An OWL 2 ontology modelling the STIX 2.1 specification. Provides a class hierarchy for all STIX Domain Objects (SDOs), Cyber Observable Objects (SCOs), Relationship Objects (SROs), Meta Objects, and structured sub-types, together with datatype and object properties covering all standard STIX properties.
STONES — STIX ONtology Expression System
STONES
The range of skos:altLabel is the class of RDF plain literals.
skos:prefLabel, skos:altLabel and skos:hiddenLabel are pairwise disjoint properties.
alternative label
An alternative lexical label for a resource.
Acronyms, abbreviations, spelling variants, and irregular plural/singular forms may be included among the alternative labels for a concept. Mis-spelled terms are normally included as hidden labels (see skos:hiddenLabel).
change note
A note about a modification to a concept.
definition
A statement or formal explanation of the meaning of a concept.
editorial note
A note for an editor, translator or maintainer of the vocabulary.
example
An example of the use of a concept.
The range of skos:hiddenLabel is the class of RDF plain literals.
hidden label
A lexical label for a resource that should be hidden when generating visual displays of the resource, but should still be accessible to free text search operations.
history note
A note about the past state/use/meaning of a concept.
note
A general note, for any purpose.
This property may be used directly, or as a super-property for more specific note types.
A resource has no more than one value of skos:prefLabel per language tag, and no more than one value of skos:prefLabel without language tag.
The range of skos:prefLabel is the class of RDF plain literals.
preferred label
The preferred lexical label for a resource, in a given language.
scope note
A note that helps to clarify the meaning and/or the use of a concept.
has broader match
skos:broadMatch is used to state a hierarchical mapping link between two conceptual resources in different concept schemes.
Broader concepts are typically rendered as parents in a concept hierarchy (tree).
has broader
Relates a concept to a concept that is more general in meaning.
By convention, skos:broader is only used to assert an immediate (i.e. direct) hierarchical link between two conceptual resources.
has broader transitive
skos:broaderTransitive is a transitive superproperty of skos:broader.
By convention, skos:broaderTransitive is not used to make assertions. Rather, the properties can be used to draw inferences about the transitive closure of the hierarchical relation, which is useful e.g. when implementing a simple query expansion algorithm in a search application.
has close match
skos:closeMatch is used to link two concepts that are sufficiently similar that they can be used interchangeably in some information retrieval applications. In order to avoid the possibility of "compound errors" when combining mappings across more than two concept schemes, skos:closeMatch is not declared to be a transitive property.
skos:exactMatch is disjoint with each of the properties skos:broadMatch and skos:relatedMatch.
has exact match
skos:exactMatch is used to link two concepts, indicating a high degree of confidence that the concepts can be used interchangeably across a wide range of information retrieval applications. skos:exactMatch is a transitive property, and is a sub-property of skos:closeMatch.
has top concept
Relates, by convention, a concept scheme to a concept which is topmost in the broader/narrower concept hierarchies for that scheme, providing an entry point to these hierarchies.
is in scheme
Relates a resource (for example a concept) to a concept scheme in which it is included.
A concept may be a member of more than one concept scheme.
These concept mapping relations mirror semantic relations, and the data model defined below is similar (with the exception of skos:exactMatch) to the data model defined for semantic relations. A distinct vocabulary is provided for concept mapping relations, to provide a convenient way to differentiate links within a concept scheme from links between concept schemes. However, this pattern of usage is not a formal requirement of the SKOS data model, and relies on informal definitions of best practice.
is in mapping relation with
Relates two concepts coming, by convention, from different schemes, and that have comparable meanings
has member
Relates a collection to one of its members.
For any resource, every item in the list given as the value of the skos:memberList property is also a value of the skos:member property.
has member list
Relates an ordered collection to the RDF list containing its members.
has narrower match
skos:narrowMatch is used to state a hierarchical mapping link between two conceptual resources in different concept schemes.
