However, we thought that using a wide variety of verb phrases might confuse a reader of a specification document because the meaning of each verb could be interpreted slightly differently. One the other hand, we didn’t want to use a single, generic verb, such as “describes,” because although the different verb choices may or may not be meaningful from an implementation standpoint, a distinction could be useful to those interested in the modeling aspect of STIX. Consequently, we have chosen to use the verbs, defined as follows, in class and property descriptions: Verb STIX Definition captures Used to record and preserve information without implying anything the structure of a class or property. Often used for properties that encompass general content. This is the least precise of the three verbs. Examples: The Source property characterizes the source of the sighting information. Examples of details captured include identitifying characteristics, time-related attributes, and a list of the tools used to collect the information. The Description property captures a textual description of the Indicator. characterizes Describes the distinctive nature or features of a class or property. Often used to describe classes and properties that themselves comprise one or more other properties. Examples: The Confidence property characterizes the level of confidence in the accuracy of the overall content captured in the Incident. The ActivityType class characterizes basic information about an activity a defender might use in response to a Campaign. specifies Used to clearly and precisely identify particular instances or values associated with a property. Often used for properties that are defined by a controlled vocabulary or enumeration; typically used for properties that take on only a single value. Example: The version property specifies the version identifier of the STIX Campaign data used to capture the information associated with the Campaign. Terminology The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in [RFC2119]. Normative References [RFC2119] Bradner, S., “Key words for use in RFCs to Indicate Requirement Levels”, BCP 14, RFC 2119, March 1997. .
Table . Properties of the HeaderType class Name Type Multiplicity Description Title basicDataTypes:BasicString 0..1 The Title property captures a title for the Report and reflects what the content producer thinks the Report as a whole should be called. The Title property is typically used by humans to reference a particular Report; however, it is not suggested for correlation. Intent stixCommon: VocabularyStringType 0..* The Intent property specifies the intended purpose(s) or use(s) for the Report. Examples of potential purposes are collective threat intelligence, campaign characterization and malware samples (these specific values are only provided to help explain the property: they are neither recommended types nor necessarily part of any existing vocabulary). The content creator may choose any arbitrary value or may constrain the set of possible values by referencing an externally-defined vocabulary or leveraging a formally defined vocabulary extending from the stixCommon:ControlledVocabularyStringType class. The STIX default vocabulary class for use in this property is 'ReportIntentVocab-1.0'. Description stixCommon: StructuredTextType 0..* The Description property captures a textual description of the Report. Any length is permitted. Optional formatting is supported via the structuring_format property of the StructuredTextType class. Short_Description stixCommon: StructuredTextType 0..* The Short_Description property captures a short textual description of the Report. This property is secondary and should only be used if the Description property is already populated and another, shorter description is available. Handling marking:MarkingType 0..1 The Handling property specifies the appropriate data handling markings for the properties of this Report. The marking is limited to the Report and the content it contains. Note that data handling markings can also be specified at a higher level.
The property table of the TTPsType class is given in Table 35. . Properties of the TTPsType class Name Type Multiplicity Description TTP stixCommon:TTPBaseType 0..* The TTP property characterizes a cyber threat adversary Tactic, Technique or Procedure (TTP). The stixCommon:TTPBaseType class is a minimal base class that is intended to be extended. The default and strongly recommended class to fully implement a TTP is the ttp:TTPType class defined in . Base classes are used to minimize interdependence between STIX components, not to enable or encourage conflicting syntactic variation. However, through the use of the idref property, a reference to a TTP defined elsewhere can be specified via the direct use of the stixCommon:TTPBaseType class. IncidentsType Class The IncidentsType class specifies a set of one or more cyber threat Incidents. The properties of the IncidentsType class are given in Table 36. Table . Properties of the IncidentsType class Name Type Multiplicity Description Incident stixCommon:IncidentBaseType 1..* The Incident property characterizes a cyber threat Incident. The stixCommon:IncidentBaseType class is a minimal base class that is intended to be extended. The default and strongly recommended class to fully implement an Incident is the incident:IncidentType class defined in . Base classes are used to minimize interdependence between STIX components, not to enable or encourage conflicting syntactic variation. However, through the use of the idref property, a reference to an Incident defined elsewhere can be specified via the direct use of the stixCommon:IncidentBaseType class.
However, through the use of the idref property, a reference to a Campaign defined elsewhere can be specified via the direct use of the stixCommon:CampaignBaseType class. ThreatActorsType Class The ThreatActorsType class specifies a set of one or more cyber Threat Actors. The property table of the ThreatActorsType class is given in Table 39. . Properties of the ThreatActorsType class Name Type Multiplicity Description Threat_Actor stixCommon:ThreatActorBaseType 1..* The ThreatActor property characterizes a cyber Threat Actor. The stixCommon:ThreatActorBaseType class is a minimal base class that is intended to be extended. The default and strongly recommended class to fully implement an ThreatActor is the ta:ThreatActorType class defined in . Base classes are used to minimize interdependence between STIX components, not to enable or encourage conflicting syntactic variation. However, through the use of the idref property, a reference to a Threat Actor defined elsewhere can be specified via the direct use of the stixCommon:ThreatActorBaseType class. RelatedReportsType The RelatedReportsType class specifies a set of one or more STIX Reports related to this STIX Report and therefore is a self-referential relationship. It extends the GenericRelationshipListType superclass defined in the STIX Common data model, which specifies the scope (whether the elements of the set are related individually or as a group). The UML diagram corresponding to the RelatedReportsType is shown in Figure 32. Figure . UML diagram showing the use of the RelatedReportsType class Table 310 shows the properties of the RelatedReportsType specialization and is associated with the UML diagram in Figure 32.