a (ciq address); capec; ciq; stix-ciqidentity; maec; Prefix tlpMarking; cvrf; ioc; oval-def; oval-var Various packages are used by STIX extensions. Details are Description in . capec:Attack_PatternType Example Package STIX Basic Data Types Prefix basicDataTypes The STIX Basic Data Types data model defines the types Description used within STIX. Example basicDataTypes:URI Package STIX Indicator Prefix indicator conveys specific The STIX Indicator data model Observable patterns combined with contextual Description information intended to represent artifacts and/or behaviors of interest within a cyber security context. Example indicator:TestMechanismType Package STIX Incident Prefix incident The STIX Incident data model captures discrete instances of Description a specific set of observed events or properties affecting an organization. Example incident:AffectedAssetType Package STIX TTP Prefix ttp The STIX TTP data model captures the behavior or modus Description operandi of cyber adversaries. Example ttp:AttackPatternType Package STIX Campaign Prefix campaign The STIX Campaign data encompasses one or more Threat Actors pursuing an Intended Effect as observed Description through sets of Incidents and/or TTP, potentially across organizations. Example campaign:AttributionType
Prefix a (ciq address); capec; ciq; stix-ciqidentity; maec; tlpMarking; cvrf; ioc; oval-def; oval-var Description Various packages are used by STIX extensions. Details are in . Example capec:Attack_PatternType Package STIX Basic Data Types Prefix basicDataTypes Description The STIX Basic Data Types data model defines the types used within STIX. Example basicDataTypes:URI Package STIX Indicator Prefix indicator Description The STIX Indicator data model conveys specific Observable patterns combined with contextual information intended to represent artifacts and/or behaviors of interest within a cyber security context. Example indicator:TestMechanismType Package STIX Incident Prefix incident Description The STIX Incident data model captures discrete instances of a specific set of observed events or properties affecting an organization. Example incident:AffectedAssetType Package STIX TTP Prefix ttp Description The STIX TTP data model captures the behavior or modus operandi of cyber adversaries. Example ttp:AttackPatternType Package STIX Campaign Prefix campaign Description The STIX Campaign data encompasses one or more Threat Actors pursuing an Intended Effect as observed through sets of Incidents and/or TTP, potentially across organizations. Example campaign:AttributionType
stix-v1.2.1-cs01-part1-overview.docx