class. The STIX default vocabulary class for use in the property is ‘LocationClassVocab-1.0.’ The property characterizes the actual physical Location location of the affected asset. The underlying abstract stixCommon: Location 0..1 class MUST be extended. The default and strongly AddressAbstractType RECOMMENDED subclass is as defined in . CIQAddressInstanceType, The property Nature_Of_Security_Effect Nature_Of_Security_Effect 0..1 NatureOfSecurityEffectType characterizes how the security properties of the asset were affected. The property characterizes Structured_Description Structured_Description cybox:ObservablesType 0..1 the through specification of a structured cyber Observables instance. AssetTypeType The class characterizes the type of the Affected Asset. Examples of asset types are directory, firewall, PBX and cashier (these AssetTypeType specific values are only provided to help explain the property: they are neither recommended values nor necessarily part of any existing vocabulary). The content creator may choose any arbitrary value or may constrain the set of possible values by referencing an vocabulary or leveraging a formally defined vocabulary extending from the stixCommon:ControlledVocabularyStringType class. The STIX default vocabulary class for use in this property is 'AssetTypeVocab-1.0'. The property of the class is given in Table 38. AssetTypeType 38. Properties of the class AssetTypeType Name Type Multiplicity Description The property specifies the number of assets count_affected count_affected basicDataTypes:Integer 0..1 of this type affected in the Incident. NatureOfSecurityEffectType The class specifies a set of zero or more security properties affected by the Incident. NatureOfSecurityEffectType The property of the class is given in Table 39. NatureOfSecurityEffectType
class. The STIX default vocabulary class for use in the property is ‘LocationClassVocab-1.0.’ Location stixCommon: AddressAbstractType 0..1 The Location property characterizes the actual physical location of the affected asset. The underlying abstract class MUST be extended. The default and strongly RECOMMENDED subclass is CIQAddressInstanceType, as defined in . Nature_Of_Security_Effect NatureOfSecurityEffectType 0..1 The Nature_Of_Security_Effect property characterizes how the security properties of the asset were affected. Structured_Description cybox:ObservablesType 0..1 The Structured_Description property characterizes the through specification of a structured cyber Observables instance. AssetTypeType The AssetTypeType class characterizes the type of the Affected Asset. Examples of asset types are directory, firewall, PBX and cashier (these specific values are only provided to help explain the property: they are neither recommended values nor necessarily part of any existing vocabulary). The content creator may choose any arbitrary value or may constrain the set of possible values by referencing an vocabulary or leveraging a formally defined vocabulary extending from the stixCommon:ControlledVocabularyStringType class. The STIX default vocabulary class for use in this property is 'AssetTypeVocab-1.0'. The property of the AssetTypeType class is given in Table 38. 38. Properties of the AssetTypeType class Name Type Multiplicity Description count_affected basicDataTypes:Integer 0..1 The count_affected property specifies the number of assets of this type affected in the Incident. NatureOfSecurityEffectType The NatureOfSecurityEffectType class specifies a set of zero or more security properties affected by the Incident. The property of the NatureOfSecurityEffectType class is given in Table 39.
stix-v1.2.1-part6-incident.docx