Showing:

Annotations
Attributes
Diagrams
Facets
Source
Used by
Imported schema ttp.xsd
Namespace http://stix.mitre.org/TTP-1
Annotations
 
This schema was originally developed by The MITRE Corporation. The STIX XML Schema implementation is maintained by The MITRE Corporation and developed by the open STIX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the STIX website at http://stix.mitre.org.
Element ttp:MalwareInstanceType / ttp:Type
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Type field provides a characterization of what type of malware this MalwareInstance is.
 
This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is MalwareTypeVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.
 
Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.
Diagram
Diagram stix_common_xsd.tmp#ControlledVocabularyStringType_vocab_name stix_common_xsd.tmp#ControlledVocabularyStringType_vocab_reference stix_common_xsd.tmp#ControlledVocabularyStringType
Type stixCommon:ControlledVocabularyStringType
Attributes
QName Type Use Annotation
vocab_name xs:string optional 
The vocab_name field specifies the name of the controlled vocabulary.
vocab_reference xs:anyURI optional 
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
 
<xs:element name="Type" type="stixCommon:ControlledVocabularyStringType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Type field provides a characterization of what type of malware this MalwareInstance is.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is MalwareTypeVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.</xs:documentation>
    <xs:documentation>Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:MalwareInstanceType / ttp:Name
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Name field specifies a name associated with this MalwareInstance.
 
This field is implemented through the xsi:type controlled vocabulary extension mechanism. No default vocabulary type has been defined for STIX 1.2. Users may either define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a free string field.
Diagram
Diagram stix_common_xsd.tmp#ControlledVocabularyStringType_vocab_name stix_common_xsd.tmp#ControlledVocabularyStringType_vocab_reference stix_common_xsd.tmp#ControlledVocabularyStringType
Type stixCommon:ControlledVocabularyStringType
Attributes
QName Type Use Annotation
vocab_name xs:string optional 
The vocab_name field specifies the name of the controlled vocabulary.
vocab_reference xs:anyURI optional 
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
 
<xs:element name="Name" type="stixCommon:ControlledVocabularyStringType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Name field specifies a name associated with this MalwareInstance.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. No default vocabulary type has been defined for STIX 1.2. Users may either define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a free string field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:MalwareInstanceType / ttp:Title
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Title field is optional and provides an unstructured, text description of an individual Malware Instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Title" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Title field is optional and provides an unstructured, text description of an individual Malware Instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:MalwareInstanceType / ttp:Description
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Description field provides an text description of an individual Malware Instance.
Diagram
Diagram stix_common_xsd.tmp#StructuredTextType_id stix_common_xsd.tmp#StructuredTextType_ordinality stix_common_xsd.tmp#StructuredTextType_structuring_format stix_common_xsd.tmp#StructuredTextType
Type stixCommon:StructuredTextType
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a globally unique identifier for this Description.
ordinality xs:positiveInteger optional 
Specifies the intended order position of this construct instance (e.g. Description) within a set of potentially multiple peer construct instances. If only a single construct instance is present its ordinality can be assumed to be 1. If multiple construct instances are present, the ordinality field should be specified with unique values for each instance.
structuring_format xs:string optional 
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interferring with XML validation of the STIX document. If this attribute is absent, the implication is that no markup is being used.
Source
 
<xs:element name="Description" type="stixCommon:StructuredTextType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Description field provides an text description of an individual Malware Instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:MalwareInstanceType / ttp:Short_Description
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Short_Description field provides a short text description of an individual Malware Instance.
Diagram
Diagram stix_common_xsd.tmp#StructuredTextType_id stix_common_xsd.tmp#StructuredTextType_ordinality stix_common_xsd.tmp#StructuredTextType_structuring_format stix_common_xsd.tmp#StructuredTextType
Type stixCommon:StructuredTextType
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a globally unique identifier for this Description.
ordinality xs:positiveInteger optional 
Specifies the intended order position of this construct instance (e.g. Description) within a set of potentially multiple peer construct instances. If only a single construct instance is present its ordinality can be assumed to be 1. If multiple construct instances are present, the ordinality field should be specified with unique values for each instance.
structuring_format xs:string optional 
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interferring with XML validation of the STIX document. If this attribute is absent, the implication is that no markup is being used.
Source
 
