created_by_ref must result in the JSON key name "created_by_ref". Properties marked required in the property tables MUST be present in the JSON serialization. Reserved Names Reserved property names are marked with a type called RESERVED and a description text of “RESERVED FOR FUTURE USE”. Any property name that is marked as RESERVED MUST NOT be present in STIX content conforming to this version of the specification. Conventions Conventions All type property names and literals are in lowercase, except when referencing canonical names defined in another standard (e.g. literal values from an IANA registry). Words in property names are separated with an underscore (_), while words in type names and string enumerations are separated with a hyphen (-). All type names, property names, object names, and vocabulary terms are between three and 250 characters long. Font Colors and Style The following color, font and font style conventions are used in this document: The Consolas font is used for all type names, property names and literals. type are in red with a light red background – threat-actor property names are in bold style – created_at literals (values) are in blue with a blue background – malicious-activity All relationship types are string literals, therefore they will also appear in blue with a blue background – related-to In an object's property if a common property is being redefined in some way, then the background is dark grey. All examples in this document are expressed in JSON. They are in Consolas 9-point font, with straight quotes, black text and a light grey background, and 2-space indentation. Parts of the example may be omitted for conciseness and clarity. These omitted parts are denoted with the ellipses (...). The term “hyphen” is used throughout this document to refer to the ASCII hyphen or minus character, which in Unicode is “hyphen-minus”, U+002D. ​
Common Relationships duplicate-of, derived-from, related-to Source Name Target Description — — — — Examples Observed Data of a File object { "type": "observed-data", "id": "observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf", "created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff", "created": "modified": "2016-04-06T19:58:16.000Z", "first_observed": "2015-12-21T19:00:00Z", "last_observed": "2015-12-21T19:00:00Z", "number_observed": 50, "objects": { "0": { "type": "file", ... } } } Type Name: report Reports are collections of threat intelligence focused on one or more topics, such as a description of a threat actor, malware, or attack technique, including context and related details. They are used to group related threat intelligence together so that it can be published as a comprehensive cyber threat story. The Report SDO contains a list of references to SDOs and SROs (the CTI objects included in the report) along with a textual description and the name of the report. For example, a threat report produced by ACME Defense Corp. discussing the Glass Gazelle campaign should be represented using Report. The Report itself would contain the narrative of the report while the Campaign SDO and any related SDOs (e.g., Indicators for the Campaign, Malware it uses, and the associated Relationships) would be referenced in the report contents.
"modified": "2016-05-12T08:17:27.000Z", "name": "CVE-2016-1234", "external_references": [ { "source_name": "cve", "external_id": "CVE-2016-1234" } ] }