STONES — STIX ONtology Expression System
type: Ontology
version IRI: https://cyberterrain.org/ns/stones/0.1.0
imports: core
imports: datatype-properties#
imports: object-properties#
imports: vocabularies#
creator: Hohimer Intelligence Strategies LLC
description: An OWL 2 ontology modelling the STIX 2.1 specification. Provides a class hierarchy for all STIX Domain Objects (SDOs), Cyber Observable Objects (SCOs), Relationship Objects (SROs), Meta Objects, and structured sub-types, together with datatype and object properties covering all standard STIX properties.
license: MIT
label: STONES
version info: 0.1.0

alternative label
type: AnnotationProperty
comment: The range of skos:altLabel is the class of RDF plain literals.
comment: skos:prefLabel, skos:altLabel and skos:hiddenLabel are pairwise disjoint properties.
definition: An alternative lexical label for a resource.
example: Acronyms, abbreviations, spelling variants, and irregular plural/singular forms may be included among the alternative labels for a concept. Mis-spelled terms are normally included as hidden labels (see skos:hiddenLabel).
sub property of: label

change note
type: AnnotationProperty
definition: A note about a modification to a concept.
sub property of: note

definition
type: AnnotationProperty
definition: A statement or formal explanation of the meaning of a concept.
sub property of: note

editorial note
type: AnnotationProperty
definition: A note for an editor, translator or maintainer of the vocabulary.
sub property of: note

example
type: AnnotationProperty
definition: An example of the use of a concept.
sub property of: note

hidden label
type: AnnotationProperty
comment: The range of skos:hiddenLabel is the class of RDF plain literals.
comment: skos:prefLabel, skos:altLabel and skos:hiddenLabel are pairwise disjoint properties.
definition: A lexical label for a resource that should be hidden when generating visual displays of the resource, but should still be accessible to free text search operations.
sub property of: label

history note
type: AnnotationProperty
definition: A note about the past state/use/meaning of a concept.
sub property of: note

note
type: AnnotationProperty
definition: A general note, for any purpose.
scope note: This property may be used directly, or as a super-property for more specific note types.

preferred label
type: AnnotationProperty
comment: A resource has no more than one value of skos:prefLabel per language tag, and no more than one value of skos:prefLabel without language tag.
comment: The range of skos:prefLabel is the class of RDF plain literals.
comment: skos:prefLabel, skos:altLabel and skos:hiddenLabel are pairwise disjoint properties.
definition: The preferred lexical label for a resource, in a given language.
sub property of: label

scope note
type: AnnotationProperty
definition: A note that helps to clarify the meaning and/or the use of a concept.
sub property of: note

has broader match
type: ObjectProperty
sub property of: has broader
sub property of: is in mapping relation with
inverse of: has narrower match
definition: skos:broadMatch is used to state a hierarchical mapping link between two conceptual resources in different concept schemes.

has broader
type: ObjectProperty
sub property of: has broader transitive
comment: Broader concepts are typically rendered as parents in a concept hierarchy (tree).
definition: Relates a concept to a concept that is more general in meaning.
scope note: By convention, skos:broader is only used to assert an immediate (i.e. direct) hierarchical link between two conceptual resources.

has broader transitive
type: ObjectProperty
sub property of: is in semantic relation with
inverse of: has narrower transitive
type: TransitiveProperty
definition: skos:broaderTransitive is a transitive superproperty of skos:broader.
scope note: By convention, skos:broaderTransitive is not used to make assertions. Rather, the properties can be used to draw inferences about the transitive closure of the hierarchical relation, which is useful e.g. when implementing a simple query expansion algorithm in a search application.

has close match
type: ObjectProperty
sub property of: is in mapping relation with
type: SymmetricProperty
definition: skos:closeMatch is used to link two concepts that are sufficiently similar that they can be used interchangeably in some information retrieval applications. In order to avoid the possibility of "compound errors" when combining mappings across more than two concept schemes, skos:closeMatch is not declared to be a transitive property.

has exact match
type: ObjectProperty
sub property of: has close match
type: SymmetricProperty
type: TransitiveProperty
comment: skos:exactMatch is disjoint with each of the properties skos:broadMatch and skos:relatedMatch.
definition: skos:exactMatch is used to link two concepts, indicating a high degree of confidence that the concepts can be used interchangeably across a wide range of information retrieval applications. skos:exactMatch is a transitive property, and is a sub-property of skos:closeMatch.

has top concept
type: ObjectProperty
inverse of: is top concept in scheme
domain: Concept Scheme
range: Concept
definition: Relates, by convention, a concept scheme to a concept which is topmost in the broader/narrower concept hierarchies for that scheme, providing an entry point to these hierarchies.

is in scheme
type: ObjectProperty
range: Concept Scheme
definition: Relates a resource (for example a concept) to a concept scheme in which it is included.
scope note: A concept may be a member of more than one concept scheme.

is in mapping relation with
type: ObjectProperty
sub property of: is in semantic relation with
comment: These concept mapping relations mirror semantic relations, and the data model defined below is similar (with the exception of skos:exactMatch) to the data model defined for semantic relations. A distinct vocabulary is provided for concept mapping relations, to provide a convenient way to differentiate links within a concept scheme from links between concept schemes. However, this pattern of usage is not a formal requirement of the SKOS data model, and relies on informal definitions of best practice.
definition: Relates two concepts coming, by convention, from different schemes, and that have comparable meanings

has member
type: ObjectProperty
domain: Collection
range: Class
  union of: Collection
  union of: Concept
definition: Relates a collection to one of its members.

has member list
type: ObjectProperty
type: FunctionalProperty
domain: Ordered Collection
range: List
comment: For any resource, every item in the list given as the value of the skos:memberList property is also a value of the skos:member property.
definition: Relates an ordered collection to the RDF list containing its members.

has narrower match
type: ObjectProperty
sub property of: is in mapping relation with
sub property of: has narrower
definition: skos:narrowMatch is used to state a hierarchical mapping link between two conceptual resources in different concept schemes.

has narrower
type: ObjectProperty
sub property of: has narrower transitive
inverse of: has broader
comment: Narrower concepts are typically rendered as children in a concept hierarchy (tree).
definition: Relates a concept to a concept that is more specific in meaning.
scope note: By convention, skos:broader is only used to assert an immediate (i.e. direct) hierarchical link between two conceptual resources.

has narrower transitive
type: ObjectProperty
sub property of: is in semantic relation with
type: TransitiveProperty
definition: skos:narrowerTransitive is a transitive superproperty of skos:narrower.
scope note: By convention, skos:narrowerTransitive is not used to make assertions. Rather, the properties can be used to draw inferences about the transitive closure of the hierarchical relation, which is useful e.g. when implementing a simple query expansion algorithm in a search application.

has related
type: ObjectProperty
sub property of: is in semantic relation with
type: SymmetricProperty
comment: skos:related is disjoint with skos:broaderTransitive
definition: Relates a concept to a concept with which there is an associative semantic relationship.

has related match
type: ObjectProperty
sub property of: is in mapping relation with
sub property of: has related
type: SymmetricProperty
definition: skos:relatedMatch is used to state an associative mapping link between two conceptual resources in different concept schemes.

is in semantic relation with
type: ObjectProperty
domain: Concept
range: Concept
definition: Links a concept to a concept related by meaning.
scope note: This property should not be used directly, but as a super-property for all properties denoting a relationship of meaning between concepts.

is top concept in scheme
type: ObjectProperty
sub property of: is in scheme
domain: Concept
range: Concept Scheme
definition: Relates a concept to the concept scheme that it is a top level concept of.

accountType
type: ObjectProperty
domain: User Account Object
range: AccountTypeVocabulary
comment: (STIX: account_type)
definition: Type of user account (account-type-ov): facebook, ldap, nis, openid, radius, skype, tacacs, twitter, unix, windows-domain, windows-local.

addressFamily
type: ObjectProperty
range: NetworkSocketAddressFamilyEnumeration
comment: (STIX: address_family)
definition: Address family of this socket (network-socket-address-family-enum): AF_UNSPEC, AF_INET, AF_INET6, AF_IPX, AF_APPLETALK, AF_NETBIOS, AF_IRDA, AF_BTH.

algorithm
type: ObjectProperty
domain: Hash Entry
range: HashingAlgorithmVocabulary
comment: (STIX: hashes dictionary key)
definition: The hashing algorithm used for this hash entry (hashing-algorithm-ov).

alternateDataStreams
type: ObjectProperty
range: Alternate Data Stream
comment: (STIX: alternate_data_streams)
definition: NTFS Alternate Data Streams present on this file. Each entry is a stones:AlternateDataStream individual.

analysisScoRefs
type: ObjectProperty
domain: Malware Analysis
range: STIX Cyber Observable Object
comment: (STIX: analysis_sco_refs)
definition: References to SCOs generated or observed as a result of this analysis.

architectureExecutionEnvs
type: ObjectProperty
domain: Malware
range: ProcessorArchitectureVocabulary
comment: (STIX: architecture_execution_envs)
definition: Processor architectures this malware can execute on (processor-architecture-ov). Multiple values as multiple triples.

bccRefs
type: ObjectProperty
domain: Email Message Object
range: Email Address Object
comment: (STIX: bcc_refs)
definition: References to email-addr SCOs in the Bcc: header.

belongsToRef
type: ObjectProperty
domain: Email Address Object
range: User Account Object
comment: (STIX: belongs_to_ref)
definition: Reference to the user-account SCO that owns this email address.

belongsToRefs
type: ObjectProperty
range: Autonomous System Object
comment: (STIX: belongs_to_refs)
definition: References to autonomous-system SCOs that own this IP address.

bodyMultipart
type: ObjectProperty
domain: Email Message Object
range: Email MIME Part
comment: (STIX: body_multipart)
definition: MIME parts of a multipart email message. Each part is a stones:EmailMimePart individual.

bodyRawRef
type: ObjectProperty
domain: Email MIME Part
range: STIX Cyber Observable Object
comment: (STIX: body_raw_ref)
definition: Reference to an artifact or file SCO containing the raw bytes of this MIME part.

capabilities
type: ObjectProperty
domain: Malware
range: MalwareCapabilitesVocabulary
comment: (STIX: capabilities)
definition: Functional capabilities exhibited by this malware (malware-capabilities-ov). Multiple values as multiple triples.

ccRefs
type: ObjectProperty
domain: Email Message Object
range: Email Address Object
comment: (STIX: cc_refs)
definition: References to email-addr SCOs in the Cc: header.

childRefs
type: ObjectProperty
domain: Process Object
range: Process Object
comment: (STIX: child_refs)
definition: References to child process SCOs spawned by this process.

containsRefs
type: ObjectProperty
range: STIX Cyber Observable Object
comment: (STIX: contains_refs)
definition: References to file or directory SCOs contained within this directory or archive.

contentRef
type: ObjectProperty
domain: File Object
range: Artifact Object
comment: (STIX: content_ref)
definition: Reference to the artifact SCO that holds the content of this file.

context
type: ObjectProperty
domain: Grouping
range: GroupingContextVocabulary
comment: (STIX: context)
definition: Shared context that motivates this grouping (grouping-context-ov).

createdByRef
type: ObjectProperty
domain: STIX Core Object
range: Identity
comment: (STIX: created_by_ref)
definition: Reference to the Identity SDO that created this STIX object.

creatorUserRef
type: ObjectProperty
range: User Account Object
comment: (STIX: creator_user_ref)
definition: Reference to the user-account SCO of the user who created this process or registry key.

dataType
type: ObjectProperty
domain: Windows Registry Value
range: WindowsRegistryDatatypeEnumeration
comment: (STIX: data_type)
definition: Data type of this Windows registry value (windows-registry-datatype-enum): REG_NONE, REG_SZ, REG_EXPAND_SZ, REG_BINARY, REG_DWORD, etc.

dstPayloadRef
type: ObjectProperty
domain: Network Traffic Object
range: Artifact Object
comment: (STIX: dst_payload_ref)
definition: Reference to the artifact SCO containing the destination-to-source payload bytes.

dstRef
type: ObjectProperty
domain: Network Traffic Object
range: STIX Cyber Observable Object
comment: (STIX: dst_ref)
definition: Reference to the destination address SCO for this network traffic flow.

encapsulatedByRef
type: ObjectProperty
domain: Network Traffic Object
range: Network Traffic Object
comment: (STIX: encapsulated_by_ref)
definition: Reference to the network-traffic SCO that encapsulates (wraps) this flow.

encapsulatesRefs
type: ObjectProperty
domain: Network Traffic Object
range: Network Traffic Object
comment: (STIX: encapsulates_refs)
definition: References to network-traffic SCOs encapsulated within this flow, e.g. inner tunnelled protocols.

encryptionAlgorithm
type: ObjectProperty
domain: Artifact Object
range: EncryptionAlgorithmEnumeration
comment: (STIX: encryption_algorithm)
definition: Encryption algorithm applied to this artifact (encryption-algorithm-enum). Required when decryptionKey is present.

