supported via the structuring_format property of the StructuredTextType class. Short_Description stixCommon: StructuredTextType 0..* The Short_Description property captures a textual description of the Indicator. This property is secondary and should only be used if the Description property is already populated and another, shorter description is available. Valid_Time_Position ValidTimeType 0..* The Valid_Time_Position property specifies the time window for which this Indicator is valid. IndicatorExpression basicDataTypes: PatternExpression 0..1 The IndicatorExpression property characterizes an observable pattern associated with the Indicator. The basicDataTypes:PatternExpression class is a UML interface, which can be realized using either the cybox:ObservableType class (see ) or the CompositeIndicatorExpressionType class (see below for more details). Indicated_TTP stixCommon:RelatedTTPType 0..* The Indicated_TTP property specifies a TTP indicated by the presence of the observable pattern within this Indicator and characterizes the relationship between the TTP and the Indicator by capturing information such as the of confidence that the observable pattern indicates the TTP, the source of the relationship information, and the type of relationship. Kill_Chain_Phases stixCommon: KillChainPhasesReferenceType 0..1 The Kill_Chain_Phases property specifies a set of one or more kill chain phases (from one or more kill chains defined elsewere) relevant to the Indicator. The kill chain property is further defined in the STIX Common specification document. For more details on the cyber kill chain see . Test_Mechanisms TestMechanismsType 0..1 The Test_Mechanisms property specifies a set of one or more test mechanisms effective at identifying the Observable patterns characterized in the Indicator. Likely_Impact stixCommon:StatementType 0..1 The Likely_Impact property characterizes the probable impact if the TTP indicated by the presence of the indicator pattern were to which includes a Value property that
The properties of the ValidTimeType are given in Table 33. 33. Properties of the ValidTimeType class Name Type Multiplicity Description Start_Time stixCommon: DateTimeWithPrecisionType 0..1 The Start_Time property specifies the beginning of the temporal window in which an Indicator is able to accurately detect the TTP. To avoid ambiguity, timestamps SHOULD include a specification of the time zone. In addition to capturing a date and time, the Start_Time property MAY also capture a precision property to specify the granularity with which the time should be considered, as specified by the DateTimePrecisionEnum enumeration (e.g., 'hour,' 'minute'). If the Start_Time property is not present, then there is no constraint on the earliest time for which the Indicator is able to accurately detect the TTP (i.e., the temporal window is only bounded by the End_Time property, if present). End_Time stixCommon: DateTimeWithPrecisionType 0..1 The End_Time property specifies the end of the temporal window in which an Indicator is able to accurately detect the TTP. To avoid ambiguity, timestamps SHOULD include a specification of the time zone. In addition to capturing a date and time, the End_Time property MAY also capture a precision property to specify the granularity with which the time should be considered, as specified by the DateTimePrecisionEnum enumeration (e.g., 'hour,' 'minute'). If the End_Time property is not present, then there is no constraint on the latest time for which the Indicator is able to accurately detect the TTP (i.e., the temporal window is only bounded by the Start_Time property, if present). CompositeIndicatorExpressionType Class The CompositeIndicatorExpressionType class characterizes a composite Indicator expression through the specification of a single operator (the operator of the expression) and zero or more Indicators (the operands of the expression). The properties of the CompositeIndiatorExpressionType class are given in Table 34. It should be noted that each simple Indicator can “trigger” individually and independently of whether a related composite Indicator triggers. A composite Indicator will trigger only when the full specified logic on the set of individual Indicators that it comprises triggers.
Table 34. Properties of the CompositeIndicatorExpressionType class Name Type Multiplicity Description operator OperatorTypeEnum 1 The operator property specifies the logical composition operator for the composite Indicator expression. The enumeration that defines valid operators in the Indicator v2.2 data model contains the operators AND and OR. Indicator IndicatorType 0..* The Indicator property characterizes a cyber threat indicator by capturing an asserted relationship between a pattern identifying certain observable conditions and a particular TTP likely in play if those observable conditions are seen, as well as contextual information about how and when it should be acted on and how it relates to other Indicators, Campaigns, and TTPs. OperatorTypeEnum Enumeration The OperatorTypeEnum enumeration is an inventory of valid operators for the CompositeIndicatorExpressionType class, which is used to define a compound Indicator expression. The enumeration literals are given in Table 35. Table 35. Literals of the OperatorTypeEnum enumeration Enumeration Literals Description AND Logical AND operator OR Logical OR operator TestMechanismsType Class A test mechanism is an alternative (non-CybOX) method of expressing an observable pattern; examples include Snort rules, Yara rules, and OVAL definitions. Test mechanisms may be provided by content producers to support consumers who rely on the relevant underlying tools and methods in their operations. An Indicator may contain both a CybOX-based Observable pattern (or a Composite Indicator Expression) and one or more semantically equivalent test mechanisms where equivalency means that the test mechanisms trigger on the same conditions as the Observable (note that this equivalency is not enforced by STIX). Just as an Indicator may contain an Observable or Composite Indicator without a test mechanism, it is also possible for an Indicator to contain one or more test mechanisms without containing an Observable or Composite
Related_Campaign stixCommon: RelatedCampaignReferenceType 1..* The Related_Campaign property specifies a Campaign for the Indicator may be relevant. Unlike most other relationships that are defined in STIX, the underlying RelatedCampaignReferencesType class does not allow a Campaign to be embedded; an already-defined Campaign MUST be specified by its Name property and/or a reference to its identifier. The relationship between the Indicator and the Campaign is characterized by capturing information such as the level of confidence that the Indicator and the Campaign are related, the source of the relationship information, and the type of the relationship.