of details captured include identitifying characteristics, time-related InformationSourceType attributes, and a list of the tools used to collect the information. Content Aggregation Types Each component type has an associated aggregation class that has one main property a set of instances of that component type. The – aggregation class for Observables, is defined in . cybox_core:ObservablesType, CampaignsType Class The class specifies a set of one or more cyber threat Campaigns. CampaignsType The properties of the class are given in Table 34. CampaignsType Table 34. Properties of the class CampaignsType Name Type Multiplicity Description The property characterizes a cyber threat Campaign. The Campaign class is a minimal base class that is stixCommon:CampaignBaseType intended to be extended. The default and strongly recommended class to Campaign stixCommon:CampaignBaseType 1..* fully implement a Campaign is the class defined campaign:CampaignType in . Base classes are used to minimize interdependence between STIX components, not to enable or encourage conflicting syntactic variation. CoursesOfActionType Class The class specifies a set of one or more actions that could be taken in regard to cyber threats. CoursesOfActionType The properties of the class are given in Table 35. CoursesOfActionType Table 35. Properties of the class CoursesOfActionType Name Type Multiplicity Description stixCommon: The property characterizes a Course of Action that Course_Of_Action Course_Of_Action 1..* CourseOfActionBaseType could be taken in regard to one of more cyber threats. The
InformationSourceType of details captured include identitifying characteristics, time-related attributes, and a list of the tools used to collect the information. Content Aggregation Types Each component type has an associated aggregation class that has one main property – a set of instances of that component type. The aggregation class for Observables, cybox_core:ObservablesType, is defined in . CampaignsType Class The CampaignsType class specifies a set of one or more cyber threat Campaigns. The properties of the CampaignsType class are given in Table 34. Table 34. Properties of the CampaignsType class Name Type Multiplicity Description Campaign stixCommon:CampaignBaseType 1..* The Campaign property characterizes a cyber threat Campaign. The stixCommon:CampaignBaseType class is a minimal base class that is intended to be extended. The default and strongly recommended class to fully implement a Campaign is the campaign:CampaignType class defined in . Base classes are used to minimize interdependence between STIX components, not to enable or encourage conflicting syntactic variation. CoursesOfActionType Class The CoursesOfActionType class specifies a set of one or more actions that could be taken in regard to cyber threats. The properties of the CoursesOfActionType class are given in Table 35. Table 35. Properties of the CoursesOfActionType class Name Type Multiplicity Description Course_Of_Action stixCommon: CourseOfActionBaseType 1..* The Course_Of_Action property characterizes a Course of Action that could be taken in regard to one of more cyber threats. The
stix-v1.2.1-part3-core.docx