extensionTypes
type: ObjectProperty
domain: Extension Definition Object
range: ExtensionTypesEnumeration
comment: (STIX: extension_types)
definition: How this extension definition is used (extension-types-enum): new-sdo, new-sco, new-sro, property-extension, toplevel-property-extension. Multiple values as multiple triples.

externalReferences
type: ObjectProperty
domain: STIX Core Object
range: External Reference
comment: (STIX: external_references)
definition: References to non-STIX information sources such as CVEs, ATT&CK techniques, or URLs.

fileHeaderHashes
type: ObjectProperty
range: Hash Entry
comment: (STIX: file_header_hashes)
definition: Hashes of the PE file header, expressed as HashEntry individuals.

fromRef
type: ObjectProperty
domain: Email Message Object
range: Email Address Object
comment: (STIX: from_ref)
definition: Reference to the email-addr SCO in the From: header.

granularMarkings
type: ObjectProperty
domain: STIX Core Object
range: Granular Marking
comment: (STIX: granular_markings)
definition: Property-level data-handling markings targeting specific fields of this object.

hashes
type: ObjectProperty
range: Hash Entry
comment: (STIX: hashes)
definition: Cryptographic hashes of an artifact, file, certificate, or other content, expressed as a set of HashEntry individuals.

hostVmRef
type: ObjectProperty
domain: Malware Analysis
range: Software Object
comment: (STIX: host_vm_ref)
definition: Reference to the software SCO describing the virtual machine used for analysis.

identityClass
type: ObjectProperty
domain: Identity
range: IdentityClassVocabulary
comment: (STIX: identity_class)
definition: Type of entity represented by this identity (identity-class-ov): individual, group, system, organization, class, unknown.

imageRef
type: ObjectProperty
domain: Process Object
range: File Object
comment: (STIX: image_ref)
definition: Reference to the file SCO of the executable image that was launched to create this process.

implementationLanguages
type: ObjectProperty
domain: Malware
range: ImplementationLanguageVocabulary
comment: (STIX: implementation_languages)
definition: Programming languages used to implement this malware (implementation-language-ov). Multiple values as multiple triples.

indicatorTypes
type: ObjectProperty
domain: Indicator
range: IndicatorTypeVocabulary
comment: (STIX: indicator_types)
definition: Categories of this indicator (indicator-type-ov): anomalous-activity, anonymization, benign, compromised, malicious-activity, attribution, unknown.

infrastructureTypes
type: ObjectProperty
domain: Infrastructure
range: InfrastuctureTypeVocabulary
comment: (STIX: infrastructure_types)
definition: Functional categories of this infrastructure (infrastructure-type-ov).

installedSoftwareRefs
type: ObjectProperty
domain: Malware Analysis
range: Software Object
comment: (STIX: installed_software_refs)
definition: References to software SCOs installed in the analysis environment.

integrityLevel
type: ObjectProperty
range: WindowsIntegrityLevelEnumeration
comment: (STIX: integrity_level)
definition: Windows integrity level of this process (windows-integrity-level-enum): low, medium, high, system.

killChainPhases
type: ObjectProperty
range: Kill Chain Phase
comment: (STIX: kill_chain_phases)
definition: Kill chain phase(s) associated with this attack-pattern, indicator, infrastructure, malware, or tool.

malwareTypes
type: ObjectProperty
domain: Malware
range: MalwareTypeVocabulary
comment: (STIX: malware_types)
definition: Functional categories of this malware (malware-type-ov). Multiple values as multiple triples.

markingRef
type: ObjectProperty
domain: Granular Marking
range: Marking Definition Object
comment: (STIX: granular-marking.marking_ref)
definition: Reference to the MarkingDefinition applied by this granular marking entry.

messageBodyRef
type: ObjectProperty
range: Artifact Object
comment: (STIX: http-request-ext.message_body_ref)
definition: Reference to the artifact SCO containing the HTTP message body.

objectMarkingRefs
type: ObjectProperty
domain: STIX Core Object
range: Marking Definition Object
comment: (STIX: object_marking_refs)
definition: References to MarkingDefinition objects that apply data-handling markings to this entire object.

objectRef
type: ObjectProperty
domain: Language Content Object
range: STIX Object
comment: (STIX: object_ref)
definition: Reference to the STIX object whose string properties are being translated by this language-content object.

objectRefs
type: ObjectProperty
range: STIX Object
comment: (STIX: object_refs)
definition: References to STIX objects included in or annotated by this grouping, report, note, opinion, or observed-data. For observed-data the referenced objects MUST be SCOs.

objects
type: ObjectProperty
domain: STIX Bundle
range: STIX Object
comment: (STIX: objects)
definition: STIX objects (SDOs, SCOs, SROs, meta-objects) carried in this bundle.

observedDataRefs
type: ObjectProperty
domain: Sighting
range: Observed Data
comment: (STIX: observed_data_refs)
definition: References to ObservedData SDOs that provide evidence supporting this sighting.

openedConnectionRefs
type: ObjectProperty
domain: Process Object
range: Network Traffic Object
comment: (STIX: opened_connection_refs)
definition: References to network-traffic SCOs representing connections this process has opened.

operatingSystemRef
type: ObjectProperty
domain: Malware Analysis
range: Software Object
comment: (STIX: operating_system_ref)
definition: Reference to the software SCO describing the operating system used for analysis.

operatingSystemRefs
type: ObjectProperty
domain: Malware
range: Software Object
comment: (STIX: operating_system_refs)
definition: References to software SCOs describing the operating systems this malware targets or runs on.

opinion
type: ObjectProperty
domain: Opinion
range: OpinionEnumeration
comment: (STIX: opinion)
definition: Level of agreement expressed by this opinion (opinion-enum): strongly-disagree, disagree, neutral, agree, strongly-agree.

parentDirectoryRef
type: ObjectProperty
domain: File Object
range: Directory Object
comment: (STIX: parent_directory_ref)
definition: Reference to the directory SCO that contains this file.

parentRef
type: ObjectProperty
domain: Process Object
range: Process Object
comment: (STIX: parent_ref)
definition: Reference to the parent process SCO of this process.

patternType
type: ObjectProperty
domain: Indicator
range: PatternTypeVocabulary
comment: (STIX: pattern_type)
definition: Pattern language used by this indicator (pattern-type-ov): stix, pcre, sigma, snort, suricata, yara.

peType
type: ObjectProperty
range: WindowsPEBinaryVocabulary
comment: (STIX: pe_type)
definition: PE binary subtype (windows-pebinary-type-ov): exe, dll, or sys.

personalMotivations
type: ObjectProperty
domain: Threat Actor
range: AttackMotivationVocabulary
comment: (STIX: personal_motivations)
definition: Personal motivations of this threat actor, distinct from organisational motivations (attack-motivation-ov). Multiple values as multiple triples.

primaryMotivation
type: ObjectProperty
range: AttackMotivationVocabulary
comment: (STIX: primary_motivation)
definition: Primary motivation driving this intrusion set or threat actor (attack-motivation-ov).

rawEmailRef
type: ObjectProperty
domain: Email Message Object
range: Artifact Object
comment: (STIX: raw_email_ref)
definition: Reference to the artifact SCO containing the full raw email bytes.

region
type: ObjectProperty
domain: Location
range: RegionVocabulary
comment: (STIX: region)
definition: UN M.49 macro-geographical region (region-ov).

reportTypes
type: ObjectProperty
domain: Report
range: ReportTypeVocabulary
comment: (STIX: report_types)
definition: Categories of intelligence covered by this report (report-type-ov). Multiple values as multiple triples.

resolvesToRefs
type: ObjectProperty
range: STIX Cyber Observable Object
comment: (STIX: resolves_to_refs)
definition: For domain-name: references to ipv4-addr, ipv6-addr, or domain-name SCOs this domain resolves to. For ipv4-addr or ipv6-addr: references to mac-addr SCOs.

resourceLevel
type: ObjectProperty
range: AttackResourceLevelVocabulary
comment: (STIX: resource_level)
definition: Resource level available to this intrusion set or threat actor (attack-resource-level-ov): individual, club, contest, team, organization, government.

result
type: ObjectProperty
domain: Malware Analysis
range: MalwareResultVocabulary
comment: (STIX: result)
definition: Analysis verdict for this malware analysis (malware-result-ov): malicious, suspicious, benign, unknown.

sampleRefs
type: ObjectProperty
domain: Malware
range: STIX Cyber Observable Object
comment: (STIX: sample_refs)
definition: References to file or artifact SCOs that are samples of this malware.

secondaryMotivations
type: ObjectProperty
range: AttackMotivationVocabulary
comment: (STIX: secondary_motivations)
definition: Additional motivations beyond the primary motivation (attack-motivation-ov). Multiple values as multiple triples.

sections
type: ObjectProperty
range: Windows PE Section
comment: (STIX: sections)
definition: PE section entries for this binary. Each entry is a stones:WindowsPeSection individual.

sectors
type: ObjectProperty
domain: Identity
range: IndustrySectorVocabulary
comment: (STIX: sectors)
definition: Industry sectors this identity operates in (industry-sector-ov). Multiple values as multiple triples.

senderRef
type: ObjectProperty
domain: Email Message Object
range: Email Address Object
comment: (STIX: sender_ref)
definition: Reference to the email-addr SCO in the Sender: header.

serviceDllRefs
type: ObjectProperty
range: File Object
comment: (STIX: service_dll_refs)
definition: References to file SCOs for DLLs loaded by this Windows service.

serviceStatus
type: ObjectProperty
range: WindowsServiceStatusEnumeration
comment: (STIX: service_status)
definition: Current status of this Windows service (windows-service-status-enum): SERVICE_RUNNING, SERVICE_STOPPED, SERVICE_PAUSED, etc.

serviceType
type: ObjectProperty
range: WindowsServiceTypeEnumeration
comment: (STIX: service_type)
definition: Windows service type (windows-service-type-enum): SERVICE_KERNEL_DRIVER, SERVICE_FILE_SYSTEM_DRIVER, SERVICE_WIN32_OWN_PROCESS, SERVICE_WIN32_SHARE_PROCESS.

sightingOfRef
type: ObjectProperty
domain: Sighting
range: STIX Core Object
comment: (STIX: sighting_of_ref)
definition: Reference to the STIX Core Object that was sighted. Typically an indicator, malware, campaign, threat-actor, intrusion-set, tool, attack-pattern, or infrastructure.

socketType
type: ObjectProperty
range: NetworkSocketTypeEnumeration
comment: (STIX: socket_type)
definition: Type of this socket (network-socket-type-enum): SOCK_STREAM, SOCK_DGRAM, SOCK_RAW, SOCK_RDM, SOCK_SEQPACKET.

sophistication
type: ObjectProperty
domain: Threat Actor
range: ThreatActorSophisticationVocabulary
comment: (STIX: sophistication)
definition: Skill and knowledge level of this threat actor (threat-actor-sophistication-ov): none, minimal, intermediate, advanced, expert, innovator, strategic.

sourceRef
type: ObjectProperty
domain: Relationship
range: STIX Core Object
comment: (STIX: source_ref)
definition: The STIX Core Object at the source (start) of this relationship.

srcPayloadRef
type: ObjectProperty
domain: Network Traffic Object
range: Artifact Object
comment: (STIX: src_payload_ref)
definition: Reference to the artifact SCO containing the source-to-destination payload bytes.

srcRef
type: ObjectProperty
domain: Network Traffic Object
range: STIX Cyber Observable Object
comment: (STIX: src_ref)
definition: Reference to the source address SCO for this network traffic flow (ipv4-addr, ipv6-addr, mac-addr, or domain-name).

startType
type: ObjectProperty
range: WindowsServiceStartTypeEnumeration
comment: (STIX: start_type)
definition: Service start type (windows-service-start-type-enum): SERVICE_AUTO_START, SERVICE_BOOT_START, SERVICE_DEMAND_START, SERVICE_DISABLED, SERVICE_SYSTEM_ALERT.

targetRef
type: ObjectProperty
domain: Relationship
range: STIX Core Object
comment: (STIX: target_ref)
definition: The STIX Core Object at the target (end) of this relationship.

threatActorRoles
type: ObjectProperty
domain: Threat Actor
range: ThreatActorRoleVocabulary
comment: (STIX: roles)
definition: Roles this threat actor plays in an attack (threat-actor-role-ov): agent, director, independent, infrastructure-architect, infrastructure-operator, malware-author, sponsor.

threatActorTypes
type: ObjectProperty
domain: Threat Actor
range: ThreatActorTypeVocabulary
comment: (STIX: threat_actor_types)
definition: Categories of this threat actor (threat-actor-type-ov). Multiple values as multiple triples.

toRefs
type: ObjectProperty
domain: Email Message Object
range: Email Address Object
comment: (STIX: to_refs)
definition: References to email-addr SCOs in the To: header.

