STONEWORK — Semantic Threat Ontology and Research Framework
type: Ontology
version IRI: https://cyberterrain.org/ns/stonework/0.2.0
imports: stones#
creator: Hohimer Intelligence Strategies LLC
description: A semantic threat ontology and research framework that serves as the evolutionary successor to the STONES ontology. It provides a forward-looking, extensible foundation for modeling next-generation cyber threat intelligence concepts, objects, relationships, workflows, and knowledge beyond the scope of STIX 2.1.
license: MIT
label: STONEWORK
version info: 0.2.0

attributed_to
type: ObjectProperty
definition: Shortcut triple: source Campaign or IntrusionSet is attributed to target ThreatActor or IntrusionSet. Corresponds to STIX relationship_type 'attributed-to'.

detects
type: ObjectProperty
definition: Shortcut triple: source CourseOfAction or Indicator detects target. Corresponds to STIX relationship_type 'detects'.

exploits
type: ObjectProperty
definition: Shortcut triple: source Malware or ThreatActor exploits target Vulnerability. Corresponds to STIX relationship_type 'exploits'.

indicates
type: ObjectProperty
definition: Shortcut triple: source Indicator indicates presence of target. Corresponds to STIX relationship_type 'indicates'.

mitigates
type: ObjectProperty
definition: Shortcut triple: source CourseOfAction mitigates target AttackPattern or Vulnerability. Corresponds to STIX relationship_type 'mitigates'.

related_to
type: ObjectProperty
definition: Shortcut triple: generic relationship. Corresponds to STIX relationship_type 'related-to'.

revoked_by
type: ObjectProperty
definition: Shortcut triple: source STIX object is revoked and superseded by target. Corresponds to STIX relationship_type 'revoked-by'.

subtechnique_of
type: ObjectProperty
definition: Shortcut triple: source AttackPattern is a sub-technique of target AttackPattern. Corresponds to STIX relationship_type 'subtechnique-of' (hyphens converted to underscores in the predicate IRI).

targets
type: ObjectProperty
definition: Shortcut triple: source targets the target Identity, Vulnerability, or Location. Corresponds to STIX relationship_type 'targets'.

affected
type: ObjectProperty
domain: Vulnerability
range: Product
definition: Relates a vulnerability to a product known to be affected by it.
scope note: The range is a stonework:Product individual whose IRI is derived deterministically from the CPE identifier. The product individual may be populated by a separate CPE ingest; references from CVE data precede that ingest and are resolved when CPE data is loaded.

exploitsWeakness
type: ObjectProperty
domain: Vulnerability
range: Weakness
definition: Relates a vulnerability to the weakness class it exploits or instantiates.
scope note: The range is a stonework:Weakness individual whose IRI is derived from the CWE identifier. The weakness individual may be populated by a separate CWE ingest.

hasMembers
type: ObjectProperty
domain: Group

hasTechnique
type: ObjectProperty
domain: Tactic
range: AttackTechnique
definition: Relates a tactic to an offensive technique that serves that tactic's goal.

hasWeakness
type: ObjectProperty
type: AsymmetricProperty
domain: Vulnerability
range: Weakness
definition: Relates a vulnerability to the weakness class it exploits or instantiates.
scope note: The range is a stonework:Weakness individual whose IRI is derived from the CWE identifier. The weakness individual may be populated by a separate CWE ingest.

membersOf
type: ObjectProperty
inverse of: hasMembers
range: Group

mitigatesAttackPattern
type: ObjectProperty
domain: Control
range: Attack Pattern
definition: Relates a security control to an attack pattern or technique it helps mitigate or counter.
scope note: Range is stones:AttackPattern, which covers both abstract attack pattern classes (e.g. CAPEC) and operationalized techniques (e.g. ATT&CK), both of which are typed attack-pattern in STIX 2.1.

relatedAttackPattern
type: ObjectProperty
domain: STIX Object
range: Attack Pattern
definition: Relates any STIX object to an attack pattern it exploits, instantiates, or operationalizes.
scope note: Covers two cross-dataset links: (1) CWE weakness → CAPEC attack pattern (exploits/instantiates), and (2) CAPEC attack pattern → ATT&CK technique (operationalizes). Both subjects are stones:StixObject individuals.

