102e..a0377134 100644
--- a/idioms-json-2.1-extensions/ais-marking-a-e-f.json
+++ b/idioms-json-2.1-extensions/ais-marking-a-e-f.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--45042075-5502-4257-97ac-64a7c25337ce",
             "id": "report--2a5b8cd8-bc44-4271-8ea0-c84e7e53598c",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-extensions/ais-marking-a-e-t.json b/idioms-json-2.1-extensions/ais-marking-a-e-t.json
index b1d19eb1..8351f003 100644
--- a/idioms-json-2.1-extensions/ais-marking-a-e-t.json
+++ b/idioms-json-2.1-extensions/ais-marking-a-e-t.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--24e957ab-2028-41c7-adda-6981f17643f6",
             "id": "report--94c5070b-9578-4a18-8103-f2580ef92d26",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-extensions/ais-marking-a-n-f.json b/idioms-json-2.1-extensions/ais-marking-a-n-f.json
index 28098b10..2e5c8d7d 100644
--- a/idioms-json-2.1-extensions/ais-marking-a-n-f.json
+++ b/idioms-json-2.1-extensions/ais-marking-a-n-f.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--4e3419bf-da71-455d-a951-c89d3e7708fa",
             "id": "report--5186042c-aa62-4aff-85ac-a78bcc88785d",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-extensions/ais-marking-a-n-t.json b/idioms-json-2.1-extensions/ais-marking-a-n-t.json
index e0c3b3b6..bf9b938a 100644
--- a/idioms-json-2.1-extensions/ais-marking-a-n-t.json
+++ b/idioms-json-2.1-extensions/ais-marking-a-n-t.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--9e55d6df-a8aa-4b08-86ef-2f2a602eee08",
             "id": "report--121058f9-f8d5-48a8-9101-40bc6e3e74c6",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-extensions/ais-marking-a-u-f.json b/idioms-json-2.1-extensions/ais-marking-a-u-f.json
index 904f8f21..81803f0b 100644
--- a/idioms-json-2.1-extensions/ais-marking-a-u-f.json
+++ b/idioms-json-2.1-extensions/ais-marking-a-u-f.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--47bbb5bc-eb30-4949-a2dd-2a08a8f08731",
             "id": "report--f8c2e325-a78f-4349-9885-a6da07a2d42d",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-extensions/ais-marking-a-u-t.json b/idioms-json-2.1-extensions/ais-marking-a-u-t.json
index 4ac90bc7..0418ae54 100644
--- a/idioms-json-2.1-extensions/ais-marking-a-u-t.json
+++ b/idioms-json-2.1-extensions/ais-marking-a-u-t.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--165279e3-7a5b-4e1a-95ed-7dfed1253971",
             "id": "report--01240769-80f4-4e36-b4b7-cfa970b21c19",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-extensions/ais-marking-g-e-f.json b/idioms-json-2.1-extensions/ais-marking-g-e-f.json
index 5d9fc76a..99b0f61f 100644
--- a/idioms-json-2.1-extensions/ais-marking-g-e-f.json
+++ b/idioms-json-2.1-extensions/ais-marking-g-e-f.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--e75a7597-365d-4586-be0e-94b2d678bef5",
             "id": "report--1b84548e-4e42-4193-9bd5-c521bf2a345e",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-extensions/ais-marking-g-e-t.json b/idioms-json-2.1-extensions/ais-marking-g-e-t.json
index b04df891..3f08c2dc 100644
--- a/idioms-json-2.1-extensions/ais-marking-g-e-t.json
+++ b/idioms-json-2.1-extensions/ais-marking-g-e-t.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--4e34a979-cd52-4666-bc8a-ba1b4e8a6021",
             "id": "report--eb0a1c05-6972-4d55-93c3-fd31daa1135b",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-extensions/ais-marking-g-n-f.json b/idioms-json-2.1-extensions/ais-marking-g-n-f.json
index 2f297310..00d52b55 100644
--- a/idioms-json-2.1-extensions/ais-marking-g-n-f.json
+++ b/idioms-json-2.1-extensions/ais-marking-g-n-f.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--c2d60a3c-7444-4df8-a9c1-742b2082d34e",
             "id": "report--fd3b3d0c-62ee-46a9-94e1-58d5100eeb43",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-extensions/ais-marking-g-n-t.json b/idioms-json-2.1-extensions/ais-marking-g-n-t.json
index 642cfe6c..a0867cfb 100644
--- a/idioms-json-2.1-extensions/ais-marking-g-n-t.json
+++ b/idioms-json-2.1-extensions/ais-marking-g-n-t.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--ea1f3408-bb92-4e3a-848c-7f09eb68c964",
             "id": "report--87519903-a5e3-4eb9-93a4-7c77f6e18f7e",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-extensions/ais-marking-g-u-f.json b/idioms-json-2.1-extensions/ais-marking-g-u-f.json
index 5a6584cf..4947ae01 100644
--- a/idioms-json-2.1-extensions/ais-marking-g-u-f.json
+++ b/idioms-json-2.1-extensions/ais-marking-g-u-f.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--008f1577-1345-47b4-b2ec-1862823cfce1",
             "id": "report--bf529f9d-f28a-495e-81d6-a7dbcf89f4cf",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-extensions/ais-marking-g-u-t.json b/idioms-json-2.1-extensions/ais-marking-g-u-t.json
index ab165d25..279f1150 100644
--- a/idioms-json-2.1-extensions/ais-marking-g-u-t.json
+++ b/idioms-json-2.1-extensions/ais-marking-g-u-t.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--e3f54eb5-e568-4a70-80f8-8f1ee7f2bc29",
             "id": "report--f5e95d21-62d3-4781-91d5-ae1527bed71a",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-extensions/ais-marking-w-e-f.json b/idioms-json-2.1-extensions/ais-marking-w-e-f.json
index 73486d06..ef5231ae 100644
--- a/idioms-json-2.1-extensions/ais-marking-w-e-f.json
+++ b/idioms-json-2.1-extensions/ais-marking-w-e-f.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--e1185b1c-32fa-4c4b-8ba5-312d6e7fca51",
             "id": "report--61a3c6b1-9254-44af-8800-42001d9ed11f",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-extensions/ais-marking-w-e-t.json b/idioms-json-2.1-extensions/ais-marking-w-e-t.json
index 05fb3251..5c647952 100644
--- a/idioms-json-2.1-extensions/ais-marking-w-e-t.json
+++ b/idioms-json-2.1-extensions/ais-marking-w-e-t.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--0f0fe037-6634-4bc9-b965-e9b34011c6dc",
             "id": "report--0fa227c2-8945-4548-be3f-4fe5f1da3008",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-extensions/ais-marking-w-n-f.json b/idioms-json-2.1-extensions/ais-marking-w-n-f.json
index db67cd5c..0392fc09 100644
--- a/idioms-json-2.1-extensions/ais-marking-w-n-f.json
+++ b/idioms-json-2.1-extensions/ais-marking-w-n-f.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--97cc7b6a-2177-4f8c-b0dd-d3332b1a09f2",
             "id": "report--3a81470f-1c9e-42c0-890c-5ea1c544012d",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-extensions/ais-marking-w-n-t.json b/idioms-json-2.1-extensions/ais-marking-w-n-t.json
index 1b92ce29..025f2380 100644
--- a/idioms-json-2.1-extensions/ais-marking-w-n-t.json
+++ b/idioms-json-2.1-extensions/ais-marking-w-n-t.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--915368b7-9705-49a6-8a16-c064eeeb22f9",
             "id": "report--59dbf620-3dda-4923-9565-d9fe3b3153ff",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-extensions/ais-marking-w-u-f.json b/idioms-json-2.1-extensions/ais-marking-w-u-f.json
index cf613e16..6aeba920 100644
--- a/idioms-json-2.1-extensions/ais-marking-w-u-f.json
+++ b/idioms-json-2.1-extensions/ais-marking-w-u-f.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--526b57d5-76ad-4d89-b0f5-5d5006ce7716",
             "id": "report--544d02d9-7bc0-4178-9a0a-aaffdb424723",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-extensions/ais-marking-w-u-t.json b/idioms-json-2.1-extensions/ais-marking-w-u-t.json
index 65ae68d7..0c775972 100644
--- a/idioms-json-2.1-extensions/ais-marking-w-u-t.json
+++ b/idioms-json-2.1-extensions/ais-marking-w-u-t.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--ad985501-24ce-449f-84cd-60d7dabff106",
             "id": "report--88596125-2859-4cf1-807c-342ad094ac97",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-extensions/block-network-traffic.json b/idioms-json-2.1-extensions/block-network-traffic.json
index 9cafbd78..2434164a 100644
--- a/idioms-json-2.1-extensions/block-network-traffic.json
+++ b/idioms-json-2.1-extensions/block-network-traffic.json
@@ -5,8 +5,12 @@
             "created": "2021-04-16T12:26:18.622Z",
             "extensions": {
                 "extension-definition--a46b18de-0b41-4a95-9d2d-67a360f2d859": {
-                    "cost": "low",
-                    "efficacy": "high",
+                    "cost": {
+                        "value": "low"
+                    },
+                    "efficacy": {
+                        "value": "high"
+                    },
                     "extension_type": "property-extension",
                     "impact": {
                         "description": "This IP address is not used for legitimate hosting so there should be no operational impact.",
diff --git a/idioms-json-2.1-extensions/campaign-v-actors.json b/idioms-json-2.1-extensions/campaign-v-actors.json
index d9d071e9..073dac00 100644
--- a/idioms-json-2.1-extensions/campaign-v-actors.json
+++ b/idioms-json-2.1-extensions/campaign-v-actors.json
@@ -49,6 +49,27 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--83e2fb0a-5463-4fb6-8395-82f37bce1a73",
+            "description": "Fred",
+            "external_references": [
+                {
+                    "source_name": "unknown",
+                    "url": "http://foo.com/bar"
+                }
+            ],
+            "id": "identity--1ecc2f42-1a71-4f6e-8b4e-12e0f67d8af5",
+            "modified": "2014-08-08T15:50:10.983Z",
+            "name": "not provided",
+            "roles": [
+                "Aggregator",
+                "Initial Author"
+            ],
+            "spec_version": "2.1",
+            "type": "identity"
+        },
+        {
+            "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--1ecc2f42-1a71-4f6e-8b4e-12e0f67d8af5",
             "extensions": {
                 "extension-definition--8f0b8ed7-c7ad-4650-babe-c4c45cac4a0b": {
                     "extension_type": "property-extension",
@@ -69,6 +90,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--1ecc2f42-1a71-4f6e-8b4e-12e0f67d8af5",
             "goals": [
                 "Theft",
                 "Theft - Theft of Proprietary Information"
@@ -89,22 +111,7 @@
                 "NewsBeef"
             ],
             "created": "2014-08-08T15:50:10.983Z",
-            "description": "Fred",
-            "extensions": {
-                "extension-definition--58c914a2-0b19-4f62-8221-0af0b542e130": {
-                    "extension_type": "property-extension",
-                    "information_source_roles": [
-                        "aggregator",
-                        "initial-author"
-                    ]
-                }
-            },
-            "external_references": [
-                {
-                    "source_name": "unknown",
-                    "url": "http://foo.com/bar"
-                }
-            ],
+            "created_by_ref": "identity--1ecc2f42-1a71-4f6e-8b4e-12e0f67d8af5",
             "id": "campaign--e5268b6e-4931-42f1-b379-87f48eb41b1e",
             "modified": "2014-08-08T15:50:10.983Z",
             "name": "Compromise of ATM Machines",
@@ -116,6 +123,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--1ecc2f42-1a71-4f6e-8b4e-12e0f67d8af5",
             "id": "relationship--141118db-7186-4d69-b555-9f36fd4b2a07",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -129,6 +137,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--1ecc2f42-1a71-4f6e-8b4e-12e0f67d8af5",
             "id": "relationship--f2d39da0-5079-457d-a347-7213a51e3b57",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -142,6 +151,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--1ecc2f42-1a71-4f6e-8b4e-12e0f67d8af5",
             "id": "relationship--47d5a677-c667-4457-aaf4-1a00fd20c439",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -155,6 +165,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--1ecc2f42-1a71-4f6e-8b4e-12e0f67d8af5",
             "id": "relationship--97e61559-4779-4f79-95fc-292e834a279b",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -168,6 +179,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--1ecc2f42-1a71-4f6e-8b4e-12e0f67d8af5",
             "id": "relationship--12d87df6-661a-45c1-bc72-c06e2b7435dd",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -181,6 +193,7 @@
         },
         {
             "created": "2022-09-15T15:50:10.747Z",
+            "created_by_ref": "identity--83e2fb0a-5463-4fb6-8395-82f37bce1a73",
             "description": "Foo\nBar\nFred\nBarney",
             "id": "report--e884fee2-4f9c-4078-af05-e04b4f7537f7",
             "modified": "2022-09-15T15:50:10.747Z",
@@ -189,6 +202,7 @@
                 "location--327ea6e3-2954-4d84-b84f-1bc45f1bd4ef",
                 "relationship--dcea2d17-1ebc-4846-86b4-2b9b9c3fff5a",
                 "identity--83e2fb0a-5463-4fb6-8395-82f37bce1a73",
+                "identity--1ecc2f42-1a71-4f6e-8b4e-12e0f67d8af5",
                 "identity--2d1c6ab3-5e4e-48ac-a32b-f0c01c2836a8",
                 "threat-actor--56f3f0db-b5d5-431c-ae56-c18f02caf500",
                 "campaign--e5268b6e-4931-42f1-b379-87f48eb41b1e",
diff --git a/idioms-json-2.1-extensions/coa_ind_malicious_file.json b/idioms-json-2.1-extensions/coa_ind_malicious_file.json
index f53f1412..e54bb6b6 100644
--- a/idioms-json-2.1-extensions/coa_ind_malicious_file.json
+++ b/idioms-json-2.1-extensions/coa_ind_malicious_file.json
@@ -96,6 +96,7 @@
         },
         {
             "created": "9999-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--7d096896-8c88-41b4-a689-e8104a172064",
             "id": "report--2ea914b4-bb03-43e4-80ad-270dfd257beb",
             "modified": "9999-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1-extensions/custom-object.json b/idioms-json-2.1-extensions/custom-object.json
index b4f3e916..0c3c6a6a 100644
--- a/idioms-json-2.1-extensions/custom-object.json
+++ b/idioms-json-2.1-extensions/custom-object.json
@@ -13,6 +13,15 @@
         },
         {
             "created": "2015-07-31T11:24:39.090Z",
+            "id": "identity--de3ab554-b950-442b-8544-aeefa9a0c747",
+            "modified": "2015-07-31T11:24:39.090Z",
+            "name": "not provided",
+            "spec_version": "2.1",
+            "type": "identity"
+        },
+        {
+            "created": "2015-07-31T11:24:39.090Z",
+            "created_by_ref": "identity--de3ab554-b950-442b-8544-aeefa9a0c747",
             "extensions": {
                 "extension-definition--a46b18de-0b41-4a95-9d2d-67a360f2d859": {
                     "extension_type": "property-extension",
@@ -36,10 +45,13 @@
         },
         {
             "created": "2015-07-31T11:24:39.090Z",
+            "created_by_ref": "identity--de3ab554-b950-442b-8544-aeefa9a0c747",
             "extensions": {
                 "extension-definition--7c8ca481-f0e9-4389-94f5-90df472eb01d": {
                     "extension_type": "property-extension",
-                    "likely_impact": "medium"
+                    "likely_impact": {
+                        "value": "medium"
+                    }
                 }
             },
             "id": "indicator--2cb76e88-2734-4a6c-a28c-52ae05f627be",
@@ -55,6 +67,7 @@
         },
         {
             "created": "2015-07-31T11:24:39.090Z",
+            "created_by_ref": "identity--de3ab554-b950-442b-8544-aeefa9a0c747",
             "id": "relationship--a29a8c0b-086b-49ec-bc0f-5afa9ea0eea6",
             "modified": "2015-07-31T11:24:39.090Z",
             "relationship_type": "investigates",
diff --git a/idioms-json-2.1-extensions/hostname.json b/idioms-json-2.1-extensions/hostname.json
index f3b94fbb..b2a5e6a0 100644
--- a/idioms-json-2.1-extensions/hostname.json
+++ b/idioms-json-2.1-extensions/hostname.json
@@ -83,6 +83,7 @@
         },
         {
             "created": "2021-08-06T14:04:41.000Z",
+            "created_by_ref": "identity--225e7a8b-6f84-4dc3-89b1-97f7229b8cb5",
             "id": "report--4f4b9d39-4458-453d-942a-f9a291408185",
             "modified": "2021-08-06T14:04:41.000Z",
             "name": "NCCIC:STIX_Package-75d3aca8-3a82-46fc-8965-c0d1958c9790",
diff --git a/idioms-json-2.1-extensions/icmp_observable.json b/idioms-json-2.1-extensions/icmp_observable.json
index 1bbbe23c..fbf14229 100644
--- a/idioms-json-2.1-extensions/icmp_observable.json
+++ b/idioms-json-2.1-extensions/icmp_observable.json
@@ -3,12 +3,16 @@
     "objects": [
         {
             "extensions": {
+                "extension-definition--6f6973cb-70be-40cb-b1ac-15ed78cebe56": {
+                    "checksum_hex": "97c02164528d",
+                    "extension_type": "property-extension"
+                },
                 "icmp-ext": {
                     "icmp_code_hex": "00",
                     "icmp_type_hex": "08"
                 }
             },
-            "id": "network-traffic--ba91908d-c347-5d7d-8446-5e1c6f0a4d8d",
+            "id": "network-traffic--1480c29a-5fb8-5914-acd0-772a5e555b20",
             "protocols": [
                 "icmp"
             ],
@@ -22,7 +26,7 @@
             "modified": "2020-12-30T16:03:21.869Z",
             "number_observed": 1,
             "object_refs": [
-                "network-traffic--ba91908d-c347-5d7d-8446-5e1c6f0a4d8d"
+                "network-traffic--1480c29a-5fb8-5914-acd0-772a5e555b20"
             ],
             "spec_version": "2.1",
             "type": "observed-data"
diff --git a/idioms-json-2.1-extensions/issue-239.json b/idioms-json-2.1-extensions/issue-239.json
index 1f127002..1671053c 100644
--- a/idioms-json-2.1-extensions/issue-239.json
+++ b/idioms-json-2.1-extensions/issue-239.json
@@ -86,6 +86,7 @@
         },
         {
             "created": "2020-11-23T14:26:05.000Z",
+            "created_by_ref": "identity--0c81618c-acf4-4b66-bcdb-db3be82e48ec",
             "description": "This is the package overview",
             "id": "report--9b442a67-7654-42e5-b647-183a36182378",
             "modified": "2020-11-23T14:26:05.000Z",
diff --git a/idioms-json-2.1-extensions/marking_information_source.json b/idioms-json-2.1-extensions/marking_information_source.json
index 2e4da95e..ed44c2d1 100644
--- a/idioms-json-2.1-extensions/marking_information_source.json
+++ b/idioms-json-2.1-extensions/marking_information_source.json
@@ -50,6 +50,7 @@
         {
             "confidence": 85,
             "created": "2015-05-15T09:00:00.000Z",
+            "created_by_ref": "identity--afb73897-d45a-4fc0-8efe-80442f9172cf",
             "description": "This is a cyber threat indicator for instances of US-China_Q14 phishing attempts.",
             "id": "indicator--a8fceb40-86b5-4fcb-b879-ed093e82d2e5",
             "indicator_types": [
@@ -69,6 +70,7 @@
         },
         {
             "created": "2014-05-08T09:00:00.000Z",
+            "created_by_ref": "identity--afb73897-d45a-4fc0-8efe-80442f9172cf",
             "id": "report--2a33d4b0-8e7a-4a43-baf0-547d97ad9866",
             "modified": "2014-05-08T09:00:00.000Z",
             "name": "Silver Gray Owl",
diff --git a/idioms-json-2.1-extensions/network-socket-observable.json b/idioms-json-2.1-extensions/network-socket-observable.json
index 199a8dca..9a16248b 100644
--- a/idioms-json-2.1-extensions/network-socket-observable.json
+++ b/idioms-json-2.1-extensions/network-socket-observable.json
@@ -2,7 +2,12 @@
     "id": "bundle--8005dcb9-398c-4f61-b44c-18133199d145",
     "objects": [
         {
+            "dst_ref": "ipv4-addr--9cf4a8ec-7640-5f40-a006-79942896168b",
             "extensions": {
+                "extension-definition--005e229c-fffc-42b0-a912-84671ab2829d": {
+                    "extension_type": "property-extension",
+                    "protocol_family": "PF_APPLETALK"
+                },
                 "socket-ext": {
                     "address_family": "AF_INET",
                     "is_listening": true,
@@ -11,21 +16,27 @@
                     }
                 }
             },
-            "id": "network-traffic--d8301f41-2ed7-599a-9851-02c19eeaca42",
+            "id": "network-traffic--cdd05437-18e8-56e2-ab08-b474ca75b370",
             "protocols": [
                 "tcp"
             ],
             "type": "network-traffic"
         },
         {
-            "created": "2020-12-30T16:03:22.369Z",
-            "first_observed": "2020-12-30T16:03:22.369Z",
+            "id": "ipv4-addr--9cf4a8ec-7640-5f40-a006-79942896168b",
+            "type": "ipv4-addr",
+            "value": "198.51.100.2"
+        },
+        {
+            "created": "2023-02-27T15:16:09.444Z",
+            "first_observed": "2023-02-27T15:16:09.444Z",
             "id": "observed-data--175e561f-3ced-4cf7-8a17-654ca651ff97",
-            "last_observed": "2020-12-30T16:03:22.369Z",
-            "modified": "2020-12-30T16:03:22.369Z",
+            "last_observed": "2023-02-27T15:16:09.444Z",
+            "modified": "2023-02-27T15:16:09.444Z",
             "number_observed": 1,
             "object_refs": [
-                "network-traffic--d8301f41-2ed7-599a-9851-02c19eeaca42"
+                "network-traffic--cdd05437-18e8-56e2-ab08-b474ca75b370",
+                "ipv4-addr--9cf4a8ec-7640-5f40-a006-79942896168b"
             ],
             "spec_version": "2.1",
             "type": "observed-data"
diff --git a/idioms-json-2.1-extensions/victim-targeting.json b/idioms-json-2.1-extensions/victim-targeting.json
index a1531d95..d0e416be 100644
--- a/idioms-json-2.1-extensions/victim-targeting.json
+++ b/idioms-json-2.1-extensions/victim-targeting.json
@@ -3,7 +3,13 @@
     "objects": [
         {
             "created": "2014-05-08T09:00:00.000Z",
-            "id": "campaign--c831ab93-ff84-9cda-2bd8-b094004da969",
+            "extensions": {
+                "extension-definition--d83fce45-ef58-4c6c-a3f4-1fbc32e98c6e": {
+                    "extension_type": "property-extension",
+                    "status": "ongoing"
+                }
+            },
+            "id": "campaign--c831ab93-ff84-4cda-8bd8-b094004da969",
             "modified": "2014-05-08T09:00:00.000Z",
             "name": "Operation Alpha",
             "spec_version": "2.1",
@@ -20,7 +26,7 @@
                     ]
                 }
             },
-            "id": "identity--4fde045a-b25f-f035-e8d0-29c9d5130cd9",
+            "id": "identity--4fde045a-b25f-4035-88d0-29c9d5130cd9",
             "identity_class": "unknown",
             "modified": "2014-05-08T09:00:00.000Z",
             "name": "Victim Targeting: Customer PII and Financial Data",
@@ -33,9 +39,9 @@
             "id": "relationship--82f13a6b-633d-4868-8060-5fde38ea6adb",
             "modified": "2014-05-08T09:00:00.000Z",
             "relationship_type": "targets",
-            "source_ref": "campaign--c831ab93-ff84-9cda-2bd8-b094004da969",
+            "source_ref": "campaign--c831ab93-ff84-4cda-2bd8-b094004da969",
             "spec_version": "2.1",
-            "target_ref": "identity--4fde045a-b25f-f035-e8d0-29c9d5130cd9",
+            "target_ref": "identity--4fde045a-b25f-4035-88d0-29c9d5130cd9",
             "type": "relationship"
         }
     ],
diff --git a/idioms-json-2.1-ignore/Mandiant_APT1_Report.json b/idioms-json-2.1-ignore/Mandiant_APT1_Report.json
index 4d78c956..7b57d01c 100644
--- a/idioms-json-2.1-ignore/Mandiant_APT1_Report.json
+++ b/idioms-json-2.1-ignore/Mandiant_APT1_Report.json
@@ -84,6 +84,10 @@
             "object_marking_refs": [
                 "marking-definition--cc7295e1-3601-4589-82b8-510d91eb9a09"
             ],
+            "roles": [
+                "Nation-State",
+                "Military"
+            ],
             "spec_version": "2.1",
             "type": "identity"
         },
@@ -206,6 +210,9 @@
             "object_marking_refs": [
                 "marking-definition--cc7295e1-3601-4589-82b8-510d91eb9a09"
             ],
+            "roles": [
+                "Research and Development"
+            ],
             "spec_version": "2.1",
             "type": "identity"
         },
@@ -437,6 +444,9 @@
             "object_marking_refs": [
                 "marking-definition--cc7295e1-3601-4589-82b8-510d91eb9a09"
             ],
+            "roles": [
+                "Nation-State"
+            ],
             "spec_version": "2.1",
             "type": "identity"
         },
@@ -477,6 +487,9 @@
             "object_marking_refs": [
                 "marking-definition--cc7295e1-3601-4589-82b8-510d91eb9a09"
             ],
+            "roles": [
+                "State-influenced Commercial Entity"
+            ],
             "spec_version": "2.1",
             "type": "identity"
         },
diff --git a/idioms-json-2.1-ignore/campaign-v-actors.json b/idioms-json-2.1-ignore/campaign-v-actors.json
index 67dbc851..4e9230d9 100644
--- a/idioms-json-2.1-ignore/campaign-v-actors.json
+++ b/idioms-json-2.1-ignore/campaign-v-actors.json
@@ -49,6 +49,27 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--0b13fca3-6398-4f59-8357-209abb93ff90",
+            "description": "Fred",
+            "external_references": [
+                {
+                    "source_name": "unknown",
+                    "url": "http://foo.com/bar"
+                }
+            ],
+            "id": "identity--7a16f71b-83db-40e5-9a00-cfa96ad0834e",
+            "modified": "2014-08-08T15:50:10.983Z",
+            "name": "not provided",
+            "roles": [
+                "Aggregator",
+                "Initial Author"
+            ],
+            "spec_version": "2.1",
+            "type": "identity"
+        },
+        {
+            "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--7a16f71b-83db-40e5-9a00-cfa96ad0834e",
             "id": "identity--2d1c6ab3-5e4e-48ac-a32b-f0c01c2836a8",
             "identity_class": "unknown",
             "modified": "2014-08-08T15:50:10.983Z",
@@ -61,6 +82,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--7a16f71b-83db-40e5-9a00-cfa96ad0834e",
             "goals": [
                 "Theft",
                 "Theft - Theft of Proprietary Information"
@@ -81,13 +103,7 @@
                 "NewsBeef"
             ],
             "created": "2014-08-08T15:50:10.983Z",
-            "description": "Fred",
-            "external_references": [
-                {
-                    "source_name": "unknown",
-                    "url": "http://foo.com/bar"
-                }
-            ],
+            "created_by_ref": "identity--dffab7d6-00f6-4a30-8b84-8c0f38bff5d7",
             "id": "campaign--e5268b6e-4931-42f1-b379-87f48eb41b1e",
             "modified": "2014-08-08T15:50:10.983Z",
             "name": "Compromise of ATM Machines",
@@ -99,6 +115,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--7a16f71b-83db-40e5-9a00-cfa96ad0834e",
             "id": "relationship--de1506fe-c2f3-4be5-9a45-4e02c3d6cda2",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -112,6 +129,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--7a16f71b-83db-40e5-9a00-cfa96ad0834e",
             "id": "relationship--f184d121-5fdb-4d21-a62b-da6c55b6d021",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -125,6 +143,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--7a16f71b-83db-40e5-9a00-cfa96ad0834e",
             "id": "relationship--6e6154da-4fd3-46e7-8a0c-7b97c9f78eba",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -138,6 +157,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--7a16f71b-83db-40e5-9a00-cfa96ad0834e",
             "id": "relationship--864c5b06-f235-4fe6-bea3-a17d041f4055",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -151,6 +171,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--7a16f71b-83db-40e5-9a00-cfa96ad0834e",
             "id": "relationship--a2e4c968-a43d-46c9-b76d-31b5239ce796",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
diff --git a/idioms-json-2.1-ignore/custom-object.json b/idioms-json-2.1-ignore/custom-object.json
index 48d4c77e..afb02fcf 100644
--- a/idioms-json-2.1-ignore/custom-object.json
+++ b/idioms-json-2.1-ignore/custom-object.json
@@ -3,6 +3,15 @@
     "objects": [
         {
             "created": "2015-07-31T11:24:39.090Z",
+            "id": "identity--dfea062d-0e09-4cef-9178-909003f8d965",
+            "modified": "2015-07-31T11:24:39.090Z",
+            "name": "not provided",
+            "spec_version": "2.1",
+            "type": "identity"
+        },
+        {
+            "created": "2015-07-31T11:24:39.090Z",
+            "created_by_ref": "identity--dfea062d-0e09-4cef-9178-909003f8d965",
             "id": "course-of-action--3dbfccad-1fbb-4e9f-8307-f2d1a5c651cc",
             "labels": [
                 "perimeter-blocking"
@@ -14,6 +23,7 @@
         },
         {
             "created": "2015-07-31T11:24:39.090Z",
+            "created_by_ref": "identity--dfea062d-0e09-4cef-9178-909003f8d965",
             "id": "indicator--2cb76e88-2734-4a6c-a28c-52ae05f627be",
             "indicator_types": [
                 "ftp"
@@ -27,6 +37,7 @@
         },
         {
             "created": "2015-07-31T11:24:39.090Z",
+            "created_by_ref": "identity--dfea062d-0e09-4cef-9178-909003f8d965",
             "id": "relationship--f7871811-ec77-4f70-8a51-315c3f15f67e",
             "modified": "2015-07-31T11:24:39.090Z",
             "relationship_type": "investigates",
diff --git a/idioms-json-2.1-ignore/marking_information_source.json b/idioms-json-2.1-ignore/marking_information_source.json
index c3044bd9..58345542 100644
--- a/idioms-json-2.1-ignore/marking_information_source.json
+++ b/idioms-json-2.1-ignore/marking_information_source.json
@@ -50,6 +50,7 @@
         {
             "confidence": 85,
             "created": "2015-05-15T09:00:00.000Z",
+            "created_by_ref": "identity--94463bad-2ff1-45f0-a575-c296e4aaf572",
             "description": "This is a cyber threat indicator for instances of US-China_Q14 phishing attempts.",
             "id": "indicator--262f78ba-287d-4f74-933c-769a266fdd20",
             "indicator_types": [
diff --git a/idioms-json-2.1-ignore/network-socket-observable.json b/idioms-json-2.1-ignore/network-socket-observable.json
index bf0f87c2..e0079ffd 100644
--- a/idioms-json-2.1-ignore/network-socket-observable.json
+++ b/idioms-json-2.1-ignore/network-socket-observable.json
@@ -2,6 +2,7 @@
     "id": "bundle--8005dcb9-398c-4f61-b44c-18133199d145",
     "objects": [
         {
+            "dst_ref": "ipv4-addr--9cf4a8ec-7640-5f40-a006-79942896168b",
             "extensions": {
                 "socket-ext": {
                     "address_family": "AF_INET",
@@ -11,25 +12,31 @@
                     }
                 }
             },
-            "id": "network-traffic--d8301f41-2ed7-599a-9851-02c19eeaca42",
+            "id": "network-traffic--cdd05437-18e8-56e2-ab08-b474ca75b370",
             "protocols": [
                 "tcp"
             ],
             "type": "network-traffic"
         },
         {
-            "created": "2021-04-27T21:09:06.718Z",
-            "first_observed": "2021-04-27T21:09:06.718Z",
+            "id": "ipv4-addr--9cf4a8ec-7640-5f40-a006-79942896168b",
+            "type": "ipv4-addr",
+            "value": "198.51.100.2"
+        },
+        {
+            "created": "2023-02-27T16:28:24.006Z",
+            "first_observed": "2023-02-27T16:28:24.006Z",
             "id": "observed-data--175e561f-3ced-4cf7-8a17-654ca651ff97",
-            "last_observed": "2021-04-27T21:09:06.718Z",
-            "modified": "2021-04-27T21:09:06.718Z",
+            "last_observed": "2023-02-27T16:28:24.006Z",
+            "modified": "2023-02-27T16:28:24.006Z",
             "number_observed": 1,
             "object_refs": [
-                "network-traffic--d8301f41-2ed7-599a-9851-02c19eeaca42"
+                "network-traffic--cdd05437-18e8-56e2-ab08-b474ca75b370",
+                "ipv4-addr--9cf4a8ec-7640-5f40-a006-79942896168b"
             ],
             "spec_version": "2.1",
             "type": "observed-data"
         }
     ],
     "type": "bundle"
-}
+}
\ No newline at end of file
diff --git a/idioms-json-2.1-ignore/victim-targeting.json b/idioms-json-2.1-ignore/victim-targeting.json
index a0ed3838..1db57b9a 100644
--- a/idioms-json-2.1-ignore/victim-targeting.json
+++ b/idioms-json-2.1-ignore/victim-targeting.json
@@ -3,7 +3,7 @@
     "objects": [
         {
             "created": "2014-05-08T09:00:00.000Z",
-            "id": "campaign--c831ab93-ff84-9cda-2bd8-b094004da969",
+            "id": "campaign--c831ab93-ff84-4cda-8bd8-b094004da969",
