datatype-properties#
type: Ontology
comment: STIX 2.1 datatype properties for the STONE ontology. Property names use lowerCamelCase; the original snake_case STIX property name is noted in rdfs:comment where disambiguation is needed.

stixId
type: DatatypeProperty
type: FunctionalProperty
definition: The STIX identifier string in the format <type>--<UUIDv4>. The IRI of the individual is the canonical identity; this property retains the string for JSON round-tripping and SPARQL querying.
comment: (STIX: id)
domain: StixObject
range: string

stixType
type: DatatypeProperty
type: FunctionalProperty
definition: The STIX object type string, e.g. 'attack-pattern'. Semantically redundant with rdf:type but preserved for JSON round-tripping.
comment: (STIX: type)
domain: StixObject
range: string

specVersion
type: DatatypeProperty
definition: STIX specification version. MUST be '2.1'.
comment: (STIX: spec_version)
domain: StixObject
range: string

created
type: DatatypeProperty
definition: Timestamp when this object was created.
comment: (STIX: created)
domain: StixCoreObject
range: dateTime

modified
type: DatatypeProperty
definition: Timestamp when this object was last modified. MUST be >= created.
comment: (STIX: modified)
domain: StixCoreObject
range: dateTime

revoked
type: DatatypeProperty
definition: If true, this object has been revoked and should no longer be considered accurate.
comment: (STIX: revoked)
domain: StixObject
range: boolean

labels
type: DatatypeProperty
definition: Free-form string terms applying to this object. Multiple labels are expressed as multiple triples.
comment: (STIX: labels)
domain: StixObject
range: string

confidence
type: DatatypeProperty
definition: Producer's confidence in the accuracy of this data, from 0 (no confidence) to 100 (fully confident).
comment: (STIX: confidence)
domain: StixObject
range: integer

lang
type: DatatypeProperty
definition: BCP 47 language tag for the human-readable content of this object, e.g. 'en', 'fr'. Also used in GranularMarking.
comment: (STIX: lang)
range: string

name
type: DatatypeProperty
definition: Human-readable name. Used across SDOs, SCOs, and sub-objects.
comment: (STIX: name)
range: string

description
type: DatatypeProperty
definition: Human-readable description providing additional detail.
comment: (STIX: description)
range: string

aliases
type: DatatypeProperty
definition: Alternative names for this object. Multiple aliases are expressed as multiple triples.
comment: (STIX: aliases)
range: string

firstSeen
type: DatatypeProperty
definition: Timestamp when this object was first observed or seen.
comment: (STIX: first_seen)
range: dateTime

lastSeen
type: DatatypeProperty
definition: Timestamp when this object was last observed or seen. MUST be >= firstSeen.
comment: (STIX: last_seen)
range: dateTime

version
type: DatatypeProperty
definition: Version string. Used for analysis tool version (malware-analysis), schema version (extension-definition), software version, X.509 version, and PDF format version.
comment: (STIX: version)
range: string

goals
type: DatatypeProperty
definition: High-level goals of this intrusion set or threat actor, e.g. 'financial gain'. Multiple values are expressed as multiple triples.
comment: (STIX: goals)
range: string

authors
type: DatatypeProperty
definition: Names of the authors of a note or opinion. Multiple values are expressed as multiple triples.
comment: (STIX: authors)
range: string

url
type: DatatypeProperty
definition: URL to a referenced resource (external-reference) or the location of artifact content.
comment: (STIX: url)
range: anyURI

mimeType
type: DatatypeProperty
definition: IANA MIME type of the content (artifact, file).
comment: (STIX: mime_type)
range: string

displayName
type: DatatypeProperty
definition: Human-readable display name (email-addr, user-account, windows-service-ext).
comment: (STIX: display_name)
range: string

value
type: DatatypeProperty
definition: Primary string value of an observable: the domain name, email address, IP address, MAC address, or URL.
comment: (STIX: value)
range: string

ctime
type: DatatypeProperty
definition: Creation timestamp of a file system object.
comment: (STIX: ctime)
range: dateTime

mtime
type: DatatypeProperty
definition: Last-modified timestamp of a file system object.
comment: (STIX: mtime)
range: dateTime

atime
type: DatatypeProperty
definition: Last-accessed timestamp of a file system object.
comment: (STIX: atime)
range: dateTime