toolTypes
type: ObjectProperty
domain: Tool
range: ToolTypeVocabulary
comment: (STIX: tool_types)
definition: Functional categories of this tool (tool-type-ov). Multiple values as multiple triples.

values
type: ObjectProperty
domain: Windows Registry Key Object
range: Windows Registry Value
comment: (STIX: values)
definition: Windows registry value entries under this key. Each entry is a stones:WindowsRegistryValue individual.

whereSightedRefs
type: ObjectProperty
domain: Sighting
range: Identity
comment: (STIX: where_sighted_refs)
definition: References to Identity SDOs representing where or by whom the sighting was recorded.

x509V3Extensions
type: ObjectProperty
domain: X.509 Certificate Object
range: X.509 v3 Extensions
comment: (STIX: x509_v3_extensions)
definition: X.509 v3 extension fields for this certificate.

notation
type: DatatypeProperty
definition: A notation, also known as classification code, is a string of characters such as "T58.5" or "303.4833" used to uniquely identify a concept within the scope of a given concept scheme.
scope note: By convention, skos:notation is used with a typed literal in the object position of the triple.

abstract
type: DatatypeProperty
domain: Note
range: string
comment: (STIX: abstract)
definition: Brief summary of the note.

accountCreated
type: DatatypeProperty
domain: User Account Object
range: dateTime
comment: (STIX: account_created)
definition: Timestamp when this account was created.

accountExpires
type: DatatypeProperty
domain: User Account Object
range: dateTime
comment: (STIX: account_expires)
definition: Timestamp when this account expires.

accountFirstLogin
type: DatatypeProperty
domain: User Account Object
range: dateTime
comment: (STIX: account_first_login)
definition: Timestamp of the first login for this account.

accountLastLogin
type: DatatypeProperty
domain: User Account Object
range: dateTime
comment: (STIX: account_last_login)
definition: Timestamp of the most recent login for this account.

accountLogin
type: DatatypeProperty
domain: User Account Object
range: string
comment: (STIX: account_login)
definition: Login name if different from userId.

administrativeArea
type: DatatypeProperty
domain: Location
range: string
comment: (STIX: administrative_area)
definition: State, province, or region within a country.

aliases
type: DatatypeProperty
range: string
comment: (STIX: aliases)
definition: Alternative names for this object. Multiple aliases are expressed as multiple triples.

analysisDefinitionVersion
type: DatatypeProperty
domain: Malware Analysis
range: string
comment: (STIX: analysis_definition_version)
definition: Version of the analysis definitions or signatures.

analysisEnded
type: DatatypeProperty
domain: Malware Analysis
range: dateTime
comment: (STIX: analysis_ended)
definition: Timestamp when analysis concluded.

analysisEngineVersion
type: DatatypeProperty
domain: Malware Analysis
range: string
comment: (STIX: analysis_engine_version)
definition: Version of the analysis engine.

analysisStarted
type: DatatypeProperty
domain: Malware Analysis
range: dateTime
comment: (STIX: analysis_started)
definition: Timestamp when analysis began.

aslrEnabled
type: DatatypeProperty
range: boolean
comment: (STIX: windows-process-ext.aslr_enabled)
definition: True if Address Space Layout Randomisation (ASLR) is enabled for this process.

atime
type: DatatypeProperty
range: dateTime
comment: (STIX: atime)
definition: Last-accessed timestamp of a file system object.

authorityInfoAccess
type: DatatypeProperty
domain: X.509 v3 Extensions
range: string
comment: (STIX: x509-v3-extensions-type.authority_info_access)
definition: X.509 v3 authority information access extension.

authorityKeyIdentifier
type: DatatypeProperty
domain: X.509 v3 Extensions
range: string
comment: (STIX: x509-v3-extensions-type.authority_key_identifier)
definition: X.509 v3 authority key identifier.

authors
type: DatatypeProperty
range: string
comment: (STIX: authors)
definition: Names of the authors of a note or opinion. Multiple values are expressed as multiple triples.

avResult
type: DatatypeProperty
domain: Malware Analysis
range: string
comment: (STIX: av_result)
definition: Raw classification string from an antivirus engine, e.g. 'Trojan.GenericKD'.

basicConstraints
type: DatatypeProperty
domain: X.509 v3 Extensions
range: string
comment: (STIX: x509-v3-extensions-type.basic_constraints)
definition: X.509 v3 basic constraints extension value.

bitsPerPixel
type: DatatypeProperty
range: integer
comment: (STIX: raster-image-ext.bits_per_pixel)
definition: Colour depth of the image in bits per pixel.

body
type: DatatypeProperty
range: string
comment: (STIX: body)
definition: Plain-text body of an email message or a MIME part.

canEscalatePrivs
type: DatatypeProperty
domain: User Account Object
range: boolean
comment: (STIX: can_escalate_privs)
definition: True if this account can escalate its own privileges.

certificatePolicies
type: DatatypeProperty
domain: X.509 v3 Extensions
range: string
comment: (STIX: x509-v3-extensions-type.certificate_policies)
definition: X.509 v3 certificate policies extension.

characteristicsHex
type: DatatypeProperty
range: hexBinary
comment: (STIX: characteristics_hex)
definition: Characteristics flags from the PE COFF header as hex.

city
type: DatatypeProperty
domain: Location
range: string
comment: (STIX: city)
definition: City name.

commandLine
type: DatatypeProperty
domain: Process Object
range: string
comment: (STIX: command_line)
definition: Full command line string used to launch this process.

comment
type: DatatypeProperty
range: string
comment: (STIX: archive-ext.comment)
definition: Comment field embedded in an archive file.

confidence
type: DatatypeProperty
domain: STIX Object
range: integer
comment: (STIX: confidence)
definition: Producer's confidence in the accuracy of this data, from 0 (no confidence) to 100 (fully confident).

configurationVersion
type: DatatypeProperty
domain: Malware Analysis
range: string
comment: (STIX: configuration_version)
definition: Version of the analysis tool configuration.

contactInformation
type: DatatypeProperty
domain: Identity
range: string
comment: (STIX: contact_information)
definition: Contact details such as email address or phone number.

content
type: DatatypeProperty
domain: Note
range: string
comment: (STIX: content)
definition: Full body text of the note.

contentDisposition
type: DatatypeProperty
domain: Email MIME Part
range: string
comment: (STIX: content_disposition)
definition: Content-Disposition header value for an email MIME part.

contentType
type: DatatypeProperty
range: string
comment: (STIX: content_type)
definition: Value of the Content-Type header (email-message, email MIME part).

count
type: DatatypeProperty
domain: Sighting
range: integer
comment: (STIX: count)
definition: Number of times the sighted object was observed. MUST be >= 0.

country
type: DatatypeProperty
domain: Location
range: string
comment: (STIX: country)
definition: ISO 3166-1 alpha-2 country code, e.g. 'US', 'GB'.

cpe
type: DatatypeProperty
domain: Software Object
range: string
comment: (STIX: cpe)
definition: NVD CPE 2.3 URI binding identifier for this software.

created
type: DatatypeProperty
domain: STIX Core Object
range: dateTime
comment: (STIX: created)
definition: Timestamp when this object was created.

createdTime
type: DatatypeProperty
domain: Process Object
range: dateTime
comment: (STIX: created_time)
definition: Timestamp when the process was created.

credential
type: DatatypeProperty
domain: User Account Object
range: string
comment: (STIX: credential)
definition: Clear-text credential associated with this account. Handle with care.

credentialLastChanged
type: DatatypeProperty
domain: User Account Object
range: dateTime
comment: (STIX: credential_last_changed)
definition: Timestamp when the account credentials were last changed.

crlDistributionPoints
type: DatatypeProperty
domain: X.509 v3 Extensions
range: string
comment: (STIX: x509-v3-extensions-type.crl_distribution_points)
definition: X.509 v3 CRL distribution points extension.

ctime
type: DatatypeProperty
range: dateTime
comment: (STIX: ctime)
definition: Creation timestamp of a file system object.

cwd
type: DatatypeProperty
domain: Process Object
range: string
comment: (STIX: cwd)
definition: Current working directory of the process.

data
type: DatatypeProperty
domain: Windows Registry Value
range: string
comment: (STIX: data)
definition: Data stored in this Windows registry value.

date
type: DatatypeProperty
domain: Email Message Object
range: dateTime
comment: (STIX: date)
definition: Date and time the email was sent as recorded in the Date header.

decryptionKey
type: DatatypeProperty
domain: Artifact Object
range: string
comment: (STIX: decryption_key)
definition: Decryption key for this artifact when it is encrypted.

defanged
type: DatatypeProperty
domain: STIX Cyber Observable Object
range: boolean
comment: (STIX: defanged)
definition: If true, the observable has been defanged, e.g. '198[.]51[.]100[.]0' in place of '198.51.100.0'.

definitionType
type: DatatypeProperty
domain: Marking Definition Object
range: string
comment: (STIX: definition_type)
definition: Type of marking definition: 'tlp' or 'statement'.

depEnabled
type: DatatypeProperty
range: boolean
comment: (STIX: windows-process-ext.dep_enabled)
definition: True if Data Execution Prevention (DEP) is enabled for this process.

description
type: DatatypeProperty
range: string
comment: (STIX: description)
definition: Human-readable description providing additional detail.

descriptions
type: DatatypeProperty
range: string
comment: (STIX: windows-service-ext.descriptions)
definition: Description strings for a Windows service. Multiple values as multiple triples.

displayName
type: DatatypeProperty
range: string
comment: (STIX: display_name)
definition: Human-readable display name (email-addr, user-account, windows-service-ext).

dstByteCount
type: DatatypeProperty
domain: Network Traffic Object
range: integer
comment: (STIX: dst_byte_count)
definition: Total bytes sent from destination to source.

dstFlagsHex
type: DatatypeProperty
range: hexBinary
comment: (STIX: tcp-ext.dst_flags_hex)
definition: TCP flags set on packets from the destination endpoint as hex.

dstPackets
type: DatatypeProperty
domain: Network Traffic Object
range: integer
comment: (STIX: dst_packets)
definition: Number of packets sent from destination to source.

dstPort
type: DatatypeProperty
domain: Network Traffic Object
range: integer
comment: (STIX: dst_port)
definition: Destination port number (0–65535).

end
type: DatatypeProperty
domain: Network Traffic Object
range: dateTime
comment: (STIX: end)
definition: Timestamp when this network traffic flow ended.

entropy
type: DatatypeProperty
domain: Windows PE Section
range: float
comment: (STIX: windows-pe-section-type.entropy)
definition: Calculated entropy of this PE section.

explanation
type: DatatypeProperty
domain: Opinion
range: string
comment: (STIX: explanation)
definition: Explanation of why this opinion was formed.

extendedKeyUsage
type: DatatypeProperty
domain: X.509 v3 Extensions
range: string
comment: (STIX: x509-v3-extensions-type.extended_key_usage)
definition: X.509 v3 extended key usage extension value.

extensionProperties
type: DatatypeProperty
domain: Extension Definition Object
range: string
comment: (STIX: extension_properties)
definition: Names of new top-level properties introduced by a toplevel-property-extension. Multiple values as multiple triples.

externalId
type: DatatypeProperty
domain: External Reference
range: string
comment: (STIX: external_id)
definition: Identifier in the external system, e.g. 'T1059', 'CVE-2021-44228'.

firstObserved
type: DatatypeProperty
domain: Observed Data
range: dateTime
comment: (STIX: first_observed)
definition: Earliest timestamp at which this observation occurred.

firstSeen
type: DatatypeProperty
range: dateTime
comment: (STIX: first_seen)
definition: Timestamp when this object was first observed or seen.

gid
type: DatatypeProperty
domain: User Account Object
range: integer
comment: (STIX: unix-account-ext.gid)
definition: Primary numeric UNIX group ID (GID).

goals
type: DatatypeProperty
range: string
comment: (STIX: goals)
definition: High-level goals of this intrusion set or threat actor, e.g. 'financial gain'. Multiple values are expressed as multiple triples.

groupName
type: DatatypeProperty
range: string
comment: (STIX: windows-service-ext.group_name)
definition: Load ordering group for this Windows service.

groups
type: DatatypeProperty
domain: User Account Object
range: string
comment: (STIX: unix-account-ext.groups)
definition: Names of UNIX groups this account belongs to. Multiple values as multiple triples.

hashValue
type: DatatypeProperty
domain: Hash Entry
range: string
comment: (STIX: hashes dictionary value)
definition: Hex-encoded hash digest value.

homeDir
type: DatatypeProperty
domain: User Account Object
range: string
comment: (STIX: unix-account-ext.home_dir)
definition: Home directory path for this UNIX account.

icmpCodeHex
type: DatatypeProperty
range: hexBinary
comment: (STIX: icmp-ext.icmp_code_hex)
definition: ICMP code field as a hex value.

icmpTypeHex
type: DatatypeProperty
range: hexBinary
comment: (STIX: icmp-ext.icmp_type_hex)
definition: ICMP type field as a hex value.

