appears_random basicDataTypes: Boolean 0..1 The appears_random property specifies whether the associated object property value appears to somewhat random in nature. An object property with this property set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure. is_obfuscated basicDataTypes: Boolean 0..1 The is_obfuscated property specifies whether the associated Object property has been obfuscated. obfuscation_algorithm_ref basicDataTypes: URI 0..1 The obfuscation_algorithm_ref property specifies a reference to a description of the algorithm used to obfuscate this Object property. is_defanged basicDataTypes: Boolean 0..1 The is_defanged property specifies whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing). defanging_algorithm_ref basicDataTypes: URI 0..1 The defanging_algorithm_ref property specifies a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property. refanging_transform_type basicDataTypes: BasicString 0..1 The refanging_transform_type property specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refanging_transform property. refanging_transform basicDataTypes: BasicString 0..1 The refanging_transform property captures an automated transform that can be applied to the Object property content in order to refang it to its original format.
pattern only matches if the provided condition successfully evaluates for every value in the Object property body. delimiter basicDataTypes: BasicString 0..1 The delimiter property captures the delimiter used when defining lists of values. The default value is "##comma##". bit_mask basicDataTypes:HexBinary 0..1 The bit_mask property specifies a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation. pattern_type PatternTypeEnum 0..1 The pattern_type property specifies the type of pattern used if one is specified for the Object property This is applicable only if the Condition property is set to 'FitsPattern'. regex_syntax basicDataTypes: BasicString 0..1 The regex_syntax property captures the syntax format used for a regular expression, if one is specified for the property value. This is applicable only if the Condition property is set to 'FitsPattern'. Setting this property with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification. Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case. has_changed basicDataTypes:Boolean 0..1 The has_changed property specifies whether a targeted observation pattern of the associated Object property has changed. This property would be leveraged within a pattern observable triggering on whether the value of a single Object property value has changed.
default and strongly RECOMMENDED subclass is CIQAddressInstanceType, as defined in the . Build-Related Classes BuildInformationType Class The BuildInformationType class contains information describing how this tool was built. Figure . UML diagram for the BuildInformationType class 10. Properties of the BuildInformationType class Name Type Multiplicity Description Build_ID basicDataTypes: BasicString 0..1 The Build_ID property captures an externally defined unique identifier of this of this application instance. Build_Project basicDataTypes: BasicString 0..1 The Build_Project property captures the project name of this build of this application instance. Build_Utility BuildUtilityType 0..1 The Build_Utility property characterizes the utility used to build this application. Build_Version basicDataTypes: BasicString 0..1 The Build_Version property captures the appropriate version descriptor of this build of this application instance. Build_Label basicDataTypes: BasicString 0..1 The Build_Label property captures any relevant label for this build of this application instance.
Compilers CompilersType 0..1 The Compilers property characterizes compilers utilized during this of this application. Compilation_Date DateTimeWithPrecisionType 0..1 The Completion_Date property specifies the compilation date for the build of the tool. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known. Build_Configuration BuildConfigurationType 0..1 The Build_Configuration property characterizes how the build utility was configured for this build of this application. Build_Script basicDataTypes: BasicString 0..1 The Build_Script property captures the actual build script for this build of this application instance. Libraries LibrariesType 0..1 The Libraries property characterizes the libraries incorporated into the build of the tool. Build_Output_Log basicDataTypes: BasicString 0..1 The Build_Output_Log property captures the output log of the build process. BuildUtilityType The BuildUtilityType contains information identifying the utility used to build this application. Table 11. Properties of the BuildUtilityType class Name Type Multiplicity Description Build_Utility_Name basicDataTypes: BasicString 1 The Build_Utility_Name property captures the informally defined name of the utility used to build this application instance.
