The property captures a log of events or actions History History 0..1 HistoryType during the handling of the Incident. The property characterizes the Information_Source stixCommon: source of the Incident information. Examples of details Information_Source 0..1 captured include identitifying characteristics, time-related InformationSourceType attributes, and a list of tools used to collect the information. The property specifies the appropriate data Handling handling markings for the properties of this Incident. The Handling 0..1 marking:MarkingType marking scope is limited to the Incident and the content is contains. Note that data handling markings can also be specified at a higher level. stixCommon: The property specifies a set of one or Related_Packages Related_Packages 0..1 more STIX Packages that are related to the Incident. RelatedPackageRefsType IncidentVersionType Enumeration The enumeration is an inventory of all versions of the Incident data for STIX Version 1.2.1. The enumeration IncidentVersionType literals are given in Table 32. Table 32. Literals of the enumeration IncidentVersionType Enumeration Literal Description stix-1.2.1 Incident data model for STIX v1.2.1 ExternalIDType The provides a reference to an ID of an incident in a remote system. ExternalIDType The properties of the class are given in Table 33. ExternalIDType 33. Properties of the class ExternalIDType
History HistoryType 0..1 The History property captures a log of events or actions during the handling of the Incident. Information_Source stixCommon: InformationSourceType 0..1 The Information_Source property characterizes the source of the Incident information. Examples of details captured include identitifying characteristics, time-related attributes, and a list of tools used to collect the information. Handling marking:MarkingType 0..1 The Handling property specifies the appropriate data handling markings for the properties of this Incident. The marking scope is limited to the Incident and the content is contains. Note that data handling markings can also be specified at a higher level. Related_Packages stixCommon: RelatedPackageRefsType 0..1 The Related_Packages property specifies a set of one or more STIX Packages that are related to the Incident. IncidentVersionType Enumeration The IncidentVersionType enumeration is an inventory of all versions of the Incident data for STIX Version 1.2.1. The enumeration literals are given in Table 32. Table 32. Literals of the IncidentVersionType enumeration Enumeration Literal Description stix-1.2.1 Incident data model for STIX v1.2.1 ExternalIDType The ExternalIDType provides a reference to an ID of an incident in a remote system. The properties of the ExternalIDType class are given in Table 33. 33. Properties of the ExternalIDType class
stix-v1.2.1-part6-incident.docx