Attack Patterns: STIX-CAPEC Data Model v1.1 The default extension class for representing attack patterns in STIX v1.1.1 is the class defined below. The underlying CAPEC2.7InstanceType data model being referenced is the Common Attack Pattern Enumeration and Classification (CAPEC) specification as defined in . CAPEC2.7InstanceType Class The class provides an extension to the STIX TTP class and belongs to the CAPEC2.7InstanceType AttackPatternType stix-capec package. It imports and leverages the CAPEC 2.7 schema for a structured characterization of attack patterns. The UML diagram for the class is shown in Figure 32. CAPEC2.7InstanceType Figure . UML diagram of the class CAPEC2.7InstanceType The property table for the class is given in Table 32. CAPEC2.7InstanceType . Properties of the class CAPEC2.7InstanceType Name Type Multiplicity Description The property specifies the structured specification of an attack pattern CAPEC CAPEC capec:Attack_PatternType 1 utilizing the CAPEC schema. Identities: STIX-CIQ Identity Data Model v1.2 The default extension class for expressing identity information in STIX v1.2.1 is the class defined below. The CIQIdentity3.0InstanceType underlying data model being referenced is the structured characterization of identity information of the OASIS Customer Information Quaility (CIQ) Specification as defined in . CIQIdentity3.0InstanceType The class extends the class and belongs to the CIQIdentity3.0InstanceType stixCommon:IdentityType stix-ciqidentity package. It imports and leverages version 3.0 of the OASIS CIQ-PIL schema for structured characterization of identity information (e.g. threat actors, victims, and sources of information). The UML diagram for the class is shown in Figure 33. CIQIdentity3.0InstanceType
Attack Patterns: STIX-CAPEC Data Model v1.1 The default extension class for representing attack patterns in STIX v1.1.1 is the CAPEC2.7InstanceType class defined below. The underlying data model being referenced is the Common Attack Pattern Enumeration and Classification (CAPEC) specification as defined in . CAPEC2.7InstanceType Class The CAPEC2.7InstanceType class provides an extension to the STIX TTP AttackPatternType class and belongs to the stix-capec package. It imports and leverages the CAPEC 2.7 schema for a structured characterization of attack patterns. The UML diagram for the CAPEC2.7InstanceType class is shown in Figure 32. Figure . UML diagram of the CAPEC2.7InstanceType class The property table for the CAPEC2.7InstanceType class is given in Table 32. . Properties of the CAPEC2.7InstanceType class Name Type Multiplicity Description CAPEC capec:Attack_PatternType 1 The CAPEC property specifies the structured specification of an attack pattern utilizing the CAPEC schema. Identities: STIX-CIQ Identity Data Model v1.2 The default extension class for expressing identity information in STIX v1.2.1 is the CIQIdentity3.0InstanceType class defined below. The underlying data model being referenced is the structured characterization of identity information of the OASIS Customer Information Quaility (CIQ) Specification as defined in . CIQIdentity3.0InstanceType The CIQIdentity3.0InstanceType class extends the stixCommon:IdentityType class and belongs to the stix-ciqidentity package. It imports and leverages version 3.0 of the OASIS CIQ-PIL schema for structured characterization of identity information (e.g. threat actors, victims, and sources of information). The UML diagram for the CIQIdentity3.0InstanceType class is shown in Figure 33.
stix-v1.2.1-cs01-part12-extensions.docx