basicDataTypes: The property captures a simple name for the kill chain name name 0..1 definition. NoEmbeddedQuoteString basicDataTypes: The property specifies the organization or definer definer 0..1 individual responsible for the kill chain definition. NoEmbeddedQuoteString The property specifies a reference associated reference reference 0..1 basicDataTypes:URI with the kill using a Uniform Resource Identifier (URI). The property specifies the number of number_of_phases number_of_phases 0..1 basicDataTypes:Integer phases in the kill chain. The property characterizes an Kill_Chain_Phase Kill_Chain_Phase 1..* KillChainPhaseType individual within the kill chain. KillChainPhaseType Class A cyber kill chain is a phase-based model to describe the stages of an attack, and a cyber kill chain phase is an individual phase within a kill chain definition. The property characterizes an individual phase within a kill chain. Kill_Chain_Phase The property table of the class is given in Table 334. KillChainPhaseType Table 334. Properties of the class KillChainPhaseType Name Type Multiplicity Description The property specifies a globally unique identifier for the kill chain phase. phase_id When used within a kill chain definition (defined by the class), it KillChainType basicDataTypes: identifies the kill chain phase being defined. When used within a kill chain reference phase_id 0..1 (defined by the class), it must reference an KillChainPhaseReferenceType QualifiedName existing kill chain property (note that this use is similar to the use of the phase_id property elsewhere in STIX.) idref The property captures a descriptive name of the kill chain phase. If the name class is extended by the KillChainPhaseType basicDataTypes: name 0..1 class, this attribute SHOULD be omitted, or if it KillChainPhaseReferenceType NoEmbeddedQuoteString is present, it MUST match the kill chain phase name used in the referenced kill chain.
name basicDataTypes: NoEmbeddedQuoteString 0..1 The name property captures a simple name for the kill chain definition. definer basicDataTypes: NoEmbeddedQuoteString 0..1 The definer property specifies the organization or individual responsible for the kill chain definition. reference basicDataTypes:URI 0..1 The reference property specifies a reference associated with the kill using a Uniform Resource Identifier (URI). number_of_phases basicDataTypes:Integer 0..1 The number_of_phases property specifies the number of phases in the kill chain. Kill_Chain_Phase KillChainPhaseType 1..* The Kill_Chain_Phase property characterizes an individual within the kill chain. KillChainPhaseType Class A cyber kill chain is a phase-based model to describe the stages of an attack, and a cyber kill chain phase is an individual phase within a kill chain definition. The Kill_Chain_Phase property characterizes an individual phase within a kill chain. The property table of the KillChainPhaseType class is given in Table 334. Table 334. Properties of the KillChainPhaseType class Name Type Multiplicity Description phase_id basicDataTypes: QualifiedName 0..1 The phase_id property specifies a globally unique identifier for the kill chain phase. When used within a kill chain definition (defined by the KillChainType class), it identifies the kill chain phase being defined. When used within a kill chain reference (defined by the KillChainPhaseReferenceType class), it must reference an existing kill chain phase_id property (note that this use is similar to the use of the idref property elsewhere in STIX.) name basicDataTypes: NoEmbeddedQuoteString 0..1 The name property captures a descriptive name of the kill chain phase. If the KillChainPhaseType class is extended by the KillChainPhaseReferenceType class, this attribute SHOULD be omitted, or if it is present, it MUST match the kill chain phase name used in the referenced kill chain.
stix-v1.2.1-csprd01-part2-common.docx