Normative References [RFC2119] Bradner, S., “Key words for use in RFCs to Indicate Requirement Levels”, BCP 14, RFC 2119, March 1997. . [RFC4648] Josefsson, S., “The Base16, Base32, and Base64 Data Encodings”, RFC 4648, October 2006.
Name Type Multiplicity Description id basicDataTypes:QualifiedName 0..1 The id property specifies a globally unique identifier for the Campaign instance. basicDataTypes:QualifiedName 0..1 The idref property specifies an identifier reference to a Campaign instance specified elsewhere. When the idref property is used, no properties other than idref and timestamp should be specified. timestamp basicDataTypes:DateTime 0..1 The timestamp property specifies the definition time of a specific version of a Campaign. When used in conjunction with the id property, it specifies the definition time for the specific version of the Campaign instance; when used in conjunction with the idref property, it specifies the definition time for a specific version of a Campaign instance defined elsewhere. The timestamp property has no defined semantic meaning if it is used without either the id or idref property. CourseOfActionBaseType The CourseOfActionBaseType class is intended to be extended by a subclass, which characterizes a course of action. The decision to define base classes that are extended – like the CourseOfActionBaseType class – was made to minimize interdependence between STIX components; it was not made to enable structural variation. The default and strongly RECOMMENDED subclass to extend the CourseOfActionBaseType class is the CourseOfActionType class in the Course of Action data model (see ). The one case where the class SHOULD NOT be extended is when the CourseOfActionBaseType class is used as a reference via its idref property. The property table of the CourseOfActionBaseType base class are given in Table 32. Table 32. Properties of the CourseOfActionBaseType base class Name Type Multiplicity Description id basicDataTypes:QualifiedName 0..1 The id property specifies a globally unique identifier for the Course of Action instance.
structure such as the CIQIdentity3.0InstanceType subclass as defined . Through the use of the idref property, a reference to an Identity defined elsewhere can be specified via the direct use of the IdentityType class. RelatedIncidentType Class The RelatedIncidentType class characterizes a relationship to an Incident. It extends the GenericRelationshipType superclass by specifying a related Incident. The UML diagram corresponding to the RelatedIncidentType class is shown in Figure 38. Figure 38. UML diagram of the RelatedIncidentType class The property table given in Table 316 corresponds to the UML diagram shown in Figure 38. Table 316. Properties of the RelatedIncidentType class Name Type Multiplicity Description Incident IncidentBaseType 1 The Incident property characterizes a cyber threat Incident. The IncidentBaseType class is a minimal base class that is intended to be extended. The default and strongly RECOMMENDED class to fully implement an Incident is the incident:IncidentType class defined in . Base classes are used to minimize interdependence between STIX components, not to enable or encourage conflicting syntactic variation. Through the use of the idref property, a reference to an Incident defined elsewhere can be specified via the direct use of the IncidentBaseType class. RelatedIndicatorType Class The RelatedIndicatorType characterizes a relationship to an Indicator. It extends the GenericRelationshipType superclass by specifying a related Indicator. The UML diagram corresponding to the RelatedIndicatorType class is shown in Figure 39.
Figure 39. UML diagram of the RelatedIndicatorType The property table given in Table 317 corresponds to the UML diagram shown in Figure 39. Table 317. Properties of the RelatedIndicatorType class Name Type Multiplicity Description Indicator IndicatorBaseType 1 The Indicator property characterizes a cyber threat Indicator. The IndicatorBaseType class is a minimal base class that is intended to be extended. The default and strongly RECOMMENDED class to fully implement an Indicator is the indicator:IndicatorType class defined in . Base classes are used to minimize interdependence between STIX components, not to enable or encourage conflicting syntactic variation. Through the use of the idref property, a reference to an Indicator defined elsewhere can be specified via the direct use of the IndicatorBaseType class. RelatedObservableType Class The RelatedObservableType class characterizes a relationship to a CybOX Observable. It extends the GenericRelationshipType superclass by specifying a related Observable. The UML diagram corresponding to the RelatedObservableType class is shown in Figure 310. Figure 310. UML diagram of the RelatedObservableType class The property table given in Table 318 corresponds to the UML diagram shown in Figure 310. Table 318. Properties of the RelatedObservableType class Name Type Multiplicity Description Observable cybox_core:ObservableType 1 The Observable property characterizes the related cyber observable.