imageHeight
type: DatatypeProperty
range: integer
comment: (STIX: raster-image-ext.image_height)
definition: Image height in pixels.

imageWidth
type: DatatypeProperty
range: integer
comment: (STIX: raster-image-ext.image_width)
definition: Image width in pixels.

imphash
type: DatatypeProperty
range: string
comment: (STIX: imphash)
definition: Import hash (imphash) of the PE binary.

inhibitAnyPolicy
type: DatatypeProperty
domain: X.509 v3 Extensions
range: string
comment: (STIX: x509-v3-extensions-type.inhibit_any_policy)
definition: X.509 v3 inhibit any policy extension.

isActive
type: DatatypeProperty
domain: Network Traffic Object
range: boolean
comment: (STIX: is_active)
definition: True if this network traffic flow was still active when it was observed.

isBlocking
type: DatatypeProperty
range: boolean
comment: (STIX: socket-ext.is_blocking)
definition: True if this socket is in blocking mode.

isDisabled
type: DatatypeProperty
domain: User Account Object
range: boolean
comment: (STIX: is_disabled)
definition: True if this account is currently disabled.

isFamily
type: DatatypeProperty
domain: Malware
range: boolean
comment: (STIX: is_family)
definition: True if this represents a malware family; false for a specific instance or sample.

isHidden
type: DatatypeProperty
domain: Process Object
range: boolean
comment: (STIX: is_hidden)
definition: If true, this process is hidden from normal process enumeration.

isListening
type: DatatypeProperty
range: boolean
comment: (STIX: socket-ext.is_listening)
definition: True if this socket is in a listening state.

isMultipart
type: DatatypeProperty
domain: Email Message Object
range: boolean
comment: (STIX: is_multipart)
definition: True if this email uses multipart MIME (bodyMultipart is populated); false if body contains the single plain-text body.

isOptimized
type: DatatypeProperty
range: boolean
comment: (STIX: pdf-ext.is_optimized)
definition: True if the PDF is linearized (optimised for fast web viewing).

isPrivileged
type: DatatypeProperty
domain: User Account Object
range: boolean
comment: (STIX: is_privileged)
definition: True if this account has elevated privileges.

isSelfSigned
type: DatatypeProperty
domain: X.509 Certificate Object
range: boolean
comment: (STIX: is_self_signed)
definition: True if this certificate is self-signed.

isServiceAccount
type: DatatypeProperty
domain: User Account Object
range: boolean
comment: (STIX: is_service_account)
definition: True if this is a service or system account rather than a user account.

issuer
type: DatatypeProperty
domain: X.509 Certificate Object
range: string
comment: (STIX: issuer)
definition: Distinguished Name of the certificate issuer.

issuerAlternativeName
type: DatatypeProperty
domain: X.509 v3 Extensions
range: string
comment: (STIX: x509-v3-extensions-type.issuer_alternative_name)
definition: X.509 v3 issuer alternative name extension.

key
type: DatatypeProperty
domain: Windows Registry Key Object
range: string
comment: (STIX: key)
definition: Full Windows Registry key path, e.g. 'HKEY_LOCAL_MACHINE\Software\...'.

keyUsage
type: DatatypeProperty
domain: X.509 v3 Extensions
range: string
comment: (STIX: x509-v3-extensions-type.key_usage)
definition: X.509 v3 key usage extension value.

killChainName
type: DatatypeProperty
domain: Kill Chain Phase
range: string
comment: (STIX: kill_chain_name)
definition: Name of the kill chain framework, e.g. 'mitre-attack', 'lockheed-martin-cyber-kill-chain'.

labels
type: DatatypeProperty
domain: STIX Object
range: string
comment: (STIX: labels)
definition: Free-form string terms applying to this object. Multiple labels are expressed as multiple triples.

lang
type: DatatypeProperty
range: string
comment: (STIX: lang)
definition: BCP 47 language tag for the human-readable content of this object, e.g. 'en', 'fr'. Also used in GranularMarking.

languages
type: DatatypeProperty
domain: Software Object
range: string
comment: (STIX: languages)
definition: BCP 47 language tags for languages supported by this software. Multiple values as multiple triples.

lastObserved
type: DatatypeProperty
domain: Observed Data
range: dateTime
comment: (STIX: last_observed)
definition: Latest timestamp at which this observation occurred. MUST be >= firstObserved.

lastSeen
type: DatatypeProperty
range: dateTime
comment: (STIX: last_seen)
definition: Timestamp when this object was last observed or seen. MUST be >= firstSeen.

latitude
type: DatatypeProperty
domain: Location
range: float
comment: (STIX: latitude)
definition: Latitude in decimal degrees, range -90 to 90. Required when longitude is present.

longitude
type: DatatypeProperty
domain: Location
range: float
comment: (STIX: longitude)
definition: Longitude in decimal degrees, range -180 to 180. Required when latitude is present.

machineHex
type: DatatypeProperty
range: hexBinary
comment: (STIX: machine_hex)
definition: Machine type from the COFF header as a hex value.

magicNumberHex
type: DatatypeProperty
domain: File Object
range: hexBinary
comment: (STIX: magic_number_hex)
definition: Magic bytes (file signature) as a hex string.

messageBodyLength
type: DatatypeProperty
range: integer
comment: (STIX: http-request-ext.message_body_length)
definition: Length of the HTTP message body in bytes.

messageId
type: DatatypeProperty
domain: Email Message Object
range: string
comment: (STIX: message_id)
definition: Value of the Message-ID header.

mimeType
type: DatatypeProperty
range: string
comment: (STIX: mime_type)
definition: IANA MIME type of the content (artifact, file).

modified
type: DatatypeProperty
domain: STIX Core Object
range: dateTime
comment: (STIX: modified)
definition: Timestamp when this object was last modified. MUST be >= created.

modifiedTime
type: DatatypeProperty
domain: Windows Registry Key Object
range: dateTime
comment: (STIX: modified_time)
definition: Last modification timestamp of this registry key.

modules
type: DatatypeProperty
domain: Malware Analysis
range: string
comment: (STIX: modules)
definition: Names of analysis modules or plugins used. Multiple values as multiple triples.

mtime
type: DatatypeProperty
range: dateTime
comment: (STIX: mtime)
definition: Last-modified timestamp of a file system object.

name
type: DatatypeProperty
range: string
comment: (STIX: name)
definition: Human-readable name. Used across SDOs, SCOs, and sub-objects.

nameConstraints
type: DatatypeProperty
domain: X.509 v3 Extensions
range: string
comment: (STIX: x509-v3-extensions-type.name_constraints)
definition: X.509 v3 name constraints extension value.

nameEnc
type: DatatypeProperty
domain: File Object
range: string
comment: (STIX: name_enc)
definition: Character encoding of the file name when non-ASCII characters are present.

number
type: DatatypeProperty
domain: Autonomous System Object
range: integer
comment: (STIX: number)
definition: Autonomous System number (ASN).

numberObserved
type: DatatypeProperty
domain: Observed Data
range: integer
comment: (STIX: number_observed)
definition: Number of times the observation occurred. MUST be >= 1.

numberOfSections
type: DatatypeProperty
range: integer
comment: (STIX: number_of_sections)
definition: Number of sections in the PE binary.

numberOfSubkeys
type: DatatypeProperty
domain: Windows Registry Key Object
range: integer
comment: (STIX: number_of_subkeys)
definition: Number of subkeys under this registry key.

numberOfSymbols
type: DatatypeProperty
range: integer
comment: (STIX: number_of_symbols)
definition: Number of entries in the COFF symbol table.

objectModified
type: DatatypeProperty
domain: Language Content Object
range: dateTime
comment: (STIX: object_modified)
definition: The modified timestamp of the STIX object being translated. Used to pin a translation to a specific version.

objective
type: DatatypeProperty
domain: Campaign
range: string
comment: (STIX: objective)
definition: Primary goal or objective of the campaign.

path
type: DatatypeProperty
range: string
comment: (STIX: path)
definition: Absolute file system path (directory, file).

pathEnc
type: DatatypeProperty
range: string
comment: (STIX: path_enc)
definition: Character encoding used for the path property when the path contains non-ASCII characters.

pattern
type: DatatypeProperty
domain: Indicator
range: string
comment: (STIX: pattern)
definition: Detection pattern expression, e.g. a STIX patterning language expression.

patternVersion
type: DatatypeProperty
domain: Indicator
range: string
comment: (STIX: pattern_version)
definition: Version of the pattern language, e.g. the STIX patterning language version.

payloadBin
type: DatatypeProperty
domain: Artifact Object
range: base64Binary
comment: (STIX: payload_bin)
definition: Artifact byte content encoded as base64. Mutually exclusive with url.

pdfid0
type: DatatypeProperty
range: string
comment: (STIX: pdf-ext.pdfid0)
definition: First PDF file identifier string from the PDF trailer.

pdfid1
type: DatatypeProperty
range: string
comment: (STIX: pdf-ext.pdfid1)
definition: Second PDF file identifier string from the PDF trailer.

phaseName
type: DatatypeProperty
domain: Kill Chain Phase
range: string
comment: (STIX: phase_name)
definition: Phase within the kill chain, e.g. 'execution', 'persistence', 'lateral-movement'.

pid
type: DatatypeProperty
domain: Process Object
range: integer
comment: (STIX: pid)
definition: Process ID (PID).

pointerToSymbolTableHex
type: DatatypeProperty
range: hexBinary
comment: (STIX: pointer_to_symbol_table_hex)
definition: File offset of the COFF symbol table as hex.

policyConstraints
type: DatatypeProperty
domain: X.509 v3 Extensions
range: string
comment: (STIX: x509-v3-extensions-type.policy_constraints)
definition: X.509 v3 policy constraints extension value.

policyMappings
type: DatatypeProperty
domain: X.509 v3 Extensions
range: string
comment: (STIX: x509-v3-extensions-type.policy_mappings)
definition: X.509 v3 policy mappings extension.

postalCode
type: DatatypeProperty
domain: Location
range: string
comment: (STIX: postal_code)
definition: Postal or ZIP code.

precision
type: DatatypeProperty
domain: Location
range: float
comment: (STIX: precision)
definition: Radius of accuracy in metres around the latitude/longitude point.

priority
type: DatatypeProperty
range: string
comment: (STIX: windows-process-ext.priority)
definition: Scheduling priority string for this Windows process, e.g. 'HIGH_PRIORITY_CLASS'.

privateKeyUsagePeriodNotAfter
type: DatatypeProperty
domain: X.509 v3 Extensions
range: dateTime
comment: (STIX: x509-v3-extensions-type.private_key_usage_period_not_after)
definition: End of the private key usage period.

privateKeyUsagePeriodNotBefore
type: DatatypeProperty
domain: X.509 v3 Extensions
range: dateTime
comment: (STIX: x509-v3-extensions-type.private_key_usage_period_not_before)
definition: Start of the private key usage period.

product
type: DatatypeProperty
domain: Malware Analysis
range: string
comment: (STIX: product)
definition: Name of the analysis tool used, e.g. 'Cuckoo', 'VirusTotal'.

protocols
type: DatatypeProperty
domain: Network Traffic Object
range: string
comment: (STIX: protocols)
definition: Ordered list of protocols from lowest to highest layer, e.g. 'ipv4', 'tcp', 'http'. Multiple values as multiple triples.

published
type: DatatypeProperty
domain: Report
range: dateTime
comment: (STIX: published)
definition: Date and time this report was published.

receivedLines
type: DatatypeProperty
domain: Email Message Object
range: string
comment: (STIX: received_lines)
definition: Received: header values in the order received. Multiple values as multiple triples.

relationshipType
type: DatatypeProperty
domain: Relationship
range: string
comment: (STIX: relationship_type)
definition: Semantic type of this relationship, e.g. 'uses', 'targets', 'indicates'.

requestMethod
type: DatatypeProperty
range: string
comment: (STIX: http-request-ext.request_method)
definition: HTTP method, e.g. 'GET', 'POST'.

requestValue
type: DatatypeProperty
range: string
comment: (STIX: http-request-ext.request_value)
definition: HTTP request URI path, e.g. '/index.html?q=1'.

requestVersion
type: DatatypeProperty
range: string
comment: (STIX: http-request-ext.request_version)
definition: HTTP version string, e.g. 'HTTP/1.1'.

resultName
type: DatatypeProperty
domain: Malware Analysis
range: string
comment: (STIX: result_name)
definition: Classification name from the analysis product.

revoked
type: DatatypeProperty
domain: STIX Object
range: boolean
comment: (STIX: revoked)
definition: If true, this object has been revoked and should no longer be considered accurate.

rir
type: DatatypeProperty
domain: Autonomous System Object
range: string
comment: (STIX: rir)
definition: Regional Internet Registry that assigned this ASN, e.g. 'ARIN', 'RIPE'.