<xs:element name="Short_Description" type="stixCommon:StructuredTextType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Short_Description field provides a short text description of an individual Malware Instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:TTP
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The TTP field characterizes specific details of observed or potential attacker Tactics, Techniques and Procedures.
Diagram
Diagram stix_common_xsd.tmp#TTPBaseType_id stix_common_xsd.tmp#TTPBaseType_idref stix_common_xsd.tmp#TTPBaseType_timestamp stix_common_xsd.tmp#TTPBaseType ttp_xsd.tmp#TTPType_version ttp_xsd.tmp#TTPType_Title ttp_xsd.tmp#TTPType_Description ttp_xsd.tmp#TTPType_Short_Description ttp_xsd.tmp#TTPType_Intended_Effect ttp_xsd.tmp#TTPType_Behavior ttp_xsd.tmp#TTPType_Resources ttp_xsd.tmp#TTPType_Victim_Targeting ttp_xsd.tmp#TTPType_Exploit_Targets ttp_xsd.tmp#TTPType_Related_TTPs ttp_xsd.tmp#TTPType_Kill_Chain_Phases ttp_xsd.tmp#TTPType_Information_Source ttp_xsd.tmp#TTPType_Kill_Chains ttp_xsd.tmp#TTPType_Handling ttp_xsd.tmp#TTPType_Related_Packages ttp_xsd.tmp#TTPType
Type ttp:TTPType
Type hierarchy
Children ttp:Behavior, ttp:Description, ttp:Exploit_Targets, ttp:Handling, ttp:Information_Source, ttp:Intended_Effect, ttp:Kill_Chain_Phases, ttp:Kill_Chains, ttp:Related_Packages, ttp:Related_TTPs, ttp:Resources, ttp:Short_Description, ttp:Title, ttp:Victim_Targeting
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a globally unique identifier for this TTP item.
idref xs:QName optional 
Specifies a globally unique identifier of a TTP item specified elsewhere.
 
When idref is specified, the id attribute must not be specified, and any instance of this TTP item should not hold content.
timestamp xs:dateTime optional 
Specifies a timestamp for the definition of a specific version of a TTP item. When used in conjunction with the id, this field is specifying the definition time for the specific version of the TTP item. When used in conjunction with the idref, this field is specifying a reference to a specific version of a TTP item defined elsewhere. This field has no defined semantic meaning if used in the absence of either the id or idref fields.
version ttp:TTPVersionType optional 
Specifies the relevant STIX-TTP schema version for this content.
Source
 
<xs:element name="TTP" type="ttp:TTPType">
  <xs:annotation>
    <xs:documentation>The TTP field characterizes specific details of observed or potential attacker Tactics, Techniques and Procedures.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:TTPType / ttp:Title
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Title field provides a simple title for this TTP.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Title" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Title field provides a simple title for this TTP.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:TTPType / ttp:Description
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Description field is optional and provides an unstructured, text description of this TTP.
Diagram
Diagram stix_common_xsd.tmp#StructuredTextType_id stix_common_xsd.tmp#StructuredTextType_ordinality stix_common_xsd.tmp#StructuredTextType_structuring_format stix_common_xsd.tmp#StructuredTextType
Type stixCommon:StructuredTextType
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a globally unique identifier for this Description.
ordinality xs:positiveInteger optional 
Specifies the intended order position of this construct instance (e.g. Description) within a set of potentially multiple peer construct instances. If only a single construct instance is present its ordinality can be assumed to be 1. If multiple construct instances are present, the ordinality field should be specified with unique values for each instance.
structuring_format xs:string optional 
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interferring with XML validation of the STIX document. If this attribute is absent, the implication is that no markup is being used.
Source
 
