defined elsewhere can be specified via the direct use of the class. ThreatActorBaseType RelatedTTPType Class The class characterizes a relationship to a TTP. It extends the superclass by specifying a related TTP. RelatedTTPType GenericRelationshipType The UML diagram corresponding to the class is shown in Figure 314. RelatedTTPType Figure 314. UML diagram of the class RelatedTTPType The property given in Table 322 corresponds to the UML diagram shown in Figure 314. Table 322. Properties of the class RelatedTTPType Name Type Multiplicity Description The TTP property characterizes a cyber threat adversary Tactic, Technique or Procedure (TTP). The class is a minimal base class that is intended to TTPBaseType be extended. The default and strongly RECOMMENDED class to fully implement a TTP is the class defined in . Base classes are used to minimize TTP TTPBaseType 1 ttp:TTPType interdependence between STIX components, not to enable or encourage conflicting syntactic variation. Through the use of the property, a reference to a TTP idref defined elsewhere can be specified via the direct use of the class. TTPBaseType Content Aggregation Classes A content aggregation class captures a collection of one (or zero, in some cases) or more STIX objects. Some content aggregation classes are very straightforward and simply capture a set of objects. However, others such as the abstract class are intended to be GenericRelationshipListType extended (see Section 3.3.1). GenericRelationshipListType The class specifies how the relationships between a subject STIX construct and a set of one or more other STIX GenericRelationshipListType constructs should be interpreted. It is an abstract class, and it MUST be extended via a subclass to characterize the actual set of related constructs.
defined elsewhere can be specified via the direct use of the ThreatActorBaseType class. RelatedTTPType Class The RelatedTTPType class characterizes a relationship to a TTP. It extends the GenericRelationshipType superclass by specifying a related TTP. The UML diagram corresponding to the RelatedTTPType class is shown in Figure 314. Figure 314. UML diagram of the RelatedTTPType class The property given in Table 322 corresponds to the UML diagram shown in Figure 314. Table 322. Properties of the RelatedTTPType class Name Type Multiplicity Description TTP TTPBaseType 1 The TTP property characterizes a cyber threat adversary Tactic, Technique or Procedure (TTP). The TTPBaseType class is a minimal base class that is intended to be extended. The default and strongly RECOMMENDED class to fully implement a TTP is the ttp:TTPType class defined in . Base classes are used to minimize interdependence between STIX components, not to enable or encourage conflicting syntactic variation. Through the use of the idref property, a reference to a TTP defined elsewhere can be specified via the direct use of the TTPBaseType class. Content Aggregation Classes A content aggregation class captures a collection of one (or zero, in some cases) or more STIX objects. Some content aggregation classes are very straightforward and simply capture a set of objects. However, others such as the GenericRelationshipListType abstract class are intended to be extended (see Section 3.3.1). GenericRelationshipListType The GenericRelationshipListType class specifies how the relationships between a subject STIX construct and a set of one or more other STIX constructs should be interpreted. It is an abstract class, and it MUST be extended via a subclass to characterize the actual set of related constructs.
stix-v1.2.1-csprd01-part2-common.docx