Name Type Multiplicity Description stixCommon: The property specifies the time that the First_Malicious_Action First_Malicious_Action 0..1 first malicious action related to the Incident occured. DateTimeWithPrecisionType stixCommon: The property specifies the time that the Initial_Compromise Initial_Compromise 0..1 initial compromise occured for the Incident. DateTimeWithPrecisionType stixCommon: The property specifies the first time at First_Data_Exfiltration First_Data_Exfiltration 0..1 which non-public data was taken from the victim environment. DateTimeWithPrecisionType stixCommon: The property specifies the first time at which Incident_Discovery 0..1 Incident_Discovery the organization learned the Incident had occurred. DateTimeWithPrecisionType stixCommon: The property specifies the time at which the Incident_Opened Incident_Opened 0..1 Incident was officially opened. DateTimeWithPrecisionType stixCommon: The property specifies the time at Containment_Achieved Containment_Achieved 0..1 which the Incident is contained (e.g., the is stopped”). “bleeding DateTimeWithPrecisionType stixCommon: The property specifies the first time at Restoration_Achieved Restoration_Achieved 0..1 which the incident's assets are restored (e.g., fully functional). DateTimeWithPrecisionType stixCommon: The property specifies the time at which the Incident_Reported Incident_Reported 0..1 Incident was reported. DateTimeWithPrecisionType stixCommon: The property specifies the time at which the Incident_Closed Incident_Closed 0..1 Incident was officially closed. DateTimeWithPrecisionType CategoriesType The class specifies one or more category labels for the Incident. CategoriesType The properties of the class are given in Table 35. TimeType Table . Properties of the class CategoriesType
Name Type Multiplicity Description First_Malicious_Action stixCommon: DateTimeWithPrecisionType 0..1 The First_Malicious_Action property specifies the time that the first malicious action related to the Incident occured. Initial_Compromise stixCommon: DateTimeWithPrecisionType 0..1 The Initial_Compromise property specifies the time that the initial compromise occured for the Incident. First_Data_Exfiltration stixCommon: DateTimeWithPrecisionType 0..1 The First_Data_Exfiltration property specifies the first time at which non-public data was taken from the victim environment. Incident_Discovery stixCommon: DateTimeWithPrecisionType 0..1 The Incident_Discovery property specifies the first time at which the organization learned the Incident had occurred. Incident_Opened stixCommon: DateTimeWithPrecisionType 0..1 The Incident_Opened property specifies the time at which the Incident was officially opened. Containment_Achieved stixCommon: DateTimeWithPrecisionType 0..1 The Containment_Achieved property specifies the time at which the Incident is contained (e.g., the “bleeding is stopped”). Restoration_Achieved stixCommon: DateTimeWithPrecisionType 0..1 The Restoration_Achieved property specifies the first time at which the incident's assets are restored (e.g., fully functional). Incident_Reported stixCommon: DateTimeWithPrecisionType 0..1 The Incident_Reported property specifies the time at which the Incident was reported. Incident_Closed stixCommon: DateTimeWithPrecisionType 0..1 The Incident_Closed property specifies the time at which the Incident was officially closed. CategoriesType The CategoriesType class specifies one or more category labels for the Incident. The properties of the TimeType class are given in Table 35. Table . Properties of the CategoriesType class
stix-v1.2.1-csd01-part6-incident.docx