Narrower concepts are typically rendered as children in a concept hierarchy (tree).
has narrower
Relates a concept to a concept that is more specific in meaning.
has narrower transitive
skos:narrowerTransitive is a transitive superproperty of skos:narrower.
By convention, skos:narrowerTransitive is not used to make assertions. Rather, the properties can be used to draw inferences about the transitive closure of the hierarchical relation, which is useful e.g. when implementing a simple query expansion algorithm in a search application.
skos:related is disjoint with skos:broaderTransitive
has related
Relates a concept to a concept with which there is an associative semantic relationship.
has related match
skos:relatedMatch is used to state an associative mapping link between two conceptual resources in different concept schemes.
is in semantic relation with
Links a concept to a concept related by meaning.
This property should not be used directly, but as a super-property for all properties denoting a relationship of meaning between concepts.
is top concept in scheme
Relates a concept to the concept scheme that it is a top level concept of.
Type of user account (account-type-ov): facebook, ldap, nis, openid, radius, skype, tacacs, twitter, unix, windows-domain, windows-local.
Address family of this socket (network-socket-address-family-enum): AF_UNSPEC, AF_INET, AF_INET6, AF_IPX, AF_APPLETALK, AF_NETBIOS, AF_IRDA, AF_BTH.
The hashing algorithm used for this hash entry (hashing-algorithm-ov).
NTFS Alternate Data Streams present on this file. Each entry is a stones:AlternateDataStream individual.
References to SCOs generated or observed as a result of this analysis.
Processor architectures this malware can execute on (processor-architecture-ov). Multiple values as multiple triples.
References to email-addr SCOs in the Bcc: header.
Reference to the user-account SCO that owns this email address.
References to autonomous-system SCOs that own this IP address.
MIME parts of a multipart email message. Each part is a stones:EmailMimePart individual.
Reference to an artifact or file SCO containing the raw bytes of this MIME part.
Functional capabilities exhibited by this malware (malware-capabilities-ov). Multiple values as multiple triples.
References to email-addr SCOs in the Cc: header.
References to child process SCOs spawned by this process.
References to file or directory SCOs contained within this directory or archive.
Reference to the artifact SCO that holds the content of this file.
Shared context that motivates this grouping (grouping-context-ov).
Reference to the Identity SDO that created this STIX object.
Reference to the user-account SCO of the user who created this process or registry key.
Data type of this Windows registry value (windows-registry-datatype-enum): REG_NONE, REG_SZ, REG_EXPAND_SZ, REG_BINARY, REG_DWORD, etc.
Reference to the artifact SCO containing the destination-to-source payload bytes.
Reference to the destination address SCO for this network traffic flow.
Reference to the network-traffic SCO that encapsulates (wraps) this flow.
References to network-traffic SCOs encapsulated within this flow, e.g. inner tunnelled protocols.
Encryption algorithm applied to this artifact (encryption-algorithm-enum). Required when decryptionKey is present.
How this extension definition is used (extension-types-enum): new-sdo, new-sco, new-sro, property-extension, toplevel-property-extension. Multiple values as multiple triples.
References to non-STIX information sources such as CVEs, ATT&CK techniques, or URLs.
Hashes of the PE file header, expressed as HashEntry individuals.
Reference to the email-addr SCO in the From: header.
Property-level data-handling markings targeting specific fields of this object.
Cryptographic hashes of an artifact, file, certificate, or other content, expressed as a set of HashEntry individuals.
Reference to the software SCO describing the virtual machine used for analysis.
Type of entity represented by this identity (identity-class-ov): individual, group, system, organization, class, unknown.
Reference to the file SCO of the executable image that was launched to create this process.
Programming languages used to implement this malware (implementation-language-ov). Multiple values as multiple triples.
Categories of this indicator (indicator-type-ov): anomalous-activity, anonymization, benign, compromised, malicious-activity, attribution, unknown.
Functional categories of this infrastructure (infrastructure-type-ov).
References to software SCOs installed in the analysis environment.
Windows integrity level of this process (windows-integrity-level-enum): low, medium, high, system.
