STIX[TM] Campaign Data Model The primary of the STIX Campaign package is the class, which characterizes a cyber threat campaign by capturing an asserted CampaignType relationship between the threat actors who are involved, the TTPs used, and the incidents that comprise parts of the campaign in addition to other intrinsic properties. Similar to the primary classes of all of the component data models in STIX, the class extends a base class defined in the STIX CampaignType Common data model; more specifically, it extends the base class, which provides the essential identifier (id) and identifier reference CampaignBaseType (idref) properties. The relationship between the and the base class, as well as the properties of the class, are CampaignType CampaignBaseType CampaignType illustrated in the UML diagram given in Figure 31. Figure . UML diagram of the CampaignType The property table, which includes property descriptions and corresponds to the UML diagram given in Figure 31, is provided in Table 31. All classes defined in the Campaign data model are described in detail in Sections 3.1 through 3.7. Details are not provided for classes defined in data models; instead, the reader is refered to the corresponding data model specification as indicated by the package prefix specified in the Type column of the table. Table . Properties of the class CampaignType Name Type Multiplicity Description The property specifies the version number of the STIX version version CampaignVersionType 0..1 Campaign data model for STIX v1.2.1 used to capture the information associated with the Campaign. The property captures a title for the Campaign and Title reflects what the content producer thinks the Campaign as a Title 0..1 whole should be called. The property is typically used by basicDataTypes:BasicString Title humans to reference a particular Campaign; however, it is not suggested for correlation. The property captures a textual description of the Description 0..* Description stixCommon:StructuredTextType Campaign. Any length is permitted. Optional formatting is
STIX[TM] Campaign Data Model The primary of the STIX Campaign package is the CampaignType class, which characterizes a cyber threat campaign by capturing an asserted relationship between the threat actors who are involved, the TTPs used, and the incidents that comprise parts of the campaign in addition to other intrinsic properties. Similar to the primary classes of all of the component data models in STIX, the CampaignType class extends a base class defined in the STIX Common data model; more specifically, it extends the CampaignBaseType base class, which provides the essential identifier (id) and identifier reference (idref) properties. The relationship between the CampaignType and the CampaignBaseType base class, as well as the properties of the CampaignType class, are illustrated in the UML diagram given in Figure 31. Figure . UML diagram of the CampaignType The property table, which includes property descriptions and corresponds to the UML diagram given in Figure 31, is provided in Table 31. All classes defined in the Campaign data model are described in detail in Sections 3.1 through 3.7. Details are not provided for classes defined in data models; instead, the reader is refered to the corresponding data model specification as indicated by the package prefix specified in the Type column of the table. Table . Properties of the CampaignType class Name Type Multiplicity Description version CampaignVersionType 0..1 The version property specifies the version number of the STIX Campaign data model for STIX v1.2.1 used to capture the information associated with the Campaign. Title basicDataTypes:BasicString 0..1 The Title property captures a title for the Campaign and reflects what the content producer thinks the Campaign as a whole should be called. The Title property is typically used by humans to reference a particular Campaign; however, it is not suggested for correlation. Description stixCommon:StructuredTextType 0..* The Description property captures a textual description of the Campaign. Any length is permitted. Optional formatting is
stix-v1.2.1-csd01-part8-campaign.docx