techniqueOf
type: ObjectProperty
inverse of: hasTechnique
domain: Technique

uses
type: ObjectProperty
domain: Intrusion Set
range: Attack Pattern
definition: Relates a threat actor group or campaign to an offensive technique they are known to employ.
scope note: Sub-property stones:uses carries the shortcut triples emitted by the STIX 2.1 transform for relationship_type 'uses'.

weaknessOf
type: ObjectProperty
inverse of: hasWeakness
domain: Weakness
range: Vulnerability
definition: Relates a weakness to the vulnerability that exploits or instantiates it.
scope note: The range is a vulnerability individual. The weakness individual (domain) is a stonework:Weakness whose IRI is derived from the CWE identifier. The weakness individual may be populated by a separate CWE ingest.

relationshipType
type: DatatypeProperty
type: FunctionalProperty
domain: Relationship
range: string
definition: The relationship_type string value from the STIX 2.1 SRO (e.g. 'uses', 'mitigates', 'subtechnique-of'). Drawn from the STIX 2.1 open vocabulary; corresponding named individuals are declared as stones:RelationshipTypeVocabulary instances in vocabularies.ttl. A shortcut object property is also asserted: stones:<type_underscored> from source to target.

Alternate Data Stream
type: Class
subclass of: STIX Sub-Type
subclass of: Restriction
  on property: name
  min cardinality: 1
definition: An NTFS Alternate Data Stream (ADS) attached to a file, identified by name with optional hashes and size.

Artifact Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: artifact
subclass of: STIX Cyber Observable Object
definition: Represents a sequence of bytes, such as the content of a file, a raw stream of network traffic, or a data blob captured from memory. The content may be embedded directly via payload_bin or referenced via url.

Attack Pattern
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: attack-pattern
subclass of: STIX Domain Object
subclass of: Restriction
  on property: name
  min cardinality: 1
definition: A type of Tactics, Techniques, and Procedures (TTP) that describes ways that adversaries attempt to compromise targets. Often maps to MITRE ATT&CK techniques.

Autonomous System Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: autonomous-system
subclass of: STIX Cyber Observable Object
definition: Represents an Autonomous System (AS), a collection of IP routing prefixes under the control of a single administrative entity, identified by its AS number.

Campaign
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: campaign
subclass of: STIX Domain Object
subclass of: Restriction
  on property: name
  min cardinality: 1
definition: A grouping of adversary behaviours and resources with a common objective pursued over a period of time. Campaigns may be attributed to intrusion sets or threat actors.

Course of Action
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: course-of-action
subclass of: STIX Domain Object
subclass of: Restriction
  on property: name
  min cardinality: 1
definition: A recommendation for a specific measure to be taken in response to an attack. May describe automated responses, playbook steps, or manual mitigations.

Directory Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: directory
subclass of: STIX Cyber Observable Object
definition: Represents a file system directory, conveying its path and timestamps. May reference the files and sub-directories it contains.

Domain Name Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: domain-name
subclass of: STIX Cyber Observable Object
definition: Represents a network domain name. Can reference the IP addresses it resolves to.

Email Address Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: email-addr
subclass of: STIX Cyber Observable Object
definition: Represents a single email address, optionally associating it with a display name and a user account.

Email Message Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: email-message
subclass of: STIX Cyber Observable Object
definition: Represents an email message, including its headers, body, and any MIME parts.

Email MIME Part
type: Class
subclass of: STIX Sub-Type
definition: A single MIME part within a multipart email message, including its body content, content type, and content disposition.

Extension Definition Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: extension-definition
subclass of: STIX Meta Object
definition: Defines a schema extension to STIX 2.1. Allows producers to add new properties or new object types in a structured, interoperable way.

External Reference
type: Class
subclass of: STIX Sub-Type
subclass of: Restriction
  on property: sourceName
  min cardinality: 1
definition: A structured reference to non-STIX information, such as a CVE entry, MITRE ATT&CK technique, or external URL. Used to link STIX content to authoritative external sources.

File Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: file
subclass of: STIX Cyber Observable Object
definition: Represents a file with its metadata and optional content reference. Supports extensions for archive files, NTFS streams, PE binaries, PDF documents, and raster images.

Granular Marking
type: Class
subclass of: STIX Sub-Type
subclass of: Restriction
  on property: markingRef
  min cardinality: 1
subclass of: Restriction
  on property: selectors
  min cardinality: 1
definition: A property-level data handling marking that applies a marking definition to specific named fields of a STIX object, enabling fine-grained access control.