roles
type: DatatypeProperty
domain: Identity
range: string
comment: (STIX: roles)
definition: Free-form roles this identity plays, e.g. 'analyst'. For threat-actor roles see the object property stones:threatActorRoles.

schema
type: DatatypeProperty
domain: Extension Definition Object
range: string
comment: (STIX: schema)
definition: URL pointing to, or the raw content of, the JSON Schema defining this extension.

selectors
type: DatatypeProperty
domain: Granular Marking
range: string
comment: (STIX: selectors)
definition: JSON property path selectors identifying the properties this marking applies to, e.g. 'name', 'description'. Multiple values as multiple triples.

serialNumber
type: DatatypeProperty
domain: X.509 Certificate Object
range: string
comment: (STIX: serial_number)
definition: Serial number assigned to this certificate by the issuer.

serviceName
type: DatatypeProperty
range: string
comment: (STIX: windows-service-ext.service_name)
definition: Windows service name as used in the Service Control Manager.

shell
type: DatatypeProperty
domain: User Account Object
range: string
comment: (STIX: unix-account-ext.shell)
definition: Login shell path for this UNIX account, e.g. '/bin/bash'.

sid
type: DatatypeProperty
range: string
comment: (STIX: sid / owner_sid)
definition: Windows Security Identifier (SID) of the file owner (ntfs-ext) or process owner (windows-process-ext).

signatureAlgorithm
type: DatatypeProperty
domain: X.509 Certificate Object
range: string
comment: (STIX: signature_algorithm)
definition: Algorithm used to sign this certificate, e.g. 'sha256WithRSAEncryption'.

size
type: DatatypeProperty
range: integer
comment: (STIX: size)
definition: Size in bytes (file, windows-pe-section, alternate-data-stream).

sizeOfOptionalHeader
type: DatatypeProperty
range: integer
comment: (STIX: size_of_optional_header)
definition: Size of the optional PE header in bytes.

socketDescriptor
type: DatatypeProperty
range: integer
comment: (STIX: socket-ext.socket_descriptor)
definition: Platform-specific socket file descriptor number.

socketHandle
type: DatatypeProperty
range: integer
comment: (STIX: socket-ext.socket_handle)
definition: Windows handle value for this socket.

sourceName
type: DatatypeProperty
domain: External Reference
range: string
comment: (STIX: source_name)
definition: Name of the information source, e.g. 'mitre-attack', 'cve', 'capec'.

specVersion
type: DatatypeProperty
domain: STIX Object
range: string
comment: (STIX: spec_version)
definition: STIX specification version. MUST be '2.1'.

srcByteCount
type: DatatypeProperty
domain: Network Traffic Object
range: integer
comment: (STIX: src_byte_count)
definition: Total bytes sent from source to destination.

srcFlagsHex
type: DatatypeProperty
range: hexBinary
comment: (STIX: tcp-ext.src_flags_hex)
definition: TCP flags set on packets from the source endpoint as hex, e.g. '0x02' for SYN.

srcPackets
type: DatatypeProperty
domain: Network Traffic Object
range: integer
comment: (STIX: src_packets)
definition: Number of packets sent from source to destination.

srcPort
type: DatatypeProperty
domain: Network Traffic Object
range: integer
comment: (STIX: src_port)
definition: Source port number (0–65535).

start
type: DatatypeProperty
domain: Network Traffic Object
range: dateTime
comment: (STIX: start)
definition: Timestamp when this network traffic flow started.

startTime
type: DatatypeProperty
domain: Relationship
range: dateTime
comment: (STIX: start_time)
definition: Timestamp when this relationship began.

statement
type: DatatypeProperty
range: string
comment: (STIX: definition.statement)
definition: Human-readable statement for a statement marking definition, e.g. a copyright notice.

stixId
type: DatatypeProperty
type: FunctionalProperty
domain: STIX Object
range: string
comment: (STIX: id)
definition: The STIX identifier string in the format <type>--<UUIDv4>. The IRI of the individual is the canonical identity; this property retains the string for JSON round-tripping and SPARQL querying.

stixType
type: DatatypeProperty
type: FunctionalProperty
domain: STIX Object
range: string
comment: (STIX: type)
definition: The STIX object type string, e.g. 'attack-pattern'. Semantically redundant with rdf:type but preserved for JSON round-tripping.

stopTime
type: DatatypeProperty
domain: Relationship
range: dateTime
comment: (STIX: stop_time)
definition: Timestamp when this relationship ended. MUST be >= startTime.

streetAddress
type: DatatypeProperty
domain: Location
range: string
comment: (STIX: street_address)
definition: Street address.

subject
type: DatatypeProperty
range: string
comment: (STIX: subject)
definition: Subject line of an email message, or Distinguished Name of the certificate subject.

subjectAlternativeName
type: DatatypeProperty
domain: X.509 v3 Extensions
range: string
comment: (STIX: x509-v3-extensions-type.subject_alternative_name)
definition: X.509 v3 subject alternative name extension.

subjectDirectoryAttributes
type: DatatypeProperty
domain: X.509 v3 Extensions
range: string
comment: (STIX: x509-v3-extensions-type.subject_directory_attributes)
definition: X.509 v3 subject directory attributes extension.

subjectKeyIdentifier
type: DatatypeProperty
domain: X.509 v3 Extensions
range: string
comment: (STIX: x509-v3-extensions-type.subject_key_identifier)
definition: X.509 v3 subject key identifier.

subjectPublicKeyAlgorithm
type: DatatypeProperty
domain: X.509 Certificate Object
range: string
comment: (STIX: subject_public_key_algorithm)
definition: Algorithm of the subject's public key, e.g. 'rsaEncryption'.

subjectPublicKeyExponent
type: DatatypeProperty
domain: X.509 Certificate Object
range: integer
comment: (STIX: subject_public_key_exponent)
definition: RSA public exponent of the subject's public key.

subjectPublicKeyModulus
type: DatatypeProperty
domain: X.509 Certificate Object
range: string
comment: (STIX: subject_public_key_modulus)
definition: RSA modulus of the subject's public key as a hex string.

submitted
type: DatatypeProperty
domain: Malware Analysis
range: dateTime
comment: (STIX: submitted)
definition: Timestamp when the sample was submitted for analysis.

summary
type: DatatypeProperty
domain: Sighting
range: boolean
comment: (STIX: summary)
definition: If true, this sighting aggregates multiple observations rather than recording a single specific event.

swid
type: DatatypeProperty
domain: Software Object
range: string
comment: (STIX: swid)
definition: ISO/IEC 19770-2 SWID tag identifier.

timeDateStamp
type: DatatypeProperty
range: dateTime
comment: (STIX: time_date_stamp)
definition: Timestamp recorded in the PE header.

tlp
type: DatatypeProperty
range: string
comment: (STIX: definition.tlp)
definition: TLP level for a TLP marking definition: 'white', 'green', 'amber', or 'red'.

toolVersion
type: DatatypeProperty
domain: Tool
range: string
comment: (STIX: tool_version)
definition: Version string of the tool.

uid
type: DatatypeProperty
domain: User Account Object
range: integer
comment: (STIX: unix-account-ext.uid)
definition: Numeric UNIX user ID (UID).

url
type: DatatypeProperty
range: anyURI
comment: (STIX: url)
definition: URL to a referenced resource (external-reference) or the location of artifact content.

userId
type: DatatypeProperty
domain: User Account Object
range: string
comment: (STIX: user_id)
definition: Identifier of the user account, such as a login name or UID.

validFrom
type: DatatypeProperty
domain: Indicator
range: dateTime
comment: (STIX: valid_from)
definition: Timestamp from which this indicator is considered valid.

validUntil
type: DatatypeProperty
domain: Indicator
range: dateTime
comment: (STIX: valid_until)
definition: Timestamp after which this indicator is no longer valid.

validityNotAfter
type: DatatypeProperty
domain: X.509 Certificate Object
range: dateTime
comment: (STIX: validity_not_after)
definition: End of the certificate validity period.

validityNotBefore
type: DatatypeProperty
domain: X.509 Certificate Object
range: dateTime
comment: (STIX: validity_not_before)
definition: Start of the certificate validity period.

value
type: DatatypeProperty
range: string
comment: (STIX: value)
definition: Primary string value of an observable: the domain name, email address, IP address, MAC address, or URL.

vendor
type: DatatypeProperty
domain: Software Object
range: string
comment: (STIX: vendor)
definition: Name of the software vendor.

version
type: DatatypeProperty
range: string
comment: (STIX: version)
definition: Version string. Used for analysis tool version (malware-analysis), schema version (extension-definition), software version, X.509 version, and PDF format version.

windowTitle
type: DatatypeProperty
range: string
comment: (STIX: windows-process-ext.window_title)
definition: Title text of the main window of this Windows process.

Collection
type: Class
disjoint with: Concept
disjoint with: Concept Scheme
definition: A meaningful collection of concepts.
scope note: Labelled collections can be used where you would like a set of concepts to be displayed under a 'node label' in the hierarchy.

Concept
type: Class
disjoint with: Concept Scheme
definition: An idea or notion; a unit of thought.

Concept Scheme
type: Class
definition: A set of concepts, optionally including statements about semantic relationships between those concepts.
example: Thesauri, classification schemes, subject heading lists, taxonomies, 'folksonomies', and other types of controlled vocabulary are all examples of concept schemes. Concept schemes are also embedded in glossaries and terminologies.
scope note: A concept scheme may be defined to include concepts from different sources.

Ordered Collection
type: Class
subclass of: Collection
definition: An ordered collection of concepts, where both the grouping and the ordering are meaningful.
scope note: Ordered collections can be used where you would like a set of concepts to be displayed in a specific order, and optionally under a 'node label'.

Alternate Data Stream
type: Class
subclass of: STIX Sub-Type
subclass of: Restriction
  on property: name
  min cardinality: 1
definition: An NTFS Alternate Data Stream (ADS) attached to a file, identified by name with optional hashes and size.

Artifact Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: artifact
subclass of: STIX Cyber Observable Object
definition: Represents a sequence of bytes, such as the content of a file, a raw stream of network traffic, or a data blob captured from memory. The content may be embedded directly via payload_bin or referenced via url.

Attack Pattern
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: attack-pattern
subclass of: STIX Domain Object
subclass of: Restriction
  on property: name
  min cardinality: 1
definition: A type of Tactics, Techniques, and Procedures (TTP) that describes ways that adversaries attempt to compromise targets. Often maps to MITRE ATT&CK techniques.

Autonomous System Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: autonomous-system
subclass of: STIX Cyber Observable Object
definition: Represents an Autonomous System (AS), a collection of IP routing prefixes under the control of a single administrative entity, identified by its AS number.

Campaign
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: campaign
subclass of: STIX Domain Object
subclass of: Restriction
  on property: name
  min cardinality: 1
definition: A grouping of adversary behaviours and resources with a common objective pursued over a period of time. Campaigns may be attributed to intrusion sets or threat actors.

Course of Action
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: course-of-action
subclass of: STIX Domain Object
subclass of: Restriction
  on property: name
  min cardinality: 1
definition: A recommendation for a specific measure to be taken in response to an attack. May describe automated responses, playbook steps, or manual mitigations.

Directory Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: directory
subclass of: STIX Cyber Observable Object
definition: Represents a file system directory, conveying its path and timestamps. May reference the files and sub-directories it contains.

Domain Name Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: domain-name
subclass of: STIX Cyber Observable Object
definition: Represents a network domain name. Can reference the IP addresses it resolves to.

Email Address Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: email-addr
subclass of: STIX Cyber Observable Object
definition: Represents a single email address, optionally associating it with a display name and a user account.

Email Message Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: email-message
subclass of: STIX Cyber Observable Object
definition: Represents an email message, including its headers, body, and any MIME parts.

Email MIME Part
type: Class
subclass of: STIX Sub-Type
definition: A single MIME part within a multipart email message, including its body content, content type, and content disposition.

Extension Definition Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: extension-definition
subclass of: STIX Meta Object
definition: Defines a schema extension to STIX 2.1. Allows producers to add new properties or new object types in a structured, interoperable way.

External Reference
type: Class
subclass of: STIX Sub-Type
subclass of: Restriction
  on property: sourceName
  min cardinality: 1
definition: A structured reference to non-STIX information, such as a CVE entry, MITRE ATT&CK technique, or external URL. Used to link STIX content to authoritative external sources.

File Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: file
subclass of: STIX Cyber Observable Object
definition: Represents a file with its metadata and optional content reference. Supports extensions for archive files, NTFS streams, PE binaries, PDF documents, and raster images.

Granular Marking
type: Class
subclass of: STIX Sub-Type
subclass of: Restriction
  on property: markingRef
  min cardinality: 1
subclass of: Restriction
  on property: selectors
  min cardinality: 1
definition: A property-level data handling marking that applies a marking definition to specific named fields of a STIX object, enabling fine-grained access control.