Kill chain phase(s) associated with this attack-pattern, indicator, infrastructure, malware, or tool.
Functional categories of this malware (malware-type-ov). Multiple values as multiple triples.
Reference to the MarkingDefinition applied by this granular marking entry.
(STIX: http-request-ext.message_body_ref)
Reference to the artifact SCO containing the HTTP message body.
References to MarkingDefinition objects that apply data-handling markings to this entire object.
Reference to the STIX object whose string properties are being translated by this language-content object.
References to STIX objects included in or annotated by this grouping, report, note, opinion, or observed-data. For observed-data the referenced objects MUST be SCOs.
STIX objects (SDOs, SCOs, SROs, meta-objects) carried in this bundle.
References to ObservedData SDOs that provide evidence supporting this sighting.
References to network-traffic SCOs representing connections this process has opened.
Reference to the software SCO describing the operating system used for analysis.
References to software SCOs describing the operating systems this malware targets or runs on.
Level of agreement expressed by this opinion (opinion-enum): strongly-disagree, disagree, neutral, agree, strongly-agree.
Reference to the directory SCO that contains this file.
Reference to the parent process SCO of this process.
Pattern language used by this indicator (pattern-type-ov): stix, pcre, sigma, snort, suricata, yara.
PE binary subtype (windows-pebinary-type-ov): exe, dll, or sys.
Personal motivations of this threat actor, distinct from organisational motivations (attack-motivation-ov). Multiple values as multiple triples.
Primary motivation driving this intrusion set or threat actor (attack-motivation-ov).
Reference to the artifact SCO containing the full raw email bytes.
UN M.49 macro-geographical region (region-ov).
Categories of intelligence covered by this report (report-type-ov). Multiple values as multiple triples.
For domain-name: references to ipv4-addr, ipv6-addr, or domain-name SCOs this domain resolves to. For ipv4-addr or ipv6-addr: references to mac-addr SCOs.
Resource level available to this intrusion set or threat actor (attack-resource-level-ov): individual, club, contest, team, organization, government.
Analysis verdict for this malware analysis (malware-result-ov): malicious, suspicious, benign, unknown.
References to file or artifact SCOs that are samples of this malware.
Additional motivations beyond the primary motivation (attack-motivation-ov). Multiple values as multiple triples.
PE section entries for this binary. Each entry is a stones:WindowsPeSection individual.
Industry sectors this identity operates in (industry-sector-ov). Multiple values as multiple triples.
Reference to the email-addr SCO in the Sender: header.
References to file SCOs for DLLs loaded by this Windows service.
Current status of this Windows service (windows-service-status-enum): SERVICE_RUNNING, SERVICE_STOPPED, SERVICE_PAUSED, etc.
Windows service type (windows-service-type-enum): SERVICE_KERNEL_DRIVER, SERVICE_FILE_SYSTEM_DRIVER, SERVICE_WIN32_OWN_PROCESS, SERVICE_WIN32_SHARE_PROCESS.
Reference to the STIX Core Object that was sighted. Typically an indicator, malware, campaign, threat-actor, intrusion-set, tool, attack-pattern, or infrastructure.
Type of this socket (network-socket-type-enum): SOCK_STREAM, SOCK_DGRAM, SOCK_RAW, SOCK_RDM, SOCK_SEQPACKET.
Skill and knowledge level of this threat actor (threat-actor-sophistication-ov): none, minimal, intermediate, advanced, expert, innovator, strategic.
The STIX Core Object at the source (start) of this relationship.
Reference to the artifact SCO containing the source-to-destination payload bytes.
Reference to the source address SCO for this network traffic flow (ipv4-addr, ipv6-addr, mac-addr, or domain-name).
Service start type (windows-service-start-type-enum): SERVICE_AUTO_START, SERVICE_BOOT_START, SERVICE_DEMAND_START, SERVICE_DISABLED, SERVICE_SYSTEM_ALERT.
The STIX Core Object at the target (end) of this relationship.