             "modified": "2014-05-08T09:00:00.000Z",
             "name": "Operation Alpha",
             "spec_version": "2.1",
@@ -11,7 +11,7 @@
         },
         {
             "created": "2014-05-08T09:00:00.000Z",
-            "id": "identity--4fde045a-b25f-f035-e8d0-29c9d5130cd9",
+            "id": "identity--4fde045a-b25f-4035-88d0-29c9d5130cd9",
             "identity_class": "unknown",
             "modified": "2014-05-08T09:00:00.000Z",
             "name": "Victim Targeting: Customer PII and Financial Data",
@@ -24,9 +24,9 @@
             "id": "relationship--d39b515c-7f4e-4fbb-911f-ae85016aa73e",
             "modified": "2014-05-08T09:00:00.000Z",
             "relationship_type": "targets",
-            "source_ref": "campaign--c831ab93-ff84-9cda-2bd8-b094004da969",
+            "source_ref": "campaign--c831ab93-ff84-4cda-8bd8-b094004da969",
             "spec_version": "2.1",
-            "target_ref": "identity--4fde045a-b25f-f035-e8d0-29c9d5130cd9",
+            "target_ref": "identity--4fde045a-b25f-4035-88d0-29c9d5130cd9",
             "type": "relationship"
         }
     ],
diff --git a/idioms-json-2.1-valid/archive-file.json b/idioms-json-2.1-valid/archive-file.json
new file mode 100644
index 00000000..90b95249
--- /dev/null
+++ b/idioms-json-2.1-valid/archive-file.json
@@ -0,0 +1,61 @@
+{
+    "id": "bundle--cc0ca596-70e6-4dac-9bef-603166d17db8",
+    "objects": [
+        {
+            "extensions": {
+                "archive-ext": {
+                    "contains_refs": [
+                        "file--06b0f286-eaeb-5996-9a08-f864854d0bf3",
+                        "file--34348c5a-2a26-5c0f-82f5-bbbe61fd61bc"
+                    ]
+                },
+                "extension-definition--db4b5429-6927-4d0c-a194-4695f05c629a": {
+                    "extension_type": "property-extension",
+                    "version": "1.2"
+                }
+            },
+            "id": "file--98522db6-20cd-5a72-8d77-8b16682ee4d9",
+            "name": "iprip32.zip",
+            "parent_directory_ref": "directory--5254394b-9d52-51d5-8a7b-613a7b0f89c0",
+            "type": "file"
+        },
+        {
+            "hashes": {
+                "SHA-256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+            },
+            "id": "file--06b0f286-eaeb-5996-9a08-f864854d0bf3",
+            "name": "fred.doc",
+            "parent_directory_ref": "directory--5254394b-9d52-51d5-8a7b-613a7b0f89c0",
+            "type": "file"
+        },
+                {
+            "id": "directory--5254394b-9d52-51d5-8a7b-613a7b0f89c0",
+            "path": "/usr/local",
+            "type": "directory"
+        },
+        {
+            "hashes": {
+                "MD5": "5d8129be965fab8115eca34fc84bd7f0"
+            },
+            "id": "file--34348c5a-2a26-5c0f-82f5-bbbe61fd61bc",
+            "type": "file"
+        },
+        {
+            "created": "2019-12-19T15:46:59.473Z",
+            "first_observed": "2019-12-19T15:46:59.473Z",
+            "id": "observed-data--c8c32b6e-2ea8-4678-8446-7f5218072f27",
+            "last_observed": "2019-12-19T15:46:59.473Z",
+            "modified": "2019-12-19T15:46:59.473Z",
+            "number_observed": 1,
+            "object_refs": [
+                "file--98522db6-20cd-5a72-8d77-8b16682ee4d9",
+                "file--06b0f286-eaeb-5996-9a08-f864854d0bf3",
+                "directory--5254394b-9d52-51d5-8a7b-613a7b0f89c0",
+                "file--34348c5a-2a26-5c0f-82f5-bbbe61fd61bc"
+            ],
+            "spec_version": "2.1",
+            "type": "observed-data"
+        }
+    ],
+    "type": "bundle"
+}
\ No newline at end of file
diff --git a/idioms-json-2.1/Mandiant_APT1_Report.json b/idioms-json-2.1/Mandiant_APT1_Report.json
index 2fdec924..acf0fa41 100644
--- a/idioms-json-2.1/Mandiant_APT1_Report.json
+++ b/idioms-json-2.1/Mandiant_APT1_Report.json
@@ -77,7 +77,6 @@
         {
             "created": "2015-05-15T09:00:00.000Z",
             "created_by_ref": "identity--a957579f-7388-4553-af4e-3aa044c52444",
-            "description": "\n\nINFORMATION_SOURCE_ROLES:\nNation-State,\nMilitary",
             "id": "identity--afeecea4-8a97-4a41-985b-ee5f619ab7ea",
             "identity_class": "organization",
             "modified": "2015-05-15T09:00:00.000Z",
@@ -85,6 +84,10 @@
             "object_marking_refs": [
                 "marking-definition--e6759cc7-4b44-4cb4-a1d5-ca16671f451e"
             ],
+            "roles": [
+                "Nation-State",
+                "Military"
+            ],
             "spec_version": "2.1",
             "type": "identity"
         },
@@ -200,7 +203,6 @@
         {
             "created": "2015-05-15T09:00:00.000Z",
             "created_by_ref": "identity--a957579f-7388-4553-af4e-3aa044c52444",
-            "description": "\n\nINFORMATION_SOURCE_ROLES:\nResearch and Development",
             "id": "identity--af5b7fd0-7807-4c6b-8027-803e8f52e910",
             "identity_class": "individual",
             "modified": "2015-05-15T09:00:00.000Z",
@@ -208,6 +210,9 @@
             "object_marking_refs": [
                 "marking-definition--e6759cc7-4b44-4cb4-a1d5-ca16671f451e"
             ],
+            "roles": [
+                "Research and Development"
+            ],
             "spec_version": "2.1",
             "type": "identity"
         },
@@ -432,7 +437,6 @@
         {
             "created": "2015-05-15T09:00:00.000Z",
             "created_by_ref": "identity--a957579f-7388-4553-af4e-3aa044c52444",
-            "description": "\n\nINFORMATION_SOURCE_ROLES:\nNation-State",
             "id": "identity--4d289304-5039-43e8-aab7-344cba0c4d63",
             "identity_class": "organization",
             "modified": "2015-05-15T09:00:00.000Z",
@@ -440,6 +444,9 @@
             "object_marking_refs": [
                 "marking-definition--e6759cc7-4b44-4cb4-a1d5-ca16671f451e"
             ],
+            "roles": [
+                "Nation-State"
+            ],
             "spec_version": "2.1",
             "type": "identity"
         },
@@ -473,7 +480,6 @@
         {
             "created": "2015-05-15T09:00:00.000Z",
             "created_by_ref": "identity--a957579f-7388-4553-af4e-3aa044c52444",
-            "description": "\n\nINFORMATION_SOURCE_ROLES:\nState-influenced Commercial Entity",
             "id": "identity--18fc9cbb-642e-45c8-a534-3b77819c64fa",
             "identity_class": "organization",
             "modified": "2015-05-15T09:00:00.000Z",
@@ -481,6 +487,9 @@
             "object_marking_refs": [
                 "marking-definition--e6759cc7-4b44-4cb4-a1d5-ca16671f451e"
             ],
+            "roles": [
+                "State-influenced Commercial Entity"
+            ],
             "spec_version": "2.1",
             "type": "identity"
         },
@@ -1193,7 +1202,7 @@
         {
             "created": "2015-05-15T09:00:00.000Z",
             "created_by_ref": "identity--a957579f-7388-4553-af4e-3aa044c52444",
-            "description": "<!DOCTYPE html>\n\t\t\t\t\t\t<html><body>\n\t\t\t\t\t\t\t\t<p>Windows password hash dumper.</P>\n\t\t\t\t\t\t\t\t<p>http://www.foofus.net/fizzgig/fgdump/</P>\n\t\t\t\t\t\t</body></html>\n\nINTENDED_EFFECT:Unauthorized Access: Escalating privileges involves acquiring items (most\n\t\t\t\toften usernames and passwords) that will allow access to more resources within\n\t\t\t\tthe network. \n\nTITLE:\n\tPrivilege Escalation",
+            "description": "<!DOCTYPE html>\n\t\t\t\t\t\t<html><body>\n\t\t\t\t\t\t\t\t<p>Windows password hash dumper.</P>\n\t\t\t\t\t\t\t\t<p>http://www.foofus.net/fizzgig/fgdump/</P>\n\t\t\t\t\t\t</body></html>\n\nVENDOR:\n\tunknown\n\nINTENDED_EFFECT:Unauthorized Access: Escalating privileges involves acquiring items (most\n\t\t\t\toften usernames and passwords) that will allow access to more resources within\n\t\t\t\tthe network. \n\nTITLE:\n\tPrivilege Escalation",
             "id": "tool--b00120c5-6374-4179-a668-93f146da503a",
             "kill_chain_phases": [
                 {
diff --git a/idioms-json-2.1/ais-marking-a-e-f.json b/idioms-json-2.1/ais-marking-a-e-f.json
index ab098978..b6b0eb3b 100644
--- a/idioms-json-2.1/ais-marking-a-e-f.json
+++ b/idioms-json-2.1/ais-marking-a-e-f.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--e23ae4e0-27a9-4a9a-bdde-d0a082a50cf3",
             "id": "report--ed47d9a7-e8bd-4036-ad2e-3c3bc6d5c63c",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1/ais-marking-a-e-t.json b/idioms-json-2.1/ais-marking-a-e-t.json
index 7adb10f1..eed41de3 100644
--- a/idioms-json-2.1/ais-marking-a-e-t.json
+++ b/idioms-json-2.1/ais-marking-a-e-t.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--f1d95c9f-adca-414e-a5cc-ca53d7db2e20",
             "id": "report--801ca8d4-20a1-4670-9b34-e8fcd6ae33ce",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1/ais-marking-a-n-f.json b/idioms-json-2.1/ais-marking-a-n-f.json
index 6f1ad7f0..2feab6c3 100644
--- a/idioms-json-2.1/ais-marking-a-n-f.json
+++ b/idioms-json-2.1/ais-marking-a-n-f.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--67c97380-ac9b-4162-8251-1d998734ca26",
             "id": "report--af4107df-75c2-457a-a647-cd26e57db2e3",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1/ais-marking-a-n-t.json b/idioms-json-2.1/ais-marking-a-n-t.json
index 852a30f1..e38a925c 100644
--- a/idioms-json-2.1/ais-marking-a-n-t.json
+++ b/idioms-json-2.1/ais-marking-a-n-t.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--45375520-a3ba-458b-8b5d-064210e417e9",
             "id": "report--d66b6b7d-ef72-40ac-9094-6df338762fb0",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1/ais-marking-a-u-f.json b/idioms-json-2.1/ais-marking-a-u-f.json
index 0f46304a..36defc7b 100644
--- a/idioms-json-2.1/ais-marking-a-u-f.json
+++ b/idioms-json-2.1/ais-marking-a-u-f.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--b19eb8b0-ccfd-4402-a064-26a6ec265778",
             "id": "report--ef82dbcc-be66-4278-a774-e8f3162f9848",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1/ais-marking-a-u-t.json b/idioms-json-2.1/ais-marking-a-u-t.json
index 938c2aa1..ca48f275 100644
--- a/idioms-json-2.1/ais-marking-a-u-t.json
+++ b/idioms-json-2.1/ais-marking-a-u-t.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--ddfc0865-cabf-4bfe-95e9-dd50de079326",
             "id": "report--9ae1e77a-5585-4daf-9687-1bfcb4b6bc4b",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1/ais-marking-g-e-f.json b/idioms-json-2.1/ais-marking-g-e-f.json
index 7d4a22b9..a412b9d4 100644
--- a/idioms-json-2.1/ais-marking-g-e-f.json
+++ b/idioms-json-2.1/ais-marking-g-e-f.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--eff39ad7-4567-4737-9bda-039924782dae",
             "id": "report--53a81d50-5857-4e9f-8986-046253937ffe",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1/ais-marking-g-e-t.json b/idioms-json-2.1/ais-marking-g-e-t.json
index d5a75e63..8433317f 100644
--- a/idioms-json-2.1/ais-marking-g-e-t.json
+++ b/idioms-json-2.1/ais-marking-g-e-t.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--4a32a5b8-d84f-42ea-a5f2-92859997ad6c",
             "id": "report--6e2bdc1a-6694-44be-a8dd-f6c80bc3a970",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1/ais-marking-g-n-f.json b/idioms-json-2.1/ais-marking-g-n-f.json
index 9c1e93f7..b88a7d11 100644
--- a/idioms-json-2.1/ais-marking-g-n-f.json
+++ b/idioms-json-2.1/ais-marking-g-n-f.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--c50ee42c-9d6a-462e-961b-3a805ad4753c",
             "id": "report--cfc6a33c-c202-48b5-ace5-d7cf7810b924",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1/ais-marking-g-n-t.json b/idioms-json-2.1/ais-marking-g-n-t.json
index a4daf415..c8410858 100644
--- a/idioms-json-2.1/ais-marking-g-n-t.json
+++ b/idioms-json-2.1/ais-marking-g-n-t.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--d0e8455e-cba4-4732-ae6e-3ace32db16ed",
             "id": "report--27d87fdb-959e-4023-9488-377ce91a4a9e",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1/ais-marking-g-u-f.json b/idioms-json-2.1/ais-marking-g-u-f.json
index 44f589b7..a6dfe055 100644
--- a/idioms-json-2.1/ais-marking-g-u-f.json
+++ b/idioms-json-2.1/ais-marking-g-u-f.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--6fac9d79-8f9c-49a9-98cb-bb98ae1bc465",
             "id": "report--5e1a4037-0035-4048-ac9d-ed588e28b1ba",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1/ais-marking-g-u-t.json b/idioms-json-2.1/ais-marking-g-u-t.json
index 245cbf8c..6dfcab24 100644
--- a/idioms-json-2.1/ais-marking-g-u-t.json
+++ b/idioms-json-2.1/ais-marking-g-u-t.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--62ed4885-9c29-43cf-a4a1-afffc702f801",
             "id": "report--fa744d71-1bfd-4d6f-889d-3f8bd3918a38",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1/ais-marking-w-e-f.json b/idioms-json-2.1/ais-marking-w-e-f.json
index defd0e12..4e26551a 100644
--- a/idioms-json-2.1/ais-marking-w-e-f.json
+++ b/idioms-json-2.1/ais-marking-w-e-f.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--7de10afb-24c7-4096-bccd-f82b5b92380f",
             "id": "report--0e13544f-09c8-4128-84db-7a2e3025a0d9",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1/ais-marking-w-e-t.json b/idioms-json-2.1/ais-marking-w-e-t.json
index 1944acb6..2a565af0 100644
--- a/idioms-json-2.1/ais-marking-w-e-t.json
+++ b/idioms-json-2.1/ais-marking-w-e-t.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--7f72d28a-a509-48ca-b8ba-7fc42f6d5463",
             "id": "report--709362e9-0ba8-47d8-bb7e-1c13b5e55d6f",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1/ais-marking-w-n-f.json b/idioms-json-2.1/ais-marking-w-n-f.json
index 463bfa0b..0c983510 100644
--- a/idioms-json-2.1/ais-marking-w-n-f.json
+++ b/idioms-json-2.1/ais-marking-w-n-f.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--855e937a-23bb-4785-8994-ded434e82614",
             "id": "report--930815e5-1cc6-45e2-8949-ed141369b595",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1/ais-marking-w-n-t.json b/idioms-json-2.1/ais-marking-w-n-t.json
index 22dc10fe..29e3c0e2 100644
--- a/idioms-json-2.1/ais-marking-w-n-t.json
+++ b/idioms-json-2.1/ais-marking-w-n-t.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--d307f0be-3218-4ad1-b423-6f44561ca827",
             "id": "report--3ad38ca4-ebfb-451c-aabd-306783429f6f",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1/ais-marking-w-u-f.json b/idioms-json-2.1/ais-marking-w-u-f.json
index 5fa2d379..7f8f754d 100644
--- a/idioms-json-2.1/ais-marking-w-u-f.json
+++ b/idioms-json-2.1/ais-marking-w-u-f.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--8169049b-9389-4e2a-9e40-3d1cfd2f19ab",
             "id": "report--43034495-4e29-4c64-a1f9-9db182c3daa6",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1/ais-marking-w-u-t.json b/idioms-json-2.1/ais-marking-w-u-t.json
index 676b7f70..72a7f276 100644
--- a/idioms-json-2.1/ais-marking-w-u-t.json
+++ b/idioms-json-2.1/ais-marking-w-u-t.json
@@ -63,6 +63,7 @@
         },
         {
             "created": "2020-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--9908e32b-f1cb-4805-98e9-71787d15ef40",
             "id": "report--66ec06f3-3038-4a89-a62b-6442d0fde4df",
             "modified": "2020-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1/campaign-v-actors.json b/idioms-json-2.1/campaign-v-actors.json
index df296a15..69f0ae97 100644
--- a/idioms-json-2.1/campaign-v-actors.json
+++ b/idioms-json-2.1/campaign-v-actors.json
@@ -49,6 +49,27 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--2f02796e-77f1-4f75-89f2-8e6f3224fff6",
+            "description": "Fred",
+            "external_references": [
+                {
+                    "source_name": "unknown",
+                    "url": "http://foo.com/bar"
+                }
+            ],
+            "id": "identity--598daac6-3957-44da-8d9c-76315ae068c7",
+            "modified": "2014-08-08T15:50:10.983Z",
+            "name": "not provided",
+            "roles": [
+                "Aggregator",
+                "Initial Author"
+            ],
+            "spec_version": "2.1",
+            "type": "identity"
+        },
+        {
+            "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--598daac6-3957-44da-8d9c-76315ae068c7",
             "description": "\n\nTARGETED_INFORMATION:\nInformation Assets - Financial Data",
             "id": "identity--2d1c6ab3-5e4e-48ac-a32b-f0c01c2836a8",
             "identity_class": "unknown",
@@ -62,6 +83,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--598daac6-3957-44da-8d9c-76315ae068c7",
             "goals": [
                 "Theft",
                 "Theft - Theft of Proprietary Information"
@@ -82,13 +104,7 @@
                 "NewsBeef"
             ],
             "created": "2014-08-08T15:50:10.983Z",
-            "description": "Fred\n\nINFORMATION_SOURCE_ROLES:\nAggregator,\nInitial Author",
-            "external_references": [
-                {
-                    "source_name": "unknown",
-                    "url": "http://foo.com/bar"
-                }
-            ],
+            "created_by_ref": "identity--78cef5d1-b4d4-49ee-b173-211d7b7763e1",
             "id": "campaign--e5268b6e-4931-42f1-b379-87f48eb41b1e",
             "modified": "2014-08-08T15:50:10.983Z",
             "name": "Compromise of ATM Machines",
@@ -100,6 +116,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--598daac6-3957-44da-8d9c-76315ae068c7",
             "id": "relationship--e41cbdc2-0e04-4e15-adfb-f49586195fe0",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -113,6 +130,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--598daac6-3957-44da-8d9c-76315ae068c7",
             "id": "relationship--4bf6433b-fb11-4a54-a9fb-24dc8910d94a",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -126,6 +144,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--598daac6-3957-44da-8d9c-76315ae068c7",
             "id": "relationship--729cae34-5226-4a4a-aaee-826f5c22834c",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -139,6 +158,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--598daac6-3957-44da-8d9c-76315ae068c7",
             "id": "relationship--4f575cd0-cf7b-4d19-958a-6ad865d7fa4c",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -152,6 +172,7 @@
         },
         {
             "created": "2014-08-08T15:50:10.983Z",
+            "created_by_ref": "identity--598daac6-3957-44da-8d9c-76315ae068c7",
             "id": "relationship--7b56c3c2-d0ff-4044-91e7-d4f71d89713e",
             "modified": "2014-08-08T15:50:10.983Z",
             "object_marking_refs": [
@@ -165,6 +186,7 @@
         },
         {
             "created": "2022-09-13T12:58:02.116Z",
+            "created_by_ref": "identity--78cef5d1-b4d4-49ee-b173-211d7b7763e1",
             "description": "Foo\nBar\nFred\nBarney",
             "id": "report--fd8c6760-88ef-4537-9e37-68ef5afe3afd",
             "modified": "2022-09-13T12:58:02.116Z",
@@ -173,6 +195,7 @@
                 "location--24174d90-f803-4389-baf0-33ea39ef6d02",
                 "relationship--06cba803-b56e-40ee-a7db-d0a16ebc240a",
                 "identity--78cef5d1-b4d4-49ee-b173-211d7b7763e1",
+                "identity--598daac6-3957-44da-8d9c-76315ae068c7",
                 "identity--2d1c6ab3-5e4e-48ac-a32b-f0c01c2836a8",
                 "threat-actor--56f3f0db-b5d5-431c-ae56-c18f02caf500",
                 "campaign--e5268b6e-4931-42f1-b379-87f48eb41b1e",
diff --git a/idioms-json-2.1/coa_ind_malicious_file.json b/idioms-json-2.1/coa_ind_malicious_file.json
index aa44bce8..56a6f7a4 100644
--- a/idioms-json-2.1/coa_ind_malicious_file.json
+++ b/idioms-json-2.1/coa_ind_malicious_file.json
@@ -96,6 +96,7 @@
         },
         {
             "created": "9999-12-31T00:00:00.000Z",
+            "created_by_ref": "identity--a5f64560-18d9-4759-9ccd-cfbb684e2378",
             "id": "report--b75cbbe1-beee-4974-a303-da9fc40db69e",
             "modified": "9999-12-31T00:00:00.000Z",
             "object_refs": [
diff --git a/idioms-json-2.1/custom_object.json b/idioms-json-2.1/custom_object.json
index bc6901d1..a911e1c6 100644
--- a/idioms-json-2.1/custom_object.json
+++ b/idioms-json-2.1/custom_object.json
@@ -3,6 +3,15 @@
     "objects": [
         {
             "created": "2015-07-31T11:24:39.090Z",
+            "id": "identity--7be4ecc8-8d52-47db-90b4-34c447f906be",
+            "modified": "2015-07-31T11:24:39.090Z",
+            "name": "not provided",
+            "spec_version": "2.1",
+            "type": "identity"
+        },
+        {
+            "created": "2015-07-31T11:24:39.090Z",
+            "created_by_ref": "identity--7be4ecc8-8d52-47db-90b4-34c447f906be",
             "description": "\n\nSTAGE:\n\tResponse\n\nOBJECTIVE: Block outbound traffic\n\nOBJECTIVE CONFIDENCE: High\n\nIMPACT:Medium: Some description about the indicator.",
             "id": "course-of-action--3dbfccad-1fbb-4e9f-8307-f2d1a5c651cc",
             "labels": [
@@ -15,6 +24,7 @@
         },
         {
             "created": "2015-07-31T11:24:39.090Z",
+            "created_by_ref": "identity--7be4ecc8-8d52-47db-90b4-34c447f906be",
             "description": "\n\nLIKELY_IMPACT:Medium",
             "id": "indicator--2cb76e88-2734-4a6c-a28c-52ae05f627be",
             "indicator_types": [
@@ -29,6 +39,7 @@
         },
         {
             "created": "2015-07-31T11:24:39.090Z",
+            "created_by_ref": "identity--7be4ecc8-8d52-47db-90b4-34c447f906be",
             "id": "relationship--acaef7f8-e5b8-40f1-a70f-bdd3b61eff7f",
             "modified": "2015-07-31T11:24:39.090Z",
             "relationship_type": "investigates",
diff --git a/idioms-json-2.1/hostname.json b/idioms-json-2.1/hostname.json
index 6941721a..0e6b637d 100644
--- a/idioms-json-2.1/hostname.json
+++ b/idioms-json-2.1/hostname.json
@@ -83,6 +83,7 @@
         },
         {
             "created": "2021-08-06T14:04:41.000Z",
+            "created_by_ref": "identity--c57e281e-8348-4911-9c51-9fab4a1b56c0",
             "id": "report--114a124e-b240-42e0-a84f-84d2932aca52",
             "modified": "2021-08-06T14:04:41.000Z",
             "name": "NCCIC:STIX_Package-75d3aca8-3a82-46fc-8965-c0d1958c9790",
diff --git a/idioms-json-2.1/issue-239.json b/idioms-json-2.1/issue-239.json
index 5df52a46..f5d7ceda 100644
--- a/idioms-json-2.1/issue-239.json
+++ b/idioms-json-2.1/issue-239.json
@@ -86,6 +86,7 @@
         },
         {
             "created": "2020-11-23T14:26:05.000Z",
+            "created_by_ref": "identity--b900ad7d-e31e-40ad-b8ba-e898d7ea046a",
             "description": "This is the package overview",
             "id": "report--f1bcf49d-d4fc-4689-b716-d8cb447ac991",
             "modified": "2020-11-23T14:26:05.000Z",
diff --git a/idioms-json-2.1/marking_information_source.json b/idioms-json-2.1/marking_information_source.json
index aed0947b..b0892333 100644
--- a/idioms-json-2.1/marking_information_source.json
+++ b/idioms-json-2.1/marking_information_source.json
@@ -50,6 +50,7 @@
         {
             "confidence": 85,
             "created": "2015-05-15T09:00:00.000Z",
+            "created_by_ref": "identity--4a630319-deb6-420c-8c15-a19516409393",
             "description": "This is a cyber threat indicator for instances of US-China_Q14 phishing attempts.",
             "id": "indicator--5712e9fc-977f-4958-99a4-3700c5a131dd",
             "indicator_types": [
@@ -69,6 +70,7 @@
         },
         {
             "created": "2014-05-08T09:00:00.000Z",
+            "created_by_ref": "identity--4a630319-deb6-420c-8c15-a19516409393",
             "id": "report--53a0ddca-816c-44af-9da6-92fcf26992d8",
             "modified": "2014-05-08T09:00:00.000Z",
             "name": "Silver Gray Owl",
diff --git a/idioms-json-2.1/network-socket-observable.json b/idioms-json-2.1/network-socket-observable.json
index 794ebc06..985b5f65 100644
--- a/idioms-json-2.1/network-socket-observable.json
+++ b/idioms-json-2.1/network-socket-observable.json
@@ -2,6 +2,7 @@
     "id": "bundle--8005dcb9-398c-4f61-b44c-18133199d145",
     "objects": [
         {
+            "dst_ref": "ipv4-addr--9cf4a8ec-7640-5f40-a006-79942896168b",
             "extensions": {
                 "socket-ext": {
                     "address_family": "AF_INET",
@@ -11,21 +12,27 @@
                     }
                 }
             },
-            "id": "network-traffic--d8301f41-2ed7-599a-9851-02c19eeaca42",
+            "id": "network-traffic--cdd05437-18e8-56e2-ab08-b474ca75b370",
             "protocols": [
                 "tcp"
             ],
             "type": "network-traffic"
         },
         {
-            "created": "2019-08-21T11:45:07.854Z",
-            "first_observed": "2019-08-21T11:45:07.854Z",
+            "id": "ipv4-addr--9cf4a8ec-7640-5f40-a006-79942896168b",
+            "type": "ipv4-addr",
+            "value": "198.51.100.2"
+        },
+        {
+            "created": "2023-02-27T14:55:11.993Z",
+            "first_observed": "2023-02-27T14:55:11.993Z",
             "id": "observed-data--175e561f-3ced-4cf7-8a17-654ca651ff97",
-            "last_observed": "2019-08-21T11:45:07.854Z",
-            "modified": "2019-08-21T11:45:07.854Z",
+            "last_observed": "2023-02-27T14:55:11.993Z",
+            "modified": "2023-02-27T14:55:11.993Z",
             "number_observed": 1,
             "object_refs": [
-                "network-traffic--d8301f41-2ed7-599a-9851-02c19eeaca42"
+                "network-traffic--cdd05437-18e8-56e2-ab08-b474ca75b370",
+                "ipv4-addr--9cf4a8ec-7640-5f40-a006-79942896168b"
             ],
             "spec_version": "2.1",
             "type": "observed-data"
@@ -33,4 +40,3 @@
     ],
     "type": "bundle"
 }
-
diff --git a/idioms-json-2.1/victim-targeting.json b/idioms-json-2.1/victim-targeting.json
index f8634ecd..61b0ce3c 100644
--- a/idioms-json-2.1/victim-targeting.json
+++ b/idioms-json-2.1/victim-targeting.json
@@ -3,7 +3,8 @@
     "objects": [
         {
             "created": "2014-05-08T09:00:00.000Z",
-            "id": "campaign--c831ab93-ff84-9cda-2bd8-b094004da969",
+            "description": "\n\nSTATUS:\n\tOngoing",
+            "id": "campaign--c831ab93-ff84-4cda-8bd8-b094004da969",
             "modified": "2014-05-08T09:00:00.000Z",
             "name": "Operation Alpha",
             "spec_version": "2.1",
@@ -12,7 +13,7 @@
         {
             "created": "2014-05-08T09:00:00.000Z",
             "description": "\n\nTARGETED_INFORMATION:\nInformation Assets - Customer PII,\nInformation Assets - Financial Data",
-            "id": "identity--4fde045a-b25f-f035-e8d0-29c9d5130cd9",
+            "id": "identity--4fde045a-b25f-4035-88d0-29c9d5130cd9",
             "identity_class": "unknown",
             "modified": "2014-05-08T09:00:00.000Z",
             "name": "Victim Targeting: Customer PII and Financial Data",
@@ -25,9 +26,9 @@
             "id": "relationship--f8285e59-ad0b-46c3-82bc-2fb84bb4cef1",
             "modified": "2014-05-08T09:00:00.000Z",
             "relationship_type": "targets",
-            "source_ref": "campaign--c831ab93-ff84-9cda-2bd8-b094004da969",
+            "source_ref": "campaign--c831ab93-ff84-4cda-8bd8-b094004da969",
             "spec_version": "2.1",
-            "target_ref": "identity--4fde045a-b25f-f035-e8d0-29c9d5130cd9",
+            "target_ref": "identity--4fde045a-b25f-4035-88d0-29c9d5130cd9",
             "type": "relationship"
         }
     ],
diff --git a/idioms-xml/Mandiant_APT1_Report.xml b/idioms-xml/Mandiant_APT1_Report.xml
index 9ff0f640..41dadc80 100644
--- a/idioms-xml/Mandiant_APT1_Report.xml
+++ b/idioms-xml/Mandiant_APT1_Report.xml
@@ -886,6 +886,7 @@
 				</ttp:Tool>
 				<ttp:Tool>
 					<cyboxCommon:Name>fgdump</cyboxCommon:Name>
+					<cyboxCommon:Vendor>unknown</cyboxCommon:Vendor>
 					<cyboxCommon:Description structuring_format="HTML5"><![CDATA[<!DOCTYPE html>
 						<html><body>
 								<p>Windows password hash dumper.</P>
diff --git a/idioms-xml/campaign-v-actors.xml b/idioms-xml/campaign-v-actors.xml
index 37e059fd..e68389b1 100644
--- a/idioms-xml/campaign-v-actors.xml
+++ b/idioms-xml/campaign-v-actors.xml
@@ -7,6 +7,7 @@
     xmlns:marking="http://data-marking.mitre.org/Marking-1"
     xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
     xmlns:stix="http://stix.mitre.org/stix-1"
+    xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
     xmlns:AIS="http://www.us-cert.gov/STIXMarkingStructure#AISConsentMarking-2"
     xmlns:stix-ciq="http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1"
     xmlns:xpil="urn:oasis:names:tc:ciq:xpil:3"
@@ -16,7 +17,6 @@
 	xmlns:xnl="urn:oasis:names:tc:ciq:xnl:3"
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="
-
     http://stix.mitre.org/Campaign-1 http://stix.mitre.org/XMLSchema/campaign/1.2/campaign.xsd
     http://stix.mitre.org/TTP-1 http://stix.mitre.org/XMLSchema/ttp/1.2/ttp.xsd
     http://stix.mitre.org/ThreatActor-1 http://stix.mitre.org/XMLSchema/threat_actor/1.2/threat_actor.xsd
diff --git a/idioms-xml/network-socket-observable.xml b/idioms-xml/network-socket-observable.xml
index c6318c45..cf87305c 100644
--- a/idioms-xml/network-socket-observable.xml
+++ b/idioms-xml/network-socket-observable.xml
@@ -1,36 +1,28 @@
 <stix:STIX_Package
-        xmlns:URIObj="http://cybox.mitre.org/objects#URIObject-2"
         xmlns:xs="http://www.w3.org/2001/XMLSchema"
-        xmlns:NetworkConnectionObj="http://cybox.mitre.org/objects#NetworkConnectionObject-2"
         xmlns:example="http://example.com"
-        xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"
         xmlns:stix="http://stix.mitre.org/stix-1"
-        xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
-        xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
-        xmlns:HTTPSessionObj="http://cybox.mitre.org/objects#HTTPSessionObject-2"
+        xmlns:NetworkSocketObj="http://cybox.mitre.org/objects#NetworkSocketObject-2"
+        xmlns:SocketAddressObj="http://cybox.mitre.org/objects#SocketAddressObject-1"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns:cybox="http://cybox.mitre.org/cybox-2"
-        xmlns:HostnameObj="http://cybox.mitre.org/objects#HostnameObject-1"
-        xmlns:stixCommon="http://stix.mitre.org/common-1"
-        xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
-        xmlns:SocketAddressObj="http://cybox.mitre.org/objects#SocketAddressObject-1"
         xmlns:AddressObject="http://cybox.mitre.org/objects#AddressObject-2"
-        xmlns:indicator="http://stix.mitre.org/Indicator-2"
         id="example:STIXPackage-8005dcb9-398c-4f61-b44c-18133199d145" version="1.2">
     <stix:Observables cybox_major_version="2" cybox_minor_version="1" cybox_update_version="0">
         <cybox:Observable id="example:observable-175e561f-3ced-4cf7-8a17-654ca651ff97">
             <cybox:Object id="example:NetworkSocket-ed2c87bf-c0e3-4da9-873a-afa95da00459">
-                <cybox:Properties xsi:type="SocketAddressObj:NetworkSocketObjectType" is_listening="true">
-                    <SocketAddressObj:Address_Family>AF_INET</SocketAddressObj:Address_Family>
-                    <SocketAddressObj:Local_Address>
+                <cybox:Properties xsi:type="NetworkSocketObj:NetworkSocketObjectType" is_listening="true">
+                    <NetworkSocketObj:Address_Family>AF_INET</NetworkSocketObj:Address_Family>
+                    <NetworkSocketObj:Domain>PF_APPLETALK</NetworkSocketObj:Domain>
+                    <NetworkSocketObj:Local_Address>
                         <SocketAddressObj:IP_Address>
                             <AddressObject:Address_Value>198.51.100.2</AddressObject:Address_Value>
                         </SocketAddressObj:IP_Address>
-                    </SocketAddressObj:Local_Address>
-                    <SocketAddressObj:Options>
-                        <SocketAddressObj:IP_MULTICAST_LOOP>true</SocketAddressObj:IP_MULTICAST_LOOP>
-                    </SocketAddressObj:Options>
-                    <SocketAddressObj:Protocol>TCP</SocketAddressObj:Protocol>
+                    </NetworkSocketObj:Local_Address>
+                    <NetworkSocketObj:Options>
+                            <NetworkSocketObj:IP_MULTICAST_LOOP>true</NetworkSocketObj:IP_MULTICAST_LOOP>
+                    </NetworkSocketObj:Options>
+                    <NetworkSocketObj:Protocol>TCP</NetworkSocketObj:Protocol>
 