defined elsewhere can be specified via the direct use of the ThreatActorBaseType class. RelatedTTPType Class The RelatedTTPType class characterizes a relationship to a TTP. It extends the GenericRelationshipType superclass by specifying a related TTP. The UML diagram corresponding to the RelatedTTPType class is shown in Figure 314. Figure 314. UML diagram of the RelatedTTPType class The property given in Table 322 corresponds to the UML diagram shown in Figure 314. Table 322. Properties of the RelatedTTPType class Name Type Multiplicity Description TTP TTPBaseType 1 The TTP property characterizes a cyber threat adversary Tactic, Technique or Procedure (TTP). The TTPBaseType class is a minimal base class that is intended to be extended. The default and strongly RECOMMENDED class to fully implement a TTP is the ttp:TTPType class defined in . Base classes are used to minimize interdependence between STIX components, not to enable or encourage conflicting syntactic variation. Through the use of the idref property, a reference to a TTP defined elsewhere can be specified via the direct use of the TTPBaseType class. Content Aggregation Classes A content aggregation class captures a collection of one (or zero, in some cases) or more STIX objects. Some content aggregation classes are very straightforward and simply capture a set of objects. However, others such as the GenericRelationshipListType abstract class are intended to be extended (see Section 3.3.1). GenericRelationshipListType The GenericRelationshipListType class specifies how the relationships between a subject STIX construct and a set of one or more other STIX constructs should be interpreted. It is an abstract class, and it MUST be extended via a subclass to characterize the actual set of related constructs.
Classes that extend the GenericRelationshipListType class are used to explicitly represent the one-to-many relationship between constructs. In this way, the model enables the ability to express a property of the set itself. Currently, the only property defined is the scope of the relationship – whether the elements of the set are related individually or as a group. Examples of STIX classes that extend the GenericRelationshipListType class include the AttributeType class defined in the Campaign data model, the RelatedIndicatorsType class in the Incident data model, and the ExploitTargetsType class defined in the TTP data model (to name just a few). An explicit example is given in Figure 315, which illustrates how the GenericRelationshipListType class can be extended by the RelatedIndicatorsType class to associate a set of Indicators to an Incident. Figure 315. Example extension of the GenericRelationshipListType class The property table given in Table 323 corresponds to the UML diagram shown in Figure 315. Table 323. Properties of the GenericRelationshipListType class Name Type Multiplicity Description scope RelationshipScopeEnum 0..1 The scope property specifies how the set of relationships should be interpreted. Potential values are specified by the ScopeEnum enumeration. If 'inclusive' is specified, then a single conceptual relationship is being defined between the subject construct and the combined collection of related constructs. If 'exclusive' is specified (the default), then multiple relationships are being defined beween the subject construct and each individual related construct. ConfidenceAssertionChainType Class The ConfidenceAssertionChainType class specifies a set of one or more related confidence levels in an assertion. The property table of the ConfidenceAssertionChainType class is given in Table 324. Table 324. Properties of the ConfidenceAssertionChainType class Name Type Multiplicity Description Confidence_Assertion ConfidenceType 1..* The Confidence_Assertion property characterizes confidence in an assertion.
ReferencesType Class The ReferencesType specifies a set of one or more references. The property table of the ReferencesType class is given in Table 329. Table 329. Properties of the ReferencesType class Name Type Multiplicity Description Reference basicDataTypes:URI 1..* The Reference property specifies a reference associated with the data entry using a Uniform Resource Identifier (URI). RelatedIdentitiesType Class The RelatedIdentitiesType class specifies a set of one or more identities. The property table of the RelatedIdentitiesType class is given Table 330. Table 330. Properties of the RelatedIdentitiesType class Name Type Multiplicity Description Related_Identity RelatedIdentityType 1..* The Related_Identity property specifies a related identity associated with the data entry using a Uniform Resource Identifier (URI). RelatedPackageRefsType Class The RelatedPackageRefsType class specifies a set of zero or more references to a related STIX Package. The property table of the RelatedPackageRefsType class is given in Table 331. Table 331. Properties of the RelatedPackageRefsType class Name Type Multiplicity Description
name basicDataTypes: NoEmbeddedQuoteString 0..1 The name property captures a simple name for the kill chain definition. definer basicDataTypes: NoEmbeddedQuoteString 0..1 The definer property specifies the organization or individual responsible for the kill chain definition. reference basicDataTypes:URI 0..1 The reference property specifies a reference associated with the kill using a Uniform Resource Identifier (URI). number_of_phases basicDataTypes:Integer 0..1 The number_of_phases property specifies the number of phases in the kill chain. Kill_Chain_Phase KillChainPhaseType 1..* The Kill_Chain_Phase property characterizes an individual within the kill chain. KillChainPhaseType Class A cyber kill chain is a phase-based model to describe the stages of an attack, and a cyber kill chain phase is an individual phase within a kill chain definition. The Kill_Chain_Phase property characterizes an individual phase within a kill chain. The property table of the KillChainPhaseType class is given in Table 334. Table 334. Properties of the KillChainPhaseType class Name Type Multiplicity Description phase_id basicDataTypes: QualifiedName 0..1 The phase_id property specifies a globally unique identifier for the kill chain phase. When used within a kill chain definition (defined by the KillChainType class), it identifies the kill chain phase being defined. When used within a kill chain reference (defined by the KillChainPhaseReferenceType class), it must reference an existing kill chain phase_id property (note that this use is similar to the use of the idref property elsewhere in STIX.) name basicDataTypes: NoEmbeddedQuoteString 0..1 The name property captures a descriptive name of the kill chain phase. If the KillChainPhaseType class is extended by the KillChainPhaseReferenceType class, this attribute SHOULD be omitted, or if it is present, it MUST match the kill chain phase name used in the referenced kill chain.