<xs:element name="Description" type="stixCommon:StructuredTextType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Description field is optional and provides an unstructured, text description of this TTP.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:TTPType / ttp:Short_Description
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Short_Description field is optional and provides a short, unstructured, text description of this TTP.
Diagram
Diagram stix_common_xsd.tmp#StructuredTextType_id stix_common_xsd.tmp#StructuredTextType_ordinality stix_common_xsd.tmp#StructuredTextType_structuring_format stix_common_xsd.tmp#StructuredTextType
Type stixCommon:StructuredTextType
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a globally unique identifier for this Description.
ordinality xs:positiveInteger optional 
Specifies the intended order position of this construct instance (e.g. Description) within a set of potentially multiple peer construct instances. If only a single construct instance is present its ordinality can be assumed to be 1. If multiple construct instances are present, the ordinality field should be specified with unique values for each instance.
structuring_format xs:string optional 
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interferring with XML validation of the STIX document. If this attribute is absent, the implication is that no markup is being used.
Source
 
<xs:element name="Short_Description" type="stixCommon:StructuredTextType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Short_Description field is optional and provides a short, unstructured, text description of this TTP.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:TTPType / ttp:Intended_Effect
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Intended_Effect field specifies the suspected intended effect for this TTP.
 
It is implemented through the StatementType, which allows for the expression of a statement in a vocabulary (Value), a description of the statement (Description), a confidence in the statement (Confidence), and the source of the statement (Source). The default vocabulary type for the Value is IntendedEffectVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.
 
Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.
Diagram
Diagram stix_common_xsd.tmp#StatementType_timestamp stix_common_xsd.tmp#StatementType_timestamp_precision stix_common_xsd.tmp#StatementType_Value stix_common_xsd.tmp#StatementType_Description stix_common_xsd.tmp#StatementType_Source stix_common_xsd.tmp#StatementType_Confidence stix_common_xsd.tmp#StatementType
Type stixCommon:StatementType
Children stixCommon:Confidence, stixCommon:Description, stixCommon:Source, stixCommon:Value
Attributes
QName Type Default Use Annotation
timestamp xs:dateTime optional 
Specifies the time this statement was asserted.
 
In order to avoid ambiguity, it is strongly suggest that all timestamps include a specification of the timezone if it is known.
timestamp_precision stixCommon:DateTimePrecisionEnum second optional 
Represents the precision of the associated timestamp value. If omitted, the default is "second", meaning the timestamp is precise to the full field value. Digits in the timestamp that are required by the xs:dateTime datatype but are beyond the specified precision should be zeroed out.
Source
 
<xs:element name="Intended_Effect" type="stixCommon:StatementType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Intended_Effect field specifies the suspected intended effect for this TTP.</xs:documentation>
    <xs:documentation>It is implemented through the StatementType, which allows for the expression of a statement in a vocabulary (Value), a description of the statement (Description), a confidence in the statement (Confidence), and the source of the statement (Source). The default vocabulary type for the Value is IntendedEffectVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.</xs:documentation>
    <xs:documentation>Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:TTPType / ttp:Behavior
Namespace http://stix.mitre.org/TTP-1
Annotations
 
Behavior describes the attack patterns, malware, or exploits that the attacker leverages to execute this TTP.
Diagram
Diagram ttp_xsd.tmp#http___stix.mitre.org_TTP-1_BehaviorType_Attack_Patterns ttp_xsd.tmp#http___stix.mitre.org_TTP-1_BehaviorType_Malware ttp_xsd.tmp#http___stix.mitre.org_TTP-1_BehaviorType_Exploits ttp_xsd.tmp#http___stix.mitre.org_TTP-1_BehaviorType
Type ttp:BehaviorType
Children ttp:Attack_Patterns, ttp:Exploits, ttp:Malware
Source
 
<xs:element name="Behavior" type="ttp:BehaviorType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>Behavior describes the attack patterns, malware, or exploits that the attacker leverages to execute this TTP.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:BehaviorType / ttp:Attack_Patterns
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Attack_Patterns field specifies one or more Attack Patterns for this TTP item.
Diagram
Diagram ttp_xsd.tmp#AttackPatternsType_Attack_Pattern ttp_xsd.tmp#AttackPatternsType
Type ttp:AttackPatternsType
Children ttp:Attack_Pattern
Source
 