path
type: DatatypeProperty
definition: Absolute file system path (directory, file).
comment: (STIX: path)
range: string

pathEnc
type: DatatypeProperty
definition: Character encoding used for the path property when the path contains non-ASCII characters.
comment: (STIX: path_enc)
range: string

size
type: DatatypeProperty
definition: Size in bytes (file, windows-pe-section, alternate-data-stream).
comment: (STIX: size)
range: integer

body
type: DatatypeProperty
definition: Plain-text body of an email message or a MIME part.
comment: (STIX: body)
range: string

contentType
type: DatatypeProperty
definition: Value of the Content-Type header (email-message, email MIME part).
comment: (STIX: content_type)
range: string

subject
type: DatatypeProperty
definition: Subject line of an email message, or Distinguished Name of the certificate subject.
comment: (STIX: subject)
range: string

objective
type: DatatypeProperty
definition: Primary goal or objective of the campaign.
comment: (STIX: objective)
domain: Campaign
range: string

roles
type: DatatypeProperty
definition: Free-form roles this identity plays, e.g. 'analyst'. For threat-actor roles see the object property stones:threatActorRoles.
comment: (STIX: roles)
domain: Identity
range: string

contactInformation
type: DatatypeProperty
definition: Contact details such as email address or phone number.
comment: (STIX: contact_information)
domain: Identity
range: string

pattern
type: DatatypeProperty
definition: Detection pattern expression, e.g. a STIX patterning language expression.
comment: (STIX: pattern)
domain: Indicator
range: string

patternVersion
type: DatatypeProperty
definition: Version of the pattern language, e.g. the STIX patterning language version.
comment: (STIX: pattern_version)
domain: Indicator
range: string

validFrom
type: DatatypeProperty
definition: Timestamp from which this indicator is considered valid.
comment: (STIX: valid_from)
domain: Indicator
range: dateTime

validUntil
type: DatatypeProperty
definition: Timestamp after which this indicator is no longer valid.
comment: (STIX: valid_until)
domain: Indicator
range: dateTime

latitude
type: DatatypeProperty
definition: Latitude in decimal degrees, range -90 to 90. Required when longitude is present.
comment: (STIX: latitude)
domain: Location
range: float

longitude
type: DatatypeProperty
definition: Longitude in decimal degrees, range -180 to 180. Required when latitude is present.
comment: (STIX: longitude)
domain: Location
range: float

precision
type: DatatypeProperty
definition: Radius of accuracy in metres around the latitude/longitude point.
comment: (STIX: precision)
domain: Location
range: float

country
type: DatatypeProperty
definition: ISO 3166-1 alpha-2 country code, e.g. 'US', 'GB'.
comment: (STIX: country)
domain: Location
range: string

administrativeArea
type: DatatypeProperty
definition: State, province, or region within a country.
comment: (STIX: administrative_area)
domain: Location
range: string

city
type: DatatypeProperty
definition: City name.
comment: (STIX: city)
domain: Location
range: string

streetAddress
type: DatatypeProperty
definition: Street address.
comment: (STIX: street_address)
domain: Location
range: string

postalCode
type: DatatypeProperty
definition: Postal or ZIP code.
comment: (STIX: postal_code)
domain: Location
range: string

isFamily
type: DatatypeProperty
definition: True if this represents a malware family; false for a specific instance or sample.
comment: (STIX: is_family)
domain: Malware
range: boolean

product
type: DatatypeProperty
definition: Name of the analysis tool used, e.g. 'Cuckoo', 'VirusTotal'.
comment: (STIX: product)
domain: MalwareAnalysis
range: string

configurationVersion
type: DatatypeProperty
definition: Version of the analysis tool configuration.
comment: (STIX: configuration_version)
domain: MalwareAnalysis
range: string

modules
type: DatatypeProperty
definition: Names of analysis modules or plugins used. Multiple values as multiple triples.
comment: (STIX: modules)
domain: MalwareAnalysis
range: string

analysisEngineVersion
type: DatatypeProperty
definition: Version of the analysis engine.
comment: (STIX: analysis_engine_version)
domain: MalwareAnalysis
range: string

analysisDefinitionVersion
type: DatatypeProperty
definition: Version of the analysis definitions or signatures.
comment: (STIX: analysis_definition_version)
domain: MalwareAnalysis
range: string