                 </cybox:Properties>
             </cybox:Object>
diff --git a/idioms-xml/victim-targeting.xml b/idioms-xml/victim-targeting.xml
index ff6a370d..052afaae 100644
--- a/idioms-xml/victim-targeting.xml
+++ b/idioms-xml/victim-targeting.xml
@@ -5,23 +5,16 @@
     xmlns:stixCommon="http://stix.mitre.org/common-1"
     xmlns:campaign="http://stix.mitre.org/Campaign-1"
     xmlns:ttp="http://stix.mitre.org/TTP-1"
-    xmlns:cybox="http://cybox.mitre.org/cybox-2"
-    xmlns:AddressObject="http://cybox.mitre.org/objects#AddressObject-2"
-    xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"
     xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
     xmlns:example="http://example.com/"
     xsi:schemaLocation="
     http://stix.mitre.org/stix-1 http://stix.mitre.org/XMLSchema/core/1.2/stix_core.xsd
     http://stix.mitre.org/Campaign-1 http://stix.mitre.org/XMLSchema/campaign/1.2/campaign.xsd
-    http://stix.mitre.org/Indicator-2 http://stix.mitre.org/XMLSchema/indicator/2.2/indicator.xsd
-    http://stix.mitre.org/TTP-2 http://stix.mitre.org/XMLSchema/ttp/1.2/ttp.xsd
-    http://stix.mitre.org/default_vocabularies-1 http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd
-    http://cybox.mitre.org/objects#AddressObject-2 http://cybox.mitre.org/XMLSchema/objects/Address/2.1/Address_Object.xsd"
+    http://stix.mitre.org/default_vocabularies-1 http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd"
     id="example:STIXPackage-bf35a4b5-e102-463d-9105-4d7a6e2d78bc"
-    version="1.2"
-    >
+    version="1.2">
     <stix:TTPs>
-        <stix:TTP xsi:type="ttp:TTPType" id="example:ttp-4fde045a-b25f-f035-e8d0-29c9d5130cd9" timestamp="2014-05-08T09:00:00.000000Z">
+        <stix:TTP xsi:type="ttp:TTPType" id="example:ttp-4fde045a-b25f-4035-88d0-29c9d5130cd9" timestamp="2014-05-08T09:00:00.000000Z">
             <ttp:Title>Victim Targeting: Customer PII and Financial Data</ttp:Title>
             <ttp:Victim_Targeting xsi:type="ttp:VictimTargetingType">
                 <ttp:Targeted_Information xsi:type="stixVocabs:InformationTypeVocab-1.0">Information Assets - Customer PII</ttp:Targeted_Information>
@@ -30,12 +23,13 @@
         </stix:TTP>
     </stix:TTPs>
     <stix:Campaigns>
-        <stix:Campaign xsi:type="campaign:CampaignType" id="example:campaign-c831ab93-ff84-9cda-2bd8-b094004da969" timestamp="2014-05-08T09:00:00.000000Z">
-            <campaign:Title>Operation Alpha</campaign:Title> 
+        <stix:Campaign xsi:type="campaign:CampaignType" id="example:campaign-c831ab93-ff84-4cda-8bd8-b094004da969" timestamp="2014-05-08T09:00:00.000000Z">
+            <campaign:Title>Operation Alpha</campaign:Title>
+            <campaign:Status xsi:type="stixVocabs:CampaignStatusVocab-1.0">Ongoing</campaign:Status>
             <campaign:Related_TTPs>
                 <campaign:Related_TTP>
                     <stixCommon:Relationship>Targets</stixCommon:Relationship>
-                    <stixCommon:TTP xsi:type="ttp:TTPType" idref="example:ttp-4fde045a-b25f-f035-e8d0-29c9d5130cd9"/>    
+                    <stixCommon:TTP xsi:type="ttp:TTPType" idref="example:ttp-4fde045a-b25f-4035-88d0-29c9d5130cd9"/>
                 </campaign:Related_TTP>
             </campaign:Related_TTPs>
         </stix:Campaign>
diff --git a/stix2elevator/convert_cybox.py b/stix2elevator/convert_cybox.py
index 76ce2aab..116c4d62 100644
--- a/stix2elevator/convert_cybox.py
+++ b/stix2elevator/convert_cybox.py
@@ -724,6 +724,7 @@ def convert_attachment(attachment):
     "User-Agent:": "user_agent",
     "Boundary": "boundary",
     "X-Priority": "x_priority",
+    "X_Originating_IP": "x_orginating_ip",
     "X-Mailer": "x_mailer"
 }
 