Roles this threat actor plays in an attack (threat-actor-role-ov): agent, director, independent, infrastructure-architect, infrastructure-operator, malware-author, sponsor.
Categories of this threat actor (threat-actor-type-ov). Multiple values as multiple triples.
References to email-addr SCOs in the To: header.
Functional categories of this tool (tool-type-ov). Multiple values as multiple triples.
Windows registry value entries under this key. Each entry is a stones:WindowsRegistryValue individual.
References to Identity SDOs representing where or by whom the sighting was recorded.
X.509 v3 extension fields for this certificate.
notation
A notation, also known as classification code, is a string of characters such as "T58.5" or "303.4833" used to uniquely identify a concept within the scope of a given concept scheme.
By convention, skos:notation is used with a typed literal in the object position of the triple.
Timestamp when this account was created.
Timestamp of the first login for this account.
Timestamp of the most recent login for this account.
State, province, or region within a country.
Alternative names for this object. Multiple aliases are expressed as multiple triples.
Version of the analysis definitions or signatures.
(STIX: windows-process-ext.aslr_enabled)
True if Address Space Layout Randomisation (ASLR) is enabled for this process.
Last-accessed timestamp of a file system object.
(STIX: x509-v3-extensions-type.authority_info_access)
X.509 v3 authority information access extension.
(STIX: x509-v3-extensions-type.authority_key_identifier)
Names of the authors of a note or opinion. Multiple values are expressed as multiple triples.
Raw classification string from an antivirus engine, e.g. 'Trojan.GenericKD'.
(STIX: x509-v3-extensions-type.basic_constraints)
X.509 v3 basic constraints extension value.
Colour depth of the image in bits per pixel.
Plain-text body of an email message or a MIME part.
True if this account can escalate its own privileges.
(STIX: x509-v3-extensions-type.certificate_policies)
X.509 v3 certificate policies extension.
Characteristics flags from the PE COFF header as hex.
Full command line string used to launch this process.
Comment field embedded in an archive file.
Producer's confidence in the accuracy of this data, from 0 (no confidence) to 100 (fully confident).
Version of the analysis tool configuration.
Contact details such as email address or phone number.
Content-Disposition header value for an email MIME part.
Value of the Content-Type header (email-message, email MIME part).
Number of times the sighted object was observed. MUST be >= 0.
ISO 3166-1 alpha-2 country code, e.g. 'US', 'GB'.
NVD CPE 2.3 URI binding identifier for this software.
Clear-text credential associated with this account. Handle with care.
Timestamp when the account credentials were last changed.
(STIX: x509-v3-extensions-type.crl_distribution_points)
X.509 v3 CRL distribution points extension.
Creation timestamp of a file system object.
Current working directory of the process.
Data stored in this Windows registry value.
Date and time the email was sent as recorded in the Date header.
Decryption key for this artifact when it is encrypted.
If true, the observable has been defanged, e.g. '198[.]51[.]100[.]0' in place of '198.51.100.0'.
Type of marking definition: 'tlp' or 'statement'.
True if Data Execution Prevention (DEP) is enabled for this process.
Human-readable description providing additional detail.
(STIX: windows-service-ext.descriptions)
Description strings for a Windows service. Multiple values as multiple triples.
Human-readable display name (email-addr, user-account, windows-service-ext).
Total bytes sent from destination to source.
TCP flags set on packets from the destination endpoint as hex.
Number of packets sent from destination to source.
Timestamp when this network traffic flow ended.
Explanation of why this opinion was formed.
(STIX: x509-v3-extensions-type.extended_key_usage)
X.509 v3 extended key usage extension value.
Names of new top-level properties introduced by a toplevel-property-extension. Multiple values as multiple triples.
Identifier in the external system, e.g. 'T1059', 'CVE-2021-44228'.
Earliest timestamp at which this observation occurred.
Timestamp when this object was first observed or seen.
High-level goals of this intrusion set or threat actor, e.g. 'financial gain'. Multiple values are expressed as multiple triples.
Load ordering group for this Windows service.
