The property specifies the or disposition of the Incident. Status Examples of potential statuses are and (these new, open, closed specific values are only provided to help explain the property: they are neither recommended values nor necessarily part of any existing vocabulary). The content creator may choose any arbitrary value or stixCommon: Status 0..1 may constrain the set of possible values by referencing an VocabularyStringType externally-defined vocabulary or leveraging a formally defined vocabulary extending from the class. The stixCommon:ControlledVocabularyStringType STIX default vocabulary class for use in the property is Status ‘IncidentStatusVocab-1.0’. The property specifies a set of one or more Related_Indicators other Indicators relevant to the Incident whether they were the 0..1 Related_Indicators RelatedIndicatorsType triggers that initiated the incident response or they are a result of the incident investigation analysis and may be of value in detecting the adversary TTPs leveraged in the incident. The property specifies a set of one or Related_Observables Related_Observables 0..1 RelatedObservablesType more observable instances that were observed in relation to the Incident. The property specifies a set of one or more Leveraged_TTPs Leveraged_TTPs 0..1 LeveragedTTPsType TTPs that are asserted as having been leveraged in the Incident. The property specifies a set of one Attributed_Threat_Actors Attributed_Threat_Actors AttributedThreatActorsType 0..1 or more other Threat Actors that have been attributed to the Incident.
Status stixCommon: VocabularyStringType 0..1 The Status property specifies the or disposition of the Incident. Examples of potential statuses are new, open, and closed (these specific values are only provided to help explain the property: they are neither recommended values nor necessarily part of any existing vocabulary). The content creator may choose any arbitrary value or may constrain the set of possible values by referencing an externally-defined vocabulary or leveraging a formally defined vocabulary extending from the stixCommon:ControlledVocabularyStringType class. The STIX default vocabulary class for use in the Status property is ‘IncidentStatusVocab-1.0’. Related_Indicators RelatedIndicatorsType 0..1 The Related_Indicators property specifies a set of one or more other Indicators relevant to the Incident whether they were the triggers that initiated the incident response or they are a result of the incident investigation analysis and may be of value in detecting the adversary TTPs leveraged in the incident. Related_Observables RelatedObservablesType 0..1 The Related_Observables property specifies a set of one or more observable instances that were observed in relation to the Incident. Leveraged_TTPs LeveragedTTPsType 0..1 The Leveraged_TTPs property specifies a set of one or more TTPs that are asserted as having been leveraged in the Incident. Attributed_Threat_Actors AttributedThreatActorsType 0..1 The Attributed_Threat_Actors property specifies a set of one or more other Threat Actors that have been attributed to the Incident.
stix-v1.2.1-csd01-part6-incident.docx