@@ -1450,14 +1451,21 @@ def convert_http_session(session):
                     return [cybox_traffic]
 
 
-def handle_missing_properties_of_icmp_extension(icmp_header, imcp_extension):
+def handle_missing_properties_of_icmp_extension(icmp_header, imcp_extension, cybox_traffic):
     if icmp_header is not None:
         if icmp_header.checksum:
             if not check_for_missing_policy("use-extensions"):
-                handle_missing_string_property(imcp_extension, "checksum", icmp_header.checksum, None, is_sco=True)
+                handle_missing_string_property(imcp_extension, "checksum_hex", icmp_header.checksum, None, is_sco=True)
             else:
-                warn("Property checksum %s is ignored, because it can't be represented using the extensions policy",
-                     314, icmp_header.checksum)
+                extension_definition_id = get_extension_definition_id("icmp-header")
+                if not extension_definition_id:
+                    warn("No extension-definition was found for STIX 1 type icmp-header", 312)
+                else:
+                    extensions_dict = cybox_traffic["extensions"]
+                    if extension_definition_id not in extensions_dict:
+                        extensions_dict[extension_definition_id] = dict()
+                    extensions_dict[extension_definition_id]["checksum_hex"] = str(icmp_header.checksum)
+                    extensions_dict[extension_definition_id]["extension_type"] = "property-extension"
 
