supported via the property of the structuring_format class. StructuredTextType The property captures a textual Short_Description stixCommon: description of the Indicator. This property is secondary and Short_Description 0..* should only be used if the property is already Description StructuredTextType populated and another, shorter description is available. The property specifies the time Valid_Time_Position Valid_Time_Position 0..* ValidTimeType window for which this Indicator is valid. The property characterizes an IndicatorExpression observable pattern associated with the Indicator. The class is a UML basicDataTypes:PatternExpression basicDataTypes: IndicatorExpression 0..1 interface, which can be realized using either the PatternExpression class (see ) or the cybox:ObservableType class (see below for CompositeIndicatorExpressionType more details). The property specifies a TTP indicated by the Indicated_TTP presence of the observable pattern within this Indicator and characterizes the relationship between the TTP and the Indicator Indicated_TTP 0..* stixCommon:RelatedTTPType by capturing information such as the of confidence that the observable pattern indicates the TTP, the source of the relationship information, and the type of relationship. The property specifies a set of one or Kill_Chain_Phases more kill chain phases (from one or more kill chains defined stixCommon: Kill_Chain_Phases 0..1 elsewere) relevant to the Indicator. The kill chain property is KillChainPhasesReferenceType further defined in the STIX Common specification document. For more details on the cyber kill chain see . The property specifies a set of one or more Test_Mechanisms Test_Mechanisms 0..1 TestMechanismsType test mechanisms effective at identifying the Observable patterns characterized in the Indicator. The property characterizes the probable Likely_Impact Likely_Impact 0..1 stixCommon:StatementType impact if the TTP indicated by the presence of the indicator pattern were to which includes a property that Value
supported via the structuring_format property of the StructuredTextType class. Short_Description stixCommon: StructuredTextType 0..* The Short_Description property captures a textual description of the Indicator. This property is secondary and should only be used if the Description property is already populated and another, shorter description is available. Valid_Time_Position ValidTimeType 0..* The Valid_Time_Position property specifies the time window for which this Indicator is valid. IndicatorExpression basicDataTypes: PatternExpression 0..1 The IndicatorExpression property characterizes an observable pattern associated with the Indicator. The basicDataTypes:PatternExpression class is a UML interface, which can be realized using either the cybox:ObservableType class (see ) or the CompositeIndicatorExpressionType class (see below for more details). Indicated_TTP stixCommon:RelatedTTPType 0..* The Indicated_TTP property specifies a TTP indicated by the presence of the observable pattern within this Indicator and characterizes the relationship between the TTP and the Indicator by capturing information such as the of confidence that the observable pattern indicates the TTP, the source of the relationship information, and the type of relationship. Kill_Chain_Phases stixCommon: KillChainPhasesReferenceType 0..1 The Kill_Chain_Phases property specifies a set of one or more kill chain phases (from one or more kill chains defined elsewere) relevant to the Indicator. The kill chain property is further defined in the STIX Common specification document. For more details on the cyber kill chain see . Test_Mechanisms TestMechanismsType 0..1 The Test_Mechanisms property specifies a set of one or more test mechanisms effective at identifying the Observable patterns characterized in the Indicator. Likely_Impact stixCommon:StatementType 0..1 The Likely_Impact property characterizes the probable impact if the TTP indicated by the presence of the indicator pattern were to which includes a Value property that
stix-v1.2.1-csd01-part4-indicator.docx