Grouping
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: grouping
subclass of: STIX Domain Object
subclass of: Restriction
  on property: context
  min cardinality: 1
subclass of: Restriction
  on property: objectRefs
  min cardinality: 1
definition: Explicitly asserts that a set of STIX objects share a common context without implying the existence of a threat report. Useful for linking related objects without a formal report.

Hash Entry
type: Class
subclass of: STIX Sub-Type
subclass of: Restriction
  on property: algorithm
  min cardinality: 1
subclass of: Restriction
  on property: hashValue
  min cardinality: 1
definition: A single cryptographic hash entry associating a hashing algorithm with its hex-encoded digest value. Used to represent entries in the STIX hashes dictionary.

IPv4 Address Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: ipv4-addr
subclass of: STIX Cyber Observable Object
definition: Represents one or more IPv4 addresses expressed using CIDR notation.

IPv6 Address Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: ipv6-addr
subclass of: STIX Cyber Observable Object
definition: Represents one or more IPv6 addresses expressed using CIDR notation.

Identity
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: identity
subclass of: STIX Domain Object
subclass of: Restriction
  on property: name
  min cardinality: 1
definition: Actual individuals, organisations, or groups, as well as classes of individuals, organisations, systems, or groups. Used to represent victims, producers, or any other real-world actor.

Indicator
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: indicator
subclass of: STIX Domain Object
subclass of: Restriction
  on property: indicatorTypes
  min cardinality: 1
subclass of: Restriction
  on property: patternType
  min cardinality: 1
subclass of: Restriction
  on property: pattern
  min cardinality: 1
subclass of: Restriction
  on property: validFrom
  min cardinality: 1
definition: Contains a pattern that can be used to detect suspicious or malicious cyber activity. Patterns are expressed using the STIX Patterning Language or another supported pattern language.

Infrastructure
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: infrastructure
subclass of: STIX Domain Object
subclass of: Restriction
  on property: infrastructureTypes
  min cardinality: 1
subclass of: Restriction
  on property: name
  min cardinality: 1
definition: Represents systems, software services, or any group of resources used to conduct cyber operations. Infrastructure is used by threat actors and intrusion sets both offensively and defensively.

Intrusion Set
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: intrusion-set
subclass of: STIX Domain Object
subclass of: Restriction
  on property: name
  min cardinality: 1
definition: A grouped set of adversarial behaviours and resources with common properties, believed to be orchestrated by a single organisation. Often represents a named APT group.

Kill Chain Phase
type: Class
subclass of: STIX Sub-Type
subclass of: Restriction
  on property: killChainName
  min cardinality: 1
subclass of: Restriction
  on property: phaseName
  min cardinality: 1
definition: Represents a phase within a named kill chain framework, such as the MITRE ATT&CK or Lockheed Martin Cyber Kill Chain, used to categorise the stage of an attack.

Language Content Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: language-content
subclass of: STIX Meta Object
definition: Provides translations of string properties of another STIX object into different languages. Allows internationalisation without modifying the original object.

Location
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: location
subclass of: STIX Domain Object
subclass of: Restriction
  on property: region
  max cardinality: 1
subclass of: Restriction
  on property: country
  max cardinality: 1
subclass of: Restriction
  on property: latitude
  max cardinality: 1
subclass of: Restriction
  on property: longitude
  max cardinality: 1
definition: Represents a geographic location. May be as specific as a latitude/longitude coordinate or as broad as a continent. At least one of region, country, or latitude/longitude must be provided.

MAC Address Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: mac-addr
subclass of: STIX Cyber Observable Object
definition: Represents a single MAC address expressed in lowercase IEEE 802 colon-hexadecimal notation.

Malware
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: malware
subclass of: STIX Domain Object
subclass of: Restriction
  on property: malwareTypes
  min cardinality: 1
subclass of: Restriction
  on property: isFamily
  min cardinality: 1
definition: A type of TTP that represents malicious code. Captures both malware families (when is_family is true) and specific instances or samples.

Malware Analysis
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: malware-analysis
subclass of: STIX Domain Object
subclass of: Restriction
  on property: product
  min cardinality: 1
definition: Captures the results of a malware analysis process, whether static or dynamic. Represents the output of a specific analysis run on a specific sample.

Marking Definition Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: marking-definition
subclass of: STIX Meta Object
definition: Defines a data handling marking used to restrict or label how STIX data can be shared or handled, such as TLP markings. Referenced by object_marking_refs or granular_markings.

Mutex Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: mutex
subclass of: STIX Cyber Observable Object
definition: Represents a named mutual-exclusion object, commonly created or checked by malware to prevent multiple concurrent instances from running.

Network Traffic Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: network-traffic
subclass of: STIX Cyber Observable Object
definition: Represents an arbitrary network traffic flow between source and destination endpoints. Supports extensions for HTTP, ICMP, socket, and TCP specifics.

Note
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: note
subclass of: STIX Domain Object
subclass of: Restriction
  on property: objectRefs
  min cardinality: 1
subclass of: Restriction
  on property: content
  min cardinality: 1
definition: Conveys informational text to provide further context and/or to assess the accuracy of existing STIX information. Similar to a comment or annotation on other STIX objects.

Observed Data
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: observed-data
subclass of: STIX Domain Object
subclass of: Restriction
  on property: objectRefs
  min cardinality: 1
subclass of: Restriction
  on property: firstObserved
  min cardinality: 1
subclass of: Restriction
  on property: lastObserved
  min cardinality: 1
subclass of: Restriction
  on property: numberObserved
  min cardinality: 1
definition: Conveys information observed on systems and networks, wrapping one or more SCO references together with observation metadata such as first and last observed timestamps.

Opinion
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: opinion
subclass of: STIX Domain Object
subclass of: Restriction
  on property: objectRefs
  min cardinality: 1
subclass of: Restriction
  on property: opinion
  min cardinality: 1
definition: An assessment of the correctness of information in one or more STIX objects. Allows analysts to express agreement or disagreement with existing intelligence.

Process Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: process
subclass of: STIX Cyber Observable Object
definition: Represents a running or terminated process on a host. Supports extensions for Windows-specific process and service attributes.

Relationship
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: relationship
subclass of: STIX Relationship Object
subclass of: Restriction
  on property: sourceRef
  min cardinality: 1
subclass of: Restriction
  on property: targetRef
  min cardinality: 1
subclass of: Restriction
  on property: relationshipType
  min cardinality: 1
definition: A directed link between two STIX Core Objects. The semantics of the link are defined by the relationship_type property.

Report
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: report
subclass of: STIX Domain Object
subclass of: Restriction
  on property: objectRefs
  min cardinality: 1
subclass of: Restriction
  on property: reportTypes
  min cardinality: 1
subclass of: Restriction
  on property: name
  min cardinality: 1
subclass of: Restriction
  on property: published
  min cardinality: 1
definition: A collection of threat intelligence focused on one or more topics, such as a description of a threat actor, malware, or attack technique. Used to package related STIX content.

Sighting
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: sighting
subclass of: STIX Relationship Object
subclass of: Restriction
  on property: sightingOfRef
  min cardinality: 1
definition: Records that a STIX object such as an indicator, malware, tool, or threat actor was seen. Wraps observation metadata around a reference to the sighted object.

Software Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: software
subclass of: STIX Cyber Observable Object
definition: Represents a software product, including commercial applications, operating systems, libraries, and utilities.

STIX Bundle
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: bundle
subclass of: STIX Object
definition: A collection of arbitrary STIX objects used as a transport container. Bundles are not Core Objects, carry no modified timestamp, and cannot be referenced by identifier.

STIX Core Object
type: Class
subclass of: STIX Object
subclass of: Restriction
  on property: created
  min cardinality: 1
subclass of: Restriction
  on property: modified
  min cardinality: 1
definition: Abstract class for STIX Core Objects, comprising SDOs, SCOs, and SROs. Core objects carry a type-qualified identifier and created/modified timestamps, and may be referenced by other objects.

STIX Cyber Observable Object
type: Class
subclass of: STIX Core Object
definition: Abstract class for STIX Cyber Observable Objects (SCOs), which represent technical observations such as IP addresses, files, network traffic, and processes.

STIX Domain Object
type: Class
subclass of: STIX Core Object
definition: Abstract class for STIX Domain Objects (SDOs), which represent modelled cyber threat intelligence concepts such as malware, campaigns, threat actors, and vulnerabilities.

STIX Meta Object
type: Class
subclass of: STIX Object
definition: Abstract class for STIX Meta Objects, which provide supporting infrastructure for the STIX ecosystem, including data markings, language translations, and extension definitions.

STIX Object
type: Class
subclass of: Restriction
  on property: specVersion
  min cardinality: 1
subclass of: Restriction
  on property: stixId
  min cardinality: 1
subclass of: Restriction
  on property: stixType
  min cardinality: 1
disjoint with: STIX Sub-Type
has key: stixId
definition: The top-level abstract class for all STIX objects, encompassing STIX Core Objects (SDOs, SCOs, SROs), Meta Objects, and Bundles.

STIX Relationship Object
type: Class
subclass of: STIX Core Object
definition: Abstract class for STIX Relationship Objects (SROs), which link Core Objects to express directed relationships and sightings between them.

STIX Sub-Type
type: Class
definition: Abstract class for structured sub-types defined by the STIX 2.1 specification that are embedded as property values within STIX objects. Instances are not STIX objects: they carry no identifier, type, spec_version, created, or modified properties and cannot be referenced by identifier from other objects. Subclasses include ExternalReference, GranularMarking, KillChainPhase, HashEntry, EmailMimePart, AlternateDataStream, WindowsPeSection, WindowsRegistryValue, and X509V3Extensions.

Threat Actor
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: threat-actor
subclass of: STIX Domain Object
subclass of: Restriction
  on property: threatActorTypes
  min cardinality: 1
subclass of: Restriction
  on property: name
  min cardinality: 1
definition: Actual individuals, groups, or organisations believed to be operating with malicious intent. Unlike Identity, a ThreatActor carries adversarial connotations.

Tool
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: tool
subclass of: STIX Domain Object
subclass of: Restriction
  on property: toolTypes
  min cardinality: 1
subclass of: Restriction
  on property: name
  min cardinality: 1
definition: Legitimate software that can be used by threat actors to perform attacks. Distinguishable from malware by being designed for benign purposes but repurposed maliciously.

URL Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: url
subclass of: STIX Cyber Observable Object
definition: Represents a Uniform Resource Locator conforming to RFC 3986.

User Account Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: user-account
subclass of: STIX Cyber Observable Object
definition: Represents a user account on a system or service, including local OS accounts, cloud accounts, and social media accounts. Supports a unix-account extension for POSIX attributes.

Vulnerability
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: vulnerability
subclass of: STIX Domain Object
subclass of: Restriction
  on property: name
  min cardinality: 1
definition: A mistake in software that can be directly used by a threat actor to gain access to a system or network. Typically identified by a CVE number via an external reference.

Windows PE Section
type: Class
subclass of: STIX Sub-Type
subclass of: Restriction
  on property: name
  min cardinality: 1
definition: A single section entry within a Windows PE (Portable Executable) binary, described by its name, size, and optional entropy value.

Windows Registry Key Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: windows-registry-key
subclass of: STIX Cyber Observable Object
definition: Represents a Windows Registry key with its full path, value entries, modification timestamp, and creator.

Windows Registry Value
type: Class
subclass of: STIX Sub-Type
subclass of: Restriction
  on property: name
  min cardinality: 1
definition: A single value entry within a Windows Registry key, comprising a name, a data string, and a registry data type.

X.509 Certificate Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: x509-certificate
subclass of: STIX Cyber Observable Object
definition: Represents an X.509 digital certificate, capturing its subject, issuer, validity window, public key details, and optional v3 extensions.

X.509 v3 Extensions
type: Class
subclass of: STIX Sub-Type
definition: The set of X.509 version 3 extension fields present in a digital certificate, such as key usage, subject alternative names, and CRL distribution points.