 
 def create_icmp_extension(icmp_header, imcp_extension, cybox_traffic):
@@ -1465,7 +1473,7 @@ def create_icmp_extension(icmp_header, imcp_extension, cybox_traffic):
         imcp_extension["icmp_type_hex"] = icmp_header.type_.value
     if icmp_header.code:
         imcp_extension["icmp_code_hex"] = icmp_header.code.value
-    handle_missing_properties_of_icmp_extension(icmp_header, imcp_extension)
+    handle_missing_properties_of_icmp_extension(icmp_header, imcp_extension, cybox_traffic)
     return imcp_extension
 
 
@@ -1504,32 +1512,38 @@ def convert_socket_options(options):
     return socket_options
 
 
-def handle_missing_properties_of_network_socket(socket, socket_extension, cybox_traffic):
-    sco_id = cybox_traffic["id"] if "id" in cybox_traffic else None
-    if socket.domain:
-        if get_option_value("spec_version") == "2.0":
-            cybox_traffic["extensions"]["socket-ext"]["protocol_family"] = socket.domain
-        else:
-            handle_missing_string_property(socket_extension, "protocol_family", socket.domain, sco_id, is_sco=True)
+def compose_socket_address(soc_add):
+    if soc_add.ip_address:
+        address_value = soc_add.ip_address
+    elif soc_add.hostname:
+        address_value = soc_add.hostname
+    else:
+        address_value = ""
+    if soc_add.port:
+        address_value += ":" + soc_add.port
+    return address_value
 
-    if socket.local_address:
-        if not check_for_missing_policy("use-extensions"):
-            handle_missing_string_property(socket_extension, "local_address", socket.local_address.ip_address, sco_id, is_sco=True)
-        else:
-            warn(
-                "Property local_address %s is ignored, because it can't be represented using the extensions policy",
-                314, socket.local_address)
-    if socket.remote_address:
-        if not check_for_missing_policy("use-extensions"):
-            handle_missing_string_property(socket_extension, "remote_address", socket.remote_address.ip_address, sco_id, is_sco=True)
-        else:
-            warn(
-                "Property remote_address %s is ignored, because it can't be represented using the extensions policy",
-                314, socket.remote_address)
+def handle_missing_properties_of_network_socket(socket, cybox_traffic):
+    container, extension_definition_id = determine_container_for_missing_properties("network-socket", cybox_traffic)
 
+    if container is not None:
+        sco_id = cybox_traffic["id"] if "id" in cybox_traffic else None
+        if socket.domain:
+            if get_option_value("spec_version") == "2.0":
+                cybox_traffic["protocol_family"] = str(socket.domain)
+            else:
+                handle_missing_string_property(container, "protocol_family", socket.domain, sco_id, is_sco=True)
+        fill_in_extension_properties(cybox_traffic, container, extension_definition_id)
 
-def convert_network_socket(socket):
+
+def convert_network_socket(socket, env=None):
+    spec_version = get_option_value("spec_version")
     cybox_traffic = create_base_sco("network-traffic", socket)
+    if spec_version == "2.0":
+        objs = {"0": cybox_traffic}
+    else:
+        objs = [cybox_traffic]
+
     if socket.protocol:
         cybox_traffic["protocols"] = [socket.protocol.value.lower()]
     socket_extension = {}
@@ -1550,9 +1564,15 @@ def convert_network_socket(socket):
         socket_extension["socket_descriptor"] = socket.socket_descriptor
 
     cybox_traffic["extensions"] = {"socket-ext": socket_extension}
+    index = 1
+    if socket.local_address:
+        index = convert_socket_address_1(socket.local_address, cybox_traffic, objs, spec_version, index, "dst", env)
+    if socket.remote_address:
+
+        convert_socket_address_1(socket.local_address, cybox_traffic, objs, spec_version, index, "src", env)
     generate_sco_id_for_2_1(cybox_traffic, socket.parent.id_)
-    handle_missing_properties_of_network_socket(socket, socket_extension, cybox_traffic)
-    return cybox_traffic
+    handle_missing_properties_of_network_socket(socket, cybox_traffic if check_for_missing_policy("use-extensions") else socket_extension)
+    return objs
 
 
 def convert_socket_address(sock_add_1x, env=None):
@@ -1747,7 +1767,7 @@ def convert_cybox_object20(obj1x):
     elif isinstance(prop, NetworkPacket):
         objs["0"] = convert_network_packet(prop)
     elif isinstance(prop, NetworkSocket):
-        objs["0"] = convert_network_socket(prop)
+        objs = convert_network_socket(prop)
     elif isinstance(prop, X509Certificate):
         objs["0"] = convert_x509_certificate(prop)
     elif isinstance(prop, SocketAddress):
@@ -1821,7 +1841,7 @@ def convert_cybox_object21(obj1x, env):
     elif isinstance(prop, NetworkPacket):
         objs = [convert_network_packet(prop)]
     elif isinstance(prop, NetworkSocket):
-        objs = [convert_network_socket(prop)]
+        objs = convert_network_socket(prop, env)
     elif isinstance(prop, X509Certificate):
         objs = [convert_x509_certificate(prop)]
     elif isinstance(prop, SocketAddress):
diff --git a/stix2elevator/convert_stix.py b/stix2elevator/convert_stix.py
index 36da5d92..2d7828f6 100644
--- a/stix2elevator/convert_stix.py
+++ b/stix2elevator/convert_stix.py
@@ -90,7 +90,7 @@
     set_tlp_reference, strftime_with_appropriate_fractional_seconds
 )
 from stix2elevator.vocab_mappings import (
-    ATTACK_MOTIVATION_MAP, COA_LABEL_MAP, INCIDENT_LABEL_MAP,
+    ATTACK_MOTIVATION_MAP, CAMPAIGN_STATUS_MAP, COA_LABEL_MAP, INCIDENT_LABEL_MAP,
     INDICATOR_LABEL_MAP, INFRASTRUCTURE_LABELS_MAP, MALWARE_LABELS_MAP,
     REPORT_LABELS_MAP, SECTORS_MAP, THREAT_ACTOR_LABEL_MAP,
     THREAT_ACTOR_SOPHISTICATION_MAP, TOOL_LABELS_MAP
@@ -229,9 +229,9 @@ def get_identity(identity, env, created_by_ref_source, temp_marking_id=None):
     if not env.get_identity_called:
         # On some occasions excessive recursion may add identity objects that are not needed
         new_env = env.newEnv(get_identity_called=True)
-        ident20 = convert_identity(identity, new_env, created_by_ref_source, temp_marking_id=temp_marking_id)
-        env.bundle_instance["objects"].append(ident20)
-        return ident20["id"]
+        ident_instance = convert_identity(identity, new_env, created_by_ref_source, temp_marking_id=temp_marking_id)
+        env.bundle_instance["objects"].append(ident_instance)
+        return ident_instance["id"]
 
 
 def get_identity_ref(identity, env, created_by_ref_source, temp_marking_id=None):
@@ -247,42 +247,61 @@ def get_identity_ref(identity, env, created_by_ref_source, temp_marking_id=None)
 
 
 def handle_missing_properties_of_information_source(so, information_source):
-    # handle missing properties
+    # This will never create any extensions, since roles are a property in STIX 2.1
+    # if information_source.tools is ever captured, this code can be used to create the extension
     container, extension_definition_id = determine_container_for_missing_properties("information_source", so)
 
     if container is not None:
-        if information_source.roles:
-            handle_missing_string_property(container, "information_source_roles", information_source.roles, so["id"],
+        if information_source.roles and get_option_value("spec_version") == "2.0":
+            handle_missing_string_property(container, "roles", information_source.roles, so["id"],
                                            True, is_literal=True)
         if information_source.tools:
             for tool in information_source.tools:
-                handle_missing_tool_property(container, tool)
+                warn("Missing property 'tool' %s is ignored", 307, ("of" + so["id"] if "id" in so else ""))
         fill_in_extension_properties(so, container, extension_definition_id)
 
