Property Name Type Description string type (required) The value of property field MUST be attack-pattern. external_references list of type A list of external references which refer to non-STIX information. This property MAY (optional) be used to provide one or more Attack Pattern identifiers, such as a CAPEC ID. When specifying a CAPEC ID, the source_name property of the external reference MUST be set to capec and the property be formatted external_id MUST as CAPEC-[id]. name (required) string A name used to identify the Attack Pattern. description (optional) string A description that provides more details and context about the Attack Pattern, potentially including its purpose and its key characteristics. kill_chain_phases list of type The list of Kill Chain Phases for which this Attack Pattern is used. (optional) Relationships These are the relationships explicitly defined between the Attack Pattern object and other SDOs. The first section lists the embedded relationships by property name along with their corresponding target. The rest of the table identifies the relationships that can be made from the Attack Pattern object by way of the Relationship object. The reverse relationships (relationships "to" the Attack Pattern object) are included as a convenience. For their definitions, please see the objects for which they represent a "from" relationship. Relationships are not restricted to those listed below. Relationship objects can be created between any SDOs using the related-to relationship type or, as with open vocabularies, user-defined names. Embedded Relationships created_by_ref identifier (of type identity) object_marking_refs identifier (of type marking-definition)
Property Name Type Description type (required) string The value of property field MUST be attack-pattern. external_references (optional) list of type A list of external references which refer to non-STIX information. This property MAY be used to provide one or more Attack Pattern identifiers, such as a CAPEC ID. When specifying a CAPEC ID, the source_name property of the external reference MUST be set to capec and the external_id property MUST be formatted as CAPEC-[id]. name (required) string A name used to identify the Attack Pattern. description (optional) string A description that provides more details and context about the Attack Pattern, potentially including its purpose and its key characteristics. kill_chain_phases (optional) list of type The list of Kill Chain Phases for which this Attack Pattern is used. Relationships These are the relationships explicitly defined between the Attack Pattern object and other SDOs. The first section lists the embedded relationships by property name along with their corresponding target. The rest of the table identifies the relationships that can be made from the Attack Pattern object by way of the Relationship object. The reverse relationships (relationships "to" the Attack Pattern object) are included as a convenience. For their definitions, please see the objects for which they represent a "from" relationship. Relationships are not restricted to those listed below. Relationship objects can be created between any SDOs using the related-to relationship type or, as with open vocabularies, user-defined names. Embedded Relationships created_by_ref identifier (of type identity) object_marking_refs identifier (of type marking-definition)
stix-v2.0-csprd02-part2-stix-objects.docx