IndicatorBaseType Class The class is intended to be extended by a subclass, which characterizes an indicator. The decision to define base classes IndicatorBaseType that are extended like the class was made to minimize interdependence between STIX components; it was not made to IndicatorBaseType – – enable structural variation. The default and strongly RECOMMENDED subclass to extend the class is the IndicatorBaseType class in the Indicator data model (see ). The one case where the class SHOULD NOT be extended is when the IndicatorType class is used as a reference via its property. IndicatorBaseType idref The property table of the base class is given in Table 35. IndicatorBaseType . Properties of the base class IndicatorBaseType Name Type Multiplicity Description The property specifies a globally unique identifier for the id 0..1 id basicDataTypes:QualifiedName Indicator instance. The property specifies an identifier reference to an idref Indicator instance specified elsewhere. When the property idref idref basicDataTypes:QualifiedName 0..1 is used, no properties other than and should idref timestamp be specified. The property specifies the definition time of a timestamp specific version of an Indicator. When used in conjunction with the property, it specifies the definition time for the specific id version of the Indicator instance; when used in conjunction with timestamp 0..1 basicDataTypes:DateTime the property, it specifies the definition time for a specific idref version of an Indicator instance defined elsewhere. The property has no defined semantic meaning if it is timestamp used without either the or property. id idref ThreatActorBaseType Class The class is intended to be extended by a subclass, which characterizes a threat actor. The decision to define base ThreatActorBaseType classes that are extended like the class was made to minimize interdependence between STIX components; it was ThreatActorBaseType – – not made to enable structural variation. The default and strongly RECOMMENDED subclass to extend the class is the ThreatActorBaseType class in the Threat Actor data model (see ). The one case where the class SHOULD NOT be extended is when the ThreatActorType class is used as a reference via its property. ThreatActorBaseType idref
IndicatorBaseType Class The IndicatorBaseType class is intended to be extended by a subclass, which characterizes an indicator. The decision to define base classes that are extended – like the IndicatorBaseType class – was made to minimize interdependence between STIX components; it was not made to enable structural variation. The default and strongly RECOMMENDED subclass to extend the IndicatorBaseType class is the IndicatorType class in the Indicator data model (see ). The one case where the class SHOULD NOT be extended is when the IndicatorBaseType class is used as a reference via its idref property. The property table of the IndicatorBaseType base class is given in Table 35. . Properties of the IndicatorBaseType base class Name Type Multiplicity Description id basicDataTypes:QualifiedName 0..1 The id property specifies a globally unique identifier for the Indicator instance. idref basicDataTypes:QualifiedName 0..1 The idref property specifies an identifier reference to an Indicator instance specified elsewhere. When the idref property is used, no properties other than idref and timestamp should be specified. timestamp basicDataTypes:DateTime 0..1 The timestamp property specifies the definition time of a specific version of an Indicator. When used in conjunction with the id property, it specifies the definition time for the specific version of the Indicator instance; when used in conjunction with the idref property, it specifies the definition time for a specific version of an Indicator instance defined elsewhere. The timestamp property has no defined semantic meaning if it is used without either the id or idref property. ThreatActorBaseType Class The ThreatActorBaseType class is intended to be extended by a subclass, which characterizes a threat actor. The decision to define base classes that are extended – like the ThreatActorBaseType class – was made to minimize interdependence between STIX components; it was not made to enable structural variation. The default and strongly RECOMMENDED subclass to extend the ThreatActorBaseType class is the ThreatActorType class in the Threat Actor data model (see ). The one case where the class SHOULD NOT be extended is when the ThreatActorBaseType class is used as a reference via its idref property.
stix-v1.2.1-part2-common.docx