STIX 2.1 datatype properties for the STONE ontology. Property names use lowerCamelCase; the original snake_case STIX property name is noted in rdfs:comment where disambiguation is needed.
The STIX identifier string in the format <type>--<UUIDv4>. The IRI of the individual is the canonical identity; this property retains the string for JSON round-tripping and SPARQL querying.
The STIX object type string, e.g. 'attack-pattern'. Semantically redundant with rdf:type but preserved for JSON round-tripping.
STIX specification version. MUST be '2.1'.
Timestamp when this object was last modified. MUST be >= created.
If true, this object has been revoked and should no longer be considered accurate.
Free-form string terms applying to this object. Multiple labels are expressed as multiple triples.
Producer's confidence in the accuracy of this data, from 0 (no confidence) to 100 (fully confident).
BCP 47 language tag for the human-readable content of this object, e.g. 'en', 'fr'. Also used in GranularMarking.
Human-readable name. Used across SDOs, SCOs, and sub-objects.
Human-readable description providing additional detail.
Alternative names for this object. Multiple aliases are expressed as multiple triples.
Timestamp when this object was first observed or seen.
Timestamp when this object was last observed or seen. MUST be >= firstSeen.
Version string. Used for analysis tool version (malware-analysis), schema version (extension-definition), software version, X.509 version, and PDF format version.
High-level goals of this intrusion set or threat actor, e.g. 'financial gain'. Multiple values are expressed as multiple triples.
Names of the authors of a note or opinion. Multiple values are expressed as multiple triples.
URL to a referenced resource (external-reference) or the location of artifact content.
IANA MIME type of the content (artifact, file).
Human-readable display name (email-addr, user-account, windows-service-ext).
Primary string value of an observable: the domain name, email address, IP address, MAC address, or URL.
Creation timestamp of a file system object.
Last-modified timestamp of a file system object.
Last-accessed timestamp of a file system object.
Absolute file system path (directory, file).
Character encoding used for the path property when the path contains non-ASCII characters.
Size in bytes (file, windows-pe-section, alternate-data-stream).
Plain-text body of an email message or a MIME part.
Value of the Content-Type header (email-message, email MIME part).
Subject line of an email message, or Distinguished Name of the certificate subject.
Primary goal or objective of the campaign.
Free-form roles this identity plays, e.g. 'analyst'. For threat-actor roles see the object property stones:threatActorRoles.
Contact details such as email address or phone number.
Detection pattern expression, e.g. a STIX patterning language expression.
Version of the pattern language, e.g. the STIX patterning language version.
Timestamp from which this indicator is considered valid.
Timestamp after which this indicator is no longer valid.
Latitude in decimal degrees, range -90 to 90. Required when longitude is present.
Longitude in decimal degrees, range -180 to 180. Required when latitude is present.
Radius of accuracy in metres around the latitude/longitude point.
ISO 3166-1 alpha-2 country code, e.g. 'US', 'GB'.
State, province, or region within a country.
True if this represents a malware family; false for a specific instance or sample.
Name of the analysis tool used, e.g. 'Cuckoo', 'VirusTotal'.
Version of the analysis tool configuration.
Names of analysis modules or plugins used. Multiple values as multiple triples.
Version of the analysis definitions or signatures.
Timestamp when the sample was submitted for analysis.
Raw classification string from an antivirus engine, e.g. 'Trojan.GenericKD'.
Classification name from the analysis product.
Earliest timestamp at which this observation occurred.
Latest timestamp at which this observation occurred. MUST be >= firstObserved.
Number of times the observation occurred. MUST be >= 1.
Explanation of why this opinion was formed.
Date and time this report was published.
Semantic type of this relationship, e.g. 'uses', 'targets', 'indicates'.
Timestamp when this relationship ended. MUST be >= startTime.
Number of times the sighted object was observed. MUST be >= 0.
If true, this sighting aggregates multiple observations rather than recording a single specific event.
Type of marking definition: 'tlp' or 'statement'.
TLP level for a TLP marking definition: 'white', 'green', 'amber', or 'red'.
Human-readable statement for a statement marking definition, e.g. a copyright notice.
The modified timestamp of the STIX object being translated. Used to pin a translation to a specific version.
URL pointing to, or the raw content of, the JSON Schema defining this extension.
Names of new top-level properties introduced by a toplevel-property-extension. Multiple values as multiple triples.
If true, the observable has been defanged, e.g. '198[.]51[.]100[.]0' in place of '198.51.100.0'.
Artifact byte content encoded as base64. Mutually exclusive with url.
Decryption key for this artifact when it is encrypted.
Regional Internet Registry that assigned this ASN, e.g. 'ARIN', 'RIPE'.
True if this email uses multipart MIME (bodyMultipart is populated); false if body contains the single plain-text body.
Date and time the email was sent as recorded in the Date header.
Received: header values in the order received. Multiple values as multiple triples.
Content-Disposition header value for an email MIME part.
Character encoding of the file name when non-ASCII characters are present.
Magic bytes (file signature) as a hex string.
Ordered list of protocols from lowest to highest layer, e.g. 'ipv4', 'tcp', 'http'. Multiple values as multiple triples.
Timestamp when this network traffic flow started.
Timestamp when this network traffic flow ended.