Data_Format DataFormatEnum 0..1 The Data_Format property characterizes the type of data contained in the Data_Segment property. Data_Size DataSizeType 0..1 The Data_Size property characterizes the size of the data contained in this element. Byte_Order EndiannessType 0..1 The Byte_Order property characterizes the endianness of the unpacked (e.g., decoded, unencrypted, etc.) data stored within the Data_Segment property. Data_Segment StringObjectPropertyType 0..1 The Data_Segment property characterizes the actual segment of data being characterized. Offset IntegerObjectPropertyType 0..1 The Offset property characterizes where to start searching for the specified data segment in an object, in bytes. Search_Distance IntegerObjectPropertyType 0..1 The Search_Distance property characterizes how far into an object should be ignored, in bytes, before starting to search for the specified data segment relative to the end of the previous data segment. Search_Within IntegerObjectPropertyType 0..1 The Search_Within property characterizes that at most N are between data segments in related objects. DependenciesType Class The DependenciesType class contains information describing a set of dependencies for this tool. Figure . UML diagram for the DependencyType class 25. Properties of the DependenciesType class
Name Type Multiplicity Description Dependency DependencyType 1..* The Dependency property characterizes a single dependency for this tool. DependencyType Class The DependencyType class contains information describing a single dependency for this tool. 26. Properties of the DependencyType class Name Type Multiplicity Description Dependency_Type basicDataTypes: BasicString 0..1 The Dependency_Type property captures the type of this dependency instance. Dependency_Description StructuredTextType 1 The Dependency_Description property captures a description of this dependency instance. Any length is permitted. Optional formatting is supported via the structuring_format property of the StructuredTextType data type. DigitalSignaturesType Class The DigitalSignaturesType is used for representing a list of digital signatures. Figure . UML diagram for the DigitalSignatureInfoType class Table 27. Properties of the DigitalSignaturesType class Name Type Multiplicity Description
Digital_Signature DigitalSignatureInfoType 0..* The Digital_Signature property characterizes a single digital signature for this Object. DigitalSignatureInfoType Class The DigitalSignatureInfoType class is used as a way to represent some of the basic information about a digital signature. Table 28. Properties of the DigitalSignatureInfoType class Name Type Multiplicity Description signature_exists basicDataTypes:Boolean 0..1 The signature_exists property specifies whether the digital signature exists. signature_verified basicDataTypes:Boolean 0..1 The signature_verified property specifies if the digital signature is verified. Certificate_Issuer StringObjectPropertyType 0..1 The Certificate_Issuer property characterizes the certificate issuer of the digital signature. Certificate_Subject StringObjectPropertyType 0..1 The Certificate_Subject property characterizes the certificate subject of the digital signature. Signature_Description StringObjectPropertyType 0..1 The Signature_Description property characterizes a description of the digital signature. EnvironmentVariableListType Class The EnvironmentVariableListType class is used for representing a list of environment variables. Table 29. Properties of the EnvironmentVariableListType class
Name Type Multiplicity Description Environment_Variable EnvironmentVariableType 1..* The Environment_Variable property is used for capturing environment variables using a name/value pair. EnvironmentVariableType The EnvironmentVariableType class is used for representing environment variables using a name/value pair. Table 30. Properties of the EnvironmentVariableType class Name Type Multiplicity Description Name StringObjectPropertyType 1 The Name property characterizes the name of the environment variable. Value StringObjectPropertyType 0..1 The Value property characterizes the value of the environment variable. Classes ErrorsType Class The ErrorsType class captures any errors generated during the run of the tool. Figure . UML diagram for the ErrorType 31. Properties of the ErrorsType class Name Type Multiplicity Description
Error ErrorType 1..* The Error property captures a single type of error generated during the run of the tool. ErrorType Class The ErrorType class captures a single error generated during the run of the tool. Table 32. Properties of the ErrorType class Name Type Multiplicity Description Error_Type basicDataTypes: BasicString 1 The Error_Type property captures the type for this tool run error. Error_Count basicDataTypes: PositiveInteger 0..1 The Error_Count property specifies the count of instances for this error in the tool run. Error_Instances ErrorInstancesType 0..1 The Error_Instances property captures the actual error output for each instance of this type of error. ErrorInstancesType The ErrorInstancesType class captures the actual error output for each instance of this type of error. 33. Properties of the ErrorInstancesType class Name Type Multiplicity Description Error_Instance basicDataTypes: BasicString 1..* The Error_Instance property captures the actual output for a single instance of this type of error.
Address HexBinaryObjectPropertyType 0..1 The Address property characterizes the location or offset of the specified string in the CybOX objects. Length PositiveIntegerObjectPropertyType 0..1 The Length property characterizes the length, in characters, of the string extracted from the CybOX object. Language StringObjectPropertyType 0..1 The Language property characterizes the language the string is written in, e.g. English. For consistency, we strongly recommend using a ISO 639-2 language code, if available. Please see for a list of ISO 639-2 codes. English_Translation StringObjectPropertyType 0..1 The English_Translation property characterizes the English translation of the string, if it is not written in English. FunctionsType Class The FunctionsType class is intended to represent an extracted list of functions leveraged within a CybOX object. Table 37. Properties of the FunctionsType class Name Type Multiplicity Description Function StringObjectPropertyType 1..* The Function property characterizes a single reference to a function called by a raw cyber object. Hash-Related Classes HashListType The HashListType is used for representing a list of hash values.