AES-256-GCM
type: NamedIndividual
type: EncryptionAlgorithmEnumeration
notation: AES-256-GCM

AF APPLETALK
type: NamedIndividual
type: NetworkSocketAddressFamilyEnumeration
notation: AF_APPLETALK

AF BTH
type: NamedIndividual
type: NetworkSocketAddressFamilyEnumeration
notation: AF_BTH

AF INET
type: NamedIndividual
type: NetworkSocketAddressFamilyEnumeration
notation: AF_INET

AF INET6
type: NamedIndividual
type: NetworkSocketAddressFamilyEnumeration
notation: AF_INET6

AF IPX
type: NamedIndividual
type: NetworkSocketAddressFamilyEnumeration
notation: AF_IPX

AF IRDA
type: NamedIndividual
type: NetworkSocketAddressFamilyEnumeration
notation: AF_IRDA

AF NETBIOS
type: NamedIndividual
type: NetworkSocketAddressFamilyEnumeration
notation: AF_NETBIOS

AF UNSPEC
type: NamedIndividual
type: NetworkSocketAddressFamilyEnumeration
notation: AF_UNSPEC

ChaCha20-Poly1305
type: NamedIndividual
type: EncryptionAlgorithmEnumeration
notation: ChaCha20-Poly1305

MD5
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: MD5

MD6
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: MD6

REG BINARY
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_BINARY

REG DWORD
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_DWORD

REG DWORD BIG ENDIAN
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_DWORD_BIG_ENDIAN

REG DWORD LITTLE ENDIAN
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_DWORD_LITTLE_ENDIAN

REG EXPAND SZ
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_EXPAND_SZ

REG FULL RESOURCE DESCRIPTION
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_FULL_RESOURCE_DESCRIPTION

REG INVALID TYPE
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_INVALID_TYPE

REG LINK
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_LINK

REG MULTI SZ
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_MULTI_SZ

REG NONE
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_NONE

REG QWORD
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_QWORD

REG RESOURCE LIST
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_RESOURCE_LIST

REG RESOURCE REQUIREMENTS LIST
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_RESOURCE_REQUIREMENTS_LIST

REG SZ
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_SZ

RIPEMD-160
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: RIPEMD-160

SERVICE AUTO START
type: NamedIndividual
type: WindowsServiceStartTypeEnumeration
notation: SERVICE_AUTO_START

SERVICE BOOT START
type: NamedIndividual
type: WindowsServiceStartTypeEnumeration
notation: SERVICE_BOOT_START

SERVICE CONTINUE PENDING
type: NamedIndividual
type: WindowsServiceStatusEnumeration
notation: SERVICE_CONTINUE_PENDING

SERVICE DEMAND START
type: NamedIndividual
type: WindowsServiceStartTypeEnumeration
notation: SERVICE_DEMAND_START

SERVICE DISABLED
type: NamedIndividual
type: WindowsServiceStartTypeEnumeration
notation: SERVICE_DISABLED

SERVICE FILE SYSTEM DRIVER
type: NamedIndividual
type: WindowsServiceTypeEnumeration
notation: SERVICE_FILE_SYSTEM_DRIVER

SERVICE KERNEL DRIVER
type: NamedIndividual
type: WindowsServiceTypeEnumeration
notation: SERVICE_KERNEL_DRIVER

SERVICE PAUSED
type: NamedIndividual
type: WindowsServiceStatusEnumeration
notation: SERVICE_PAUSED

SERVICE PAUSE PENDING
type: NamedIndividual
type: WindowsServiceStatusEnumeration
notation: SERVICE_PAUSE_PENDING

SERVICE RUNNING
type: NamedIndividual
type: WindowsServiceStatusEnumeration
notation: SERVICE_RUNNING

SERVICE START PENDING
type: NamedIndividual
type: WindowsServiceStatusEnumeration
notation: SERVICE_START_PENDING

SERVICE STOPPED
type: NamedIndividual
type: WindowsServiceStatusEnumeration
notation: SERVICE_STOPPED

SERVICE STOP PENDING
type: NamedIndividual
type: WindowsServiceStatusEnumeration
notation: SERVICE_STOP_PENDING

SERVICE SYSTEM ALERT
type: NamedIndividual
type: WindowsServiceStartTypeEnumeration
notation: SERVICE_SYSTEM_ALERT

SERVICE WIN32 OWN PROCESS
type: NamedIndividual
type: WindowsServiceTypeEnumeration
notation: SERVICE_WIN32_OWN_PROCESS

SERVICE WIN32 SHARE PROCESS
type: NamedIndividual
type: WindowsServiceTypeEnumeration
notation: SERVICE_WIN32_SHARE_PROCESS

SHA-1
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SHA-1

SHA-224
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SHA-224

SHA-256
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SHA-256

SHA-384
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SHA-384

SHA-512
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SHA-512

SHA3-224
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SHA3-224

SHA3-256
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SHA3-256

SHA3-384
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SHA3-384

SHA3-512
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SHA3-512

SOCK DGRAM
type: NamedIndividual
type: NetworkSocketTypeEnumeration
notation: SOCK_DGRAM

SOCK RAW
type: NamedIndividual
type: NetworkSocketTypeEnumeration
notation: SOCK_RAW

SOCK RDM
type: NamedIndividual
type: NetworkSocketTypeEnumeration
notation: SOCK_RDM

SOCK SEQPACKET
type: NamedIndividual
type: NetworkSocketTypeEnumeration
notation: SOCK_SEQPACKET

SOCK STREAM
type: NamedIndividual
type: NetworkSocketTypeEnumeration
notation: SOCK_STREAM

SSDEEP
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SSDEEP

TLSH
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: TLSH

accesses-remote-machines
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: accesses-remote-machines

accidental
type: NamedIndividual
type: AttackMotivationVocabulary
notation: accidental

activist
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: activist

advanced
type: NamedIndividual
type: ThreatActorSophisticationVocabulary
notation: advanced

adware
type: NamedIndividual
type: MalwareTypeVocabulary
notation: adware

aerospace
type: NamedIndividual
type: IndustrySectorVocabulary
notation: aerospace

africa
type: NamedIndividual
type: RegionVocabulary
notation: africa

agent
type: NamedIndividual
type: ThreatActorRoleVocabulary
notation: agent

agree
type: NamedIndividual
type: OpinionEnumeration
notation: agree

agriculture
type: NamedIndividual
type: IndustrySectorVocabulary
notation: agriculture

alpha
type: NamedIndividual
type: ProcessorArchitectureVocabulary
notation: alpha

amplification
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: amplification

analysis-of
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: analysis-of

anomalous-activity
type: NamedIndividual
type: IndicatorTypeVocabulary
notation: anomalous-activity

anonymization
type: NamedIndividual
type: IndicatorTypeVocabulary
type: InfrastuctureTypeVocabulary
notation: anonymization

anti-debugging
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: anti-debugging

anti-disassembly
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: anti-disassembly

anti-emulation
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: anti-emulation

anti-memory-forensics
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: anti-memory-forensics

anti-sandbox
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: anti-sandbox

anti-vm
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: anti-vm

applescript
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: applescript

arm
type: NamedIndividual
type: ProcessorArchitectureVocabulary
notation: arm

asia
type: NamedIndividual
type: RegionVocabulary
notation: asia

attack-pattern
type: NamedIndividual
type: ReportTypeVocabulary
notation: attack-pattern

attributed-to
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: attributed-to

attribution
type: NamedIndividual
type: IndicatorTypeVocabulary
notation: attribution

australia-new-zealand
type: NamedIndividual
type: RegionVocabulary
notation: australia-new-zealand

authored-by
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: authored-by

automotive
type: NamedIndividual
type: IndustrySectorVocabulary
notation: automotive

backdoor
type: NamedIndividual
type: MalwareTypeVocabulary
notation: backdoor

based-on
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: based-on

bash
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: bash

beacons-to
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: beacons-to

benign
type: NamedIndividual
type: IndicatorTypeVocabulary
type: MalwareResultVocabulary
notation: benign

bootkit
type: NamedIndividual
type: MalwareTypeVocabulary
notation: bootkit

bot
type: NamedIndividual
type: MalwareTypeVocabulary
notation: bot

botnet
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: botnet

c
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: c

c-plus-plus
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: c++

c-sharp
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: c#

campaign
type: NamedIndividual
type: ReportTypeVocabulary
notation: campaign

captures-input-peripherals
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: captures-input-peripherals

captures-output-peripherals
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: captures-output-peripherals

captures-system-state-data
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: captures-system-state-data

caribbean
type: NamedIndividual
type: RegionVocabulary
notation: caribbean

central-america
type: NamedIndividual
type: RegionVocabulary
notation: central-america

central-asia
type: NamedIndividual
type: RegionVocabulary
notation: central-asia

characterizes
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: characterizes

chemical
type: NamedIndividual
type: IndustrySectorVocabulary
notation: chemical

class
type: NamedIndividual
type: IdentityClassVocabulary
notation: class

cleans-traces-of-infection
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: cleans-traces-of-infection

club
type: NamedIndividual
type: AttackResourceLevelVocabulary
notation: club

coercion
type: NamedIndividual
type: AttackMotivationVocabulary
notation: coercion

command-and-control
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: command-and-control

commercial
type: NamedIndividual
type: IndustrySectorVocabulary
notation: commercial

commits-fraud
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: commits-fraud

communications
type: NamedIndividual
type: IndustrySectorVocabulary
notation: communications

competitor
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: competitor

compromised
type: NamedIndividual
type: IndicatorTypeVocabulary
notation: compromised

compromises
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: compromises

compromises-data-availability
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: compromises-data-availability

compromises-data-integrity
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: compromises-data-integrity

compromises-system-availability
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: compromises-system-availability

construction
type: NamedIndividual
type: IndustrySectorVocabulary
notation: construction

contest
type: NamedIndividual
type: AttackResourceLevelVocabulary
notation: contest

controls-local-machine
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: controls-local-machine

credential-exploitation
type: NamedIndividual
type: ToolTypeVocabulary
notation: credential-exploitation

crime-syndicate
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: crime-syndicate

criminal
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: criminal

dams
type: NamedIndividual
type: IndustrySectorVocabulary
notation: dams

ddos
type: NamedIndividual
type: MalwareTypeVocabulary
notation: ddos

defense
type: NamedIndividual
type: IndustrySectorVocabulary
notation: defense

degrades-security-software
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: degrades-security-software

degrades-system-updates
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: degrades-system-updates

denial-of-service
type: NamedIndividual
type: ToolTypeVocabulary
notation: denial-of-service

derived-from
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: derived-from

detects
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: detects

determines-c2-server
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: determines-c2-server

director
type: NamedIndividual
type: ThreatActorRoleVocabulary
notation: director

disagree
type: NamedIndividual
type: OpinionEnumeration
notation: disagree

dll
type: NamedIndividual
type: WindowsPEBinaryVocabulary
notation: dll

dominance
type: NamedIndividual
type: AttackMotivationVocabulary
notation: dominance

downloader
type: NamedIndividual
type: MalwareTypeVocabulary
notation: downloader

downloads
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: downloads

dropper
type: NamedIndividual
type: MalwareTypeVocabulary
notation: dropper

drops
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: drops

duplicate-of
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: duplicate-of

dynamic-analysis-of
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: dynamic-analysis-of

eastern-africa
type: NamedIndividual
type: RegionVocabulary
notation: eastern-africa

eastern-asia
type: NamedIndividual
type: RegionVocabulary
notation: eastern-asia

eastern-europe
type: NamedIndividual
type: RegionVocabulary
notation: eastern-europe

education
type: NamedIndividual
type: IndustrySectorVocabulary
notation: education

emails-spam
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: emails-spam

emergency-services
type: NamedIndividual
type: IndustrySectorVocabulary
notation: emergency-services

energy
type: NamedIndividual
type: IndustrySectorVocabulary
notation: energy

engineering
type: NamedIndividual
type: IndustrySectorVocabulary
notation: engineering

entertainment
type: NamedIndividual
type: IndustrySectorVocabulary
notation: entertainment

escalates-privileges
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: escalates-privileges

europe
type: NamedIndividual
type: RegionVocabulary
notation: europe

evades-av
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: evades-av

exe
type: NamedIndividual
type: WindowsPEBinaryVocabulary
notation: exe

exfiltrates-data
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: exfiltrates-data

exfiltrates-to
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: exfiltrates-to

exfiltration
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: exfiltration

expert
type: NamedIndividual
type: ThreatActorSophisticationVocabulary
notation: expert

exploit-kit
type: NamedIndividual
type: MalwareTypeVocabulary
notation: exploit-kit

exploitation
type: NamedIndividual
type: ToolTypeVocabulary
notation: exploitation

exploits
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: exploits

facebook
type: NamedIndividual
type: AccountTypeVocabulary
notation: facebook

financial-services
type: NamedIndividual
type: IndustrySectorVocabulary
notation: financial-services

fingerprints-host
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: fingerprints-host

firewall
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: firewall

go
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: go

government
type: NamedIndividual
type: AttackResourceLevelVocabulary
type: IndustrySectorVocabulary
notation: government

government-local
type: NamedIndividual
type: IndustrySectorVocabulary
notation: government-local

government-national
type: NamedIndividual
type: IndustrySectorVocabulary
notation: government-national

government-public-services
type: NamedIndividual
type: IndustrySectorVocabulary
notation: government-public-services

government-regional
type: NamedIndividual
type: IndustrySectorVocabulary
notation: government-regional

group
type: NamedIndividual
type: IdentityClassVocabulary
notation: group

hacker
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: hacker

healthcare
type: NamedIndividual
type: IndustrySectorVocabulary
notation: healthcare

hides-artifacts
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: hides-artifacts

hides-executing-code
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: hides-executing-code

high
type: NamedIndividual
type: WindowsIntegrityLevelEnumeration
notation: high

hospitality-leisure
type: NamedIndividual
type: IndustrySectorVocabulary
notation: hospitality-leisure

hosting-malware
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: hosting-malware