 
 def process_information_source(information_source, so, env, temp_marking_id=None):
+    identity_instance = None
     if information_source:
         if information_source.identity is not None:
             if information_source.identity.idref:
-                so["created_by_ref"] = information_source.identity.idref
+                identity_ref = information_source.identity.idref
             else:
-                so["created_by_ref"] = get_identity(information_source.identity,
-                                                    env,
-                                                    "this_identity",
-                                                    temp_marking_id)
+                identity_ref = get_identity(information_source.identity,
+                                            env,
+                                            "this_identity",
+                                            temp_marking_id)
+            if not env.created_by_ref:
+                env.created_by_ref = identity_ref
         else:
-            so["created_by_ref"] = env.created_by_ref
-
+            identity_instance = create_basic_object("identity", None, env)
+            identity_ref = identity_instance["id"]
+            if "name" not in identity_instance:
+                identity_instance["name"] = "not provided"
+            finish_basic_object(None,
+                                identity_instance,
+                                env,
+                                identity_instance,
+                                temp_marking_id=temp_marking_id)
+            env.bundle_instance["objects"].append(identity_instance)
+        so["created_by_ref"] = identity_ref
         if so == env.bundle_instance:
             warn("Information Source on %s is not representable in STIX 2.x", 401, so["id"])
         else:
-            if information_source.description:
-                process_description_and_short_description(so, information_source)
-            if information_source.references:
-                for ref in information_source.references:
-                    so["external_references"].append({"source_name": "unknown", "url": ref})
-            handle_missing_properties_of_information_source(so, information_source)
-
+            if identity_instance:
+                if information_source.description:
+                    process_description_and_short_description(identity_instance, information_source)
+                if information_source.references:
+                    for ref in information_source.references:
+                        identity_instance["external_references"].append({"source_name": "unknown", "url": ref})
+                if information_source.roles and get_option_value("spec_version") == "2.1":
+                    identity_instance["roles"] = [str(r) for r in information_source.roles]
+                handle_missing_properties_of_information_source(identity_instance, information_source)
+        if information_source.contributing_sources:
+            info("Information Source property Contributing_Sources in %s is not handled, yet.", 815, so["id"])
+        if information_source.time:
+            info("Information Source property Time in %s is not handled, yet.", 815, so["id"])
     else:
         so["created_by_ref"] = env.created_by_ref
     return so["created_by_ref"]
@@ -982,8 +1001,11 @@ def handle_missing_properties_of_campaign(campaign_instance, camp):
 
     if container is not None:
         handle_multiple_missing_statement_properties(container, camp.intended_effects, "intended_effects",
-                                                     campaign_instance["id"], is_literal=True)
-        handle_missing_string_property(container, "status", camp.status, campaign_instance["id"])
+                                                     campaign_instance["id"],
+                                                     is_literal=True, mapping = _INTENDED_EFFECTS_LITERAL_MAPPING)
+        handle_missing_string_property(container, "status", camp.status,
+                                       campaign_instance["id"],
+                                       is_literal=True, mapping=CAMPAIGN_STATUS_MAP)
 
         if get_option_value("spec_version") == "2.0":
             handle_missing_confidence_property(container, camp.confidence, campaign_instance["id"])
@@ -1086,7 +1108,7 @@ def handle_missing_objective_property(container, objective, id):
                 warn("Used custom property for objective of %s", 308, id)
             elif check_for_missing_policy("use-extensions"):
                 container["objective"] = " ".join(all_text)
-                warn("Used an extension for objective of %s", 311, id)
+                warn("Used an extension property for %s of %s", 313, id, "objective")
             if objective.applicability_confidence:
                 handle_missing_confidence_property(container, objective.applicability_confidence, id, "objective")
 
@@ -1393,19 +1415,22 @@ def convert_ciq_addresses2_1(ciq_info_addresses, identity_instance, env, created
             add_unfinished_marked_object(location)
 
 
-def handle_missing_properties_of_ciq_instance(identity_instance, ciq):
+def handle_missing_properties_of_ciq_instance(identity_instance, ciq, spec_version):
     container, extension_definition_id = determine_container_for_missing_properties("identity-ciq", identity_instance)
 
     if container is not None:
         if ciq.roles:
-            handle_missing_string_property(container,
-                                           "information_source_roles",
-                                           ciq.roles,
-                                           identity_instance["id"],
-                                           True)
-            warn("Roles is not a property of an identity (%s).  Perhaps the roles are associated with a related Threat Actor",
-                 428,
-                 identity_instance["id"])
+            if spec_version == "2.0":
+                handle_missing_string_property(container,
+                                               "information_source_roles",
+                                               ciq.roles,
+                                               identity_instance["id"],
+                                               True)
+                warn("Roles is not a property of an identity in 2.0 (%s).  Perhaps the roles are associated with a related Threat Actor",
+                     428,
+                     identity_instance["id"])
+            else:
+                identity_instance["roles"] = ciq.roles
         if ciq._specification.free_text_lines:
             lines = ""
             for line in ciq._specification.free_text_lines:
@@ -1424,7 +1449,8 @@ def convert_identity(identity, env, created_by_ref_source, parent_id=None, temp_
     if identity.name is not None:
         identity_instance["name"] = identity.name
     if isinstance(identity, CIQIdentity3_0Instance):
-        handle_missing_properties_of_ciq_instance(identity_instance, identity)
+        handle_missing_properties_of_ciq_instance(identity_instance, identity, spec_version)
+        # The spec seems to imply that roles can be specified without using CIQ, but this appears not to be true
         # convert_controlled_vocabs_to_open_vocabs(identity_instance, "roles", identity.roles, ROLES_MAP, False)
         ciq_info = identity._specification
         if ciq_info.party_name:
@@ -2247,8 +2273,8 @@ def determine_ttp_relationship_type_and_direction(source_type, target_type, rela
         return "related-to", True
 
 
-def handle_missing_properties_of_ttp(sdo_instance, ttp):
-    container, extension_definition_id = determine_container_for_missing_properties(sdo_instance["type"],
+def handle_missing_properties_of_ttp(sdo_instance, ttp, type_of_ttp):
+    container, extension_definition_id = determine_container_for_missing_properties(sdo_instance["type"] if not type_of_ttp else type_of_ttp,
                                                                                     sdo_instance)
     if container is not None:
         handle_multiple_missing_statement_properties(container, ttp.intended_effects, "intended_effects",
@@ -2263,7 +2289,7 @@ def handle_missing_properties_of_ttp(sdo_instance, ttp):
         fill_in_extension_properties(sdo_instance, container, extension_definition_id)
 
 
-def process_ttp_properties(sdo_instance, ttp, env, kill_chains_in_sdo=True, marking_refs=None):
+def process_ttp_properties(sdo_instance, ttp, env, kill_chains_in_sdo=True, marking_refs=None, type_of_ttp=None):
     process_description_and_short_description(sdo_instance, ttp, True)
 
     # only populate kill chain phases if that is a property of the sdo_instance type, as indicated by kill_chains_in_sdo
@@ -2303,7 +2329,7 @@ def process_ttp_properties(sdo_instance, ttp, env, kill_chains_in_sdo=True, mark
     if hasattr(ttp, "related_packages") and ttp.related_packages is not None:
         for p in ttp.related_packages:
             warn("Related_Packages type in %s not supported in STIX 2.x", 402, ttp.id_)
-    handle_missing_properties_of_ttp(sdo_instance, ttp)
+    handle_missing_properties_of_ttp(sdo_instance, ttp, type_of_ttp)
 
 
 def convert_attack_pattern(ap, ttp, env, ttp_id_used):
@@ -2506,10 +2532,10 @@ def convert_resources(resources, ttp, env, generated_ttps):
     return resources_generated
 
 
-def convert_identity_for_victim_target(identity, ttp, env, ttp_generated):
-    if identity:
-        identity_markings = create_marking_union(identity)
-        identity_instance = convert_identity(identity,
+def convert_identity_for_victim_target(victim_targeting, ttp, env, ttp_generated):
+    if victim_targeting.identity:
+        identity_markings = create_marking_union(victim_targeting.identity)
+        identity_instance = convert_identity(victim_targeting.identity,
                                              env,
                                              created_by_ref_source="from_env",
                                              parent_id=ttp.id_ if not ttp_generated else None,
@@ -2519,7 +2545,8 @@ def convert_identity_for_victim_target(identity, ttp, env, ttp_generated):
         identity_instance["identity_class"] = "unknown"
         identity_markings = create_marking_union(ttp)
     env.bundle_instance["objects"].append(identity_instance)
-    process_ttp_properties(identity_instance, ttp, env, False, marking_refs=identity_markings)
+    process_ttp_properties(identity_instance, ttp, env, False, marking_refs=identity_markings, type_of_ttp="victim")
+    handle_missing_properties_of_victim_target(identity_instance, victim_targeting)
     if "name" not in identity_instance:
         handle_missing_required_property("name", identity_instance)
     finish_basic_object(ttp.id_, identity_instance, env, ttp)
@@ -2527,7 +2554,7 @@ def convert_identity_for_victim_target(identity, ttp, env, ttp_generated):
 
 
 def handle_missing_properties_of_victim_target(identity_instance, victim_targeting):
-    container, extension_definition_id = determine_container_for_missing_properties("identity",
+    container, extension_definition_id = determine_container_for_missing_properties("victim",
                                                                                     identity_instance)
 
     if container is not None:
@@ -2545,9 +2572,8 @@ def handle_missing_properties_of_victim_target(identity_instance, victim_targeti
 
 
 def convert_victim_targeting(victim_targeting, ttp, env, ttps_generated):
-    identity_instance = convert_identity_for_victim_target(victim_targeting.identity, ttp, env, ttps_generated)
+    identity_instance = convert_identity_for_victim_target(victim_targeting, ttp, env, ttps_generated)
     info("%s generated an identity associated with a victim", 713, ttp.id_)
-    handle_missing_properties_of_victim_target(identity_instance, victim_targeting)
 
     if ttps_generated:
         marking_refs = create_marking_union(ttp, victim_targeting.identity)
@@ -2809,6 +2835,8 @@ def create_object_for_package_header(stix_package_header, env, type_of_obj):
     if hasattr(stix_package_header, "title") and stix_package_header.title is not None:
         sdo_instance["name"] = stix_package_header.title
     process_description_and_short_description(sdo_instance, stix_package_header)
+    if env.created_by_ref:
+        sdo_instance["created_by_ref"] = env.created_by_ref
     if type_of_obj == 'report':
         spec_version = get_option_value("spec_version")
         convert_controlled_vocabs_to_open_vocabs(sdo_instance,
diff --git a/stix2elevator/convert_to_acs.py b/stix2elevator/convert_to_acs.py
index 21ae7bb0..19b25fc1 100644
--- a/stix2elevator/convert_to_acs.py
+++ b/stix2elevator/convert_to_acs.py
@@ -166,9 +166,9 @@ def convert_control_set(control_set):
     return cs
 
 
-_ISA_IDENTIFIER_PREFIX = "isa:guide.19001.ACS3-"
+_ISA_IDENTIFIER_PREFIX = "^[iI][sS][aA]:[gG][uU][iI][dD][eE]\\.(19001|999191)\\.([0-9a-zA-z]+-)?"
 
-_UUID_RE = "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}"
+_UUID_RE = "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
 
 _ISA_IDENTIFIER_PATTERN = re.compile(_ISA_IDENTIFIER_PREFIX + _UUID_RE)
 
diff --git a/stix2elevator/extension_definitions.py b/stix2elevator/extension_definitions.py
index fa2110cd..7a4fe03c 100644
--- a/stix2elevator/extension_definitions.py
+++ b/stix2elevator/extension_definitions.py
@@ -1,40 +1,36 @@
-MITRE_COPYRIGHT_STATEMENT_DATA_MARKING = {
-    "created": "2020-12-22T00:00:00.000000Z",
-    "definition": {
-        "statement": "Copyright 2020 - The MITRE Corporation, Inc."
-    },
-    "definition_type": "statement",
-    "id": "marking-definition--3cd55916-d34b-4747-a8e0-dedec14b711b",
-    "spec_version": "2.1",
-    "type": "marking-definition"
-}
+# object found in STIX common object repository
+_MITRE_COPYRIGHT_STATEMENT_DATA_MARKING_ID = "marking-definition--3cd55916-d34b-4747-a8e0-dedec14b711b"
 
-MITRE_IDENTITY_OBJECT = {
+
+_MITRE_IDENTITY_OBJECT = {
     "created": "2020-12-22T00:00:00.000000Z",
     "id": "identity--659e8342-f720-4d0d-b193-6a04fdfbb401",
     "modified": "2020-12-22T00:00:00.000000Z",
     "name": "MITRE",
     "object_marking_refs": [
-        MITRE_COPYRIGHT_STATEMENT_DATA_MARKING["id"]
+        _MITRE_COPYRIGHT_STATEMENT_DATA_MARKING_ID
     ],
     "spec_version": "2.1",
     "type": "identity"
 }
 
