STIX[TM] Threat Actor Data Model The primary class of the STIX Threat Actor package is the class, which characterizes a cyber threat actor including their identity, ThreatActorType sophistication, presumed intent, historically observed behavior (TTPs), and campaigns or other threat actors they are believed to be associated with. Similar to the primary classes of all of the component data models in STIX, the class extends a base class defined in the STIX ThreatActorType Common data model; more specifically, it extends the base class, which provides the essential identifier (id) and identifier ThreatActorBaseType reference (idref) properties. This relationship between the class and the base class, as well as the properties of the ThreatActorType ThreatActorBaseType class, are illustrated in the UML diagram given in Figure 31. ThreatActorType Figure 31. UML diagram of the ThreatActorType The property table, which includes property descriptions and corresponds to the UML diagram given in Figure 31 is provided in Table 31. All classes defined in the Threat Actor data model are described in detail in Section 3.1 through Section 3.4. Details are not provided for classes defined in non-Threat Actor data models; instead, the reader is referred to the corresponding data model specification as indicated by the package prefix specified in the Type column of the table. Table 31. Properties of the class ThreatActorType Name Type Multiplicity Description The property specifies the version number of version the STIX Threat Actor data model for STIX v1.2.1 used version 0..1 ThreatActorVersionType to capture the information associated with the Threat Actor. The property captures a title for the Threat Title Actor and reflects what the content producer thinks the basicDataTypes: Threat Actor as a whole should be called. The Title Title 0..1 property is typically used by humans to reference a BasicString particular Threat Actor; however, it is not suggested for correlation. The property captures a textual Description Description 0..* stixCommon: description of the Threat Actor. Any length is
STIX[TM] Threat Actor Data Model The primary class of the STIX Threat Actor package is the ThreatActorType class, which characterizes a cyber threat actor including their identity, sophistication, presumed intent, historically observed behavior (TTPs), and campaigns or other threat actors they are believed to be associated with. Similar to the primary classes of all of the component data models in STIX, the ThreatActorType class extends a base class defined in the STIX Common data model; more specifically, it extends the ThreatActorBaseType base class, which provides the essential identifier (id) and identifier reference (idref) properties. This relationship between the ThreatActorType class and the ThreatActorBaseType base class, as well as the properties of the ThreatActorType class, are illustrated in the UML diagram given in Figure 31. Figure 31. UML diagram of the ThreatActorType The property table, which includes property descriptions and corresponds to the UML diagram given in Figure 31 is provided in Table 31. All classes defined in the Threat Actor data model are described in detail in Section 3.1 through Section 3.4. Details are not provided for classes defined in non-Threat Actor data models; instead, the reader is referred to the corresponding data model specification as indicated by the package prefix specified in the Type column of the table. Table 31. Properties of the ThreatActorType class Name Type Multiplicity Description version ThreatActorVersionType 0..1 The version property specifies the version number of the STIX Threat Actor data model for STIX v1.2.1 used to capture the information associated with the Threat Actor. Title basicDataTypes: BasicString 0..1 The Title property captures a title for the Threat Actor and reflects what the content producer thinks the Threat Actor as a whole should be called. The Title property is typically used by humans to reference a particular Threat Actor; however, it is not suggested for correlation. Description stixCommon: 0..* The Description property captures a textual description of the Threat Actor. Any length is
stix-v1.2.1-csd01-part7-threat-actor.docx