Has_Choice HashValueChoiceType 0..1 The Has_Choice property is associated with the class HashValueChoiceType. It indicates that there is a choice between the Simple_Hash_Value property or the Fuzzy_Hash_Value property. Only one of the properties of HashValueChoiceType can be populated at any time. See Section 1.2.3 for more detail. HashValueType Class The HashValueType class is used for specifying the resulting value from a hash calculation. 40. Properties of the HashType class Name Type Multiplicity Description Has_Choice HashValueChoiceType 0..1 The Has_Choice property is associated with the class HashValueChoiceType. It indicates that there is a choice between the Simple_Hash_Value property or the Fuzzy_Hash_Value property. Only one of the properties of HashValueChoiceType class can be populated at any time. See Section 1.2.3 for more detail. HashValueChoiceType Class The HashValueChoiceType class is used for specifying the choice between different formats of the resulting value from a hash calculation. In the UML model, this class is associated with the <<choice>> UML stereotype, which specifies that only one of the available properties of the HashValueChoiceType class can be populated at any time. See Section 3.2.9 for details on SimpleHashValueType and FuzzyHashValueType data Table 41. Properties of the HashValueChoiceType class
Name Type Multiplicity Description Simple_Hash_Value SimpleHashValueType 0..1 The Simple_Hash_Value property characterizes a single result value of a basic cryptographic hash function outputting a single hexbinary hash value. The Simple_Hash_Value and Fuzzy_Hash_Value properties MUST NOT both have a value. Fuzzy_Hash_Value FuzzyHashValueType 0..1 The Fuzzy_Hash_Value property characterizes a single result of a cryptographic fuzzy hash function outputting a single complex string based hash value. (e.g., SSDEEP's Block1hash:Block2hash format). The Simple_Hash_Value and Fuzzy_Hash_Value properties MUST NOT both have a value. FuzzyHashStructureType The FuzzyHashStructureType class is used for characterizing the internal components of a cryptographic fuzzy hash algorithmic calculation. Table 42. Properties of the FuzzyHashStructureType class Name Type Multiplicity Description Block_Size IntegerObjectPropertyType 0..1 The Block_Size property characterizes the calculated block size for this fuzzy hash calculation. Block_Hash FuzzyHashBlockType 0..1 The Block_Hash property characterizes specification of the elemental components utilized for a fuzzy hash calculation on the hashed object utilizing the Block_Size property to calculate trigger points.
HashSegmentType Class The HashSegmentType class is used for characterizing the internal components of a single trigger point-delimited segment in a cryptographic fuzzy hash algorithmic calculation. Table 45. Properties of the HashSegmentType class Name Type Multiplicity Description Trigger_Point HexBinaryObjectPropertyType 0..1 The Trigger_Point property characterizes the offset within the hashed object of the trigger point for this segment. Segment_Hash HashValueType 0..1 The Segment_Hash property characterizes a calculated hash for this segment. Raw_Segment_Content HexBinaryObjectPropertyType 0..1 The Raw_Segment_Content property captures the raw content of this segment of the hashed object. ImportsType Class The ImportsType class is intended to represent an extracted list of imports specified within a CybOX object. 46. Properties of the ImportsType class Name Type Multiplicity Description Import StringObjectPropertyType 1..* The Import property characterizes a single reference to an external resource imported by a raw object.
class. The CybOX default vocabulary class for use in the property is ‘ToolTypeVocab-1.1’. Description StructuredTextType 0..1 The Description property captures a technical description of the Tool Information. Any length is permitted. Optional formatting is supported via the structuring_format property of the StructuredTextType References ToolReferencesType 0..1 The References property captures references to instances or additional information for this tool. Vendor basicDataTypes: BasicString 0..1 The Vendor property captures information identifying the vendor organization for this tool. Version basicDataTypes: BasicString 0..1 The Version property captures an appropriate version descriptor of this tool. Service_Pack basicDataTypes: BasicString 0..1 The Service_Pack property captures an appropriate service pack descriptor for this tool. Tool_Specific_Data ToolSpecificDataType 0..1 The Tool_Specific_Data property characterizes data to be included. Tool_Hashes HashListType 0..1 The Tool_Hashes property captures a hash value computed on the tool file content in order to verify its integrity. Tool_Configuration ToolConfigurationType 0..1 The Tool_Configuation property characterizes the configuration and usage of the tool. Execution_Environment ExecutionEnvironmentType 0..1 The Execution_Environment property characterizes the execution environment of the tool.