Grouping
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: grouping
subclass of: STIX Domain Object
subclass of: Restriction
  on property: context
  min cardinality: 1
subclass of: Restriction
  on property: objectRefs
  min cardinality: 1
definition: Explicitly asserts that a set of STIX objects share a common context without implying the existence of a threat report. Useful for linking related objects without a formal report.

Hash Entry
type: Class
subclass of: STIX Sub-Type
subclass of: Restriction
  on property: algorithm
  min cardinality: 1
subclass of: Restriction
  on property: hashValue
  min cardinality: 1
definition: A single cryptographic hash entry associating a hashing algorithm with its hex-encoded digest value. Used to represent entries in the STIX hashes dictionary.

IPv4 Address Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: ipv4-addr
subclass of: STIX Cyber Observable Object
definition: Represents one or more IPv4 addresses expressed using CIDR notation.

IPv6 Address Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: ipv6-addr
subclass of: STIX Cyber Observable Object
definition: Represents one or more IPv6 addresses expressed using CIDR notation.

Identity
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: identity
subclass of: STIX Domain Object
subclass of: Restriction
  on property: name
  min cardinality: 1
definition: Actual individuals, organisations, or groups, as well as classes of individuals, organisations, systems, or groups. Used to represent victims, producers, or any other real-world actor.

Indicator
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: indicator
subclass of: STIX Domain Object
subclass of: Restriction
  on property: indicatorTypes
  min cardinality: 1
subclass of: Restriction
  on property: patternType
  min cardinality: 1
subclass of: Restriction
  on property: pattern
  min cardinality: 1
subclass of: Restriction
  on property: validFrom
  min cardinality: 1
definition: Contains a pattern that can be used to detect suspicious or malicious cyber activity. Patterns are expressed using the STIX Patterning Language or another supported pattern language.

Infrastructure
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: infrastructure
subclass of: STIX Domain Object
subclass of: Restriction
  on property: infrastructureTypes
  min cardinality: 1
subclass of: Restriction
  on property: name
  min cardinality: 1
definition: Represents systems, software services, or any group of resources used to conduct cyber operations. Infrastructure is used by threat actors and intrusion sets both offensively and defensively.

Intrusion Set
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: intrusion-set
subclass of: STIX Domain Object
subclass of: Restriction
  on property: name
  min cardinality: 1
definition: A grouped set of adversarial behaviours and resources with common properties, believed to be orchestrated by a single organisation. Often represents a named APT group.

Kill Chain Phase
type: Class
subclass of: STIX Sub-Type
subclass of: Restriction
  on property: killChainName
  min cardinality: 1
subclass of: Restriction
  on property: phaseName
  min cardinality: 1
definition: Represents a phase within a named kill chain framework, such as the MITRE ATT&CK or Lockheed Martin Cyber Kill Chain, used to categorise the stage of an attack.

Language Content Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: language-content
subclass of: STIX Meta Object
definition: Provides translations of string properties of another STIX object into different languages. Allows internationalisation without modifying the original object.

Location
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: location
subclass of: STIX Domain Object
subclass of: Restriction
  on property: region
  max cardinality: 1
subclass of: Restriction
  on property: country
  max cardinality: 1
subclass of: Restriction
  on property: latitude
  max cardinality: 1
subclass of: Restriction
  on property: longitude
  max cardinality: 1
definition: Represents a geographic location. May be as specific as a latitude/longitude coordinate or as broad as a continent. At least one of region, country, or latitude/longitude must be provided.

MAC Address Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: mac-addr
subclass of: STIX Cyber Observable Object
definition: Represents a single MAC address expressed in lowercase IEEE 802 colon-hexadecimal notation.

Malware
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: malware
subclass of: STIX Domain Object
subclass of: Restriction
  on property: malwareTypes
  min cardinality: 1
subclass of: Restriction
  on property: isFamily
  min cardinality: 1
definition: A type of TTP that represents malicious code. Captures both malware families (when is_family is true) and specific instances or samples.

Malware Analysis
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: malware-analysis
subclass of: STIX Domain Object
subclass of: Restriction
  on property: product
  min cardinality: 1
definition: Captures the results of a malware analysis process, whether static or dynamic. Represents the output of a specific analysis run on a specific sample.

