nor necessarily part of any existing vocabulary). The content creator may choose any arbitrary value or may constrain the set of possible values by referencing an externally-defined vocabulary or leveraging a formally defined vocabulary extending from the stixCommon:ControlledVocabularyStringType class. The STIX default vocabulary class for use in the property is ‘CampaignStatusVocab-1.0’. The property specifies a set of one or more Related_TTPs Related_TTPs 0..1 RelatedTTPsType TTPs leveraged within the Campaign (or in some way related to a Campaign). The property specifies a set of one or RelatedIncidents Related_Incidents 0..1 RelatedIncidentsType more Incidents that are part of the Campaign (or in some way related to the Campaign). The property specifies a set of one Related_Indicators or more Indicators relevant to the Campaign. Note: as Related_Indicators 0..1 RelatedIndicatorsType discussed in Section 3.5, this property is deprecated and is planned for removal in STIX Campaign Version 2.0. The property specifies attribution information Attribution in the form of a set of one or more Threat Actors who are Attribution 0..* AttributionType asserted to be responsible for the Campaign. Multiple groups can be captured by defining multiple Attribution elements. The property specifies a set of Associated_Campaigns Associated_Campaigns 0..1 AssociatedCampaignsType one or more Campaigns related to this Campaign. The property characterizes the level of Confidence Confidence 0..1 stixCommon:ConfidenceType confidence in the accuracy of the collection of information captured for the Campaign. The property characterizes a defender activity Activity associated with the Campaign. Its underlying abstract class Activity 0..* stixCommon:ActivityType must be extended to include the chosen format of activity characterization. The property characterizes the Information_Source Information_Source 0..1 stixCommon: source of the Campaign information. Examples of details
nor necessarily part of any existing vocabulary). The content creator may choose any arbitrary value or may constrain the set of possible values by referencing an externally-defined vocabulary or leveraging a formally defined vocabulary extending from the stixCommon:ControlledVocabularyStringType class. The STIX default vocabulary class for use in the property is ‘CampaignStatusVocab-1.0’. Related_TTPs RelatedTTPsType 0..1 The Related_TTPs property specifies a set of one or more TTPs leveraged within the Campaign (or in some way related to a Campaign). Related_Incidents RelatedIncidentsType 0..1 The RelatedIncidents property specifies a set of one or more Incidents that are part of the Campaign (or in some way related to the Campaign). Related_Indicators RelatedIndicatorsType 0..1 The Related_Indicators property specifies a set of one or more Indicators relevant to the Campaign. Note: as discussed in Section 3.5, this property is deprecated and is planned for removal in STIX Campaign Version 2.0. Attribution AttributionType 0..* The Attribution property specifies attribution information in the form of a set of one or more Threat Actors who are asserted to be responsible for the Campaign. Multiple groups can be captured by defining multiple Attribution elements. Associated_Campaigns AssociatedCampaignsType 0..1 The Associated_Campaigns property specifies a set of one or more Campaigns related to this Campaign. Confidence stixCommon:ConfidenceType 0..1 The Confidence property characterizes the level of confidence in the accuracy of the collection of information captured for the Campaign. Activity stixCommon:ActivityType 0..* The Activity property characterizes a defender activity associated with the Campaign. Its underlying abstract class must be extended to include the chosen format of activity characterization. Information_Source stixCommon: 0..1 The Information_Source property characterizes the source of the Campaign information. Examples of details
stix-v1.2.1-part8-campaign.docx