Names of UNIX groups this account belongs to. Multiple values as multiple triples.
Home directory path for this UNIX account.
(STIX: x509-v3-extensions-type.inhibit_any_policy)
True if this network traffic flow was still active when it was observed.
True if this socket is in blocking mode.
True if this account is currently disabled.
True if this represents a malware family; false for a specific instance or sample.
If true, this process is hidden from normal process enumeration.
True if this socket is in a listening state.
True if this email uses multipart MIME (bodyMultipart is populated); false if body contains the single plain-text body.
True if the PDF is linearized (optimised for fast web viewing).
True if this account has elevated privileges.
True if this certificate is self-signed.
True if this is a service or system account rather than a user account.
Distinguished Name of the certificate issuer.
(STIX: x509-v3-extensions-type.issuer_alternative_name)
X.509 v3 issuer alternative name extension.
Full Windows Registry key path, e.g. 'HKEY_LOCAL_MACHINE\Software\...'.
(STIX: x509-v3-extensions-type.key_usage)
Name of the kill chain framework, e.g. 'mitre-attack', 'lockheed-martin-cyber-kill-chain'.
Free-form string terms applying to this object. Multiple labels are expressed as multiple triples.
BCP 47 language tag for the human-readable content of this object, e.g. 'en', 'fr'. Also used in GranularMarking.
BCP 47 language tags for languages supported by this software. Multiple values as multiple triples.
Latest timestamp at which this observation occurred. MUST be >= firstObserved.
Timestamp when this object was last observed or seen. MUST be >= firstSeen.
Latitude in decimal degrees, range -90 to 90. Required when longitude is present.
Longitude in decimal degrees, range -180 to 180. Required when latitude is present.
Machine type from the COFF header as a hex value.
Magic bytes (file signature) as a hex string.
(STIX: http-request-ext.message_body_length)
Length of the HTTP message body in bytes.
IANA MIME type of the content (artifact, file).
Timestamp when this object was last modified. MUST be >= created.
Last modification timestamp of this registry key.
Names of analysis modules or plugins used. Multiple values as multiple triples.
Last-modified timestamp of a file system object.
Human-readable name. Used across SDOs, SCOs, and sub-objects.
(STIX: x509-v3-extensions-type.name_constraints)
X.509 v3 name constraints extension value.
Character encoding of the file name when non-ASCII characters are present.
Number of times the observation occurred. MUST be >= 1.
Number of subkeys under this registry key.
Number of entries in the COFF symbol table.
The modified timestamp of the STIX object being translated. Used to pin a translation to a specific version.
Primary goal or objective of the campaign.
Absolute file system path (directory, file).
Character encoding used for the path property when the path contains non-ASCII characters.
Detection pattern expression, e.g. a STIX patterning language expression.
Version of the pattern language, e.g. the STIX patterning language version.
Artifact byte content encoded as base64. Mutually exclusive with url.
First PDF file identifier string from the PDF trailer.
Second PDF file identifier string from the PDF trailer.
Phase within the kill chain, e.g. 'execution', 'persistence', 'lateral-movement'.
File offset of the COFF symbol table as hex.
(STIX: x509-v3-extensions-type.policy_constraints)
X.509 v3 policy constraints extension value.
(STIX: x509-v3-extensions-type.policy_mappings)
Radius of accuracy in metres around the latitude/longitude point.
Scheduling priority string for this Windows process, e.g. 'HIGH_PRIORITY_CLASS'.
(STIX: x509-v3-extensions-type.private_key_usage_period_not_after)
(STIX: x509-v3-extensions-type.private_key_usage_period_not_before)
Name of the analysis tool used, e.g. 'Cuckoo', 'VirusTotal'.
Ordered list of protocols from lowest to highest layer, e.g. 'ipv4', 'tcp', 'http'. Multiple values as multiple triples.
Date and time this report was published.
Received: header values in the order received. Multiple values as multiple triples.
Semantic type of this relationship, e.g. 'uses', 'targets', 'indicates'.