+_EXTENSION_SCHEMA_URL = "https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/stix-1x" # noqa
+
+
 EXTENSION_DEFINITION_FOR_STIX_1_X = {
     "archive-file": {
         "id": "extension-definition--db4b5429-6927-4d0c-a194-4695f05c629a",
         "type": "extension-definition",
         "spec_version": "2.1",
-        "name": "Extension to support STIX 1.x archive-file",
-        "description": "This schema adds two properties to a STIX object",
+        "name": "Extension to support STIX 1.x/CybOX 2.1 archive-file",
+        "description": "This schema adds STIX 1.x/CybOX 2.1 archive-file properties not present in the STIX 2.1 archive-file object", # noqa
         "created": "2020-12-22T00:00:00.000000Z",
-        "modified": "2020-12-22T00:00:00.000000Z",
-        "created_by_ref": MITRE_IDENTITY_OBJECT["id"],
+        "modified": "2022-12-22T00:00:00.000000Z",
+        "created_by_ref": _MITRE_IDENTITY_OBJECT["id"],
         "object_marking_refs": [
-            MITRE_COPYRIGHT_STATEMENT_DATA_MARKING["id"]
+            _MITRE_COPYRIGHT_STATEMENT_DATA_MARKING_ID
         ],
-        "schema": "https://github.com/mitre/cti/extension-definitions/stix-1-archive-file/",
+        "schema": _EXTENSION_SCHEMA_URL,
         "version": "1.0.0",
         "extension_types": ["property-extension"]
     },
@@ -43,14 +39,14 @@
         "type": "extension-definition",
         "spec_version": "2.1",
         "name": "Extension to support STIX 1.x Attack Pattern",
-        "description": "This schema adds two properties to a STIX object",
+        "description": "This schema adds STIX 1.x TTP properties not present in the STIX 2.1 Attack Pattern object",  # noqa
         "created": "2020-12-22T00:00:00.000000Z",
-        "modified": "2020-12-22T00:00:00.000000Z",
-        "created_by_ref": MITRE_IDENTITY_OBJECT["id"],
+        "modified": "2022-12-22T00:00:00.000000Z",
+        "created_by_ref": _MITRE_IDENTITY_OBJECT["id"],
         "object_marking_refs": [
-            MITRE_COPYRIGHT_STATEMENT_DATA_MARKING["id"]
+            _MITRE_COPYRIGHT_STATEMENT_DATA_MARKING_ID
         ],
-        "schema": "https://github.com/mitre/cti/extension-definitions/stix-1-attack-pattern/",
+        "schema": _EXTENSION_SCHEMA_URL,
         "version": "1.0.0",
         "extension_types": ["property-extension"]
     },
@@ -59,14 +55,14 @@
         "type": "extension-definition",
         "spec_version": "2.1",
         "name": "Extension to support STIX 1.x Campaigns",
-        "description": "This schema adds two properties to a STIX object",
+        "description": "This schema adds STIX 1.x Campaign properties not present in the STIX 2.1 Campaign object",
         "created": "2020-12-22T00:00:00.000000Z",
-        "modified": "2020-12-22T00:00:00.000000Z",
-        "created_by_ref": MITRE_IDENTITY_OBJECT["id"],
+        "modified": "2022-12-22T00:00:00.000000Z",
+        "created_by_ref": _MITRE_IDENTITY_OBJECT["id"],
         "object_marking_refs": [
-            MITRE_COPYRIGHT_STATEMENT_DATA_MARKING["id"]
+            _MITRE_COPYRIGHT_STATEMENT_DATA_MARKING_ID
         ],
-        "schema": "https://github.com/mitre/cti/extension-definitions/stix-1-campaign/",
+        "schema": _EXTENSION_SCHEMA_URL,
         "version": "1.0.0",
         "extension_types": ["property-extension"]
     },
@@ -75,14 +71,14 @@
         "type": "extension-definition",
         "spec_version": "2.1",
         "name": "Extension to support STIX 1.x Courses of Action",
-        "description": "This schema adds two properties to a STIX object",
+        "description": "This schema adds STIX 1.x Courses of Action properties not present in the STIX 2.1 COA object",
         "created": "2020-12-22T00:00:00.000000Z",
-        "modified": "2020-12-22T00:00:00.000000Z",
-        "created_by_ref": MITRE_IDENTITY_OBJECT["id"],
+        "modified": "2022-12-22T00:00:00.000000Z",
+        "created_by_ref": _MITRE_IDENTITY_OBJECT["id"],
         "object_marking_refs": [
-            MITRE_COPYRIGHT_STATEMENT_DATA_MARKING["id"]
+            _MITRE_COPYRIGHT_STATEMENT_DATA_MARKING_ID
         ],
-        "schema": "https://github.com/mitre/cti/extension-definitions/stix-1-course-of-action/",
+        "schema": _EXTENSION_SCHEMA_URL,
         "version": "1.0.0",
         "extension_types": ["property-extension"]
     },
@@ -90,31 +86,15 @@
         "id": "extension-definition--0d4dda28-1b6c-446a-be85-38b9d9cd297c",
         "type": "extension-definition",
         "spec_version": "2.1",
-        "name": "Extension to support STIX 1.x email-message",
-        "description": "This schema adds two properties to a STIX object",
+        "name": "Extension to support STIX 1.x/CybOX 2.1 email-message",
+        "description": "This schema adds STIX 1.x/CybOX 2.1 Email Messages properties not present in the STIX 2.1 Email Message object", # noqa
         "created": "2020-12-22T00:00:00.000000Z",
-        "modified": "2020-12-22T00:00:00.000000Z",
-        "created_by_ref": MITRE_IDENTITY_OBJECT["id"],
-        "object_marking_refs": [
-            MITRE_COPYRIGHT_STATEMENT_DATA_MARKING["id"]
-        ],
-        "schema": "https://github.com/mitre/cti/extension-definitions/stix-1-email-message/",
-        "version": "1.0.0",
-        "extension_types": ["property-extension"]
-    },
-    "grouping": {
-        "id": "extension-definition--1db7034e-6002-43ea-902d-56ff9fccd2e3",
-        "type": "extension-definition",
-        "spec_version": "2.1",
-        "name": "Extension to support STIX 1.x STIX Header",
-        "description": "This schema adds one property to a STIX object",
-        "created": "2022-08-27T00:00:00.000000Z",
-        "modified": "2022-08-27T00:00:00.000000Z",
-        "created_by_ref": MITRE_IDENTITY_OBJECT["id"],
+        "modified": "2022-12-22T00:00:00.000000Z",
+        "created_by_ref": _MITRE_IDENTITY_OBJECT["id"],
         "object_marking_refs": [
-            MITRE_COPYRIGHT_STATEMENT_DATA_MARKING["id"]
+            _MITRE_COPYRIGHT_STATEMENT_DATA_MARKING_ID
         ],
-        "schema": "https://github.com/mitre/cti/extension-definitions/stix-1-stix-header/",
+        "schema": _EXTENSION_SCHEMA_URL,
         "version": "1.0.0",
         "extension_types": ["property-extension"]
     },
@@ -122,31 +102,31 @@
         "id": "extension-definition--6f6973cb-70be-40cb-b1ac-15ed78cebe56",
         "type": "extension-definition",
         "spec_version": "2.1",
-        "name": "Extension to support STIX 1.x Malware Instances",
-        "description": "This schema adds two properties to a STIX object",
+        "name": "Extension to support STIX 1.x/CybOX 2.1 Network Packet ICMP IPV4 properties",
+        "description": "This schema adds STIX 1.x/CybOX 2.1 Network Packet ICMP IPV4 properties in the STIX 2.x Network Traffic object", # noqa
         "created": "2020-12-22T00:00:00.000000Z",
-        "modified": "2020-12-22T00:00:00.000000Z",
-        "created_by_ref": MITRE_IDENTITY_OBJECT["id"],
+        "modified": "2022-12-22T00:00:00.000000Z",
+        "created_by_ref": _MITRE_IDENTITY_OBJECT["id"],
         "object_marking_refs": [
-            MITRE_COPYRIGHT_STATEMENT_DATA_MARKING["id"]
+            _MITRE_COPYRIGHT_STATEMENT_DATA_MARKING_ID
         ],
-        "schema": "https://github.com/mitre/cti/extension-definitions/stix-1-icmp-header/",
+        "schema": _EXTENSION_SCHEMA_URL,
         "version": "1.0.0",
         "extension_types": ["property-extension"]
     },
-    "identity": {
+    "victim": {
         "id": "extension-definition--8f0b8ed7-c7ad-4650-babe-c4c45cac4a0b",
         "type": "extension-definition",
         "spec_version": "2.1",
-        "name": "Extension to support STIX 1.x Identities",
-        "description": "This schema adds two properties to a STIX object",
+        "name": "Extension to support STIX 1.x Victim Targeting",
+        "description": "This schema adds STIX 1.x Victim Targeting properties not present in the STIX 2.1 Identity object",  # noqa
         "created": "2020-12-22T00:00:00.000000Z",
-        "modified": "2020-12-22T00:00:00.000000Z",
-        "created_by_ref": MITRE_IDENTITY_OBJECT["id"],
+        "modified": "2022-12-22T00:00:00.000000Z",
+        "created_by_ref": _MITRE_IDENTITY_OBJECT["id"],
         "object_marking_refs": [
-            MITRE_COPYRIGHT_STATEMENT_DATA_MARKING["id"]
+            _MITRE_COPYRIGHT_STATEMENT_DATA_MARKING_ID
         ],
-        "schema": "https://https://github.com/mitre/cti/extension-definitions/stix-1-identity/",
+        "schema": _EXTENSION_SCHEMA_URL,
         "version": "1.0.0",
         "extension_types": ["property-extension"]
     },
@@ -155,14 +135,14 @@
         "type": "extension-definition",
         "spec_version": "2.1",
         "name": "Extension to support STIX 1.x CIQ Identities",
-        "description": "This schema adds two properties to a STIX object",
+        "description": "This schema adds STIX 1.x CIQ Identity properties not present in the STIX 2.1 Identity object",
         "created": "2020-12-22T00:00:00.000000Z",
-        "modified": "2020-12-22T00:00:00.000000Z",
-        "created_by_ref": MITRE_IDENTITY_OBJECT["id"],
+        "modified": "2022-12-22T00:00:00.000000Z",
+        "created_by_ref": _MITRE_IDENTITY_OBJECT["id"],
         "object_marking_refs": [
-            MITRE_COPYRIGHT_STATEMENT_DATA_MARKING["id"]
+            _MITRE_COPYRIGHT_STATEMENT_DATA_MARKING_ID
         ],
-        "schema": "https://github.com/mitre/cti/extension-definitions/stix-1-identity-ciq/",
+        "schema": _EXTENSION_SCHEMA_URL,
         "version": "1.0.0",
         "extension_types": ["property-extension"]
     },
@@ -173,12 +153,12 @@
         "name": "Extension to support STIX 1.x Incident",
         "description": "This schema adds STIX 1.x Incident properties not present in the STIX 2.1 Incident stub object",
         "created": "2020-12-22T00:00:00.000000Z",
-        "modified": "2020-12-22T00:00:00.000000Z",
-        "created_by_ref": MITRE_IDENTITY_OBJECT["id"],
+        "modified": "2022-12-22T00:00:00.000000Z",
+        "created_by_ref": _MITRE_IDENTITY_OBJECT["id"],
         "object_marking_refs": [
-            MITRE_COPYRIGHT_STATEMENT_DATA_MARKING["id"]
+            _MITRE_COPYRIGHT_STATEMENT_DATA_MARKING_ID
         ],
-        "schema": "https://github.com/oasis-open/cti-stix-common-objects/blob/elevator-extensions/extension-definition-specifications/stix1x-incident/stix1x-incident.json",  # noqa
+        "schema": _EXTENSION_SCHEMA_URL,  # noqa
         "version": "1.0.0",
         "extension_types": ["property-extension"]
     },
@@ -187,30 +167,14 @@
         "type": "extension-definition",
         "spec_version": "2.1",
         "name": "Extension to support STIX 1.x Indicators",
-        "description": "This schema adds two properties to a STIX object",
-        "created": "2020-12-22T00:00:00.000000Z",
-        "modified": "2020-12-22T00:00:00.000000Z",
-        "created_by_ref": MITRE_IDENTITY_OBJECT["id"],
-        "object_marking_refs": [
-            MITRE_COPYRIGHT_STATEMENT_DATA_MARKING["id"]
-        ],
-        "schema": "https://github.com/mitre/cti/extension-definitions/stix-1-indicator/",
-        "version": "1.0.0",
-        "extension_types": ["property-extension"]
-    },
-    "information_source": {
-        "id": "extension-definition--58c914a2-0b19-4f62-8221-0af0b542e130",
-        "type": "extension-definition",
-        "spec_version": "2.1",
-        "name": "Extension to support STIX 1.x information_source",
-        "description": "This schema adds two properties to a STIX object",
+        "description": "This schema adds STIX 1.x Indicator properties not present in the STIX 2.1 Indicator object",
         "created": "2020-12-22T00:00:00.000000Z",
-        "modified": "2020-12-22T00:00:00.000000Z",
-        "created_by_ref": MITRE_IDENTITY_OBJECT["id"],
+        "modified": "2022-12-22T00:00:00.000000Z",
+        "created_by_ref": _MITRE_IDENTITY_OBJECT["id"],
         "object_marking_refs": [
-            MITRE_COPYRIGHT_STATEMENT_DATA_MARKING["id"]
+            _MITRE_COPYRIGHT_STATEMENT_DATA_MARKING_ID
         ],
-        "schema": "https://github.com/mitre/cti/extension-definitions/stix-1-information-source/",
+        "schema": _EXTENSION_SCHEMA_URL,
         "version": "1.0.0",
         "extension_types": ["property-extension"]
     },
@@ -219,14 +183,14 @@
         "type": "extension-definition",
         "spec_version": "2.1",
         "name": "Extension to support STIX 1.x Infrastucture",
-        "description": "This schema adds two properties to a STIX object",
+        "description": "This schema adds STIX 1.x TTP properties not present in the STIX 2.1 Infrastucture object",  # noqa
         "created": "2020-12-22T00:00:00.000000Z",
-        "modified": "2020-12-22T00:00:00.000000Z",
-        "created_by_ref": MITRE_IDENTITY_OBJECT["id"],
+        "modified": "2022-12-22T00:00:00.000000Z",
+        "created_by_ref": _MITRE_IDENTITY_OBJECT["id"],
         "object_marking_refs": [
-            MITRE_COPYRIGHT_STATEMENT_DATA_MARKING["id"]
+            _MITRE_COPYRIGHT_STATEMENT_DATA_MARKING_ID
         ],
-        "schema": "https://github.com/mitre/cti/extension-definitions/stix-1-infrastucture/",
+        "schema": _EXTENSION_SCHEMA_URL,
         "version": "1.0.0",
         "extension_types": ["property-extension"]
     },
@@ -235,14 +199,14 @@
         "type": "extension-definition",
         "spec_version": "2.1",
         "name": "Extension to support STIX 1.x Malware Instances",
-        "description": "This schema adds two properties to a STIX object",
+        "description": "This schema adds STIX 1.x TTP properties not present in the STIX 2.1 Malware object",  # noqa
         "created": "2020-12-22T00:00:00.000000Z",
-        "modified": "2020-12-22T00:00:00.000000Z",
-        "created_by_ref": MITRE_IDENTITY_OBJECT["id"],
+        "modified": "2022-12-22T00:00:00.000000Z",
+        "created_by_ref": _MITRE_IDENTITY_OBJECT["id"],
         "object_marking_refs": [
-            MITRE_COPYRIGHT_STATEMENT_DATA_MARKING["id"]
+            _MITRE_COPYRIGHT_STATEMENT_DATA_MARKING_ID
         ],
-        "schema": "https://github.com/mitre/cti/extension-definitions/stix-1-malware/",
+        "schema": _EXTENSION_SCHEMA_URL,
         "version": "1.0.0",
         "extension_types": ["property-extension"]
     },
@@ -250,31 +214,15 @@
         "id": "extension-definition--005e229c-fffc-42b0-a912-84671ab2829d",
         "type": "extension-definition",
         "spec_version": "2.1",
-        "name": "Extension to support STIX 1.x Malware Instances",
-        "description": "This schema adds two properties to a STIX object",
+        "name": "Extension to support STIX 1.x/CybOX 2.1 Network Sockets",
+        "description": "This schema adds STIX 1.x/CybOX 2.1 Network Sockets properties not present in the STIX 2.1 Network Traffic object", # noqa
         "created": "2020-12-22T00:00:00.000000Z",
         "modified": "2020-12-22T00:00:00.000000Z",
-        "created_by_ref": MITRE_IDENTITY_OBJECT["id"],
+        "created_by_ref": _MITRE_IDENTITY_OBJECT["id"],
         "object_marking_refs": [
-            MITRE_COPYRIGHT_STATEMENT_DATA_MARKING["id"]
+            _MITRE_COPYRIGHT_STATEMENT_DATA_MARKING_ID
         ],
-        "schema": "https://github.com/mitre/cti/extension-definitions/stix-1-network-socket/",
-        "version": "1.0.0",
-        "extension_types": ["property-extension"]
-    },
-    "report": {
-        "id": "extension-definition--faebed16-db10-4824-8538-62d9cd38b117",
-        "type": "extension-definition",
-        "spec_version": "2.1",
-        "name": "Extension to support STIX 1.x STIX Header",
-        "description": "This schema adds one property to a STIX object",
-        "created": "2022-08-27T00:00:00.000000Z",
-        "modified": "2022-08-27T00:00:00.000000Z",
-        "created_by_ref": MITRE_IDENTITY_OBJECT["id"],
-        "object_marking_refs": [
-            MITRE_COPYRIGHT_STATEMENT_DATA_MARKING["id"]
-        ],
-        "schema": "https://github.com/mitre/cti/extension-definitions/stix-1-stix-header/",
+        "schema": _EXTENSION_SCHEMA_URL,
         "version": "1.0.0",
         "extension_types": ["property-extension"]
     },
@@ -283,14 +231,14 @@
         "type": "extension-definition",
         "spec_version": "2.1",
         "name": "Extension to support STIX 1.x Threat Actors",
-        "description": "This schema adds two properties to a STIX object",
+        "description": "This schema adds STIX 1.x Threat Actor properties not present in the STIX 2.1 Threat Actor object",  # noqa
         "created": "2020-12-22T00:00:00.000000Z",
-        "modified": "2020-12-22T00:00:00.000000Z",
-        "created_by_ref": MITRE_IDENTITY_OBJECT["id"],
+        "modified": "2022-12-22T00:00:00.000000Z",
+        "created_by_ref": _MITRE_IDENTITY_OBJECT["id"],
         "object_marking_refs": [
-            MITRE_COPYRIGHT_STATEMENT_DATA_MARKING["id"]
+            _MITRE_COPYRIGHT_STATEMENT_DATA_MARKING_ID
         ],
-        "schema": "https://github.com/mitre/cti/extension-definitions/stix-1-threat-actor/",
+        "schema": _EXTENSION_SCHEMA_URL,
         "version": "1.0.0",
         "extension_types": ["property-extension"]
     },
@@ -299,14 +247,14 @@
         "type": "extension-definition",
         "spec_version": "2.1",
         "name": "Extension to support STIX 1.x Tools",
-        "description": "This schema adds two properties to a STIX object",
+        "description": "This schema adds STIX 1.x Tool properties not present in the STIX 2.1 Tool object",  # noqa
         "created": "2020-12-22T00:00:00.000000Z",
-        "modified": "2020-12-22T00:00:00.000000Z",
-        "created_by_ref": MITRE_IDENTITY_OBJECT["id"],
+        "modified": "2022-12-22T00:00:00.000000Z",
+        "created_by_ref": _MITRE_IDENTITY_OBJECT["id"],
         "object_marking_refs": [
-            MITRE_COPYRIGHT_STATEMENT_DATA_MARKING["id"]
+            _MITRE_COPYRIGHT_STATEMENT_DATA_MARKING_ID
         ],
-        "schema": "https://github.com/mitre/cti/extension-definitions/stix-1-tool/",
+        "schema": _EXTENSION_SCHEMA_URL,
         "version": "1.0.0",
         "extension_types": ["property-extension"]
     },
@@ -317,12 +265,12 @@
         "name": "Extension to support STIX 1.x Vulnerabilities",
         "description": "This schema adds two properties to a STIX object",
         "created": "2020-12-22T00:00:00.000000Z",
-        "modified": "2020-12-22T00:00:00.000000Z",
-        "created_by_ref": MITRE_IDENTITY_OBJECT["id"],
+        "modified": "2022-12-22T00:00:00.000000Z",
+        "created_by_ref": _MITRE_IDENTITY_OBJECT["id"],
         "object_marking_refs": [
-            MITRE_COPYRIGHT_STATEMENT_DATA_MARKING["id"]
+            _MITRE_COPYRIGHT_STATEMENT_DATA_MARKING_ID
         ],
-        "schema": "https://github.com/mitre/cti/extension-definitions/stix-1-vulnerabilities/",
+        "schema": _EXTENSION_SCHEMA_URL,
         "version": "1.0.0",
         "extension_types": ["property-extension"]
     }
diff --git a/stix2elevator/missing_policy.py b/stix2elevator/missing_policy.py
index f6ecc2a6..5bcf2b6e 100644
--- a/stix2elevator/missing_policy.py
+++ b/stix2elevator/missing_policy.py
@@ -35,8 +35,19 @@ def convert_to_custom_name(name, separator="_"):
 
 
 def remove_custom_name(name, separator="_"):
-    prefix = "x" + separator + get_option_value("custom_property_prefix") + separator
-    return name[len(prefix):]
+    if name.startswith("x"):
+        prefix = "x" + separator + get_option_value("custom_property_prefix") + separator
+        return name[len(prefix):]
+    else:
+        return name
+
+
+def do_vocab_mapping(prop_values_as_string, mapping):
+    if prop_values_as_string in mapping:
+        # conversion in mapping
+        return mapping[prop_values_as_string]
+    else:
+        return convert_to_stix_literal(prop_values_as_string)
 
 
 def add_string_property_to_description(sdo_instance, property_name, property_value, is_list=False):
@@ -55,40 +66,41 @@ def add_string_property_to_description(sdo_instance, property_name, property_val
     warn("Appended %s to description of %s", 302, property_name, sdo_instance["id"])
 