hosting-target-lists
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: hosting-target-lists

hosts
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: hosts

ia-64
type: NamedIndividual
type: ProcessorArchitectureVocabulary
notation: ia-64

identity
type: NamedIndividual
type: ReportTypeVocabulary
notation: identity

ideology
type: NamedIndividual
type: AttackMotivationVocabulary
notation: ideology

indicates
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: indicates

indicator
type: NamedIndividual
type: ReportTypeVocabulary
notation: indicator

individual
type: NamedIndividual
type: AttackResourceLevelVocabulary
type: IdentityClassVocabulary
notation: individual

infects-files
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: infects-files

infects-remote-machines
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: infects-remote-machines

information-gathering
type: NamedIndividual
type: ToolTypeVocabulary
notation: information-gathering

infrastructure
type: NamedIndividual
type: IndustrySectorVocabulary
notation: infrastructure

infrastructure-architect
type: NamedIndividual
type: ThreatActorRoleVocabulary
notation: infrastructure-architect

infrastructure-operator
type: NamedIndividual
type: ThreatActorRoleVocabulary
notation: infrastructure-operator

innovator
type: NamedIndividual
type: ThreatActorSophisticationVocabulary
notation: innovator

insider-accidental
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: insider-accidental

insider-disgruntled
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: insider-disgruntled

installs-other-components
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: installs-other-components

insurance
type: NamedIndividual
type: IndustrySectorVocabulary
notation: insurance

intermediate
type: NamedIndividual
type: ThreatActorSophisticationVocabulary
notation: intermediate

intrusion-set
type: NamedIndividual
type: ReportTypeVocabulary
notation: intrusion-set

java
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: java

javascript
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: javascript

keylogger
type: NamedIndividual
type: MalwareTypeVocabulary
notation: keylogger

latin-america-caribbean
type: NamedIndividual
type: RegionVocabulary
notation: latin-america-caribbean

ldap
type: NamedIndividual
type: AccountTypeVocabulary
notation: ldap

located-at
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: located-at

low
type: NamedIndividual
type: WindowsIntegrityLevelEnumeration
notation: low

lua
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: lua

malicious
type: NamedIndividual
type: MalwareResultVocabulary
notation: malicious

malicious-activity
type: NamedIndividual
type: IndicatorTypeVocabulary
notation: malicious-activity

malware
type: NamedIndividual
type: ReportTypeVocabulary
notation: malware

malware-analysis
type: NamedIndividual
type: GroupingContextVocabulary
notation: malware-analysis

malware-author
type: NamedIndividual
type: ThreatActorRoleVocabulary
notation: malware-author

manufacturing
type: NamedIndividual
type: IndustrySectorVocabulary
notation: manufacturing

medium
type: NamedIndividual
type: WindowsIntegrityLevelEnumeration
notation: medium

melanesia
type: NamedIndividual
type: RegionVocabulary
notation: melanesia

micronesia
type: NamedIndividual
type: RegionVocabulary
notation: micronesia

middle-africa
type: NamedIndividual
type: RegionVocabulary
notation: middle-africa

mime-type-indicated
type: NamedIndividual
type: EncryptionAlgorithmEnumeration
notation: mime-type-indicated

minimal
type: NamedIndividual
type: ThreatActorSophisticationVocabulary
notation: minimal

mining
type: NamedIndividual
type: IndustrySectorVocabulary
notation: mining

mips
type: NamedIndividual
type: ProcessorArchitectureVocabulary
notation: mips

mips-le
type: NamedIndividual
type: ProcessorArchitectureVocabulary
notation: mips-le

mitigates
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: mitigates

nation-state
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: nation-state

network-capture
type: NamedIndividual
type: ToolTypeVocabulary
notation: network-capture

neutral
type: NamedIndividual
type: OpinionEnumeration
notation: neutral

new-sco
type: NamedIndividual
type: ExtensionTypesEnumeration
notation: new-sco

new-sdo
type: NamedIndividual
type: ExtensionTypesEnumeration
notation: new-sdo

new-sro
type: NamedIndividual
type: ExtensionTypesEnumeration
notation: new-sro

nis
type: NamedIndividual
type: AccountTypeVocabulary
notation: nis

non-profit
type: NamedIndividual
type: IndustrySectorVocabulary
notation: non-profit

none
type: NamedIndividual
type: ThreatActorSophisticationVocabulary
notation: none

northern-africa
type: NamedIndividual
type: RegionVocabulary
notation: northern-africa

northern-america
type: NamedIndividual
type: RegionVocabulary
notation: northern-america

northern-europe
type: NamedIndividual
type: RegionVocabulary
notation: northern-europe

notoriety
type: NamedIndividual
type: AttackMotivationVocabulary
notation: notoriety

nuclear
type: NamedIndividual
type: IndustrySectorVocabulary
notation: nuclear

objective-c
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: objective-c

observed-data
type: NamedIndividual
type: ReportTypeVocabulary
notation: observed-data

oceania
type: NamedIndividual
type: RegionVocabulary
notation: oceania

openid
type: NamedIndividual
type: AccountTypeVocabulary
notation: openid

organization
type: NamedIndividual
type: AttackResourceLevelVocabulary
type: IdentityClassVocabulary
notation: organization

organizational-gain
type: NamedIndividual
type: AttackMotivationVocabulary
notation: organizational-gain

originates-from
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: originates-from

owns
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: owns

pcre
type: NamedIndividual
type: PatternTypeVocabulary
notation: pcre

perl
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: perl

persists-after-system-reboot
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: persists-after-system-reboot

personal-gain
type: NamedIndividual
type: AttackMotivationVocabulary
notation: personal-gain

personal-satisfaction
type: NamedIndividual
type: AttackMotivationVocabulary
notation: personal-satisfaction

pharmaceuticals
type: NamedIndividual
type: IndustrySectorVocabulary
notation: pharmaceuticals

phishing
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: phishing

php
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: php

polynesia
type: NamedIndividual
type: RegionVocabulary
notation: polynesia

powerpc
type: NamedIndividual
type: ProcessorArchitectureVocabulary
notation: powerpc

powershell
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: powershell

prevents-artifact-access
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: prevents-artifact-access

prevents-artifact-deletion
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: prevents-artifact-deletion

probes-network-environment
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: probes-network-environment

property-extension
type: NamedIndividual
type: ExtensionTypesEnumeration
notation: property-extension

python
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: python

radius
type: NamedIndividual
type: AccountTypeVocabulary
notation: radius

ransomware
type: NamedIndividual
type: MalwareTypeVocabulary
notation: ransomware

reconnaissance
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: reconnaissance

related-to
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: related-to

remediates
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: remediates

remote-access
type: NamedIndividual
type: ToolTypeVocabulary
notation: remote-access

remote-access-trojan
type: NamedIndividual
type: MalwareTypeVocabulary
notation: remote-access-trojan

resource-exploitation
type: NamedIndividual
type: MalwareTypeVocabulary
notation: resource-exploitation

retail
type: NamedIndividual
type: IndustrySectorVocabulary
notation: retail

revenge
type: NamedIndividual
type: AttackMotivationVocabulary
notation: revenge

revoked-by
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: revoked-by

rogue-security-software
type: NamedIndividual
type: MalwareTypeVocabulary
notation: rogue-security-software

rootkit
type: NamedIndividual
type: MalwareTypeVocabulary
notation: rootkit

routers-switches
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: routers-switches

ruby
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: ruby

scala
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: scala

screen-capture
type: NamedIndividual
type: MalwareTypeVocabulary
notation: screen-capture

self-modifies
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: self-modifies

sensationalist
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: sensationalist

sigma
type: NamedIndividual
type: PatternTypeVocabulary
notation: sigma

skype
type: NamedIndividual
type: AccountTypeVocabulary
notation: skype

snort
type: NamedIndividual
type: PatternTypeVocabulary
notation: snort

south-america
type: NamedIndividual
type: RegionVocabulary
notation: south-america

south-eastern-asia
type: NamedIndividual
type: RegionVocabulary
notation: south-eastern-asia

southern-africa
type: NamedIndividual
type: RegionVocabulary
notation: southern-africa

southern-asia
type: NamedIndividual
type: RegionVocabulary
notation: southern-asia

southern-europe
type: NamedIndividual
type: RegionVocabulary
notation: southern-europe

sparc
type: NamedIndividual
type: ProcessorArchitectureVocabulary
notation: sparc

sponsor
type: NamedIndividual
type: ThreatActorRoleVocabulary
notation: sponsor

spy
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: spy

spyware
type: NamedIndividual
type: MalwareTypeVocabulary
notation: spyware

staging
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: staging

static-analysis-of
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: static-analysis-of

steals-authentication-credentials
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: steals-authentication-credentials

stix
type: NamedIndividual
type: PatternTypeVocabulary
notation: stix

strategic
type: NamedIndividual
type: ThreatActorSophisticationVocabulary
notation: strategic

strongly-agree
type: NamedIndividual
type: OpinionEnumeration
notation: strongly-agree

strongly-disagree
type: NamedIndividual
type: OpinionEnumeration
notation: strongly-disagree

subtechnique-of
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: subtechnique-of

suricata
type: NamedIndividual
type: PatternTypeVocabulary
notation: suricata

suspicious
type: NamedIndividual
type: MalwareResultVocabulary
notation: suspicious

suspicious-activity
type: NamedIndividual
type: GroupingContextVocabulary
notation: suspicious-activity

swift
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: swift

sys
type: NamedIndividual
type: WindowsPEBinaryVocabulary
notation: sys

system
type: NamedIndividual
type: IdentityClassVocabulary
type: WindowsIntegrityLevelEnumeration
notation: system

tacacs
type: NamedIndividual
type: AccountTypeVocabulary
notation: tacacs

targets
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: targets

team
type: NamedIndividual
type: AttackResourceLevelVocabulary
notation: team

technology
type: NamedIndividual
type: IndustrySectorVocabulary
notation: technology

telecommunications
type: NamedIndividual
type: IndustrySectorVocabulary
notation: telecommunications

terrorist
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: terrorist

threat-actor
type: NamedIndividual
type: ReportTypeVocabulary
notation: threat-actor

threat-report
type: NamedIndividual
type: ReportTypeVocabulary
notation: threat-report

tool
type: NamedIndividual
type: ReportTypeVocabulary
notation: tool

toplevel-property-extension
type: NamedIndividual
type: ExtensionTypesEnumeration
notation: toplevel-property-extension

transportation
type: NamedIndividual
type: IndustrySectorVocabulary
notation: transportation

trojan
type: NamedIndividual
type: MalwareTypeVocabulary
notation: trojan

twitter
type: NamedIndividual
type: AccountTypeVocabulary
notation: twitter

typescript
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: typescript

unix
type: NamedIndividual
type: AccountTypeVocabulary
notation: unix

unknown
type: NamedIndividual
type: IdentityClassVocabulary
type: IndicatorTypeVocabulary
type: MalwareResultVocabulary
type: MalwareTypeVocabulary
type: ThreatActorTypeVocabulary
type: ToolTypeVocabulary
notation: unknown

unpredictable
type: NamedIndividual
type: AttackMotivationVocabulary
notation: unpredictable

unspecified
type: NamedIndividual
type: GroupingContextVocabulary
notation: unspecified

uses
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: uses

utilities
type: NamedIndividual
type: IndustrySectorVocabulary
notation: utilities

variant-of
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: variant-of

violates-system-operational-integrity
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: violates-system-operational-integrity

virus
type: NamedIndividual
type: MalwareTypeVocabulary
notation: virus

visual-basic
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: visual-basic

vulnerability
type: NamedIndividual
type: ReportTypeVocabulary
notation: vulnerability

vulnerability-scanning
type: NamedIndividual
type: ToolTypeVocabulary
notation: vulnerability-scanning

water
type: NamedIndividual
type: IndustrySectorVocabulary
notation: water

webshell
type: NamedIndividual
type: MalwareTypeVocabulary
notation: webshell

western-africa
type: NamedIndividual
type: RegionVocabulary
notation: western-africa

western-asia
type: NamedIndividual
type: RegionVocabulary
notation: western-asia

western-europe
type: NamedIndividual
type: RegionVocabulary
notation: western-europe

windows-domain
type: NamedIndividual
type: AccountTypeVocabulary
notation: windows-domain

windows-local
type: NamedIndividual
type: AccountTypeVocabulary
notation: windows-local

wiper
type: NamedIndividual
type: MalwareTypeVocabulary
notation: wiper

workstation
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: workstation

worm
type: NamedIndividual
type: MalwareTypeVocabulary
notation: worm

x86
type: NamedIndividual
type: ProcessorArchitectureVocabulary
notation: x86

x86-32
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: x86-32

x86-64
type: NamedIndividual
type: ImplementationLanguageVocabulary
type: ProcessorArchitectureVocabulary
notation: x86-64

yara
type: NamedIndividual
type: PatternTypeVocabulary
notation: yara