submitted
type: DatatypeProperty
definition: Timestamp when the sample was submitted for analysis.
comment: (STIX: submitted)
domain: MalwareAnalysis
range: dateTime

analysisStarted
type: DatatypeProperty
definition: Timestamp when analysis began.
comment: (STIX: analysis_started)
domain: MalwareAnalysis
range: dateTime

analysisEnded
type: DatatypeProperty
definition: Timestamp when analysis concluded.
comment: (STIX: analysis_ended)
domain: MalwareAnalysis
range: dateTime

avResult
type: DatatypeProperty
definition: Raw classification string from an antivirus engine, e.g. 'Trojan.GenericKD'.
comment: (STIX: av_result)
domain: MalwareAnalysis
range: string

resultName
type: DatatypeProperty
definition: Classification name from the analysis product.
comment: (STIX: result_name)
domain: MalwareAnalysis
range: string

abstract
type: DatatypeProperty
definition: Brief summary of the note.
comment: (STIX: abstract)
domain: Note
range: string

content
type: DatatypeProperty
definition: Full body text of the note.
comment: (STIX: content)
domain: Note
range: string

firstObserved
type: DatatypeProperty
definition: Earliest timestamp at which this observation occurred.
comment: (STIX: first_observed)
domain: ObservedData
range: dateTime

lastObserved
type: DatatypeProperty
definition: Latest timestamp at which this observation occurred. MUST be >= firstObserved.
comment: (STIX: last_observed)
domain: ObservedData
range: dateTime

numberObserved
type: DatatypeProperty
definition: Number of times the observation occurred. MUST be >= 1.
comment: (STIX: number_observed)
domain: ObservedData
range: integer

explanation
type: DatatypeProperty
definition: Explanation of why this opinion was formed.
comment: (STIX: explanation)
domain: Opinion
range: string

published
type: DatatypeProperty
definition: Date and time this report was published.
comment: (STIX: published)
domain: Report
range: dateTime

toolVersion
type: DatatypeProperty
definition: Version string of the tool.
comment: (STIX: tool_version)
domain: Tool
range: string

relationshipType
type: DatatypeProperty
definition: Semantic type of this relationship, e.g. 'uses', 'targets', 'indicates'.
comment: (STIX: relationship_type)
domain: Relationship
range: string

startTime
type: DatatypeProperty
definition: Timestamp when this relationship began.
comment: (STIX: start_time)
domain: Relationship
range: dateTime

stopTime
type: DatatypeProperty
definition: Timestamp when this relationship ended. MUST be >= startTime.
comment: (STIX: stop_time)
domain: Relationship
range: dateTime

count
type: DatatypeProperty
definition: Number of times the sighted object was observed. MUST be >= 0.
comment: (STIX: count)
domain: Sighting
range: integer

summary
type: DatatypeProperty
definition: If true, this sighting aggregates multiple observations rather than recording a single specific event.
comment: (STIX: summary)
domain: Sighting
range: boolean

definitionType
type: DatatypeProperty
definition: Type of marking definition: 'tlp' or 'statement'.
comment: (STIX: definition_type)
domain: MarkingDefinitionObject
range: string

tlp
type: DatatypeProperty
definition: TLP level for a TLP marking definition: 'white', 'green', 'amber', or 'red'.
comment: (STIX: definition.tlp)
range: string

statement
type: DatatypeProperty
definition: Human-readable statement for a statement marking definition, e.g. a copyright notice.
comment: (STIX: definition.statement)
range: string

objectModified
type: DatatypeProperty
definition: The modified timestamp of the STIX object being translated. Used to pin a translation to a specific version.
comment: (STIX: object_modified)
domain: LanguageContentObject
range: dateTime

schema
type: DatatypeProperty
definition: URL pointing to, or the raw content of, the JSON Schema defining this extension.
comment: (STIX: schema)
domain: ExtensionDefinitionObject
range: string

extensionProperties
type: DatatypeProperty
definition: Names of new top-level properties introduced by a toplevel-property-extension. Multiple values as multiple triples.
comment: (STIX: extension_properties)
domain: ExtensionDefinitionObject
range: string

defanged
type: DatatypeProperty
definition: If true, the observable has been defanged, e.g. '198[.]51[.]100[.]0' in place of '198.51.100.0'.
comment: (STIX: defanged)
domain: StixCyberobservableObject
range: boolean