Errors ErrorsType 0..1 The Errors property captures any errors generated during the run of the tool. Metadata MetadataType 0..* The Metadata property captures other relevant metadata including tool-specific properties. Compensation_Model CompensationModelType 0..1 The Compensation_Model property captures the name of the compensation model used for the tool. ToolSpecificDataType Class The ToolSpecificDataType is an abstract class placeholder within the CybOX enabling the inclusion of metadata for a specific type of tool through the use of a custom type defined as an extension of this class. ToolConfigurationType Class The ToolConfigurationType class characterizes the configuration for a tool used as a cyber observation source. 57. Properties of the ToolConfigurationType class Name Type Multiplicity Description Configuration_Settings ConfigurationSettingsType 0..1 The Configuration_Settings property characterizes the configuration settings of this tool instance. Dependencies DependenciesType 0..1 The Dependencies property characterizes the relevant dependencies for this tool. Usage_Context_Assumptions UsageContextAssumptionsType 0..1 The Usage_Context_Assumptions property characterizes the various relevant usage context assumptions for this tool.
Internationalization_Settings Internationalization SettingsType 0..1 The Internationalization_Settings property characterizes the relevant internationalization setting for this tool. Build_Information BuildInformationType 0..1 The Build_Information property characterizes how this tool was built. ToolReferencesType The ToolReferencesType is used to indicate one or more references to tool instances and information. Table 58. Properties of the ToolReferencesType class Name Type Multiplicity Description Reference ToolReferenceType 1..* The Reference property specifies one reference to information or instances of a given tool. ToolReferenceType Class Contains one reference to information or instances of a tool. Table 59. Properties of the ToolReferenceType class Name Type Multiplicity Description reference_type ToolReferenceTypeEnum 0..1 The reference_type property specifies the nature of the referenced material (documentation, source, executable, etc.).
LocationType The LocationType is used to express geographic location information. This class is usually extended to incorporate specific location information. The default extension type is CIQAddress3.0InstanceType (see ). Those who wish to express a simple name may also do so by simply using the Name property of this type. Table 65. Properties of the LocationType class Name Type Multiplicity Description id basicDataTypes: QualifiedName 0..1 The id property specifies a globally unique identifier for the Location. basicDataTypes: QualifiedName 0..1 The idref property specifies an identifier reference to a Location instance specified elsewhere. When the idref property is used, no other property should be specified. Name basicDataTypes: BasicString 0..1 The Name property captures a location through a simple name. StructuredTextType Data Type The StructuredTextType is a type representing a generalized structure for capturing structured or unstructured textual information such as descriptions of things. Table 66. Properties of the StructuredTextType class Name Type Multiplicity Description structuring_format basicDataTypes: BasicString 0..1 The structuring_format property specifies a particular structuring format (e.g., used within an instance of StructuredTextType. If this property is absent, then markup MUST NOT be used. TimeType The TimeType specifies various time properties for this construct.
