captured include identitifying characteristics, time-related attributes, and a list of the tools used to collect the information. Content Aggregation Each component type has an associated aggregation class that has one main property a set of instances of that component type whether directly – specified or included via reference. The aggregation class for Observables, is defined in the . cybox_core:ObservablesType, IndicatorsType Class The class specifies a set of one or more cyber threat Indicators. IndicatorsType The properties of the class are given in Table 34. IndicatorsType Table 34. Properties of the class IndicatorsType Name Type Multiplicity Description The property characterizes a threat Indicator. The Indicator class is a minimal base class stixCommon:IndicatorBaseType that is intended to be extended. The default and strongly recommended class to fully implement an Indicator is the class defined in . Base classes are indicator:IndicatorType Indicator 1..* stixCommon:IndicatorBaseType used to minimize interdependence between STIX components, not to enable or encourage conflicting syntactic variation. However, through the use of the property, a reference to an Indicator idref defined elsewhere can be specified via the direct use of the class. stixCommon:IndicatorBaseType TTPsType Class The class specifies a set of zero or more cyber threat TTPs. TTPsType The property table of the class is given in Table 35. TTPsType Table 35. Properties of the class TTPsType
captured include identitifying characteristics, time-related attributes, and a list of the tools used to collect the information. Content Aggregation Each component type has an associated aggregation class that has one main property – a set of instances of that component type whether directly specified or included via reference. The aggregation class for Observables, cybox_core:ObservablesType, is defined in the . IndicatorsType Class The IndicatorsType class specifies a set of one or more cyber threat Indicators. The properties of the IndicatorsType class are given in Table 34. Table 34. Properties of the IndicatorsType class Name Type Multiplicity Description Indicator stixCommon:IndicatorBaseType 1..* The Indicator property characterizes a threat Indicator. The stixCommon:IndicatorBaseType class is a minimal base class that is intended to be extended. The default and strongly recommended class to fully implement an Indicator is the indicator:IndicatorType class defined in . Base classes are used to minimize interdependence between STIX components, not to enable or encourage conflicting syntactic variation. However, through the use of the idref property, a reference to an Indicator defined elsewhere can be specified via the direct use of the stixCommon:IndicatorBaseType class. TTPsType Class The TTPsType class specifies a set of zero or more cyber threat TTPs. The property table of the TTPsType class is given in Table 35. Table 35. Properties of the TTPsType class
stix-v1.2.1-csprd01-part11-report.docx