payloadBin
type: DatatypeProperty
definition: Artifact byte content encoded as base64. Mutually exclusive with url.
comment: (STIX: payload_bin)
domain: ArtifactObject
range: base64Binary

decryptionKey
type: DatatypeProperty
definition: Decryption key for this artifact when it is encrypted.
comment: (STIX: decryption_key)
domain: ArtifactObject
range: string

number
type: DatatypeProperty
definition: Autonomous System number (ASN).
comment: (STIX: number)
domain: AutonomousSystemObject
range: integer

rir
type: DatatypeProperty
definition: Regional Internet Registry that assigned this ASN, e.g. 'ARIN', 'RIPE'.
comment: (STIX: rir)
domain: AutonomousSystemObject
range: string

isMultipart
type: DatatypeProperty
definition: True if this email uses multipart MIME (bodyMultipart is populated); false if body contains the single plain-text body.
comment: (STIX: is_multipart)
domain: EmailMessageObject
range: boolean

date
type: DatatypeProperty
definition: Date and time the email was sent as recorded in the Date header.
comment: (STIX: date)
domain: EmailMessageObject
range: dateTime

messageId
type: DatatypeProperty
definition: Value of the Message-ID header.
comment: (STIX: message_id)
domain: EmailMessageObject
range: string

receivedLines
type: DatatypeProperty
definition: Received: header values in the order received. Multiple values as multiple triples.
comment: (STIX: received_lines)
domain: EmailMessageObject
range: string

contentDisposition
type: DatatypeProperty
definition: Content-Disposition header value for an email MIME part.
comment: (STIX: content_disposition)
domain: EmailMimePart
range: string

nameEnc
type: DatatypeProperty
definition: Character encoding of the file name when non-ASCII characters are present.
comment: (STIX: name_enc)
domain: FileObject
range: string

magicNumberHex
type: DatatypeProperty
definition: Magic bytes (file signature) as a hex string.
comment: (STIX: magic_number_hex)
domain: FileObject
range: hexBinary

protocols
type: DatatypeProperty
definition: Ordered list of protocols from lowest to highest layer, e.g. 'ipv4', 'tcp', 'http'. Multiple values as multiple triples.
comment: (STIX: protocols)
domain: NetworkTrafficObject
range: string

srcPort
type: DatatypeProperty
definition: Source port number (0–65535).
comment: (STIX: src_port)
domain: NetworkTrafficObject
range: integer

dstPort
type: DatatypeProperty
definition: Destination port number (0–65535).
comment: (STIX: dst_port)
domain: NetworkTrafficObject
range: integer

start
type: DatatypeProperty
definition: Timestamp when this network traffic flow started.
comment: (STIX: start)
domain: NetworkTrafficObject
range: dateTime

end
type: DatatypeProperty
definition: Timestamp when this network traffic flow ended.
comment: (STIX: end)
domain: NetworkTrafficObject
range: dateTime

isActive
type: DatatypeProperty
definition: True if this network traffic flow was still active when it was observed.
comment: (STIX: is_active)
domain: NetworkTrafficObject
range: boolean

srcByteCount
type: DatatypeProperty
definition: Total bytes sent from source to destination.
comment: (STIX: src_byte_count)
domain: NetworkTrafficObject
range: integer

dstByteCount
type: DatatypeProperty
definition: Total bytes sent from destination to source.
comment: (STIX: dst_byte_count)
domain: NetworkTrafficObject
range: integer

srcPackets
type: DatatypeProperty
definition: Number of packets sent from source to destination.
comment: (STIX: src_packets)
domain: NetworkTrafficObject
range: integer

dstPackets
type: DatatypeProperty
definition: Number of packets sent from destination to source.
comment: (STIX: dst_packets)
domain: NetworkTrafficObject
range: integer

isHidden
type: DatatypeProperty
definition: If true, this process is hidden from normal process enumeration.
comment: (STIX: is_hidden)
domain: ProcessObject
range: boolean

pid
type: DatatypeProperty
definition: Process ID (PID).
comment: (STIX: pid)
domain: ProcessObject
range: integer

createdTime
type: DatatypeProperty
definition: Timestamp when the process was created.
comment: (STIX: created_time)
domain: ProcessObject
range: dateTime

