Table 34. Properties of the class CompositeIndicatorExpressionType Name Type Multiplicity Description The property specifies the logical composition operator for the operator operator 1 OperatorTypeEnum composite Indicator expression. The enumeration that defines valid operators in the Indicator v2.2 data model contains the operators AND and OR. The property characterizes a cyber threat indicator by capturing an Indicator asserted relationship between a pattern identifying certain observable conditions Indicator 0..* IndicatorType and a particular TTP likely in play if those observable conditions are seen, as well as contextual information about how and when it should be acted on and how it relates to other Indicators, Campaigns, and TTPs. OperatorTypeEnum Enumeration The enumeration is an inventory of valid operators for the class, which is used OperatorTypeEnum CompositeIndicatorExpressionType to define a compound Indicator expression. The enumeration literals are given in Table 35. Table 35. Literals of the enumeration OperatorTypeEnum Enumeration Literals Description AND Logical AND operator OR Logical OR operator TestMechanismsType Class A test mechanism is an alternative (non-CybOX) method of expressing an observable pattern; examples include Snort rules, Yara rules, and OVAL definitions. Test mechanisms may be provided by content producers to support consumers who rely on the relevant underlying tools and methods in their operations. An Indicator may contain both a CybOX-based Observable pattern (or a Composite Indicator Expression) and one or more semantically equivalent test mechanisms where equivalency means that the test mechanisms trigger on the same conditions as the Observable (note that this equivalency is not enforced by STIX). Just as an Indicator may contain an Observable or Composite Indicator without a test mechanism, it is also possible for an Indicator to contain one or more test mechanisms without containing an Observable or Composite
Table 34. Properties of the CompositeIndicatorExpressionType class Name Type Multiplicity Description operator OperatorTypeEnum 1 The operator property specifies the logical composition operator for the composite Indicator expression. The enumeration that defines valid operators in the Indicator v2.2 data model contains the operators AND and OR. Indicator IndicatorType 0..* The Indicator property characterizes a cyber threat indicator by capturing an asserted relationship between a pattern identifying certain observable conditions and a particular TTP likely in play if those observable conditions are seen, as well as contextual information about how and when it should be acted on and how it relates to other Indicators, Campaigns, and TTPs. OperatorTypeEnum Enumeration The OperatorTypeEnum enumeration is an inventory of valid operators for the CompositeIndicatorExpressionType class, which is used to define a compound Indicator expression. The enumeration literals are given in Table 35. Table 35. Literals of the OperatorTypeEnum enumeration Enumeration Literals Description AND Logical AND operator OR Logical OR operator TestMechanismsType Class A test mechanism is an alternative (non-CybOX) method of expressing an observable pattern; examples include Snort rules, Yara rules, and OVAL definitions. Test mechanisms may be provided by content producers to support consumers who rely on the relevant underlying tools and methods in their operations. An Indicator may contain both a CybOX-based Observable pattern (or a Composite Indicator Expression) and one or more semantically equivalent test mechanisms where equivalency means that the test mechanisms trigger on the same conditions as the Observable (note that this equivalency is not enforced by STIX). Just as an Indicator may contain an Observable or Composite Indicator without a test mechanism, it is also possible for an Indicator to contain one or more test mechanisms without containing an Observable or Composite
stix-v1.2.1-csd01-part4-indicator.docx