“A(1)|B(0..1)” will indicate that the API_Call property can be chosen with multiplicity 1 or the Code property can be chosen with multiplicity 0 or 1. Property and Class Descriptions Each class and property defined in STIX is described using the format, “The X property verb Y.” For example, in the specification for the STIX Indicator, we write, “The id property specifies a globally unique identifier for the kill chain instance.” In fact, the verb “specifies” could have been replaced by any number of alternatives: “defines,” “describes,” “contains,” “references,” etc. However, we thought that using a wide variety of verb phrases might confuse a reader of a specification document because the meaning of each verb could be interpreted slightly differently. On the other hand, we didn’t want to use a single, generic verb, such as “describes,” because although the different verb choices may or may not be meaningful from an implementation standpoint, a distinction could be useful to those interested in the modeling aspect of STIX. Consequently, we have chosen to use the verbs, defined as follows, in class and property descriptions: Verb STIX Definition captures Used to record and preserve information without implying anything about the structure of a class or property. Often used for properties that encompass general content. This is the least precise of the three verbs. Examples: The Source property characterizes the source of the sighting information. Examples of details captured include identitifying characteristics, time-related attributes, and a list of the tools used to collect the information. The Description property captures a textual description of the Indicator. characterizes Describes the distinctive nature or features of a class or property. Often used to describe classes and properties that themselves comprise one or more other properties. Examples: The Confidence property characterizes the level of confidence in the accuracy of the overall content captured in the Incident. The ActivityType characterizes basic information about an activity a defender might use in response to a Campaign. specifies Used to clearly and precisely identify particular instances or values associated with a property. Often used for properties that are defined by a controlled vocabulary or enumeration; typically used for properties that take on only a single value. Example: The version property specifies the version identifier of the STIX Campaign data model used to capture the information associated with the Campaign.
External_ID ExternalIDType 0..* The External_ID property captures an identifier for the Incident managed in an external non-STIX system. Time TimeType 0..1 The Time property specifies a variety of time values associated with the Incident (e.g., the time the Incident was officially opened). Description stixCommon: StructuredTextType 0..* The Description property captures a textual description of the Incident. Any length is permitted. Optional formatting is supported via the structuring_format property of the StructuredTextType class. Short_Description stixCommon: StructuredTextType 0..* The Short_Description property captures a textual description of the Incident. This property is secondary and should only be used if the Description property is already populated and another, shorter description is available. Categories CategoriesType 0..1 The Categories property specifies a set of categorization labels for the Incident. Reporter stixCommon: InformationSourceType 0..1 The Reporter property characterizes the entity that reported the Incident. Responder stixCommon: InformationSourceType 0..* The Responder property characterizes the entity playing the role of the responder for the Incident. Coordinator stixCommon: InformationSourceType 0..* The Coordinator property characterizes the entity playing the role of coordinator for the Incident. Victim stixCommon: IdentityType 0..* The Victim property chracterizes information about a victim of the Incident. For situations calling for more than a simple name, the underlying class may be extended using a more complete structure such as the CIQIdentity3.0InstanceType subclass as defined in . Affected_Assets AffectedAssetsType 0..1 The Affected_Assets property characterizes the assets affected during the Incident. Impact_Assessment ImpactAssessmentType 0..1 The Impact_Assessment property characterizes an assessment of impact for the Incident.
History HistoryType 0..1 The History property captures a log of events or actions during the handling of the Incident. Information_Source stixCommon: InformationSourceType 0..1 The Information_Source property characterizes the source of the Incident information. Examples of details captured include identitifying characteristics, time-related attributes, and a list of tools used to collect the information. Handling marking:MarkingType 0..1 The Handling property specifies the appropriate data handling markings for the properties of this Incident. The marking scope is limited to the Incident and the content is contains. Note that data handling markings can also be specified at a higher level. Related_Packages stixCommon: RelatedPackageRefsType 0..1 The Related_Packages property specifies a set of one or more STIX Packages that are related to the Incident. IncidentVersionType Enumeration The IncidentVersionType enumeration is an inventory of all versions of the Incident data for STIX Version 1.2.1. The enumeration literals are given in Table 32. Table 32. Literals of the IncidentVersionType enumeration Enumeration Literal Description stix-1.2.1 Incident data model for STIX v1.2.1 ExternalIDType The ExternalIDType provides a reference to an ID of an incident in a remote system. The properties of the ExternalIDType class are given in Table 33. 33. Properties of the ExternalIDType class
class. The STIX default vocabulary class for use in the property is ‘LocationClassVocab-1.0.’ Location stixCommon: AddressAbstractType 0..1 The Location property characterizes the actual physical location of the affected asset. The underlying abstract class MUST be extended. The default and strongly RECOMMENDED subclass is CIQAddressInstanceType, as defined in . Nature_Of_Security_Effect NatureOfSecurityEffectType 0..1 The Nature_Of_Security_Effect property characterizes how the security properties of the asset were affected. Structured_Description cybox:ObservablesType 0..1 The Structured_Description property characterizes the through specification of a structured cyber Observables instance. AssetTypeType The AssetTypeType class characterizes the type of the Affected Asset. Examples of asset types are directory, firewall, PBX and cashier (these specific values are only provided to help explain the property: they are neither recommended values nor necessarily part of any existing vocabulary). The content creator may choose any arbitrary value or may constrain the set of possible values by referencing an vocabulary or leveraging a formally defined vocabulary extending from the stixCommon:ControlledVocabularyStringType class. The STIX default vocabulary class for use in this property is 'AssetTypeVocab-1.0'. The property of the AssetTypeType class is given in Table 38. 38. Properties of the AssetTypeType class Name Type Multiplicity Description count_affected basicDataTypes:Integer 0..1 The count_affected property specifies the number of assets of this type affected in the Incident. NatureOfSecurityEffectType The NatureOfSecurityEffectType class specifies a set of zero or more security properties affected by the Incident. The property of the NatureOfSecurityEffectType class is given in Table 39.
