detailed information such as the stage in the cyber threat management lifecycle to which the course of action is relevant, the impact and cost of applying the course of action, and efficacy of the course of action. The property table for the class is given in Table 337. ActivityType Table . Properties of the class ActivityType Name Type Multiplicity Description The property specifies the date and time at which the activity Date_Time occurred. To avoid ambiguity, all timestamps SHOULD include a specification of the time zone. In addition to specifying a date and time, the property may also capture a property to specify the Date_Time precision Date_Time DateTimeWithPrecisionType 1 granularity with which the time should be considered, as specified by the enumeration (e.g., 'hour,' 'minute'). If omitted, DateTimePrecisionEnum the default precision is 'second.' Digits in a timestamp that are beyond the specified precision SHOULD be zeroed out. The property captures a textual description of the activity. Description Description StructuredTextType 0..* Any length is permitted. Optional formatting is supported via the property of the class. structuring_format StructuredTextType AddressAbstractType Class The class characterizes geographic address information. It is an abstract class, so it MUST be extended via a subclass AddressAbstractType to capture an address. STIX v1.2.1 defines the subclass as a default extension to leverage the OASIS CIQAddress3.0InstanceType Customer Information Quality (CIQ) data model, which is a set of XML specifications for representing characteristic information about individuals and organizations. Details are provided in . The class has no properties of its own (so there is no associated property table). Its UML diagram is illustrated in Figure AddressAbstractType 317. Figure . UML diagram of the class AddressAbstractType ConfidenceType Class The class characterizes confidence in an assertion. ConfidenceType
detailed information such as the stage in the cyber threat management lifecycle to which the course of action is relevant, the impact and cost of applying the course of action, and efficacy of the course of action. The property table for the ActivityType class is given in Table 337. Table . Properties of the ActivityType class Name Type Multiplicity Description Date_Time DateTimeWithPrecisionType 1 The Date_Time property specifies the date and time at which the activity occurred. To avoid ambiguity, all timestamps SHOULD include a specification of the time zone. In addition to specifying a date and time, the Date_Time property may also capture a precision property to specify the granularity with which the time should be considered, as specified by the DateTimePrecisionEnum enumeration (e.g., 'hour,' 'minute'). If omitted, the default precision is 'second.' Digits in a timestamp that are beyond the specified precision SHOULD be zeroed out. Description StructuredTextType 0..* The Description property captures a textual description of the activity. Any length is permitted. Optional formatting is supported via the structuring_format property of the StructuredTextType class. AddressAbstractType Class The AddressAbstractType class characterizes geographic address information. It is an abstract class, so it MUST be extended via a subclass to capture an address. STIX v1.2.1 defines the CIQAddress3.0InstanceType subclass as a default extension to leverage the OASIS Customer Information Quality (CIQ) data model, which is a set of XML specifications for representing characteristic information about individuals and organizations. Details are provided in . The AddressAbstractType class has no properties of its own (so there is no associated property table). Its UML diagram is illustrated in Figure 317. Figure . UML diagram of the AddressAbstractType class ConfidenceType Class The ConfidenceType class characterizes confidence in an assertion.
stix-v1.2.1-part2-common.docx