STIX[TM] Campaign Data Model The primary of the STIX Campaign package is the CampaignType class, which characterizes a cyber threat campaign by capturing an asserted relationship between the threat actors who are involved, the TTPs used, and the incidents that comprise parts of the campaign in addition to other intrinsic properties. Similar to the primary classes of all of the component data models in STIX, the CampaignType class extends a base class defined in the STIX Common data model; more specifically, it extends the CampaignBaseType base class, which provides the essential identifier (id) and identifier reference (idref) properties. The relationship between the CampaignType and the CampaignBaseType base class, as well as the properties of the CampaignType class, are illustrated in the UML diagram given in Figure 31. Figure . UML diagram of the CampaignType The property table, which includes property descriptions and corresponds to the UML diagram given in Figure 31, is provided in Table 31. All classes defined in the Campaign data model are described in detail in Sections 3.1 through 3.7. Details are not provided for classes defined in data models; instead, the reader is refered to the corresponding data model specification as indicated by the package prefix specified in the Type column of the table. Table . Properties of the CampaignType class Name Type Multiplicity Description version CampaignVersionType 0..1 The version property specifies the version number of the STIX Campaign data model for STIX v1.2.1 used to capture the information associated with the Campaign. Title basicDataTypes:BasicString 0..1 The Title property captures a title for the Campaign and reflects what the content producer thinks the Campaign as a whole should be called. The Title property is typically used by humans to reference a particular Campaign; however, it is not suggested for correlation. Description stixCommon:StructuredTextType 0..* The Description property captures a textual description of the Campaign. Any length is permitted. Optional formatting is
stixCommon:ControlledVocabularyStringType class. The STIX default vocabulary class for use in the property is ‘CampaignStatusVocab-1.0’. Related_TTPs RelatedTTPsType 0..1 The Related_TTPs property specifies a set of one or more TTPs leveraged within the Campaign (or in some way related to a Campaign). Related_Incidents RelatedIncidentsType 0..1 The RelatedIncidents property specifies a set of one or more Incidents that are part of the Campaign (or in some way related to the Campaign). Related_Indicators RelatedIndicatorsType 0..1 The Related_Indicators property specifies a set of one or more Indicators relevant to the Campaign. Note: as discussed in Section 3.5, this property is deprecated and is planned for removal in STIX Campaign Version 2.0. Attribution AttributionType 0..* The Attribution property specifies attribution information in the form of a set of one or more Threat Actors who are asserted to be responsible for the Campaign. Multiple groups can be captured by defining multiple Attribution elements. Associated_Campaigns AssociatedCampaignsType 0..1 The Associated_Campaigns property specifies a set of one or more Campaigns related to this Campaign. Confidence stixCommon:ConfidenceType 0..1 The Confidence property characterizes the level of confidence in the accuracy of the collection of information captured for the Campaign. Activity stixCommon:ActivityType 0..* The Activity property characterizes a defender activity associated with the Campaign. Its underlying abstract must be extended to include the chosen format of activity characterization. Information_Source stixCommon: InformationSourceType 0..1 The Information_Source property characterizes the source of the Campaign information. Examples of details captured include identitifying characteristics, time-related attributes, and a list of the tools used to collect the information. Handling marking:MarkingType 0..1 The Handling property specifies data handling markings for the properties of this Campaign. The marking scope is limited to the
campaign and the content it contains. Note that data handling markings can also be specified at a higher level. Related_Packages stixCommon: RelatedPackagesRefsType 0..1 The Related_Packages property specifies a set of one or more STIX Packages that are related to the Campaign. DEPRECATED: This property is deprecated and will be removed in the next major version of STIX. Its use is strongly discouraged except for legacy applications. CampaignVersionType Enumeration The CampaignVersionType enumeration is an inventory of all versions of the Campaign data model for STIX Version 1.2.1. The enumeration literals are given in Table 32. Table . Literals of the CampaignVersionType enumeration Enumeration Literal Description stix-1.2.1 Campaign data model for STIX v1.2.1 NamesType Class The NamesType class specifies a set of one or more names used to identify the Campaign. Note that an equivalent NamesType class is defined in the STIX Common data model; this duplication is due to backward-compatiblity issues and will be corrected in the next major release of STIX. At that time, the campaign:NamesType class will be removed, and Campaign names will be defined via the stixCommon:NamesType class. The property of the NamesType class is shown in Table 33. Table . Properties of the NamesType class Name Type Multiplicity Description Name stixCommon: VocabularyStringType 1..* The Name property is used to specify a single name or alias that identifies the Campaign. The content creator may choose any arbitrary value or may constrain the set of possible values by referencing an externally-defined vocabulary or leveraging a formally defined vocabulary extending from the