Marking Definition Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: marking-definition
subclass of: STIX Meta Object
definition: Defines a data handling marking used to restrict or label how STIX data can be shared or handled, such as TLP markings. Referenced by object_marking_refs or granular_markings.

Mutex Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: mutex
subclass of: STIX Cyber Observable Object
definition: Represents a named mutual-exclusion object, commonly created or checked by malware to prevent multiple concurrent instances from running.

Network Traffic Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: network-traffic
subclass of: STIX Cyber Observable Object
definition: Represents an arbitrary network traffic flow between source and destination endpoints. Supports extensions for HTTP, ICMP, socket, and TCP specifics.

Note
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: note
subclass of: STIX Domain Object
subclass of: Restriction
  on property: objectRefs
  min cardinality: 1
subclass of: Restriction
  on property: content
  min cardinality: 1
definition: Conveys informational text to provide further context and/or to assess the accuracy of existing STIX information. Similar to a comment or annotation on other STIX objects.

Observed Data
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: observed-data
subclass of: STIX Domain Object
subclass of: Restriction
  on property: objectRefs
  min cardinality: 1
subclass of: Restriction
  on property: firstObserved
  min cardinality: 1
subclass of: Restriction
  on property: lastObserved
  min cardinality: 1
subclass of: Restriction
  on property: numberObserved
  min cardinality: 1
definition: Conveys information observed on systems and networks, wrapping one or more SCO references together with observation metadata such as first and last observed timestamps.

Opinion
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: opinion
subclass of: STIX Domain Object
subclass of: Restriction
  on property: objectRefs
  min cardinality: 1
subclass of: Restriction
  on property: opinion
  min cardinality: 1
definition: An assessment of the correctness of information in one or more STIX objects. Allows analysts to express agreement or disagreement with existing intelligence.

Process Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: process
subclass of: STIX Cyber Observable Object
definition: Represents a running or terminated process on a host. Supports extensions for Windows-specific process and service attributes.

Relationship
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: relationship
subclass of: STIX Relationship Object
subclass of: Restriction
  on property: sourceRef
  min cardinality: 1
subclass of: Restriction
  on property: targetRef
  min cardinality: 1
subclass of: Restriction
  on property: relationshipType
  min cardinality: 1
definition: A directed link between two STIX Core Objects. The semantics of the link are defined by the relationship_type property.

Report
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: report
subclass of: STIX Domain Object
subclass of: Restriction
  on property: objectRefs
  min cardinality: 1
subclass of: Restriction
  on property: reportTypes
  min cardinality: 1
subclass of: Restriction
  on property: name
  min cardinality: 1
subclass of: Restriction
  on property: published
  min cardinality: 1
definition: A collection of threat intelligence focused on one or more topics, such as a description of a threat actor, malware, or attack technique. Used to package related STIX content.

Sighting
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: sighting
subclass of: STIX Relationship Object
subclass of: Restriction
  on property: sightingOfRef
  min cardinality: 1
definition: Records that a STIX object such as an indicator, malware, tool, or threat actor was seen. Wraps observation metadata around a reference to the sighted object.

Software Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: software
subclass of: STIX Cyber Observable Object
definition: Represents a software product, including commercial applications, operating systems, libraries, and utilities.

STIX Bundle
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: bundle
subclass of: STIX Object
definition: A collection of arbitrary STIX objects used as a transport container. Bundles are not Core Objects, carry no modified timestamp, and cannot be referenced by identifier.

STIX Core Object
type: Class
subclass of: STIX Object
subclass of: Restriction
  on property: created
  min cardinality: 1
subclass of: Restriction
  on property: modified
  min cardinality: 1
definition: Abstract class for STIX Core Objects, comprising SDOs, SCOs, and SROs. Core objects carry a type-qualified identifier and created/modified timestamps, and may be referenced by other objects.

STIX Cyber Observable Object
type: Class
subclass of: STIX Core Object
definition: Abstract class for STIX Cyber Observable Objects (SCOs), which represent technical observations such as IP addresses, files, network traffic, and processes.

STIX Domain Object
type: Class
subclass of: STIX Core Object
definition: Abstract class for STIX Domain Objects (SDOs), which represent modelled cyber threat intelligence concepts such as malware, campaigns, threat actors, and vulnerabilities.

STIX Meta Object
type: Class
subclass of: STIX Object
definition: Abstract class for STIX Meta Objects, which provide supporting infrastructure for the STIX ecosystem, including data markings, language translations, and extension definitions.