cwd
type: DatatypeProperty
definition: Current working directory of the process.
comment: (STIX: cwd)
domain: ProcessObject
range: string

commandLine
type: DatatypeProperty
definition: Full command line string used to launch this process.
comment: (STIX: command_line)
domain: ProcessObject
range: string

cpe
type: DatatypeProperty
definition: NVD CPE 2.3 URI binding identifier for this software.
comment: (STIX: cpe)
domain: SoftwareObject
range: string

swid
type: DatatypeProperty
definition: ISO/IEC 19770-2 SWID tag identifier.
comment: (STIX: swid)
domain: SoftwareObject
range: string

languages
type: DatatypeProperty
definition: BCP 47 language tags for languages supported by this software. Multiple values as multiple triples.
comment: (STIX: languages)
domain: SoftwareObject
range: string

vendor
type: DatatypeProperty
definition: Name of the software vendor.
comment: (STIX: vendor)
domain: SoftwareObject
range: string

userId
type: DatatypeProperty
definition: Identifier of the user account, such as a login name or UID.
comment: (STIX: user_id)
domain: UserAccountObject
range: string

credential
type: DatatypeProperty
definition: Clear-text credential associated with this account. Handle with care.
comment: (STIX: credential)
domain: UserAccountObject
range: string

accountLogin
type: DatatypeProperty
definition: Login name if different from userId.
comment: (STIX: account_login)
domain: UserAccountObject
range: string

isServiceAccount
type: DatatypeProperty
definition: True if this is a service or system account rather than a user account.
comment: (STIX: is_service_account)
domain: UserAccountObject
range: boolean

isPrivileged
type: DatatypeProperty
definition: True if this account has elevated privileges.
comment: (STIX: is_privileged)
domain: UserAccountObject
range: boolean

canEscalatePrivs
type: DatatypeProperty
definition: True if this account can escalate its own privileges.
comment: (STIX: can_escalate_privs)
domain: UserAccountObject
range: boolean

isDisabled
type: DatatypeProperty
definition: True if this account is currently disabled.
comment: (STIX: is_disabled)
domain: UserAccountObject
range: boolean

accountCreated
type: DatatypeProperty
definition: Timestamp when this account was created.
comment: (STIX: account_created)
domain: UserAccountObject
range: dateTime

accountExpires
type: DatatypeProperty
definition: Timestamp when this account expires.
comment: (STIX: account_expires)
domain: UserAccountObject
range: dateTime

credentialLastChanged
type: DatatypeProperty
definition: Timestamp when the account credentials were last changed.
comment: (STIX: credential_last_changed)
domain: UserAccountObject
range: dateTime

accountFirstLogin
type: DatatypeProperty
definition: Timestamp of the first login for this account.
comment: (STIX: account_first_login)
domain: UserAccountObject
range: dateTime

accountLastLogin
type: DatatypeProperty
definition: Timestamp of the most recent login for this account.
comment: (STIX: account_last_login)
domain: UserAccountObject
range: dateTime

key
type: DatatypeProperty
definition: Full Windows Registry key path, e.g. 'HKEY_LOCAL_MACHINE\Software\...'.
comment: (STIX: key)
domain: WindowsRegistryKeyObject
range: string

modifiedTime
type: DatatypeProperty
definition: Last modification timestamp of this registry key.
comment: (STIX: modified_time)
domain: WindowsRegistryKeyObject
range: dateTime

numberOfSubkeys
type: DatatypeProperty
definition: Number of subkeys under this registry key.
comment: (STIX: number_of_subkeys)
domain: WindowsRegistryKeyObject
range: integer

isSelfSigned
type: DatatypeProperty
definition: True if this certificate is self-signed.
comment: (STIX: is_self_signed)
domain: X509CertificateObject
range: boolean

serialNumber
type: DatatypeProperty
definition: Serial number assigned to this certificate by the issuer.
comment: (STIX: serial_number)
domain: X509CertificateObject
range: string

signatureAlgorithm
type: DatatypeProperty
definition: Algorithm used to sign this certificate, e.g. 'sha256WithRSAEncryption'.
comment: (STIX: signature_algorithm)
domain: X509CertificateObject
range: string

issuer
type: DatatypeProperty
definition: Distinguished Name of the certificate issuer.
comment: (STIX: issuer)
domain: X509CertificateObject
range: string

