STIX[TM] Version 1.2.1. Part 7: Threat Actor Committee Specification Draft 01 06 November 2015 Specification URIs This version: (Authoritative) Previous version: N/A Latest version: (Authoritative) Technical Committee: Chair: Richard Struse (), Editors: Sean Barnum (), Desiree Beck (), Aharon Chernin (), Rich Piazza (), Additional artifacts: This prose specification is one component of a Work Product that also includes: STIX Version 1.2.1. Part 1: Overview. STIX Version 1.2.1. Part 2: Common. STIX Version 1.2.1. Part 3: Core. STIX Version 1.2.1. Part 4: Indicator. STIX Version 1.2.1. Part 5: TTP. STIX Version 1.2.1. Part 6: Incident. STIX Version 1.2.1. Part 7: Threat Actor (this document). STIX Version 1.2.1. Part 8: Campaign. STIX Version 1.2.1. Part 9: Course of Action. STIX Version 1.2.1. Part 10: Exploit Target. STIX Version 1.2.1. Part 11: Report. STIX Version 1.2.1. Part 12: Default Extensions. STIX Version 1.2.1. Part 13: Data Marking. STIX Version 1.2.1. Part 14: Vocabularies. STIX Version 1.2.1. Part 15: UML Model. UML Serialization: Related work: This specification replaces or supersedes: STIXTM 1.2 Threat Actor Specification (v1.2).
STIX[TM] Threat Actor Data Model The primary class of the STIX Threat Actor package is the ThreatActorType class, which characterizes a cyber threat actor including their identity, sophistication, presumed intent, historically observed behavior (TTPs), and campaigns or other threat actors they are believed to be associated with. Similar to the primary classes of all of the component data models in STIX, the ThreatActorType class extends a base class defined in the STIX Common data model; more specifically, it extends the ThreatActorBaseType base class, which provides the essential identifier (id) and identifier reference (idref) properties. This relationship between the ThreatActorType class and the ThreatActorBaseType base class, as well as the properties of the ThreatActorType class, are illustrated in the UML diagram given in Figure 31. Figure 31. UML diagram of the ThreatActorType The property table, which includes property descriptions and corresponds to the UML diagram given in Figure 31 is provided in Table 31. All classes defined in the Threat Actor data model are described in detail in Section 3.1 through Section 3.4. Details are not provided for classes defined in non-Threat Actor data models; instead, the reader is referred to the corresponding data model specification as indicated by the package prefix specified in the Type column of the table. Table 31. Properties of the ThreatActorType class Name Type Multiplicity Description version ThreatActorVersionType 0..1 The version property specifies the version number of the STIX Threat Actor data model for STIX v1.2.1 used to capture the information associated with the Threat Actor. Title basicDataTypes: BasicString 0..1 The Title property captures a title for the Threat Actor and reflects what the content producer thinks the Threat Actor as a whole should be called. The Title property is typically used by humans to reference a particular Threat Actor; however, it is not suggested for correlation. Description stixCommon: 0..* The Description property captures a textual description of the Threat Actor. Any length is