<xs:element name="Attack_Patterns" type="ttp:AttackPatternsType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Attack_Patterns field specifies one or more Attack Patterns for this TTP item.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:AttackPatternsType / ttp:Attack_Pattern
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Attack_Pattern field specifies a single Attack Pattern for this TTP item.
Diagram
Diagram ttp_xsd.tmp#AttackPatternType_id ttp_xsd.tmp#AttackPatternType_idref ttp_xsd.tmp#AttackPatternType_capec_id ttp_xsd.tmp#AttackPatternType_Title ttp_xsd.tmp#AttackPatternType_Description ttp_xsd.tmp#AttackPatternType_Short_Description ttp_xsd.tmp#AttackPatternType
Type ttp:AttackPatternType
Children ttp:Description, ttp:Short_Description, ttp:Title
Attributes
QName Type Use Annotation
capec_id restriction of xs:string optional 
This field specifies a reference to a particular entry within the Common Attack Pattern Enumeration and Classification (CAPEC)
id xs:QName optional 
Specifies a unique ID for this Attack Pattern.
idref xs:QName optional 
Specifies a reference to the ID for this Attack Pattern specified elsewhere.
Source
 
<xs:element name="Attack_Pattern" type="ttp:AttackPatternType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Attack_Pattern field specifies a single Attack Pattern for this TTP item.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:AttackPatternType / ttp:Title
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Title field provides a simple title for an individual Attack Pattern.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Title" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Title field provides a simple title for an individual Attack Pattern.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:AttackPatternType / ttp:Description
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Description field is optional and provides an unstructured, text description of an individual Attack Pattern.
Diagram
Diagram stix_common_xsd.tmp#StructuredTextType_id stix_common_xsd.tmp#StructuredTextType_ordinality stix_common_xsd.tmp#StructuredTextType_structuring_format stix_common_xsd.tmp#StructuredTextType
Type stixCommon:StructuredTextType
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a globally unique identifier for this Description.
ordinality xs:positiveInteger optional 
Specifies the intended order position of this construct instance (e.g. Description) within a set of potentially multiple peer construct instances. If only a single construct instance is present its ordinality can be assumed to be 1. If multiple construct instances are present, the ordinality field should be specified with unique values for each instance.
structuring_format xs:string optional 
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interferring with XML validation of the STIX document. If this attribute is absent, the implication is that no markup is being used.
Source
 
<xs:element name="Description" type="stixCommon:StructuredTextType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Description field is optional and provides an unstructured, text description of an individual Attack Pattern.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:AttackPatternType / ttp:Short_Description
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Short_Description field is optional and provides a short, unstructured, text description of an individual Attack Pattern.
Diagram
Diagram stix_common_xsd.tmp#StructuredTextType_id stix_common_xsd.tmp#StructuredTextType_ordinality stix_common_xsd.tmp#StructuredTextType_structuring_format stix_common_xsd.tmp#StructuredTextType
Type stixCommon:StructuredTextType
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a globally unique identifier for this Description.
ordinality xs:positiveInteger optional 
Specifies the intended order position of this construct instance (e.g. Description) within a set of potentially multiple peer construct instances. If only a single construct instance is present its ordinality can be assumed to be 1. If multiple construct instances are present, the ordinality field should be specified with unique values for each instance.
structuring_format xs:string optional 
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interferring with XML validation of the STIX document. If this attribute is absent, the implication is that no markup is being used.
Source
 
<xs:element name="Short_Description" type="stixCommon:StructuredTextType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Short_Description field is optional and provides a short, unstructured, text description of an individual Attack Pattern.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:BehaviorType / ttp:Malware
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Malware field specifies one or more instances of Malware for this TTP item.
Diagram
Diagram ttp_xsd.tmp#MalwareType_Malware_Instance ttp_xsd.tmp#MalwareType
Type ttp:MalwareType
Children ttp:Malware_Instance
Source
 