validityNotBefore
type: DatatypeProperty
definition: Start of the certificate validity period.
comment: (STIX: validity_not_before)
domain: X509CertificateObject
range: dateTime

validityNotAfter
type: DatatypeProperty
definition: End of the certificate validity period.
comment: (STIX: validity_not_after)
domain: X509CertificateObject
range: dateTime

subjectPublicKeyAlgorithm
type: DatatypeProperty
definition: Algorithm of the subject's public key, e.g. 'rsaEncryption'.
comment: (STIX: subject_public_key_algorithm)
domain: X509CertificateObject
range: string

subjectPublicKeyModulus
type: DatatypeProperty
definition: RSA modulus of the subject's public key as a hex string.
comment: (STIX: subject_public_key_modulus)
domain: X509CertificateObject
range: string

subjectPublicKeyExponent
type: DatatypeProperty
definition: RSA public exponent of the subject's public key.
comment: (STIX: subject_public_key_exponent)
domain: X509CertificateObject
range: integer

sourceName
type: DatatypeProperty
definition: Name of the information source, e.g. 'mitre-attack', 'cve', 'capec'.
comment: (STIX: source_name)
domain: ExternalReference
range: string

externalId
type: DatatypeProperty
definition: Identifier in the external system, e.g. 'T1059', 'CVE-2021-44228'.
comment: (STIX: external_id)
domain: ExternalReference
range: string

killChainName
type: DatatypeProperty
definition: Name of the kill chain framework, e.g. 'mitre-attack', 'lockheed-martin-cyber-kill-chain'.
comment: (STIX: kill_chain_name)
domain: KillChainPhase
range: string

phaseName
type: DatatypeProperty
definition: Phase within the kill chain, e.g. 'execution', 'persistence', 'lateral-movement'.
comment: (STIX: phase_name)
domain: KillChainPhase
range: string

selectors
type: DatatypeProperty
definition: JSON property path selectors identifying the properties this marking applies to, e.g. 'name', 'description'. Multiple values as multiple triples.
comment: (STIX: selectors)
domain: GranularMarking
range: string

hashValue
type: DatatypeProperty
definition: Hex-encoded hash digest value.
comment: (STIX: hashes dictionary value)
domain: HashEntry
range: string

data
type: DatatypeProperty
definition: Data stored in this Windows registry value.
comment: (STIX: data)
domain: WindowsRegistryValue
range: string

comment
type: DatatypeProperty
definition: Comment field embedded in an archive file.
comment: (STIX: archive-ext.comment)
range: string

imphash
type: DatatypeProperty
definition: Import hash (imphash) of the PE binary.
comment: (STIX: imphash)
range: string

machineHex
type: DatatypeProperty
definition: Machine type from the COFF header as a hex value.
comment: (STIX: machine_hex)
range: hexBinary

numberOfSections
type: DatatypeProperty
definition: Number of sections in the PE binary.
comment: (STIX: number_of_sections)
range: integer

timeDateStamp
type: DatatypeProperty
definition: Timestamp recorded in the PE header.
comment: (STIX: time_date_stamp)
range: dateTime

pointerToSymbolTableHex
type: DatatypeProperty
definition: File offset of the COFF symbol table as hex.
comment: (STIX: pointer_to_symbol_table_hex)
range: hexBinary

numberOfSymbols
type: DatatypeProperty
definition: Number of entries in the COFF symbol table.
comment: (STIX: number_of_symbols)
range: integer

sizeOfOptionalHeader
type: DatatypeProperty
definition: Size of the optional PE header in bytes.
comment: (STIX: size_of_optional_header)
range: integer

characteristicsHex
type: DatatypeProperty
definition: Characteristics flags from the PE COFF header as hex.
comment: (STIX: characteristics_hex)
range: hexBinary

entropy
type: DatatypeProperty
definition: Calculated entropy of this PE section.
comment: (STIX: windows-pe-section-type.entropy)
domain: WindowsPeSection
range: float

sid
type: DatatypeProperty
definition: Windows Security Identifier (SID) of the file owner (ntfs-ext) or process owner (windows-process-ext).
comment: (STIX: sid / owner_sid)
range: string

isOptimized
type: DatatypeProperty
definition: True if the PDF is linearized (optimised for fast web viewing).
comment: (STIX: pdf-ext.is_optimized)
range: boolean

