The property specifies a test mechanism specification in its Specification native format. The specification should be encoded so that it is compliant with stixCommon: Specification 0..1 NativeFormatString the chosen test mechanism formalism, however this is not a requirement of the STIX specification. OpenIOC Test Mechanism Data Model v1.2 The default extension class for representing OpenIOC test mechanisms in STIX v1.2.1 is the class defined OpenIOC2010TestMechanismType below. The underlying data model being referenced is OpenIOC An Open Framework for Sharing Threat Intelligence . – OpenIOC2010TestMechanismType Class The enables OpenIOC indicators of compromise, as defined in the 2010 Open IOC data model, to be OpenIOC2010TestMechanismType leveraged as test mechanisms of an Indicator. The class is a specialization of the abstract superclass defined in . It is TestMechanismType contained in the package. stix-openioc The UML diagram corresponding to the class is shown in Figure 39. OpenIOC2010TestMechanismType Figure . UML diagram for class OpenIOC2010TestMechanismType The properties of the class specialization is listed in Table 311. OpenIOC2010TestMechanismType Table . Properties of the class OpenIOC2010TestMechanismType Name Type Multiplicity Description The property specifies the structured specification of an OpenIOC ioc test mechanism, which will typically be semantically equivalent to the Observables captured in the Indicator. An Indicator of Compromise ioc 1 ioc:IndicatorOfCompromise (IOC) instance captures information such as a textual description of the indicator, keywords associated with the indicator, and author information, as well as the actual indicator definition pattern. OVAL Test Mechanism Data Model v1.2 The default extension class for representing OVAL test mechanisms in STIX v1.2.1 is the class defined below. OVAL5.10TestMechanismType The underlying data model being referenced is OVAL - Open Vulnerability and Assessment Language .
Specification stixCommon: NativeFormatString 0..1 The Specification property specifies a test mechanism specification in its native format. The specification should be encoded so that it is compliant with the chosen test mechanism formalism, however this is not a requirement of the STIX specification. OpenIOC Test Mechanism Data Model v1.2 The default extension class for representing OpenIOC test mechanisms in STIX v1.2.1 is the OpenIOC2010TestMechanismType class defined below. The underlying data model being referenced is OpenIOC – An Open Framework for Sharing Threat Intelligence . OpenIOC2010TestMechanismType Class The OpenIOC2010TestMechanismType enables OpenIOC indicators of compromise, as defined in the 2010 Open IOC data model, to be leveraged as test mechanisms of an Indicator. The class is a specialization of the abstract TestMechanismType superclass defined in . It is contained in the stix-openioc package. The UML diagram corresponding to the OpenIOC2010TestMechanismType class is shown in Figure 39. Figure . UML diagram for OpenIOC2010TestMechanismType class The properties of the OpenIOC2010TestMechanismType class specialization is listed in Table 311. Table . Properties of the OpenIOC2010TestMechanismType class Name Type Multiplicity Description ioc ioc:IndicatorOfCompromise 1 The ioc property specifies the structured specification of an OpenIOC test mechanism, which will typically be semantically equivalent to the Observables captured in the Indicator. An Indicator of Compromise (IOC) instance captures information such as a textual description of the indicator, keywords associated with the indicator, and author information, as well as the actual indicator definition pattern. OVAL Test Mechanism Data Model v1.2 The default extension class for representing OVAL test mechanisms in STIX v1.2.1 is the OVAL5.10TestMechanismType class defined below. The underlying data model being referenced is OVAL - Open Vulnerability and Assessment Language .
stix-v1.2.1-part12-extensions.docx