Name Type Multiplicity Description The TTP property characterizes a threat adversary Tactic, Technique or Procedure (TTP). The class stixCommon:TTPBaseType is a minimal base class that is intended to be extended. The default and strongly recommended class to fully implement a TTP is the class defined in . Base classes are used to minimize TTP 0..* stixCommon:TTPBaseType ttp:TTPType interdependence between STIX components, not to enable or encourage conflicting syntactic variation. However, through the use of the idref property, a reference to a TTP defined elsewhere can be specified via the direct use of the class. stixCommon:TTPBaseType IncidentsType Class The class specifies a set of one or more cyber threat Incidents. IncidentsType The properties of the class are given in Table 36. IncidentsType Table 36. Properties of the class IncidentsType Name Type Multiplicity Description The property characterizes a cyber threat Incident. The Incident class is a minimal base class that is stixCommon:IncidentBaseType intended to be extended. The default and strongly recommended class to fully implement an Incident is the class incident:IncidentType Incident stixCommon:IncidentBaseType 1..* defined in . Base classes are used to minimize interdependence between STIX components, not to enable or encourage conflicting syntactic variation. However, through the use of the property, a reference to idref an Incident defined elsewhere can be specified via the direct use of the class. stixCommon:IncidentBaseType CoursesOfActionType Class The class specifies a set of one or more actions that could be taken in regard to cyber threats. CoursesOfActionType The properties of the class are given in Table 37. CoursesOfActionType
Name Type Multiplicity Description TTP stixCommon:TTPBaseType 0..* The TTP property characterizes a threat adversary Tactic, Technique or Procedure (TTP). The stixCommon:TTPBaseType class is a minimal base class that is intended to be extended. The default and strongly recommended class to fully implement a TTP is the ttp:TTPType class defined in . Base classes are used to minimize interdependence between STIX components, not to enable or encourage conflicting syntactic variation. However, through the use of the idref property, a reference to a TTP defined elsewhere can be specified via the direct use of the stixCommon:TTPBaseType class. IncidentsType Class The IncidentsType class specifies a set of one or more cyber threat Incidents. The properties of the IncidentsType class are given in Table 36. Table 36. Properties of the IncidentsType class Name Type Multiplicity Description Incident stixCommon:IncidentBaseType 1..* The Incident property characterizes a cyber threat Incident. The stixCommon:IncidentBaseType class is a minimal base class that is intended to be extended. The default and strongly recommended class to fully implement an Incident is the incident:IncidentType class defined in . Base classes are used to minimize interdependence between STIX components, not to enable or encourage conflicting syntactic variation. However, through the use of the idref property, a reference to an Incident defined elsewhere can be specified via the direct use of the stixCommon:IncidentBaseType class. CoursesOfActionType Class The CoursesOfActionType class specifies a set of one or more actions that could be taken in regard to cyber threats. The properties of the CoursesOfActionType class are given in Table 37.
stix-v1.2.1-csprd01-part11-report.docx