STIX[TM] Report Data Model The primary class of the STIX Report package is the ReportType class, which defines a contextual wrapper for a grouping of STIX content. Similar to the primary classes of all of the component data models in STIX, the ReportType class extends a base class defined in the STIX Common data model; more specifically, it extends the ReportBaseType base class, which provides the essential identifier (id) and identifier reference (idref) properties. The relationship between the ReportType and the ReportBaseType base class, as well as the properties of the ReportType class, are illustrated in the UML diagram given in Figure 31 on page 14. The property table, which includes property descriptions and corresponds to the UML diagram given in Figure 31, is provided in Table 31. All classes defined in the Report data model are described in detail in Sections 3.2 and 3.3. Details are not provided for classes defined in non-Report data models; instead, the reader is refered to the corresponding data model specification as indicated by the package prefix specified in the Type column of the table. Figure 31. UML diagram of the ReportType class Table 31. Properties of the ReportType class Name Type Multiplicity Description version ReportVersionEnum 0..1 The version property specifies the version number of the STIX Report data model for STIX v1.2.1 used to capture the information associated with the Report. Header HeaderType 0..1 The Header property characterizes the contextual information for this grouping of STIX content. Observables cybox:ObservablesType 0..1 The Observables property specifies a set of one or more observables. Indicators IndicatorsType 0..1 The Indicators property specifies a set of one or more cyber threat Indicators. TTPs TTPsType 0..1 The TTPs property specifies a set of one or more cyber threat adversary Tactics, Techniques or Procedures.
Exploit_Targets stixCommon:ExploitTargetsType 0..1 The Exploit_Targets property specifies a set of one or more potential targets for exploitation. Incidents IncidentsType 0..1 The Incidents property specifies a set of one or more cyber threat Incidents. Courses_Of_Action CoursesOfActionType 0..1 The Courses_Of_Action property specifies a set of one or more Courses of Action to be taken in regards to one of more cyber threats. Campaigns CampaignsType 0..1 The Campaigns property specifies a set of one or more threat Campaigns. Threat_Actors ThreatActorsType 0..1 The Threat_Actors property specifies a set of one or more cyber Threat Actors. Related_Reports RelatedReportsType 0..1 The Related_Reports property specifies a set of one or more other Reports related to this Report. ReportVersionEnum Enumeration The ReportVersionEnum enumeration is an inventory of all versions of the Report data model for STIX version 1.2.1. The enumeration literals are given in Table 32. 32. Literals of the ReportVersionEnum enumeration Enumeration Literal Description stix-1.2.1 Report data for STIX v1.2.1 HeaderType Class The HeaderType provides a structure for characterizing the contextual information of a Report. The property of the HeaderType class is given in Table 33. Table 33. Properties of the HeaderType class
Name Type Multiplicity Description Title basicDataTypes:BasicString 0..1 The Title property captures a title for the Report and reflects what the content producer thinks the Report as a whole should be called. The Title property is typically used by humans to reference a particular Report; however, it is not suggested for correlation. Intent stixCommon: VocabularyStringType 0..* The Intent property specifies the intended purpose(s) or use(s) for the Report. Examples of potential purposes are collective threat intelligence, campaign characterization and malware samples (these specific values are only provided to help explain the property: they are neither recommended types nor necessarily part of any existing vocabulary). The content creator may choose any arbitrary value or may constrain the set of possible values by referencing an externally-defined vocabulary or leveraging a formally defined vocabulary extending from the stixCommon:ControlledVocabularyStringType class. The STIX default vocabulary class for use in this property is 'ReportIntentVocab-1.0'. Description stixCommon: StructuredTextType 0..* The Description property captures a textual description of the Report. Any length is permitted. Optional formatting is supported via the structuring_format property of the StructuredTextType class. Short_Description stixCommon: StructuredTextType 0..* The Short_Description property captures a short textual description of the Report. This property is secondary and should only be used if the Description property is already populated and another, shorter description is available. Handling marking:MarkingType 0..1 The Handling property specifies the appropriate data handling markings for the properties of this Report. The marking scope is limited to the Report and the content it contains. Note that data handling markings can also be specified at a higher level. Information_Source stixCommon: InformationSourceType 0..1 The Information_Source property characterizes the source of the Report and all of its contained information unless that information specifies a different source. Examples of details
captured include identitifying characteristics, time-related attributes, and a list of the tools used to collect the information. Content Aggregation Each component type has an associated aggregation class that has one main property – a set of instances of that component type whether directly specified or included via reference. The aggregation class for Observables, cybox_core:ObservablesType, is defined in the . IndicatorsType Class The IndicatorsType class specifies a set of one or more cyber threat Indicators. The properties of the IndicatorsType class are given in Table 34. Table 34. Properties of the IndicatorsType class Name Type Multiplicity Description Indicator stixCommon:IndicatorBaseType 1..* The Indicator property characterizes a threat Indicator. The stixCommon:IndicatorBaseType class is a minimal base class that is intended to be extended. The default and strongly recommended class to fully implement an Indicator is the indicator:IndicatorType class defined in . Base classes are used to minimize interdependence between STIX components, not to enable or encourage conflicting syntactic variation. However, through the use of the idref property, a reference to an Indicator defined elsewhere can be specified via the direct use of the stixCommon:IndicatorBaseType class. TTPsType Class The TTPsType class specifies a set of zero or more cyber threat TTPs. The property table of the TTPsType class is given in Table 35. Table 35. Properties of the TTPsType class
Name Type Multiplicity Description TTP stixCommon:TTPBaseType 0..* The TTP property characterizes a threat adversary Tactic, Technique or Procedure (TTP). The stixCommon:TTPBaseType class is a minimal base class that is intended to be extended. The default and strongly recommended class to fully implement a TTP is the ttp:TTPType class defined in . Base classes are used to minimize interdependence between STIX components, not to enable or encourage conflicting syntactic variation. However, through the use of the idref property, a reference to a TTP defined elsewhere can be specified via the direct use of the stixCommon:TTPBaseType class. IncidentsType Class The IncidentsType class specifies a set of one or more cyber threat Incidents. The properties of the IncidentsType class are given in Table 36. Table 36. Properties of the IncidentsType class Name Type Multiplicity Description Incident stixCommon:IncidentBaseType 1..* The Incident property characterizes a cyber threat Incident. The stixCommon:IncidentBaseType class is a minimal base class that is intended to be extended. The default and strongly recommended class to fully implement an Incident is the incident:IncidentType class defined in . Base classes are used to minimize interdependence between STIX components, not to enable or encourage conflicting syntactic variation. However, through the use of the idref property, a reference to an Incident defined elsewhere can be specified via the direct use of the stixCommon:IncidentBaseType class. CoursesOfActionType Class The CoursesOfActionType class specifies a set of one or more actions that could be taken in regard to cyber threats. The properties of the CoursesOfActionType class are given in Table 37.