HTTP request URI path, e.g. '/index.html?q=1'.
(STIX: http-request-ext.request_version)
Classification name from the analysis product.
If true, this object has been revoked and should no longer be considered accurate.
Regional Internet Registry that assigned this ASN, e.g. 'ARIN', 'RIPE'.
Free-form roles this identity plays, e.g. 'analyst'. For threat-actor roles see the object property stones:threatActorRoles.
URL pointing to, or the raw content of, the JSON Schema defining this extension.
JSON property path selectors identifying the properties this marking applies to, e.g. 'name', 'description'. Multiple values as multiple triples.
Serial number assigned to this certificate by the issuer.
(STIX: windows-service-ext.service_name)
Windows service name as used in the Service Control Manager.
Login shell path for this UNIX account, e.g. '/bin/bash'.
Windows Security Identifier (SID) of the file owner (ntfs-ext) or process owner (windows-process-ext).
Algorithm used to sign this certificate, e.g. 'sha256WithRSAEncryption'.
Size in bytes (file, windows-pe-section, alternate-data-stream).
Size of the optional PE header in bytes.
Platform-specific socket file descriptor number.
Name of the information source, e.g. 'mitre-attack', 'cve', 'capec'.
STIX specification version. MUST be '2.1'.
Total bytes sent from source to destination.
TCP flags set on packets from the source endpoint as hex, e.g. '0x02' for SYN.
Number of packets sent from source to destination.
Timestamp when this network traffic flow started.
Human-readable statement for a statement marking definition, e.g. a copyright notice.
The STIX identifier string in the format <type>--<UUIDv4>. The IRI of the individual is the canonical identity; this property retains the string for JSON round-tripping and SPARQL querying.
The STIX object type string, e.g. 'attack-pattern'. Semantically redundant with rdf:type but preserved for JSON round-tripping.
Timestamp when this relationship ended. MUST be >= startTime.
Subject line of an email message, or Distinguished Name of the certificate subject.
(STIX: x509-v3-extensions-type.subject_alternative_name)
X.509 v3 subject alternative name extension.
(STIX: x509-v3-extensions-type.subject_directory_attributes)
X.509 v3 subject directory attributes extension.
(STIX: x509-v3-extensions-type.subject_key_identifier)
Algorithm of the subject's public key, e.g. 'rsaEncryption'.
RSA public exponent of the subject's public key.
RSA modulus of the subject's public key as a hex string.
Timestamp when the sample was submitted for analysis.
If true, this sighting aggregates multiple observations rather than recording a single specific event.
TLP level for a TLP marking definition: 'white', 'green', 'amber', or 'red'.
URL to a referenced resource (external-reference) or the location of artifact content.
Identifier of the user account, such as a login name or UID.
Timestamp from which this indicator is considered valid.
Timestamp after which this indicator is no longer valid.
Start of the certificate validity period.
Primary string value of an observable: the domain name, email address, IP address, MAC address, or URL.
Version string. Used for analysis tool version (malware-analysis), schema version (extension-definition), software version, X.509 version, and PDF format version.
(STIX: windows-process-ext.window_title)
Title text of the main window of this Windows process.
Collection
A meaningful collection of concepts.
Labelled collections can be used where you would like a set of concepts to be displayed under a 'node label' in the hierarchy.
Concept
An idea or notion; a unit of thought.
Concept Scheme
A set of concepts, optionally including statements about semantic relationships between those concepts.
Thesauri, classification schemes, subject heading lists, taxonomies, 'folksonomies', and other types of controlled vocabulary are all examples of concept schemes. Concept schemes are also embedded in glossaries and terminologies.
A concept scheme may be defined to include concepts from different sources.
Ordered Collection
An ordered collection of concepts, where both the grouping and the ordering are meaningful.
Ordered collections can be used where you would like a set of concepts to be displayed in a specific order, and optionally under a 'node label'.
An NTFS Alternate Data Stream (ADS) attached to a file, identified by name with optional hashes and size.
