semantic meaning if used in the absence of either the id or idref properties. version STIXPackageVersionEnum 0..1 The version property specifies the version identifier of the STIX Core data for STIX v1.2.1 used to capture the information associated with the STIX Package. STIX_Header STIXHeaderType 0..1 The STIX_Header property characterizes the metadata for this package of STIX content. Observables cybox:ObservablesType 0..1 The Observables property specifies a set of one or more cyber observables. Indicators IndicatorsType 0..1 The Indicators property specifies a set of one or more cyber threat Indicators. TTPs TTPsType 0..1 The TTPs property specifies a set of one or more cyber threat adversary Tactics, Techniques or Procedures (TTPs), or Kill Chains. Exploit_Targets stixCommon:ExploitTargetsType 0..1 The Exploit_Targets property specifies a set of zero or more potential targets for exploitation. Incidents IncidentsType 0..1 The Incidents property specifies a set of one or more cyber threat Incidents. Courses_Of_Action CoursesOfActionType 0..1 The CoursesOfActions property specifies a set of one or more Courses of Action that could be taken in regard to one of more cyber threats. Campaigns CampaignsType 0..1 The Campaigns property specifies a set of one or more Campaigns. Threat_Actors ThreatActorsType 0..1 The ThreatActors property specifies a set of one or more Threat Actors. Reports ReportsType 0..1 The Reports property specifies a set of one or more Reports. Related_Packages RelatedPackagesType 0..1 The Related_Packages property specifies a set of one or more Packages which may be relevant to this STIX Package.
Content Aggregation Types Each component type has an associated aggregation class that has one main property – a set of instances of that component type. The aggregation class for Observables, cybox_core:ObservablesType, is defined in . CampaignsType Class The CampaignsType class specifies a set of one or more cyber threat Campaigns. The properties of the CampaignsType class are given in Table 34. Table . Properties of the CampaignsType class Name Type Multiplicity Description Campaign stixCommon:CampaignBaseType 1..* The Campaign property characterizes a cyber threat Campaign. The stixCommon:CampaignBaseType class is a minimal base class that is intended to be extended. The default and strongly recommended class to fully implement a Campaign is the campaign:CampaignType class defined in . Base classes are used to minimize interdependence between STIX components, not to enable or encourage conflicting syntactic variation. CoursesOfActionType Class The CoursesOfActionType class specifies a set of one or more actions that could be taken in regard to cyber threats. The properties of the CoursesOfActionType class are given in Table 35. . Properties of the CoursesOfActionType class Name Type Multiplicity Description Course_Of_Action stixCommon: CourseOfActionBaseType 1..* The Course_Of_Action property characterizes a Course of Action that be taken in regard to one of more cyber threats. The stixCommon:CourseOfActionBaseType class is a minimal base class that is intended to be extended. The default and strongly RECOMMENDED class to fully implement a Course of Action is the coa:CourseOfActionType class
Name Type Multiplicity Description Related_Package RelatedPackageType 0..* The Related_Package property characterizes a relationship to one or more other STIX Packages. RelatedPackageType Class The RelatedPackageType identifies or characterizes the relationship of STIX Package to another. The properties of the RelatedPackageType are given in Table 312. Table . Properties of RelatedPackageType class Name Type Multiplicity Description Package STIXType 1 The Package property captures or references a STIX Package related to this STIX Package.