 
-def add_string_property_as_custom_property(sdo_instance, property_name, property_value, is_list=False):
+def add_string_property_as_custom_property(sdo_instance, property_name, property_value, is_list, is_literal, mapping):
     if is_list:
-        property_values = list()
-        for v in property_value:
-            property_values.append(str(v))
-        sdo_instance[convert_to_custom_name(property_name)] = property_values
+        if is_literal:
+            property_values = list()
+            for v in property_value:
+                prop_value_as_string = str(v)
+                property_values.append(do_vocab_mapping(prop_value_as_string, mapping))
+            sdo_instance[convert_to_custom_name(property_name)] = property_values
+        else:
+            sdo_instance[convert_to_custom_name(property_name)] = [str(v) for v in property_value]
     else:
-        sdo_instance[convert_to_custom_name(property_name)] = str(property_value)
+        prop_value_as_string = str(property_value)
+        if is_literal:
+            sdo_instance[convert_to_custom_name(property_name)] = do_vocab_mapping(prop_value_as_string, mapping)
+        else:
+            sdo_instance[convert_to_custom_name(property_name)] = prop_value_as_string
     warn("Used custom property for %s", 308, property_name + (" of " + sdo_instance["id"] if "id" in sdo_instance else ""))
 
 
 def add_string_property_as_extension_property(container, property_name, property_value, sdo_id, is_list=False, is_literal=False, mapping={}):
     if is_list:
         if is_literal:
-            container[property_name] = []
+            container[property_name] = list()
             for v in property_value:
-                v_as_string = str(v)
-                if v_as_string in mapping:
-                    # conversion in mapping
-                    container[property_name].append(mapping[v_as_string])
-                else:
-                    container[property_name].append(convert_to_stix_literal(v_as_string))
+                prop_value_as_string = str(v)
+                container[property_name].append(do_vocab_mapping(prop_value_as_string, mapping))
         else:
             container[property_name] = [str(v) for v in property_value]
     else:
-        prop_values_as_string = str(property_value)
+        prop_value_as_string = str(property_value)
         if is_literal:
-            if prop_values_as_string in mapping:
-                container[property_name] = mapping[prop_values_as_string]
-            else:
-                container[property_name] = convert_to_stix_literal(prop_values_as_string)
+            container[property_name] = do_vocab_mapping(prop_value_as_string, mapping)
         else:
-            container[property_name] = prop_values_as_string
-    warn("Used extension property for %s", 313, property_name + (" of " + sdo_id if sdo_id else ""))
+            container[property_name] = prop_value_as_string
+    warn("Used an extension property for %s", 313, property_name + (" of " + sdo_id if sdo_id else ""))
 
 
 def handle_missing_string_property(container, property_name, property_value, sdo_id, is_list=False, is_sco=False, is_literal=False, mapping={}):
@@ -100,7 +112,7 @@ def handle_missing_string_property(container, property_name, property_value, sdo
             else:
                 add_string_property_to_description(container, property_name, property_value, is_list)
         elif check_for_missing_policy("use-custom-properties"):
-            add_string_property_as_custom_property(container, property_name, property_value, is_list)
+            add_string_property_as_custom_property(container, property_name, property_value, is_list, is_literal, mapping)
         elif check_for_missing_policy("use-extensions"):
             add_string_property_as_extension_property(container, property_name, property_value, sdo_id, is_list, is_literal, mapping)
         else:
@@ -142,7 +154,7 @@ def add_confidence_property_as_extension_property(container, confidence, id, par
         container[prefix + "confidence"] = str(confidence.value)
     if confidence.description is not None:
         container[prefix + "confidence_description"] = str(confidence.description)
-    warn("Used extensions properties for Confidence type content of %s", 313, id)
+    warn("Used an extensions properties for Confidence type content of %s", 313, id)
 
 
 def handle_missing_confidence_property(container, confidence, id, parent_property_name=None):
@@ -232,7 +244,6 @@ def statement_type_as_extension_properties(container, statement, property_name,
         info("Source property in STIX 1.x statement is not handled, yet.", 815)
     if statement.confidence:
         add_confidence_property_as_extension_property(map, statement.confidence, property_name, id)
-    converted_value = None
     if statement.value:
         value_as_string = str(statement.value)
         if is_literal:
@@ -242,13 +253,10 @@ def statement_type_as_extension_properties(container, statement, property_name,
                 converted_value = convert_to_stix_literal(value_as_string)
         else:
             converted_value = value_as_string
-    if map:
         if converted_value:
             map["value"] = converted_value
+    if not map == dict():
         container[property_name] = [map] if is_list else map
-    else:
-        if converted_value:
-            container[property_name] = [converted_value] if is_list else converted_value
 
 
 def handle_missing_statement_properties(container, statement, property_name, id, is_list=False, is_literal=True, mapping=None):
diff --git a/stix2elevator/stix_stepper.py b/stix2elevator/stix_stepper.py
index 60300088..afb08fb3 100644
--- a/stix2elevator/stix_stepper.py
+++ b/stix2elevator/stix_stepper.py
@@ -124,17 +124,37 @@ def step_observable_data(observed_data):
     return scos
 
 
+def determine_extension_name(stix_object):
+    if ("extensions" in stix_object and
+        "archive-ext" in stix_object["extensions"] and
+        "version" in stix_object["extensions"]["archive-ext"]):
+        # handle special case, where version is in archive-ext in 2.0, but not in 2.1
+        return "archive-file"
+    obj_type = stix_object["type"]
+    for key in stix_object.keys():
+        if key.startswith("x_"):
+            if key in ["x_elevator_targeted_information", "x_elevator_targeted_system"]:
+                return "victim"
+    return obj_type
+
+
 def step_to_extensions(stix_object):
-    custom_properties = []
+    custom_properties = {}
     for key in stix_object.keys():
         if key.startswith("x_"):
-            custom_properties.append(key)
-    container, extension_definition_id = determine_container_for_missing_properties(stix_object["type"],
+            custom_properties[key] = stix_object
+        elif ("extensions" in stix_object and
+              "archive-ext" in stix_object["extensions"] and
+              "version" in stix_object["extensions"]["archive-ext"]):
+            # handle special case, where version is in archive-ext in 2.0, but not in 2.1
+            custom_properties["version"] = stix_object["extensions"]["archive-ext"]
+            break
+    container, extension_definition_id = determine_container_for_missing_properties(determine_extension_name(stix_object),
                                                                                     stix_object)
     if container is not None:
-        for key in custom_properties:
-            key_value = stix_object[key]
-            stix_object.pop(key)
+        for key, location in custom_properties.items():
+            key_value = location[key]
+            location.pop(key)
             container[remove_custom_name(key)] = key_value
         fill_in_extension_properties(stix_object, container, extension_definition_id)
 
@@ -228,6 +248,11 @@ def step_object(stix_object):
         step_confidence_property(stix21_obj)
         if contains_custom_properties(stix21_obj):
             step_to_extensions(stix21_obj)
+        elif (stix21_obj["type"] == "file" and "extensions" in stix21_obj and
+                 "archive-ext" in stix21_obj["extensions"] and
+                 "version" in stix21_obj["extensions"]["archive-ext"]):
+            # handle special case, where version is in archive-ext in 2.0, but not in 2.1
+            step_to_extensions(stix21_obj)
     return stix21_objs
 
 
diff --git a/stix2elevator/utils.py b/stix2elevator/utils.py
index cefeace1..21f7ca1c 100644
--- a/stix2elevator/utils.py
+++ b/stix2elevator/utils.py
@@ -88,7 +88,7 @@ def map_vocabs_to_label(t, vocab_map):
         return canonicalize_label(t)
 
 
-def convert_controlled_vocabs_to_open_vocabs(new_obj, new_property_name, old_vocabs, vocab_mapping, only_one, required=True):
+def convert_controlled_vocabs_to_open_vocabs(new_obj, new_property_name, old_vocabs, vocab_mapping, only_one, required=True, add=False):
     if not old_vocabs and required:
         if only_one:
             new_obj[new_property_name] = "unknown"
@@ -96,7 +96,10 @@ def convert_controlled_vocabs_to_open_vocabs(new_obj, new_property_name, old_voc
             new_obj[new_property_name] = ["unknown"]
         warn("No STIX 1.x vocab value given for %s, using 'unknown'", 509, new_property_name)
     else:
-        values = []
+        if add:
+            values = new_obj[new_property_name]
+        else:
+            values = []
         for t in old_vocabs:
             if values is None or not only_one:
                 if isinstance(t, (str, bytes)):
diff --git a/stix2elevator/vocab_mappings.py b/stix2elevator/vocab_mappings.py
index 18afaece..b06a8891 100644
--- a/stix2elevator/vocab_mappings.py
+++ b/stix2elevator/vocab_mappings.py
@@ -75,7 +75,10 @@
 
 ROLES_MAP = \
     {
-
+        "Initial Author": "initial-author",
+        "Content Enhancer/Refiner": "content-enhancer-refiner",
+        "Aggregator": "aggregator",
+        "Transformer/Translator": "transformer-translator"
     }
 
 SECTORS_MAP = \
@@ -209,6 +212,13 @@
         "Malware Samples": "malware-samples",
     }
 
+CAMPAIGN_STATUS_MAP = \
+    {
+        "Future": "future",
+        "Historic": "historic",
+        "Ongoing": "ongoing"
+    }
+
 # CybOX
 
 WINDOWS_PEBINARY = \


Test patch:
diff --git a/idioms-json-2.0-custom/snort-test-mechanism.json b/idioms-json-2.0-custom/snort-test-mechanism.json
index fbbc7e15..ef8deb8f 100644
--- a/idioms-json-2.0-custom/snort-test-mechanism.json
+++ b/idioms-json-2.0-custom/snort-test-mechanism.json
@@ -12,7 +12,8 @@
             "id": "vulnerability--e77c1e36-5b43-4c5c-b8cb-7b36035f2b90",
             "modified": "2014-06-20T15:16:56.986Z",
             "name": "Heartbleed",
-            "type": "vulnerability"
+            "type": "vulnerability",
+            "x_elevator_published_datetime": "2013-09-18T00:00:00.000000Z"
         },
         {
             "created": "2014-06-20T15:16:56.987Z",
diff --git a/idioms-json-2.0/snort-test-mechanism.json b/idioms-json-2.0/snort-test-mechanism.json
index b0af81d0..5f851c0c 100644
--- a/idioms-json-2.0/snort-test-mechanism.json
+++ b/idioms-json-2.0/snort-test-mechanism.json
@@ -3,6 +3,7 @@
     "objects": [
         {
             "created": "2017-01-27T13:49:54.310Z",
+            "description": "\n\nPUBLISHED_DATETIME:\n\t2013-09-18T00:00:00.000000Z",
             "external_references": [
                 {
                     "external_id": "CVE-2013-3893",
diff --git a/idioms-json-2.1-custom/snort-test-mechanism.json b/idioms-json-2.1-custom/snort-test-mechanism.json
index 75332061..b4e47fd4 100644
--- a/idioms-json-2.1-custom/snort-test-mechanism.json
+++ b/idioms-json-2.1-custom/snort-test-mechanism.json
@@ -13,7 +13,8 @@
       "modified": "2017-01-27T13:49:54.310Z",
       "name": "Heartbleed",
       "spec_version": "2.1",
-      "type": "vulnerability"
+      "type": "vulnerability",
+      "x_elevator_published_datetime": "2013-09-18T00:00:00.000000Z"
     },
     {
       "confidence": 85,
diff --git a/idioms-json-2.1-extensions/snort-test-mechanism.json b/idioms-json-2.1-extensions/snort-test-mechanism.json
index 7c2b5b2e..65f7b3bb 100644
--- a/idioms-json-2.1-extensions/snort-test-mechanism.json
+++ b/idioms-json-2.1-extensions/snort-test-mechanism.json
@@ -3,6 +3,12 @@
     "objects": [
         {
             "created": "2014-06-20T15:16:56.986Z",
+            "extensions": {
+                "extension-definition--ac577b78-8356-41e0-bc5a-2cd3e5c17b2c": {
+                    "extension_type": "property-extension",
+                    "published_datetime": "2013-09-18T00:00:00.000000Z"
+                }
+            },
             "external_references": [
                 {
                     "external_id": "CVE-2013-3893",
diff --git a/idioms-json-2.1/snort-test-mechanism.json b/idioms-json-2.1/snort-test-mechanism.json
index 75332061..2d77e0f5 100644
--- a/idioms-json-2.1/snort-test-mechanism.json
+++ b/idioms-json-2.1/snort-test-mechanism.json
@@ -3,6 +3,7 @@
   "objects": [
     {
       "created": "2017-01-27T13:49:54.310Z",
+      "description": "\n\nPUBLISHED_DATETIME:\n\t2013-09-18T00:00:00.000000Z",
       "external_references": [
         {
           "external_id": "CVE-2013-3893",
diff --git a/idioms-xml/snort-test-mechanism.xml b/idioms-xml/snort-test-mechanism.xml
index 74be736a..5a954eb8 100644
--- a/idioms-xml/snort-test-mechanism.xml
+++ b/idioms-xml/snort-test-mechanism.xml
@@ -62,6 +62,7 @@
             <et:Title>Heartbleed</et:Title>
             <et:Vulnerability>
                 <et:CVE_ID>CVE-2013-3893</et:CVE_ID>
+                <et:Published_DateTime>2013-09-18T00:00:00Z</et:Published_DateTime>
             </et:Vulnerability>
         </stixCommon:Exploit_Target>
     </stix:Exploit_Targets>
diff --git a/stix2elevator/test/test_idioms.py b/stix2elevator/test/test_idioms.py
index d0a42686..c54eeccb 100644
--- a/stix2elevator/test/test_idioms.py
+++ b/stix2elevator/test/test_idioms.py
@@ -37,12 +37,15 @@ def idiom_elevator_mappings(before_file_path, stored_json, version, missing_poli
     """Test fresh conversion from XML to JSON matches stored JSON samples."""
     print("Checking - " + before_file_path)
     print("With Master - " + stored_json["id"])
+    validator_args = "--version " + version
+    if missing_policy == "use-extensions":
+        validator_args += " -s extension-definition-schemas -v --no-cache"
 
     initialize_options(options={"spec_version": version,
                                 "missing_policy": missing_policy,
                                 "log_level": "WARN",
                                 "incidents": True,
-                                "validator_args": "--version " + version})
+                                "validator_args": validator_args})
     if not get_option_value("policy") == "no_policy":
         print("'no_policy' is the default for testing")
     set_option_value("policy", "no_policy")