Alternate Data Stream
Represents a sequence of bytes, such as the content of a file, a raw stream of network traffic, or a data blob captured from memory. The content may be embedded directly via payload_bin or referenced via url.
Artifact Object
A type of Tactics, Techniques, and Procedures (TTP) that describes ways that adversaries attempt to compromise targets. Often maps to MITRE ATT&CK techniques.
Attack Pattern
Represents an Autonomous System (AS), a collection of IP routing prefixes under the control of a single administrative entity, identified by its AS number.
Autonomous System Object
A grouping of adversary behaviours and resources with a common objective pursued over a period of time. Campaigns may be attributed to intrusion sets or threat actors.
Campaign
A recommendation for a specific measure to be taken in response to an attack. May describe automated responses, playbook steps, or manual mitigations.
Course of Action
Represents a file system directory, conveying its path and timestamps. May reference the files and sub-directories it contains.
Directory Object
Represents a network domain name. Can reference the IP addresses it resolves to.
Domain Name Object
Represents a single email address, optionally associating it with a display name and a user account.
Email Address Object
Represents an email message, including its headers, body, and any MIME parts.
Email Message Object
A single MIME part within a multipart email message, including its body content, content type, and content disposition.
Email MIME Part
Defines a schema extension to STIX 2.1. Allows producers to add new properties or new object types in a structured, interoperable way.
Extension Definition Object
A structured reference to non-STIX information, such as a CVE entry, MITRE ATT&CK technique, or external URL. Used to link STIX content to authoritative external sources.
External Reference
Represents a file with its metadata and optional content reference. Supports extensions for archive files, NTFS streams, PE binaries, PDF documents, and raster images.
File Object
A property-level data handling marking that applies a marking definition to specific named fields of a STIX object, enabling fine-grained access control.
Granular Marking
Explicitly asserts that a set of STIX objects share a common context without implying the existence of a threat report. Useful for linking related objects without a formal report.
Grouping
A single cryptographic hash entry associating a hashing algorithm with its hex-encoded digest value. Used to represent entries in the STIX hashes dictionary.
Hash Entry
Represents one or more IPv4 addresses expressed using CIDR notation.
IPv4 Address Object
Represents one or more IPv6 addresses expressed using CIDR notation.
IPv6 Address Object
Actual individuals, organisations, or groups, as well as classes of individuals, organisations, systems, or groups. Used to represent victims, producers, or any other real-world actor.
Identity
Contains a pattern that can be used to detect suspicious or malicious cyber activity. Patterns are expressed using the STIX Patterning Language or another supported pattern language.
Indicator
Represents systems, software services, or any group of resources used to conduct cyber operations. Infrastructure is used by threat actors and intrusion sets both offensively and defensively.
Infrastructure
A grouped set of adversarial behaviours and resources with common properties, believed to be orchestrated by a single organisation. Often represents a named APT group.
Intrusion Set
Represents a phase within a named kill chain framework, such as the MITRE ATT&CK or Lockheed Martin Cyber Kill Chain, used to categorise the stage of an attack.
Kill Chain Phase
Provides translations of string properties of another STIX object into different languages. Allows internationalisation without modifying the original object.
Language Content Object
Represents a geographic location. May be as specific as a latitude/longitude coordinate or as broad as a continent. At least one of region, country, or latitude/longitude must be provided.
Location
Represents a single MAC address expressed in lowercase IEEE 802 colon-hexadecimal notation.
MAC Address Object
A type of TTP that represents malicious code. Captures both malware families (when is_family is true) and specific instances or samples.
Malware
Captures the results of a malware analysis process, whether static or dynamic. Represents the output of a specific analysis run on a specific sample.
Malware Analysis
Defines a data handling marking used to restrict or label how STIX data can be shared or handled, such as TLP markings. Referenced by object_marking_refs or granular_markings.
Marking Definition Object
Represents a named mutual-exclusion object, commonly created or checked by malware to prevent multiple concurrent instances from running.
