The property table of the class is given in Table 35. TTPsType . Properties of the class TTPsType Name Type Multiplicity Description The TTP property characterizes a cyber threat adversary Tactic, Technique or Procedure (TTP). The class stixCommon:TTPBaseType is a minimal base class that is intended to be extended. The default and strongly recommended class to fully implement a TTP is the class defined in . Base classes are used to minimize TTP stixCommon:TTPBaseType 0..* ttp:TTPType interdependence between STIX components, not to enable or encourage conflicting syntactic variation. However, through the use of the idref property, a reference to a TTP defined elsewhere can be specified via the direct use of the class. stixCommon:TTPBaseType IncidentsType Class The class specifies a set of one or more cyber threat Incidents. IncidentsType The properties of the class are given in Table 36. IncidentsType Table . Properties of the class IncidentsType Name Type Multiplicity Description The property characterizes a cyber threat Incident. The Incident class is a minimal base class that is stixCommon:IncidentBaseType intended to be extended. The default and strongly recommended class to fully implement an Incident is the class incident:IncidentType Incident stixCommon:IncidentBaseType 1..* defined in . Base classes are used to minimize interdependence between STIX components, not to enable or encourage conflicting syntactic variation. However, through the use of the property, a reference to idref an Incident defined elsewhere can be specified via the direct use of the class. stixCommon:IncidentBaseType
The property table of the TTPsType class is given in Table 35. . Properties of the TTPsType class Name Type Multiplicity Description TTP stixCommon:TTPBaseType 0..* The TTP property characterizes a cyber threat adversary Tactic, Technique or Procedure (TTP). The stixCommon:TTPBaseType class is a minimal base class that is intended to be extended. The default and strongly recommended class to fully implement a TTP is the ttp:TTPType class defined in . Base classes are used to minimize interdependence between STIX components, not to enable or encourage conflicting syntactic variation. However, through the use of the idref property, a reference to a TTP defined elsewhere can be specified via the direct use of the stixCommon:TTPBaseType class. IncidentsType Class The IncidentsType class specifies a set of one or more cyber threat Incidents. The properties of the IncidentsType class are given in Table 36. Table . Properties of the IncidentsType class Name Type Multiplicity Description Incident stixCommon:IncidentBaseType 1..* The Incident property characterizes a cyber threat Incident. The stixCommon:IncidentBaseType class is a minimal base class that is intended to be extended. The default and strongly recommended class to fully implement an Incident is the incident:IncidentType class defined in . Base classes are used to minimize interdependence between STIX components, not to enable or encourage conflicting syntactic variation. However, through the use of the idref property, a reference to an Incident defined elsewhere can be specified via the direct use of the stixCommon:IncidentBaseType class.
stix-v1.2.1-cs01-part11-report.docx