<xs:element name="Malware" type="ttp:MalwareType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Malware field specifies one or more instances of Malware for this TTP item.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:MalwareType / ttp:Malware_Instance
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Malware_Instance field specifies a single instance of Malware for this TTP item.
Diagram
Diagram ttp_xsd.tmp#MalwareInstanceType_id ttp_xsd.tmp#MalwareInstanceType_idref ttp_xsd.tmp#MalwareInstanceType_Type ttp_xsd.tmp#MalwareInstanceType_Name ttp_xsd.tmp#MalwareInstanceType_Title ttp_xsd.tmp#MalwareInstanceType_Description ttp_xsd.tmp#MalwareInstanceType_Short_Description ttp_xsd.tmp#MalwareInstanceType
Type ttp:MalwareInstanceType
Children ttp:Description, ttp:Name, ttp:Short_Description, ttp:Title, ttp:Type
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a unique ID for this Malware Instance.
idref xs:QName optional 
Specifies a reference to the ID for this Malware Instance specified elsewhere.
Source
 
<xs:element name="Malware_Instance" type="ttp:MalwareInstanceType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Malware_Instance field specifies a single instance of Malware for this TTP item.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:BehaviorType / ttp:Exploits
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Exploits field specifies one or more Exploits for this TTP item.
Diagram
Diagram ttp_xsd.tmp#ExploitsType_Exploit ttp_xsd.tmp#ExploitsType
Type ttp:ExploitsType
Children ttp:Exploit
Source
 
<xs:element name="Exploits" type="ttp:ExploitsType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Exploits field specifies one or more Exploits for this TTP item.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:ExploitsType / ttp:Exploit
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Exploit field specifies a single Exploit for this TTP item.
Diagram
Diagram ttp_xsd.tmp#http___stix.mitre.org_TTP-1_ExploitType_id ttp_xsd.tmp#http___stix.mitre.org_TTP-1_ExploitType_idref ttp_xsd.tmp#http___stix.mitre.org_TTP-1_ExploitType_Title ttp_xsd.tmp#http___stix.mitre.org_TTP-1_ExploitType_Description ttp_xsd.tmp#http___stix.mitre.org_TTP-1_ExploitType_Short_Description ttp_xsd.tmp#http___stix.mitre.org_TTP-1_ExploitType
Type ttp:ExploitType
Children ttp:Description, ttp:Short_Description, ttp:Title
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a unique ID for this Exploit Instance.
idref xs:QName optional 
Specifies a reference to the ID for this Exploit Instance specified elsewhere.
Source
 
<xs:element name="Exploit" type="ttp:ExploitType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Exploit field specifies a single Exploit for this TTP item.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:ExploitType / ttp:Title
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Title field provides a simple title for an individual Exploit instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Title" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Title field provides a simple title for an individual Exploit instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:ExploitType / ttp:Description
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Description field is optional and provides an unstructured, text description of an individual Exploit Instance.
Diagram
Diagram stix_common_xsd.tmp#StructuredTextType_id stix_common_xsd.tmp#StructuredTextType_ordinality stix_common_xsd.tmp#StructuredTextType_structuring_format stix_common_xsd.tmp#StructuredTextType
Type stixCommon:StructuredTextType
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a globally unique identifier for this Description.
ordinality xs:positiveInteger optional 
Specifies the intended order position of this construct instance (e.g. Description) within a set of potentially multiple peer construct instances. If only a single construct instance is present its ordinality can be assumed to be 1. If multiple construct instances are present, the ordinality field should be specified with unique values for each instance.
structuring_format xs:string optional 
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interferring with XML validation of the STIX document. If this attribute is absent, the implication is that no markup is being used.
Source
 
<xs:element name="Description" type="stixCommon:StructuredTextType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Description field is optional and provides an unstructured, text description of an individual Exploit Instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:ExploitType / ttp:Short_Description
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Short_Description field is optional and provides a short, unstructured, text description of an individual Exploit Instance.
Diagram
Diagram stix_common_xsd.tmp#StructuredTextType_id stix_common_xsd.tmp#StructuredTextType_ordinality stix_common_xsd.tmp#StructuredTextType_structuring_format stix_common_xsd.tmp#StructuredTextType
Type stixCommon:StructuredTextType
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a globally unique identifier for this Description.
ordinality xs:positiveInteger optional 
Specifies the intended order position of this construct instance (e.g. Description) within a set of potentially multiple peer construct instances. If only a single construct instance is present its ordinality can be assumed to be 1. If multiple construct instances are present, the ordinality field should be specified with unique values for each instance.
structuring_format xs:string optional 
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interferring with XML validation of the STIX document. If this attribute is absent, the implication is that no markup is being used.
Source
 