Mutex Object
Represents an arbitrary network traffic flow between source and destination endpoints. Supports extensions for HTTP, ICMP, socket, and TCP specifics.
Network Traffic Object
Conveys informational text to provide further context and/or to assess the accuracy of existing STIX information. Similar to a comment or annotation on other STIX objects.
Note
Conveys information observed on systems and networks, wrapping one or more SCO references together with observation metadata such as first and last observed timestamps.
Observed Data
An assessment of the correctness of information in one or more STIX objects. Allows analysts to express agreement or disagreement with existing intelligence.
Opinion
Represents a running or terminated process on a host. Supports extensions for Windows-specific process and service attributes.
Process Object
A directed link between two STIX Core Objects. The semantics of the link are defined by the relationship_type property.
Relationship
A collection of threat intelligence focused on one or more topics, such as a description of a threat actor, malware, or attack technique. Used to package related STIX content.
Report
Records that a STIX object such as an indicator, malware, tool, or threat actor was seen. Wraps observation metadata around a reference to the sighted object.
Sighting
Represents a software product, including commercial applications, operating systems, libraries, and utilities.
Software Object
A collection of arbitrary STIX objects used as a transport container. Bundles are not Core Objects, carry no modified timestamp, and cannot be referenced by identifier.
STIX Bundle
Abstract class for STIX Core Objects, comprising SDOs, SCOs, and SROs. Core objects carry a type-qualified identifier and created/modified timestamps, and may be referenced by other objects.
STIX Core Object
Abstract class for STIX Cyber Observable Objects (SCOs), which represent technical observations such as IP addresses, files, network traffic, and processes.
STIX Cyber Observable Object
Abstract class for STIX Domain Objects (SDOs), which represent modelled cyber threat intelligence concepts such as malware, campaigns, threat actors, and vulnerabilities.
STIX Domain Object
Abstract class for STIX Meta Objects, which provide supporting infrastructure for the STIX ecosystem, including data markings, language translations, and extension definitions.
STIX Meta Object
The top-level abstract class for all STIX objects, encompassing STIX Core Objects (SDOs, SCOs, SROs), Meta Objects, and Bundles.
STIX Object
Abstract class for STIX Relationship Objects (SROs), which link Core Objects to express directed relationships and sightings between them.
STIX Relationship Object
Abstract class for structured sub-types defined by the STIX 2.1 specification that are embedded as property values within STIX objects. Instances are not STIX objects: they carry no identifier, type, spec_version, created, or modified properties and cannot be referenced by identifier from other objects. Subclasses include ExternalReference, GranularMarking, KillChainPhase, HashEntry, EmailMimePart, AlternateDataStream, WindowsPeSection, WindowsRegistryValue, and X509V3Extensions.
STIX Sub-Type
Actual individuals, groups, or organisations believed to be operating with malicious intent. Unlike Identity, a ThreatActor carries adversarial connotations.
Threat Actor
Legitimate software that can be used by threat actors to perform attacks. Distinguishable from malware by being designed for benign purposes but repurposed maliciously.
Tool
Represents a Uniform Resource Locator conforming to RFC 3986.
URL Object
Represents a user account on a system or service, including local OS accounts, cloud accounts, and social media accounts. Supports a unix-account extension for POSIX attributes.
User Account Object
A mistake in software that can be directly used by a threat actor to gain access to a system or network. Typically identified by a CVE number via an external reference.
Vulnerability
A single section entry within a Windows PE (Portable Executable) binary, described by its name, size, and optional entropy value.
Windows PE Section
Represents a Windows Registry key with its full path, value entries, modification timestamp, and creator.
Windows Registry Key Object
A single value entry within a Windows Registry key, comprising a name, a data string, and a registry data type.
Windows Registry Value
Represents an X.509 digital certificate, capturing its subject, issuer, validity window, public key details, and optional v3 extensions.
X.509 Certificate Object
The set of X.509 version 3 extension fields present in a digital certificate, such as key usage, subject alternative names, and CRL distribution points.
X.509 v3 Extensions