pdfid0
type: DatatypeProperty
definition: First PDF file identifier string from the PDF trailer.
comment: (STIX: pdf-ext.pdfid0)
range: string

pdfid1
type: DatatypeProperty
definition: Second PDF file identifier string from the PDF trailer.
comment: (STIX: pdf-ext.pdfid1)
range: string

imageHeight
type: DatatypeProperty
definition: Image height in pixels.
comment: (STIX: raster-image-ext.image_height)
range: integer

imageWidth
type: DatatypeProperty
definition: Image width in pixels.
comment: (STIX: raster-image-ext.image_width)
range: integer

bitsPerPixel
type: DatatypeProperty
definition: Colour depth of the image in bits per pixel.
comment: (STIX: raster-image-ext.bits_per_pixel)
range: integer

requestMethod
type: DatatypeProperty
definition: HTTP method, e.g. 'GET', 'POST'.
comment: (STIX: http-request-ext.request_method)
range: string

requestValue
type: DatatypeProperty
definition: HTTP request URI path, e.g. '/index.html?q=1'.
comment: (STIX: http-request-ext.request_value)
range: string

requestVersion
type: DatatypeProperty
definition: HTTP version string, e.g. 'HTTP/1.1'.
comment: (STIX: http-request-ext.request_version)
range: string

messageBodyLength
type: DatatypeProperty
definition: Length of the HTTP message body in bytes.
comment: (STIX: http-request-ext.message_body_length)
range: integer

icmpTypeHex
type: DatatypeProperty
definition: ICMP type field as a hex value.
comment: (STIX: icmp-ext.icmp_type_hex)
range: hexBinary

icmpCodeHex
type: DatatypeProperty
definition: ICMP code field as a hex value.
comment: (STIX: icmp-ext.icmp_code_hex)
range: hexBinary

isBlocking
type: DatatypeProperty
definition: True if this socket is in blocking mode.
comment: (STIX: socket-ext.is_blocking)
range: boolean

isListening
type: DatatypeProperty
definition: True if this socket is in a listening state.
comment: (STIX: socket-ext.is_listening)
range: boolean

socketDescriptor
type: DatatypeProperty
definition: Platform-specific socket file descriptor number.
comment: (STIX: socket-ext.socket_descriptor)
range: integer

socketHandle
type: DatatypeProperty
definition: Windows handle value for this socket.
comment: (STIX: socket-ext.socket_handle)
range: integer

srcFlagsHex
type: DatatypeProperty
definition: TCP flags set on packets from the source endpoint as hex, e.g. '0x02' for SYN.
comment: (STIX: tcp-ext.src_flags_hex)
range: hexBinary

dstFlagsHex
type: DatatypeProperty
definition: TCP flags set on packets from the destination endpoint as hex.
comment: (STIX: tcp-ext.dst_flags_hex)
range: hexBinary

aslrEnabled
type: DatatypeProperty
definition: True if Address Space Layout Randomisation (ASLR) is enabled for this process.
comment: (STIX: windows-process-ext.aslr_enabled)
range: boolean

depEnabled
type: DatatypeProperty
definition: True if Data Execution Prevention (DEP) is enabled for this process.
comment: (STIX: windows-process-ext.dep_enabled)
range: boolean

priority
type: DatatypeProperty
definition: Scheduling priority string for this Windows process, e.g. 'HIGH_PRIORITY_CLASS'.
comment: (STIX: windows-process-ext.priority)
range: string

windowTitle
type: DatatypeProperty
definition: Title text of the main window of this Windows process.
comment: (STIX: windows-process-ext.window_title)
range: string

serviceName
type: DatatypeProperty
definition: Windows service name as used in the Service Control Manager.
comment: (STIX: windows-service-ext.service_name)
range: string

descriptions
type: DatatypeProperty
definition: Description strings for a Windows service. Multiple values as multiple triples.
comment: (STIX: windows-service-ext.descriptions)
range: string

groupName
type: DatatypeProperty
definition: Load ordering group for this Windows service.
comment: (STIX: windows-service-ext.group_name)
range: string

uid
type: DatatypeProperty
definition: Numeric UNIX user ID (UID).
comment: (STIX: unix-account-ext.uid)
domain: UserAccountObject
range: integer

gid
type: DatatypeProperty
definition: Primary numeric UNIX group ID (GID).
comment: (STIX: unix-account-ext.gid)
domain: UserAccountObject
range: integer

