The properties of the are given in Table 33. ValidTimeType 33. Properties of the class ValidTimeType Name Type Multiplicity Description The property specifies the beginning of the temporal window in Start_Time which an Indicator is able to accurately detect the TTP. To avoid ambiguity, timestamps SHOULD include a specification of the time zone. In addition to capturing a date and time, the property MAY also capture a Start_Time stixCommon: property to specify the granularity with which the time should be precision Start_Time 0..1 considered, as specified by the enumeration (e.g., DateTimePrecisionEnum DateTimeWithPrecisionType 'hour,' 'minute'). If the property is not present, then there is no Start_Time constraint on the earliest time for which the Indicator is able to accurately detect the TTP (i.e., the temporal window is only bounded by the End_Time property, if present). The property specifies the end of the temporal window in which an End_Time Indicator is able to accurately detect the TTP. To avoid ambiguity, timestamps SHOULD include a specification of the time zone. In addition to capturing a date and time, the property MAY also capture a End_Time precision stixCommon: property to specify the granularity with which the time should be considered, as End_Time 0..1 specified by the enumeration (e.g., 'hour,' DateTimePrecisionEnum DateTimeWithPrecisionType 'minute'). If the property is not present, then there is no constraint End_Time on the latest time for which the Indicator is able to accurately detect the TTP (i.e., the temporal window is only bounded by the property, if Start_Time present). CompositeIndicatorExpressionType Class The class characterizes a composite Indicator expression through the specification of a single CompositeIndicatorExpressionType operator (the operator of the expression) and zero or more Indicators (the operands of the expression). The properties of the class are given in Table 34. CompositeIndiatorExpressionType It should be noted that each simple Indicator can individually and independently of whether a related composite Indicator triggers. A “trigger” composite Indicator will trigger only when the full specified logic on the set of individual Indicators that it comprises triggers.
The properties of the ValidTimeType are given in Table 33. 33. Properties of the ValidTimeType class Name Type Multiplicity Description Start_Time stixCommon: DateTimeWithPrecisionType 0..1 The Start_Time property specifies the beginning of the temporal window in which an Indicator is able to accurately detect the TTP. To avoid ambiguity, timestamps SHOULD include a specification of the time zone. In addition to capturing a date and time, the Start_Time property MAY also capture a precision property to specify the granularity with which the time should be considered, as specified by the DateTimePrecisionEnum enumeration (e.g., 'hour,' 'minute'). If the Start_Time property is not present, then there is no constraint on the earliest time for which the Indicator is able to accurately detect the TTP (i.e., the temporal window is only bounded by the End_Time property, if present). End_Time stixCommon: DateTimeWithPrecisionType 0..1 The End_Time property specifies the end of the temporal window in which an Indicator is able to accurately detect the TTP. To avoid ambiguity, timestamps SHOULD include a specification of the time zone. In addition to capturing a date and time, the End_Time property MAY also capture a precision property to specify the granularity with which the time should be considered, as specified by the DateTimePrecisionEnum enumeration (e.g., 'hour,' 'minute'). If the End_Time property is not present, then there is no constraint on the latest time for which the Indicator is able to accurately detect the TTP (i.e., the temporal window is only bounded by the Start_Time property, if present). CompositeIndicatorExpressionType Class The CompositeIndicatorExpressionType class characterizes a composite Indicator expression through the specification of a single operator (the operator of the expression) and zero or more Indicators (the operands of the expression). The properties of the CompositeIndiatorExpressionType class are given in Table 34. It should be noted that each simple Indicator can “trigger” individually and independently of whether a related composite Indicator triggers. A composite Indicator will trigger only when the full specified logic on the set of individual Indicators that it comprises triggers.
stix-v1.2.1-csd01-part4-indicator.docx