we didn’t want to use a single, generic verb, such as “describes,” because although the different verb choices may or may not be meaningful from an implementation standpoint, a distinction could be useful to those interested in the modeling aspect of STIX. Consequently, we have chosen to use the three verbs, defined as follows, in class and property descriptions: Verb STIX Definition captures Used to record and preserve information without implying anything about the structure of a class or property. Often used for properties that encompass general content. This is the least precise of the three verbs. Examples: The Source property characterizes the source of the sighting information. Examples of details captured include identitifying characteristics, time-related attributes, and a list of the tools used to collect the information. The Description property captures a textual description of the Indicator. characterizes Describes the distinctive nature or features of a class or property. Often used to describe classes and properties that themselves comprise one or more other properties. Examples: The Confidence property characterizes the level of confidence in the accuracy of the overall content captured in the Incident. The ActivityType class characterizes basic information about an activity a defender might use in response to a Campaign. specifies Used to clearly and precisely identify particular instances or values associated with a property. used for properties that are defined by a controlled vocabulary or enumeration; typically used for properties that take on only a single value. Example: The version property specifies the version identifier of the STIX Campaign data model used to capture the information associated with the Campaign. Terminology The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in [RFC2119]. Normative References [RFC2119] Bradner, S., “Key words for use in RFCs to Indicate Requirement Levels”, BCP 14, RFC 2119, March 1997. [Online]. Available: . Non-Normative References [V111] DRAFT STIX specification documents for version 1.1.1. (n.d.). [Online]. Available: . Accessed Aug. 24, 2015.
version STIXPackageVersionEnum 0..1 The version property specifies the version identifier of the STIX Core data for STIX v1.2.1 used to capture the information associated with the STIX Package. STIX_Header STIXHeaderType 0..1 The STIX_Header property characterizes the metadata for this package of STIX content. Observables cybox:ObservablesType 0..1 The Observables property specifies a set of one or more cyber observables. Indicators IndicatorsType 0..1 The Indicators property specifies a set of one or more cyber threat Indicators. TTPs TTPsType 0..1 The TTPs property specifies a set of one or more threat adversary Tactics, Techniques or Procedures (TTPs), or Kill Chains. Exploit_Targets stixCommon:ExploitTargetsType 0..1 The Exploit_Targets property specifies a set of zero or more potential targets for exploitation. Incidents IncidentsType 0..1 The Incidents property specifies a set of one or more threat Incidents. Courses_Of_Action CoursesOfActionType 0..1 The CoursesOfActions property specifies a set of one or more Courses of Action that could be taken in regard to one of more cyber threats. Campaigns CampaignsType 0..1 The Campaigns property specifies a set of one or more Campaigns. Threat_Actors ThreatActorsType 0..1 The ThreatActors property specifies a set of one or more Threat Actors. Reports ReportsType 0..1 The Reports property specifies a set of one or more Reports. Related_Packages RelatedPackagesType 0..1 The Related_Packages property specifies a set of one or more Packages may be relevant to this STIX Package.
InformationSourceType of details captured include identitifying characteristics, time-related attributes, and a list of the tools used to collect the information. Content Aggregation Types Each component type has an associated aggregation class that has one main property – a set of instances of that component type. The aggregation class for Observables, cybox_core:ObservablesType, is defined in . CampaignsType Class The CampaignsType class specifies a set of one or more cyber threat Campaigns. The properties of the CampaignsType class are given in Table 34. Table 34. Properties of the CampaignsType class Name Type Multiplicity Description Campaign stixCommon:CampaignBaseType 1..* The Campaign property characterizes a cyber threat Campaign. The stixCommon:CampaignBaseType class is a minimal base class that is intended to be extended. The default and strongly recommended class to fully implement a Campaign is the campaign:CampaignType class defined in . Base classes are used to minimize interdependence between STIX components, not to enable or encourage conflicting syntactic variation. CoursesOfActionType Class The CoursesOfActionType class specifies a set of one or more actions that could be taken in regard to cyber threats. The properties of the CoursesOfActionType class are given in Table 35. Table 35. Properties of the CoursesOfActionType class Name Type Multiplicity Description Course_Of_Action stixCommon: CourseOfActionBaseType 1..* The Course_Of_Action property characterizes a Course of Action that could be taken in regard to one of more cyber threats. The
Kill_Chains stixCommon:KillChainsType 0..1 A cyber kill chain is a phase-based model to describe the stages of an attack. The Kill_Chains property specifies a set of one or more specific kill chain definitions. The kill_chain property is further defined in the STIX Common specification document. Note that kill chains may also be defined using the Kill_Chains property of the TTP TTPType class, which is equivalent to this property. Suggested practice is to use the TTP TTPType Kill_Chains property (rather than this property) to define a kill chain. ReportsType The ReportsType class specifies a set of one or more cyber threat Reports. The properties of the ReportsType class are given in Table 310. Table 310. Properties of ReportsType class Name Type Multiplicity Description Report stixCommon: ReportBaseType 1..* The Report property characterizes a cyber threat Report. The stixCommon:Report BaseType class is a minimal base class that is intended to be extended. The default and strongly recommended class to fully implement a Report is the report:ReportType class defined in . Base classes are used to minimize interdependence between STIX components, not to enable or encourage conflicting syntactic variation. RelatedPackagesType Class The RelatedPackagesType class specifies a set of one or more STIX Package related to this STIX Package. It extends the GenericRelationShipListType superclass defined in the STIX Common data model, which specifies the scope (whether the elements of the set are related individually or as a group). The UML diagram corresponding to the RelatedPackagesType class is shown in Figure 32, and the specialized properties are shown in Table 311. Figure 32. UML diagram for RelatedPackagesType class In addition to being a property of the STIXType class, Related_Packages is a property of all of the top-level component types.