will indicate that the property can be chosen with multiplicity 1 or the API_Call Code “A(1)|B(0..1)” property can be chosen with multiplicity 0 or 1. Property and Class Descriptions Each class and property defined in STIX is described using the format, X property verb Y.” For “The example, in the specification for the STIX Indicator, we write, property specifies a globally unique “The id identifier for the kill chain instance.” In fact, the verb could have been replaced by any number “specifies” of alternatives: etc. “defines,” “describes,” “contains,” “references,” However, we thought that using a wide variety of verb phrases might confuse a reader of a specification document because the meaning of each verb could be interpreted slightly differently. On the other hand, we didn’t want to use a single, generic verb, such as because although the different verb “describes,” choices may or may not be meaningful from an implementation standpoint, a distinction could be useful to those interested in the modeling aspect of STIX. Consequently, we have chosen to use the verbs, defined as follows, in class and property descriptions: Verb STIX Definition Used to record and preserve information without implying anything about the captures structure of a class or property. Often used for properties that encompass general content. This is the least precise of the three verbs. Examples: The property characterizes the source of the sighting information. Source Examples of details captured include identitifying characteristics, time-related attributes, and a list of the tools used to collect the information. The property captures a textual description of the Indicator. Description Describes the distinctive nature or features of a class or property. Often used to characterizes describe classes and properties that themselves comprise one or more other properties. Examples: The property characterizes the level of confidence in the accuracy Confidence of the overall content captured in the Incident. The characterizes basic information about an activity a ActivityType defender might use in response to a Campaign. Used to clearly and precisely identify particular instances or values associated with a property. Often used for properties that are defined by a controlled specifies vocabulary or enumeration; typically used for properties that take on only a single value. Example: The property specifies the version identifier of the STIX Campaign data version model used to capture the information associated with the Campaign.
“A(1)|B(0..1)” will indicate that the API_Call property can be chosen with multiplicity 1 or the Code property can be chosen with multiplicity 0 or 1. Property and Class Descriptions Each class and property defined in STIX is described using the format, “The X property verb Y.” For example, in the specification for the STIX Indicator, we write, “The id property specifies a globally unique identifier for the kill chain instance.” In fact, the verb “specifies” could have been replaced by any number of alternatives: “defines,” “describes,” “contains,” “references,” etc. However, we thought that using a wide variety of verb phrases might confuse a reader of a specification document because the meaning of each verb could be interpreted slightly differently. On the other hand, we didn’t want to use a single, generic verb, such as “describes,” because although the different verb choices may or may not be meaningful from an implementation standpoint, a distinction could be useful to those interested in the modeling aspect of STIX. Consequently, we have chosen to use the verbs, defined as follows, in class and property descriptions: Verb STIX Definition captures Used to record and preserve information without implying anything about the structure of a class or property. Often used for properties that encompass general content. This is the least precise of the three verbs. Examples: The Source property characterizes the source of the sighting information. Examples of details captured include identitifying characteristics, time-related attributes, and a list of the tools used to collect the information. The Description property captures a textual description of the Indicator. characterizes Describes the distinctive nature or features of a class or property. Often used to describe classes and properties that themselves comprise one or more other properties. Examples: The Confidence property characterizes the level of confidence in the accuracy of the overall content captured in the Incident. The ActivityType characterizes basic information about an activity a defender might use in response to a Campaign. specifies Used to clearly and precisely identify particular instances or values associated with a property. Often used for properties that are defined by a controlled vocabulary or enumeration; typically used for properties that take on only a single value. Example: The version property specifies the version identifier of the STIX Campaign data model used to capture the information associated with the Campaign.
stix-v1.2.1-part6-incident.docx