True if this network traffic flow was still active when it was observed.
Total bytes sent from source to destination.
Total bytes sent from destination to source.
Number of packets sent from source to destination.
Number of packets sent from destination to source.
If true, this process is hidden from normal process enumeration.
Current working directory of the process.
Full command line string used to launch this process.
NVD CPE 2.3 URI binding identifier for this software.
BCP 47 language tags for languages supported by this software. Multiple values as multiple triples.
Identifier of the user account, such as a login name or UID.
Clear-text credential associated with this account. Handle with care.
True if this is a service or system account rather than a user account.
True if this account has elevated privileges.
True if this account can escalate its own privileges.
True if this account is currently disabled.
Timestamp when this account was created.
Timestamp when the account credentials were last changed.
Timestamp of the first login for this account.
Timestamp of the most recent login for this account.
Full Windows Registry key path, e.g. 'HKEY_LOCAL_MACHINE\Software\...'.
Last modification timestamp of this registry key.
Number of subkeys under this registry key.
True if this certificate is self-signed.
Serial number assigned to this certificate by the issuer.
Algorithm used to sign this certificate, e.g. 'sha256WithRSAEncryption'.
Distinguished Name of the certificate issuer.
Start of the certificate validity period.
Algorithm of the subject's public key, e.g. 'rsaEncryption'.
RSA modulus of the subject's public key as a hex string.
RSA public exponent of the subject's public key.
Name of the information source, e.g. 'mitre-attack', 'cve', 'capec'.
Identifier in the external system, e.g. 'T1059', 'CVE-2021-44228'.
Name of the kill chain framework, e.g. 'mitre-attack', 'lockheed-martin-cyber-kill-chain'.
Phase within the kill chain, e.g. 'execution', 'persistence', 'lateral-movement'.
JSON property path selectors identifying the properties this marking applies to, e.g. 'name', 'description'. Multiple values as multiple triples.
Data stored in this Windows registry value.
Comment field embedded in an archive file.
Machine type from the COFF header as a hex value.
File offset of the COFF symbol table as hex.
Number of entries in the COFF symbol table.
Size of the optional PE header in bytes.
Characteristics flags from the PE COFF header as hex.
Windows Security Identifier (SID) of the file owner (ntfs-ext) or process owner (windows-process-ext).
True if the PDF is linearized (optimised for fast web viewing).
First PDF file identifier string from the PDF trailer.
Second PDF file identifier string from the PDF trailer.
Colour depth of the image in bits per pixel.
HTTP request URI path, e.g. '/index.html?q=1'.
(STIX: http-request-ext.request_version)
Length of the HTTP message body in bytes.
(STIX: http-request-ext.message_body_length)
True if this socket is in blocking mode.
True if this socket is in a listening state.
Platform-specific socket file descriptor number.
TCP flags set on packets from the source endpoint as hex, e.g. '0x02' for SYN.
TCP flags set on packets from the destination endpoint as hex.
True if Address Space Layout Randomisation (ASLR) is enabled for this process.
(STIX: windows-process-ext.aslr_enabled)
True if Data Execution Prevention (DEP) is enabled for this process.
Scheduling priority string for this Windows process, e.g. 'HIGH_PRIORITY_CLASS'.
Title text of the main window of this Windows process.
(STIX: windows-process-ext.window_title)
Windows service name as used in the Service Control Manager.
(STIX: windows-service-ext.service_name)
Description strings for a Windows service. Multiple values as multiple triples.
(STIX: windows-service-ext.descriptions)
Load ordering group for this Windows service.
Names of UNIX groups this account belongs to. Multiple values as multiple triples.
Home directory path for this UNIX account.
Login shell path for this UNIX account, e.g. '/bin/bash'.
X.509 v3 basic constraints extension value.
(STIX: x509-v3-extensions-type.basic_constraints)
X.509 v3 name constraints extension value.
(STIX: x509-v3-extensions-type.name_constraints)
X.509 v3 policy constraints extension value.
(STIX: x509-v3-extensions-type.policy_constraints)
(STIX: x509-v3-extensions-type.key_usage)
X.509 v3 extended key usage extension value.
(STIX: x509-v3-extensions-type.extended_key_usage)
(STIX: x509-v3-extensions-type.subject_key_identifier)
(STIX: x509-v3-extensions-type.authority_key_identifier)
X.509 v3 subject alternative name extension.
(STIX: x509-v3-extensions-type.subject_alternative_name)
X.509 v3 issuer alternative name extension.
(STIX: x509-v3-extensions-type.issuer_alternative_name)
X.509 v3 subject directory attributes extension.
(STIX: x509-v3-extensions-type.subject_directory_attributes)
X.509 v3 CRL distribution points extension.
(STIX: x509-v3-extensions-type.crl_distribution_points)
(STIX: x509-v3-extensions-type.inhibit_any_policy)
(STIX: x509-v3-extensions-type.private_key_usage_period_not_before)
(STIX: x509-v3-extensions-type.private_key_usage_period_not_after)
X.509 v3 certificate policies extension.
(STIX: x509-v3-extensions-type.certificate_policies)
(STIX: x509-v3-extensions-type.policy_mappings)
X.509 v3 authority information access extension.
(STIX: x509-v3-extensions-type.authority_info_access)