The property specifies the ordinality (e.g., or of this phase ordinality ‘1’, ‘2’, ‘3’) within the kill chain definition. It should be omitted when the associated kill chain is basicDataTypes: ordinality 0..1 being referenced (defined by the class), but if KillChainPhaseReferenceType Integer the property is present, it MUST match the ordinality of the corresponding phase in the kill chain that is referenced. KillChainPhasesReferenceType Class A cyber kill chain is a phase-based model to describe the stages of an attack, and a cyber kill chain phase is an individual phase within a kill chain definition. The class specifies a set of one or more kill chain phases. KillChainPhasesReferenceType The property table of the class is given in Table 335. KillChainPhasesReferenceType Table 335. Properties of the class KillChainPhasesReferenceType Name Type Multiplicity Description The property specifies a single kill Kill_Chain_Phase Kill_Chain_Phase 1..* KillChainPhaseReferenceType chain phase associated with this item. KillChainPhaseReferenceType Class The class specifies a phase within a kill chain by extending the superclass. A kill chain KillChainPhaseReferenceType KillChainPhaseType reference in an Indicator component indicates that the indicator detects malicious behavior at that phase of the kill chain. A kill chain reference in a TTP component indicates that the TTP is used (malware, infrastructure, etc.) at that phase of the kill chain. The property of the class is given in Table 336. KillChainPhaseReferenceType Table 336. Properties of the class KillChainPhaseReferenceType Name Type Multiplicity Description The property specifies the globally unique identifier for basicDataTypes: kill_chain_id 0..1 kill_chain_id the referenced kill chain instance. QualifiedName basicDataTypes: The property captures a descriptive name of the kill kill_chain_name kill_chain_name 0..1 chain. If a kill chain is referenced by the property, this kill_chain_id NoEmbeddedQuotesString
ordinality basicDataTypes: Integer 0..1 The ordinality property specifies the ordinality (e.g., ‘1’, ‘2’, or ‘3’) of this phase within the kill chain definition. It should be omitted when the associated kill chain is being referenced (defined by the KillChainPhaseReferenceType class), but if the property is present, it MUST match the ordinality of the corresponding phase in the kill chain that is referenced. KillChainPhasesReferenceType Class A cyber kill chain is a phase-based model to describe the stages of an attack, and a cyber kill chain phase is an individual phase within a kill chain definition. The KillChainPhasesReferenceType class specifies a set of one or more kill chain phases. The property table of the KillChainPhasesReferenceType class is given in Table 335. Table 335. Properties of the KillChainPhasesReferenceType class Name Type Multiplicity Description Kill_Chain_Phase KillChainPhaseReferenceType 1..* The Kill_Chain_Phase property specifies a single kill chain phase associated with this item. KillChainPhaseReferenceType Class The KillChainPhaseReferenceType class specifies a phase within a kill chain by extending the KillChainPhaseType superclass. A kill chain reference in an Indicator component indicates that the indicator detects malicious behavior at that phase of the kill chain. A kill chain reference in a TTP component indicates that the TTP is used (malware, infrastructure, etc.) at that phase of the kill chain. The property of the KillChainPhaseReferenceType class is given in Table 336. Table 336. Properties of the KillChainPhaseReferenceType class Name Type Multiplicity Description kill_chain_id basicDataTypes: QualifiedName 0..1 The kill_chain_id property specifies the globally unique identifier for the referenced kill chain instance. kill_chain_name basicDataTypes: NoEmbeddedQuotesString 0..1 The kill_chain_name property captures a descriptive name of the kill chain. If a kill chain is referenced by the kill_chain_id property, this