groups
type: DatatypeProperty
definition: Names of UNIX groups this account belongs to. Multiple values as multiple triples.
comment: (STIX: unix-account-ext.groups)
domain: UserAccountObject
range: string

homeDir
type: DatatypeProperty
definition: Home directory path for this UNIX account.
comment: (STIX: unix-account-ext.home_dir)
domain: UserAccountObject
range: string

shell
type: DatatypeProperty
definition: Login shell path for this UNIX account, e.g. '/bin/bash'.
comment: (STIX: unix-account-ext.shell)
domain: UserAccountObject
range: string

basicConstraints
type: DatatypeProperty
definition: X.509 v3 basic constraints extension value.
comment: (STIX: x509-v3-extensions-type.basic_constraints)
domain: X509V3Extensions
range: string

nameConstraints
type: DatatypeProperty
definition: X.509 v3 name constraints extension value.
comment: (STIX: x509-v3-extensions-type.name_constraints)
domain: X509V3Extensions
range: string

policyConstraints
type: DatatypeProperty
definition: X.509 v3 policy constraints extension value.
comment: (STIX: x509-v3-extensions-type.policy_constraints)
domain: X509V3Extensions
range: string

keyUsage
type: DatatypeProperty
definition: X.509 v3 key usage extension value.
comment: (STIX: x509-v3-extensions-type.key_usage)
domain: X509V3Extensions
range: string

extendedKeyUsage
type: DatatypeProperty
definition: X.509 v3 extended key usage extension value.
comment: (STIX: x509-v3-extensions-type.extended_key_usage)
domain: X509V3Extensions
range: string

subjectKeyIdentifier
type: DatatypeProperty
definition: X.509 v3 subject key identifier.
comment: (STIX: x509-v3-extensions-type.subject_key_identifier)
domain: X509V3Extensions
range: string

authorityKeyIdentifier
type: DatatypeProperty
definition: X.509 v3 authority key identifier.
comment: (STIX: x509-v3-extensions-type.authority_key_identifier)
domain: X509V3Extensions
range: string

subjectAlternativeName
type: DatatypeProperty
definition: X.509 v3 subject alternative name extension.
comment: (STIX: x509-v3-extensions-type.subject_alternative_name)
domain: X509V3Extensions
range: string

issuerAlternativeName
type: DatatypeProperty
definition: X.509 v3 issuer alternative name extension.
comment: (STIX: x509-v3-extensions-type.issuer_alternative_name)
domain: X509V3Extensions
range: string

subjectDirectoryAttributes
type: DatatypeProperty
definition: X.509 v3 subject directory attributes extension.
comment: (STIX: x509-v3-extensions-type.subject_directory_attributes)
domain: X509V3Extensions
range: string

crlDistributionPoints
type: DatatypeProperty
definition: X.509 v3 CRL distribution points extension.
comment: (STIX: x509-v3-extensions-type.crl_distribution_points)
domain: X509V3Extensions
range: string

inhibitAnyPolicy
type: DatatypeProperty
definition: X.509 v3 inhibit any policy extension.
comment: (STIX: x509-v3-extensions-type.inhibit_any_policy)
domain: X509V3Extensions
range: string

privateKeyUsagePeriodNotBefore
type: DatatypeProperty
definition: Start of the private key usage period.
comment: (STIX: x509-v3-extensions-type.private_key_usage_period_not_before)
domain: X509V3Extensions
range: dateTime

privateKeyUsagePeriodNotAfter
type: DatatypeProperty
definition: End of the private key usage period.
comment: (STIX: x509-v3-extensions-type.private_key_usage_period_not_after)
domain: X509V3Extensions
range: dateTime

certificatePolicies
type: DatatypeProperty
definition: X.509 v3 certificate policies extension.
comment: (STIX: x509-v3-extensions-type.certificate_policies)
domain: X509V3Extensions
range: string

policyMappings
type: DatatypeProperty
definition: X.509 v3 policy mappings extension.
comment: (STIX: x509-v3-extensions-type.policy_mappings)
domain: X509V3Extensions
range: string

authorityInfoAccess
type: DatatypeProperty
definition: X.509 v3 authority information access extension.
comment: (STIX: x509-v3-extensions-type.authority_info_access)
domain: X509V3Extensions
range: string