Acknowledgements The following individuals have participated in the creation of this specification and are gratefully acknowledged: Aetna David Crawford AIT Austrian Institute of Technology Roman Fiedler Florian Skopik Australia and New Zealand Banking Group (ANZ Bank) Dean Thompson Blue Coat Systems, Inc. Owen Johnson Bret Jordan Century Link Cory Kennedy CIRCL Alexandre Dulaunoy Andras Iklody Raphaël Vinot Citrix Systems Joey Peloquin Dell Will Urbanski Jeff Williams DTCC Dan Gordon Hundley Chris Koutras EMC Robert Griffin Jeff Odom Ravi Sharda Financial Services Information Sharing and Analysis Center (FS-ISAC) David Eilken Chris Ricard Fortinet Inc. Gavin Chow Kenichi Terashita Airbus SAS Joerg Eschweiler Marcos Orallo Anomali Ryan Clough Wei Huang Hugh Njemanze Katie Pelusi Shelmire Jason Trost Bank of America Alexander Foley Center for Internet Security (CIS) Kelley Check Point Software Technologies Ron Davidson Cisco Systems Syam Appala Ted Bedwell David McGrew Pavan Reddy Omar Santos Jyoti Verma Cyber Threat Intelligence Network, Inc. (CTIN) Doug DePeppe Jane Ginn Ben Othman DHS Office of Cybersecurity and Communications (CS&C) Richard Struse Marlon Taylor EclecticIQ Marko Dragoljevic Joep Gommers Sergey Polzunov Rutger Prins
Fujitsu Limited Neil Edwards Frederick Hirsch Ryusuke Masuoka Daisuke Murabayashi Google Inc. Mark Risher Hitachi, Ltd. Kazuo Noguchi Akihito Sawada Masato Terada iboss, Inc. Paul Martini Individual Jerome Athias Brown Jones Sanjiv Kalkar Bar Lockwood Terry MacDonald Alex Intel Corporation Tim Casey Kent Landfield JPMorgan Chase Bank, N.A. Terrence Driscoll David Laurance LookingGlass Allan Thomson Lee Vorthman Mitre Corporation Greg Back Jonathan Sean Barnum Desiree Beck Nicole Gong Jasen Jacobsen Ivan Kirillov Richard Piazza Jon Salwen Charles Schmidt Emmanuelle Vargas-Gonzalez Andrei Sîrghi Raymon van der Velde eSentire, Inc. Gajek FireEye, Inc. Phillip Boles Gorakav Anuj Kumar Shyamal Pandya Paul Patrick Scott Shreve Fox-IT Sarah Brown Georgetown University Eric Burger Hewlett Packard Enterprise (HPE) Tomas Sander IBM Peter Allor Eldan Ben-Haim Sandra Hernandez Jason Keirstead John Morris Laura Rusu Ron Williams IID Chris Richardson Integrated Networking Technologies, Inc. Patrick Maroney Johns Hopkins University Applied Physics Laboratory Karin Marr Julie Modlin Mark Moss Pamela Smith Kaiser Permanente Russell Culpepper Beth Pumo Lumeta Corporation Brandon Hoffman MTG Management Consultants, LLC. James Cabral
John Wunder National Council of ISACs (NCI) Scott Algeier Denise Anderson Josh Poster NEC Corporation Takahiro Kakumaru North American Energy Standards Board David Darnell Object Management Group Cory Casanave Palo Alto Networks Vishaal Hariprasad Queralt, Inc. John Tolbert Resilient Systems, Inc. Ted Julian Securonix Igor Baikalov Siemens AG Bernd Grobauer Soltra John Anderson Aishwarya Asok Kumar Peter Ayasse Jeff Beekman Michael Butt Cynthia Camacho Aharon Chernin Mark Clancy Cotton Trey Darley Mark Davidson Paul Dion Daniel Dye Robert Raymond Keckler Ali Khan Chris Kiehl Clayton Long Michael Pepin Natalie Suarez National Security Agency Mike Boyle Jessica Fitzgerald-McKay New Context Services, Inc. John-Mark Gurney Christian Hunt James Moler Daniel Riedel Andrew Storms OASIS James Bryce Clark Robin Cover Chet Ensign Open Identity Exchange Don Thibeau PhishMe Inc. Josh Larkins Raytheon Company-SAS Daniel Wyschogrod Retail Cyber Intelligence Sharing Center Engle Semper Fortis Solutions Joseph Brand Splunk Inc. Cedric LeRoux Brian Luger Kathy Wang Greg Reaume Alan Steer Threat Intelligence Pty Ltd Tyron Miller Andrew van der Stock ThreatConnect, Inc. Wade Baker Cole Iliff Andrew Pendergast Ben Schmoker Jason Spies TruSTAR Technology Chris Roblee
David Waters Benjamin Yates Symantec Corp. Curtis Kostrosky The Boeing Company Crystal Hayes ThreatQuotient, Inc. Ryan U.S. Bank Mark Angel Brad Butts Brian Fay Mona Magathan Yevgen Sautin US Department of Defense (DoD) James Bohling Eoghan Casey Gary Katz Jeffrey Mates VeriSign Robert Coderre Kyle Maxwell Eric Osterweil United Kingdom Cabinet Office Iain Brown Adam Cooper Mike McLellan Chris O’Brien James Penman Howard Staple Chris Taylor Laurie Thomson Alastair Treharne Julian Bethany Yates US Department of Homeland Security Evette Maynard-Noel Justin Stekervetz ViaSat, Inc. Lee Chieffalo Wilson Figueroa Andrew May Yaana Technologies, LLC Anthony Rutkowski The authors would also like to thank the larger CybOX Community for its input and help in reviewing this document.