leveraging a formally defined vocabulary extending from the ControlledVocabularyStringType class. The STIX default vocabulary class for use in the property is ‘HighMediumLowVocab-1.0.’ Description StructuredTextType 0..* The Description property captures a textual description of the confidence assertion. Any length is permitted. Optional formatting is supported via the structuring_format property of the StructuredTextType Source InformationSourceType 0..1 The Source property characterizes the organization or tool that is the source of the confidence assertion. Examples of details captured include identitifying characteristics, time-related attributes, and a list of the tools used to collect the information. Confidence_Assertion_Chain ConfidenceAssertionChainType 0..1 The Confidence_Assertion_Chain property specifies a set of one or more related confidence assertions. IdentityType Class The IdentityType class characterizes identity information for both individuals and organizations. The IdentityType class is intended to be extended via a subclass to capture the structured descriptions of identity information for both individuals and organizations. STIX v1.2.1 defines a default extension to the IdentityType class to leverage the OASIS Customer Information Quality (CIQ) data model, which is a set of XML specifications for representing characteristic information about individuals and organizations (see ). The property table of the IdentityType class is given in Table 339. Table 339. Properties of the IdentityType class Name Type Multiplicity Description id basicDataTypes:QualifiedName 0..1 The id property specifies a globally unique identifier for the identity. basicDataTypes:QualifiedName 0..1 The idref property specifies a globally unique identifier for an identity specified elsewhere. When the idref property is used, the id property MUST NOT also be specified and the other
properties of the IdentityType class SHOULD NOT hold any content. Name basicDataTypes:BasicString 0..1 The Name property captures a simple name for the identity. Related_Identities RelatedIdentitiesType 0..1 The Related_Identities property specifies a set of one or more identities related to this identify. InformationSourceType Class The InformationSourceType class specifies source information for the given STIX content. The property table of the InformationSourceType class is given in Table 340. Table 340. Properties of the InformationSourceType class Name Type Multiplicity Description Description StructuredTextType 0..* The Description property captures a textual description of the information source. Any length is permitted. Optional formatting is supported via the structuring_format property of the StructuredTextType Identity IdentityType 0..1 The Identity property characterizes the identity of the information source. For situations calling for more than a simple name, the underlying class may be extended using a more complete structure such as the CIQIdentity3.0InstanceType subclass as defined in . Role VocabularyStringType 0..* The Role property specifies a role played by the information source. Examples of potential roles include initial author, aggregator, and transformer/translator (these specific values are only provided to help explain the property: they are neither recommended values nor necessarily part of any existing vocabulary). The content creator may choose any arbitrary value or may constrain the set of possible values by referencing an externally-defined vocabulary or leveraging a formally defined vocabulary extending from the ControlledVocabularyStringType class. The STIX default
vocabulary class for use in the property is ‘InformationSourceRoleVocab-1.0.’ Contributing_Sources ContributingSourcesType 0..1 The Contributing_Sources property specifies a set of zero or more individual sources contributing to the STIX content. Note that this property captures secondary sources of information. Time TimeType 0..1 The Time property characterizes the time-related attributes of the STIX content. Tools ToolsInformationType 0..1 The Tools property specifies a set of one or more tools contributing to the STIX content. References ReferencesType 0..1 The References property specifies a set of one or more references to information source material related to the STIX content. StatementType Class The StatementType characterizes a statement associated with STIX content. The UML diagram corresponding to the StatementType class is shown in Figure 318. Figure 318. UML diagram of the StatementType The property table given in Table 341 corresponds to the UML diagram shown in Figure 318. Table 341. Properties of the StatementType class Name Type Multiplicity Description timestamp basicDataTypes:DateTime 0..1 The timestamp property specifies the date and time of the statement. To avoid ambiguity, all timestamps SHOULD include a specification of the time zone. timestamp_precision DateTimePrecisionEnum 0..1 The timestamp_precision property specifies the granularity with the timestamp property should be considered, as specified by the DateTimePrecisionEnum enumeration (e.g., 'hour,' 'minute'). If omitted, the default precision is ‘second.’ Digits