STIX[TM] Report Data Model The primary class of the STIX Report package is the class, which defines a contextual wrapper for a grouping of STIX content. Similar to the ReportType primary classes of all of the component data models in STIX, the class extends a base class defined in the STIX Common data model; more ReportType specifically, it extends the base class, which provides the essential identifier (id) and identifier reference (idref) properties. ReportBaseType The relationship between the and the base class, as well as the properties of the class, are illustrated ReportType ReportBaseType ReportType in the UML diagram given in Figure 31 on page 14. The property table, which includes property descriptions and corresponds to the UML diagram given in Figure 31, is provided in Table 31. All classes defined in the Report data model are described in detail in Sections 3.2 and 3.3. Details are not provided for classes defined in non-Report data models; instead, the reader is refered to the corresponding data model specification as indicated by the package prefix specified in the Type column of the table. Figure 31. UML diagram of the class ReportType Table 31. Properties of the class ReportType Name Type Multiplicity Description The property specifies the version number of the version version ReportVersionEnum 0..1 STIX Report data model for STIX v1.2.1 used to capture the information associated with the Report. The property characterizes the contextual information Header Header 0..1 HeaderType for this grouping of STIX content. The property specifies a set of one or more Observables Observables 0..1 cybox:ObservablesType observables. The property specifies a set of one or more Indicators Indicators 0..1 IndicatorsType cyber threat Indicators. The property specifies a set of one or more cyber threat TTPs TTPs TTPsType 0..1 adversary Tactics, Techniques or Procedures.
STIX[TM] Report Data Model The primary class of the STIX Report package is the ReportType class, which defines a contextual wrapper for a grouping of STIX content. Similar to the primary classes of all of the component data models in STIX, the ReportType class extends a base class defined in the STIX Common data model; more specifically, it extends the ReportBaseType base class, which provides the essential identifier (id) and identifier reference (idref) properties. The relationship between the ReportType and the ReportBaseType base class, as well as the properties of the ReportType class, are illustrated in the UML diagram given in Figure 31 on page 14. The property table, which includes property descriptions and corresponds to the UML diagram given in Figure 31, is provided in Table 31. All classes defined in the Report data model are described in detail in Sections 3.2 and 3.3. Details are not provided for classes defined in non-Report data models; instead, the reader is refered to the corresponding data model specification as indicated by the package prefix specified in the Type column of the table. Figure 31. UML diagram of the ReportType class Table 31. Properties of the ReportType class Name Type Multiplicity Description version ReportVersionEnum 0..1 The version property specifies the version number of the STIX Report data model for STIX v1.2.1 used to capture the information associated with the Report. Header HeaderType 0..1 The Header property characterizes the contextual information for this grouping of STIX content. Observables cybox:ObservablesType 0..1 The Observables property specifies a set of one or more observables. Indicators IndicatorsType 0..1 The Indicators property specifies a set of one or more cyber threat Indicators. TTPs TTPsType 0..1 The TTPs property specifies a set of one or more cyber threat adversary Tactics, Techniques or Procedures.
stix-v1.2.1-csprd01-part11-report.docx