STIX Object
type: Class
subclass of: Restriction
  on property: specVersion
  min cardinality: 1
subclass of: Restriction
  on property: stixId
  min cardinality: 1
subclass of: Restriction
  on property: stixType
  min cardinality: 1
disjoint with: STIX Sub-Type
has key: stixId
definition: The top-level abstract class for all STIX objects, encompassing STIX Core Objects (SDOs, SCOs, SROs), Meta Objects, and Bundles.

STIX Relationship Object
type: Class
subclass of: STIX Core Object
definition: Abstract class for STIX Relationship Objects (SROs), which link Core Objects to express directed relationships and sightings between them.

STIX Sub-Type
type: Class
definition: Abstract class for structured sub-types defined by the STIX 2.1 specification that are embedded as property values within STIX objects. Instances are not STIX objects: they carry no identifier, type, spec_version, created, or modified properties and cannot be referenced by identifier from other objects. Subclasses include ExternalReference, GranularMarking, KillChainPhase, HashEntry, EmailMimePart, AlternateDataStream, WindowsPeSection, WindowsRegistryValue, and X509V3Extensions.

Threat Actor
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: threat-actor
subclass of: STIX Domain Object
subclass of: Restriction
  on property: threatActorTypes
  min cardinality: 1
subclass of: Restriction
  on property: name
  min cardinality: 1
definition: Actual individuals, groups, or organisations believed to be operating with malicious intent. Unlike Identity, a ThreatActor carries adversarial connotations.

Tool
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: tool
subclass of: STIX Domain Object
subclass of: Restriction
  on property: toolTypes
  min cardinality: 1
subclass of: Restriction
  on property: name
  min cardinality: 1
definition: Legitimate software that can be used by threat actors to perform attacks. Distinguishable from malware by being designed for benign purposes but repurposed maliciously.

URL Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: url
subclass of: STIX Cyber Observable Object
definition: Represents a Uniform Resource Locator conforming to RFC 3986.

User Account Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: user-account
subclass of: STIX Cyber Observable Object
definition: Represents a user account on a system or service, including local OS accounts, cloud accounts, and social media accounts. Supports a unix-account extension for POSIX attributes.

Vulnerability
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: vulnerability
subclass of: STIX Domain Object
subclass of: Restriction
  on property: name
  min cardinality: 1
definition: A mistake in software that can be directly used by a threat actor to gain access to a system or network. Typically identified by a CVE number via an external reference.

Windows PE Section
type: Class
subclass of: STIX Sub-Type
subclass of: Restriction
  on property: name
  min cardinality: 1
definition: A single section entry within a Windows PE (Portable Executable) binary, described by its name, size, and optional entropy value.

Windows Registry Key Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: windows-registry-key
subclass of: STIX Cyber Observable Object
definition: Represents a Windows Registry key with its full path, value entries, modification timestamp, and creator.

Windows Registry Value
type: Class
subclass of: STIX Sub-Type
subclass of: Restriction
  on property: name
  min cardinality: 1
definition: A single value entry within a Windows Registry key, comprising a name, a data string, and a registry data type.

X.509 Certificate Object
type: Class
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    on property: stixType
    has value: x509-certificate
subclass of: STIX Cyber Observable Object
definition: Represents an X.509 digital certificate, capturing its subject, issuer, validity window, public key details, and optional v3 extensions.

X.509 v3 Extensions
type: Class
subclass of: STIX Sub-Type
definition: The set of X.509 version 3 extension fields present in a digital certificate, such as key usage, subject alternative names, and CRL distribution points.

Agent
type: Class
subclass of: STIX Core Object
definition: Any entity that can act, perform actions, or be attributed responsibility in a cyber or sociotechnical context.
scope note: Covers human individuals, groups, organizations, and other actors (e.g. threat actors, vendors, government bodies). Used as the top-level superclass for identity-related objects in alignment with STIX Identity.

AttackTechnique
type: Class
subclass of: CyberTechnique
definition: A prescribed offensive method used by an adversary to achieve a specific tactical objective within a target environment.
scope note: Aligns with MITRE ATT&CK techniques and D3FEND OffensiveTechnique. Not a subclass of stones:AttackPattern — attack patterns (e.g. CAPEC) are abstract descriptions of attack classes, whereas AttackTechnique is an operationalized plan for execution. Framework-specific subclasses (e.g. attack:Technique) provide the concrete individuals.