Table 39. Properties of the NatureOfSecurityEffectType class Name Type Multiplicity Description Property_Affected PropertyAffectedType 0..* The Property_Affected property characterizes how a particular security property of the was affected. PropertyAffectedType Class The PropertyAffectedType class characterizes aspects of how security properties of an asset, such as Availability, Confidentiality, etc., were affected in this Incident. The properties of the PropertyAffectedType class are given in Table 310. 310. Properties of the PropertyAffectedType class Name Type Multiplicity Description Property stixCommon: VocabularyStringType 0..1 The Property property specifies the security property that was affected by the incident. Examples of potential security properties are confidentiality, integrity and availability specific values are only provided to help explain the property: they are neither recommended values nor necessarily part of any existing vocabulary). The content creator may choose any arbitrary value or may constrain the set of possible values by referencing an externally-defined vocabulary or leveraging a formally defined vocabulary extending from the stixCommon:ControlledVocabularyStringType class. The STIX default vocabulary class for use in the property is ‘LossPropertyVocab-1.0.’ Description_Of_Effect stixCommon: StructuredTextType 0..* The Description_Of_Effect property captures a textual description of how the security property was affected. Any length is permitted. Optional formatting is supported via the structuring_format property of the StructuredTextType
defined vocabulary extending from the stixCommon:ControlledVocabularyStringType class. The STIX default vocabulary class for use in the Non_Public_Data_Compromised property is ‘SecurityCompromiseVocab-1.0’. NonPublicDataCompromisedType Class The NonPublicDataCompromisedType class represents whether non-public data was compromised or exposed and whether that data was encrypted or not. Table 311. Properties of the NonPublicCompromisedType class Name Type Multiplicity Description data_encrypted basicDataTypes: Boolean 0..1 The data_encrypted property specifies whether the data that was compromised was encrypted or not. ImpactAssessmentType Class The ImpactAssessmentType class characterizes a summary assessment of impact for this cyber threat Incident. The UML diagram corresponding to the ImpactAssessmentType class is shown in Figure 33. Figure 34. UML diagram of the ImpactAssessmentType class The property tables given in Table 312, Table 313, Table 315, Table 316, Table 317 and Table 318 all correspond to the UML diagram shown in Figure 34. Table 312. Properties of the ImpactAssessmentType class Name Type Multiplicity Description
explain the property: they are neither recommended values nor necessarily part of any existing vocabulary). The content creator may choose any arbitrary value or may constrain the set of possible values by referencing an externally-defined vocabulary or leveraging a formally defined vocabulary extending from the stixCommon:ControlledVocabularyStringType class. The STIX default vocabulary class for use in this property is ‘SecurityCompromiseVocab-1.0’. TotalLossEstimationType Class The TotalLossEstimationType class characterizes both the initial reported and actual estimated financial losses for this Incident. 315. Properties of the TotalLossEstimationType class Name Type Multiplicity Description Initial_Reported_Total_Loss_Estimation LossEstimationType 0..1 The Initial_Reported_Total_Loss_Estimation property specifies the initially reported level of total estimated financial loss for the Incident. Actual_Total_Loss_Estimation LossEstimationType 0..1 The Actual_Total_Loss_Estimation property specifies the actual level of total estimated financial loss for the Incident. LossEstimationType Class The LossEstimationType class characterizes an estimated financial loss. 316. Properties of the LossEstimationType class Name Type Multiplicity Description amount basicDataTypes:Decimal 0..1 The amount property specifies the estimated financial loss for the Incident. iso_currency_code basicDataTypes: NoEmbeddedQuotesString 0..1 The iso_currency_code property specifies the ISO 4217 currency code if other than USD.