STIX[TM] Core Data Model The primary class of the STIX Core package is the STIXType class, which defines a bundle of information characterized in the Structured Threat Information Expression (STIX) language. We refer to this bundle of information as a “STIX Package”. The properties of the STIXType class, are illustrated in the UML diagram given in Figure 31 on page 14. Figure 31. UML diagram of the STIXType class 31. Properties of The STIXType class Name Type Multiplicity Description id BasicDataTypes: QualifiedName 0..1 The id property specifies a globally unique identifier for the STIX Package. idref BasicDataTypes: QualifiedName 0..1 The idref property specifies an identifier reference to a STIX Package specified elsewhere. When the idref property is used, the id property MUST NOT also be specified and the other properties of the STIXType class SHOULD NOT hold any content. DEPRECATED: This property is deprecated and will be removed in the next major version of STIX. Its use is strongly discouraged except for legacy applications. timestamp BasicDataTypes: DateTime 0..1 The timestamp property specifies a timestamp for the definition of a specific version of a STIX Package. When used in conjunction with the id property, this property specifies the definition time for the specific version of the STIX Package. When used in conjunction with the property, this property specifies a reference to a specific version of a STIX Package defined elsewhere. This property has no defined
semantic meaning if used in the absence of either the id or idref properties. version STIXPackageVersionEnum 0..1 The version property specifies the version identifier of the STIX Core data model for STIX v1.2.1 used to capture the information associated with the STIX Package. STIX_Header STIXHeaderType 0..1 The STIX_Header property characterizes the metadata for this package of STIX content. Observables cybox:ObservablesType 0..1 The Observables property specifies a set of one or more cyber observables. Indicators IndicatorsType 0..1 The Indicators property specifies a set of one or more cyber threat Indicators. TTPs TTPsType 0..1 The TTPs property specifies a set of one or more threat adversary Tactics, Techniques or Procedures (TTPs), or Kill Chains. Exploit_Targets stixCommon:ExploitTargetsType 0..1 The Exploit_Targets property specifies a set of zero or more potential targets for exploitation. Incidents IncidentsType 0..1 The Incidents property specifies a set of one or more cyber threat Incidents. Courses_Of_Action CoursesOfActionType 0..1 The CoursesOfActions property specifies a set of one or more Courses of Action that could be taken in regard to one of more cyber threats. Campaigns CampaignsType 0..1 The Campaigns property specifies a set of one or more Campaigns. Threat_Actors ThreatActorsType 0..1 The ThreatActors property specifies a set of one or more Threat Actors. Reports ReportsType 0..1 The Reports property specifies a set of one or more Reports. Related_Packages RelatedPackagesType 0..1 The Related_Packages property specifies a set of one or more Packages which may be relevant to this STIX Package.
DEPRECATION NOTICE: The use of the @idref attribute on any instance at the top level of the content aggregation classes is deprecated and will be removed in the next major version of STIX. Its use is strongly discouraged except for legacy applications. Instances in these content aggregation classes should only be embedded, not referenced. STIXPackageVersionType Enumeration The STIXPackageVersionType enumeration is an inventory of all versions of the STIX Core data model for STIX Version 1.2.1. The enumeration literals are given in Table 32. Table 32. Literals of the STIXPackageVersionType enumeration Enumeration Literal Description stix-1.2.1 STIX Core data model for STIX v1.2.1 STIXHeaderType Class The STIXHeaderType class provides a structure for characterizing a package of STIX content. The properties of the STIXHeaderType are given in Table 33. Table 33. Properties of the STIXHeaderType class Name Type Multiplicity Description Title basicDataTypes:BasicString 0..1 The property captures a title for the STIX Package and reflects what the content producer thinks the Package as a whole should be called. The Title property is typically used by humans to reference a particular Package; however, it is not suggested for correlation. DEPRECATED: This property is deprecated and will be removed in the next major version of STIX. Its use is strongly discouraged except for legacy applications. Package_Intent stixCommon: VocabularyStringType 0..* The Package_Intent property specifies the intended purpose(s) or use(s) for The STIX Package. Examples of potential purposes are phishing, exploit characterization and malware samples (these specific values are only