Control
type: Class
subclass of: STIX Domain Object
comment: Instances of stonework:Control may represent individual controls, control enhancements, or sub‑controls. Framework‑specific identifiers (e.g., "AC‑2", "CIS 4.1") SHOULD be modeled using explicit properties rather than encoded in the class IRI. Control text SHOULD be referenced via citations rather than reproduced verbatim.
definition: A prescribed security or privacy safeguard that specifies an action, capability, or condition intended to reduce risk, enforce policy, or achieve a defined protection objective within an information system or organization.
scope note: This class provides a semantic representation of security and privacy controls from frameworks such as NIST SP 800‑53 and the CIS Controls. It supports mapping to external control identifiers and families without embedding copyrighted control text.

CyberTechnique
type: Class
subclass of: Technique
definition: A technique performed within or against cyberspace, encompassing both offensive and defensive cyber operations.
scope note: Mirrors D3FEND's CyberTechnique class. Subclassed by stonework:AttackTechnique (offensive) and stonework:DefendTechnique (defensive), enabling a single property chain to span both ATT&CK and D3FEND individuals.

DefendTechnique
type: Class
subclass of: CyberTechnique
definition: A prescribed defensive method used to detect, prevent, or respond to adversary behavior within a target environment.
scope note: Aligns with MITRE D3FEND DefensiveTechnique. Framework-specific subclasses (e.g. d3fend:DefensiveTechnique) extend this class when D3FEND data is loaded.

Group
type: Class
subclass of: Agent
definition: Any collection of Persons, Organizations, or other Groups that share a common purpose or identity but do not necessarily have formal legal structure.
scope note: Used for informal collectives, communities, ad-hoc teams, criminal syndicates, or loose alliances. More general than Organization. Can contain other Groups or Organizations.

Impact
type: Class
subclass of: STIX Domain Object
comment: Instances of stonework:Impact SHOULD specify the affected asset or mission, the type of consequence, and the severity level. Impact SHOULD be represented using explicit properties rather than encoded in class IRIs or labels.
definition: The magnitude of harm, loss, or adverse effects that would result if a threat were realized and a compromise occurred, expressed in terms of mission, business, operational, or technical consequences.
scope note: Impact represents the severity of consequences associated with a compromise. It may include effects on confidentiality, integrity, availability, safety, mission success, financial loss, or reputational damage. Impact values may be qualitative or quantitative.

Likelihood
type: Class
subclass of: STIX Domain Object
comment: Instances of stonework:Likelihood may incorporate assumptions, uncertainty, adversary behavior, historical frequency, or environmental conditions. Likelihood SHOULD be represented using explicit properties rather than encoded in class IRIs or labels.
definition: The estimated probability, plausibility, or frequency with which a threat could be realized and lead to a compromise under specified conditions.
scope note: Likelihood reflects the chance that a compromise will occur, considering adversary capability, intent, opportunity, preconditions, and environmental factors. Likelihood values may be qualitative, ordinal, or quantitative.

Organization
type: Class
subclass of: Group
definition: A formal or semi-formal structured entity such as a company, government agency, non-profit, military unit, or consortium with defined boundaries and usually legal identity.
scope note: Corresponds to STIX Identity with identity_class = 'organization'. Includes corporations, government bodies, NGOs, universities, etc. Distinguished from Group by having more persistent structure, roles, and often legal standing.

Person
type: Class
subclass of: Agent
definition: A single human individual.
scope note: Represents real named people (e.g. employees, threat actors, researchers). Does not include legal entities or groups. Corresponds to STIX Identity with identity_class = 'individual'.

Procedure
type: Class
subclass of: STIX Domain Object
comment: Procedures are instances or patterns of execution that realize a technique. They may include command lines, API calls, malware behaviors, or operator playbook steps. Procedures are distinct from techniques, which describe generalized methods.
definition: A concrete, observable sequence of actions, commands, or behaviors that implements a technique in a specific operational context.
scope note: Procedures describe the actual steps an adversary takes, such as specific commands, scripts, tools, or configurations. They represent the most granular level of adversary behavior.

