A cyber kill chain is a phase-based model to describe the stages of an attack. The property specifies a set of one or more specific kill chain Kill_Chains definitions. The property is further defined in the STIX Common kill_chain Kill_Chains stixCommon:KillChainsType 0..1 specification document. Note that kill chains may also be defined using the property of the TTP class, which is equivalent to this Kill_Chains TTPType property. Suggested practice is to use the TTP TTPType Kill_Chains property (rather than this property) to define a kill chain. ReportsType The class specifies a set of one or more cyber threat Reports. ReportsType The properties of the class are given in Table 310. ReportsType Table 310. Properties of class ReportsType Name Type Multiplicity Description The property characterizes a cyber threat Report. The BaseType Report stixCommon:Report class is a minimal base class that is intended to be extended. The default and strongly stixCommon: Report 1..* recommended class to fully implement a Report is the class defined in . report:ReportType ReportBaseType Base classes are used to minimize interdependence between STIX components, not to enable or encourage conflicting syntactic variation. RelatedPackagesType Class The class specifies a set of one or more STIX Package related to this STIX Package. It extends the RelatedPackagesType superclass defined in the STIX Common data model, which specifies the scope (whether the elements of the GenericRelationShipListType set are related individually or as a group). The UML diagram corresponding to the class is shown in Figure 32, and the specialized properties are shown in Table RelatedPackagesType 311. Figure 32. UML diagram for class RelatedPackagesType In addition to being a property of the class, is a property of all of the top-level component types. STIXType Related_Packages
Kill_Chains stixCommon:KillChainsType 0..1 A cyber kill chain is a phase-based model to describe the stages of an attack. The Kill_Chains property specifies a set of one or more specific kill chain definitions. The kill_chain property is further defined in the STIX Common specification document. Note that kill chains may also be defined using the Kill_Chains property of the TTP TTPType class, which is equivalent to this property. Suggested practice is to use the TTP TTPType Kill_Chains property (rather than this property) to define a kill chain. ReportsType The ReportsType class specifies a set of one or more cyber threat Reports. The properties of the ReportsType class are given in Table 310. Table 310. Properties of ReportsType class Name Type Multiplicity Description Report stixCommon: ReportBaseType 1..* The Report property characterizes a cyber threat Report. The stixCommon:Report BaseType class is a minimal base class that is intended to be extended. The default and strongly recommended class to fully implement a Report is the report:ReportType class defined in . Base classes are used to minimize interdependence between STIX components, not to enable or encourage conflicting syntactic variation. RelatedPackagesType Class The RelatedPackagesType class specifies a set of one or more STIX Package related to this STIX Package. It extends the GenericRelationShipListType superclass defined in the STIX Common data model, which specifies the scope (whether the elements of the set are related individually or as a group). The UML diagram corresponding to the RelatedPackagesType class is shown in Figure 32, and the specialized properties are shown in Table 311. Figure 32. UML diagram for RelatedPackagesType class In addition to being a property of the STIXType class, Related_Packages is a property of all of the top-level component types.
stix-v1.2.1-part3-core.docx