time for a specific version of a Report defined elsewhere. The property has no defined semantic meaning if it is used timestamp without either the or property. id idref Relationship-Oriented Classes The STIX Common data defines a number of classes that capture relationships between STIX constructs through specialization of the GenericRelationshipType abstract class, which is defined first. GenericRelationshipType The class captures attributes associated with a relationship between a subject STIX construct and another STIX GenericRelationshipType construct. It is an abstract class, and it MUST be extended via a subclass to specify the other STIX constructs. Use of the class helps to define a consistent structure for relationships that go beyond a simple statement of A is GenericRelationshipType “construct related to construct B.” Instead, additional properties of the relationship can be specified such as the nature of the relationship and the level of confidence in the presence and accuracy of the asserted relationship. The property of the class is given in Table 39. GenericRelationshipType Table . Properties of the class GenericRelationshipType Name Type Multiplicity Description The property characterizes the level of confidence in the Confidence Confidence 0..1 ConfidenceType presence and accuracy of the asserted relationship. The property characterizes the source of the Information_Source relationship information. Examples of details captured include identitifying Information_Source InformationSourceType 0..1 characteristics, time-related attributes, and a list of tools used to collect the information. The property specifies the nature of the relationship Relationship between two STIX constructs. Examples of potential natures of relationship include Updates - Revises (for versioning of content), Asserted Same (for relating two Threat Actors), and Leverages (for relating two Relationship 0..1 VocabularyStringType TTPs). These specific values are only provided to help explain the property: they are neither recommended values nor necessarily part of any existing vocabulary). The content creator may choose any arbitrary value or may constrain the set of possible values by referencing an
time for a specific version of a Report defined elsewhere. The timestamp property has no defined semantic meaning if it is used without either the id or idref property. Relationship-Oriented Classes The STIX Common data defines a number of classes that capture relationships between STIX constructs through specialization of the GenericRelationshipType abstract class, which is defined first. GenericRelationshipType The GenericRelationshipType class captures attributes associated with a relationship between a subject STIX construct and another STIX construct. It is an abstract class, and it MUST be extended via a subclass to specify the other STIX constructs. Use of the GenericRelationshipType class helps to define a consistent structure for relationships that go beyond a simple statement of “construct A is related to construct B.” Instead, additional properties of the relationship can be specified such as the nature of the relationship and the level of confidence in the presence and accuracy of the asserted relationship. The property of the GenericRelationshipType class is given in Table 39. Table . Properties of the GenericRelationshipType class Name Type Multiplicity Description Confidence ConfidenceType 0..1 The Confidence property characterizes the level of confidence in the presence and accuracy of the asserted relationship. Information_Source InformationSourceType 0..1 The Information_Source property characterizes the source of the relationship information. Examples of details captured include identitifying characteristics, time-related attributes, and a list of tools used to collect the information. Relationship VocabularyStringType 0..1 The Relationship property specifies the nature of the relationship between two STIX constructs. Examples of potential natures of relationship include Updates - Revises (for versioning of content), Asserted Same (for relating two Threat Actors), and Leverages (for relating two TTPs). These specific values are only provided to help explain the property: they are neither recommended values nor necessarily part of any existing vocabulary). The content creator may choose any arbitrary value or may constrain the set of possible values by referencing an
stix-v1.2.1-part2-common.docx