Product
type: Class
subclass of: STIX Domain Object
comment: Instances of stonework:Product may include operating systems, applications, libraries, devices, or embedded components. Versioning, vendor attribution, and edition details SHOULD be represented using explicit properties rather than encoded strings.
definition: A software, hardware, or firmware entity identified by its vendor, product name, and version characteristics, used to represent a specific platform or component within vulnerability, configuration, or threat‑intelligence contexts.
scope note: This class provides a semantic representation of platform entities commonly identified using CPE naming schemes. It does not require the use of CPE, but supports mapping to CPE identifiers when available.

Risk
type: Class
subclass of: STIX Domain Object
comment: Instances of stonework:Risk may reference the threat being considered, the assets affected, the expected impact of compromise, and the likelihood of occurrence. Risk values may be qualitative or quantitative, and SHOULD be represented using explicit properties rather than encoded in class IRIs or labels.
definition: A measure of the potential for loss or adverse effects arising from the realization of a threat, expressed as a function of the impact of compromise and the likelihood that the compromise will occur.
scope note: This class represents the assessed or estimated level of exposure to harm for a specific asset, mission, or organization. Risk is typically derived from the combination of impact and likelihood, and may incorporate assumptions, uncertainty, and contextual factors.

Tactic
type: Class
subclass of: STIX Domain Object
comment: Instances of stonework:Tactic SHOULD correspond to high‑level adversary goals. Techniques are typically modeled as children or members of a tactic.
definition: A high‑level adversary objective or strategic goal that groups related techniques by the purpose they serve during an intrusion or operation.
scope note: Tactics represent the strategic intent behind adversary behavior, such as gaining initial access, executing code, or exfiltrating data. They serve as conceptual categories for techniques.

Technique
type: Class
subclass of: STIX Domain Object
comment: Mirrors D3FEND's Technique class and reflects the PROV-O Plan philosophy: a technique is a plan that describes how an action should be carried out, distinct from the activity that executes it. Subclassed by stonework:CyberTechnique for cyber-specific methods.
definition: A reusable, prescribed method for achieving an objective, which may be instantiated as a concrete execution by an actor or system.
scope note: Technique is intentionally not a subclass of stones:AttackPattern. Attack patterns (e.g. CAPEC) are abstract descriptions of attack classes in the STIX sense; techniques are operationalized plans. See stonework:CyberTechnique, stonework:AttackTechnique, stonework:DefendTechnique.

Threat
type: Class
subclass of: STIX Domain Object
comment: Instances of stonework:Threat may describe adversary capabilities, strategic objectives, targeting patterns, or environmental conditions that increase the likelihood of harmful action. Threats may be linked to threat actors, campaigns, malware, TTPs, weaknesses, or assets, but are conceptually distinct from the actions or events that realize them.
definition: A potential or actual source of harm arising from an adversary's capability, intent, and opportunity to exploit weaknesses or create adverse effects within a system, organization, or mission.
scope note: This class represents the abstract notion of a cyber threat, independent of specific threat actors, campaigns, or events. It provides a semantic foundation for modeling adversary capabilities, intentions, targeting, and conditions that give rise to harmful outcomes.

ThreatScenario
type: Class
subclass of: STIX Domain Object
comment: Instances of stonework:ThreatScenario may include assumptions, triggering conditions, targeted assets, adversary profiles, attack paths, and expected impacts. Threat scenarios are distinct from threats, attacks, or incidents; they represent hypothetical or anticipated sequences rather than observed events.
definition: A structured description of how a threat could materialize against specific assets or missions, incorporating adversary intent, capability, opportunity, preconditions, and potential consequences.
scope note: Threat scenarios describe plausible or anticipated sequences of adversarial behavior and environmental conditions that could lead to harmful outcomes. They support risk assessment, prioritization, and strategic planning by expressing how threats may be realized in a given organizational context.

Weakness
type: Class
subclass of: STIX Domain Object
comment: Instances of stonework:Weakness may represent base weaknesses, variant weaknesses, or compound weaknesses. CWE identifiers (e.g., "CWE‑79") SHOULD be modeled using explicit properties rather than encoded in the class IRI. Descriptions and extended details SHOULD be referenced via citations rather than reproduced verbatim.
definition: A type of flaw, fault, or design condition in software, hardware, or system architecture that can enable vulnerabilities, reduce security assurance, or increase the likelihood of exploitable behavior.
scope note: This class provides a semantic representation of weakness types defined in the Common Weakness Enumeration (CWE). It supports hierarchical relationships, abstraction levels, and mappings to related attack patterns, vulnerabilities, and security controls.