<xs:element name="Short_Description" type="stixCommon:StructuredTextType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Short_Description field is optional and provides a short, unstructured, text description of an individual Exploit Instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:TTPType / ttp:Resources
Namespace http://stix.mitre.org/TTP-1
Annotations
 
Resources describe the infrastructure or tools that the adversary uses to execute this TTP.
Diagram
Diagram ttp_xsd.tmp#ResourceType_Tools ttp_xsd.tmp#ResourceType_Infrastructure ttp_xsd.tmp#ResourceType_Personas ttp_xsd.tmp#ResourceType
Type ttp:ResourceType
Children ttp:Infrastructure, ttp:Personas, ttp:Tools
Source
 
<xs:element name="Resources" type="ttp:ResourceType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>Resources describe the infrastructure or tools that the adversary uses to execute this TTP.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:ResourceType / ttp:Tools
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Tools field specifies one or more Tools leveraged by this TTP item.
Diagram
Diagram ttp_xsd.tmp#ToolsType_Tool ttp_xsd.tmp#ToolsType
Type ttp:ToolsType
Children ttp:Tool
Source
 
<xs:element name="Tools" type="ttp:ToolsType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Tools field specifies one or more Tools leveraged by this TTP item.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:ToolsType / ttp:Tool
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Tool field specifies a single Tool leveraged by this TTP item.
 
The Type field under this field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is AttackerToolTypeVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.
 
Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.
Diagram
Diagram cybox_common_xsd.tmp#ToolInformationType_id cybox_common_xsd.tmp#ToolInformationType_idref cybox_common_xsd.tmp#ToolInformationType_Name cybox_common_xsd.tmp#ToolInformationType_Type cybox_common_xsd.tmp#ToolInformationType_Description cybox_common_xsd.tmp#ToolInformationType_References cybox_common_xsd.tmp#ToolInformationType_Vendor cybox_common_xsd.tmp#ToolInformationType_Version cybox_common_xsd.tmp#ToolInformationType_Service_Pack cybox_common_xsd.tmp#ToolInformationType_Tool_Specific_Data cybox_common_xsd.tmp#ToolInformationType_Tool_Hashes cybox_common_xsd.tmp#ToolInformationType_Tool_Configuration cybox_common_xsd.tmp#ToolInformationType_Execution_Environment cybox_common_xsd.tmp#ToolInformationType_Errors cybox_common_xsd.tmp#ToolInformationType_Metadata cybox_common_xsd.tmp#ToolInformationType_Compensation_Model cybox_common_xsd.tmp#ToolInformationType stix_common_xsd.tmp#http___stix.mitre.org_common-1_ToolInformationType_Title stix_common_xsd.tmp#http___stix.mitre.org_common-1_ToolInformationType_Short_Description stix_common_xsd.tmp#http___stix.mitre.org_common-1_ToolInformationType
Type stixCommon:ToolInformationType
Type hierarchy
Children cyboxCommon:Compensation_Model, cyboxCommon:Description, cyboxCommon:Errors, cyboxCommon:Execution_Environment, cyboxCommon:Metadata, cyboxCommon:Name, cyboxCommon:References, cyboxCommon:Service_Pack, cyboxCommon:Tool_Configuration, cyboxCommon:Tool_Hashes, cyboxCommon:Tool_Specific_Data, cyboxCommon:Type, cyboxCommon:Vendor, cyboxCommon:Version, stixCommon:Short_Description, stixCommon:Title
Attributes
QName Type Use Annotation
id xs:QName optional 
The id field specifies a unique ID for this Tool.
idref xs:QName optional 
The idref field specifies reference to a unique ID for this Tool.
 
When idref is specified, the id attribute must not be specified, and any instance of this type should not hold content unless an extension of the type allows it.
Source
 
<xs:element name="Tool" type="stixCommon:ToolInformationType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Tool field specifies a single Tool leveraged by this TTP item.</xs:documentation>
    <xs:documentation>The Type field under this field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is AttackerToolTypeVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.</xs:documentation>
    <xs:documentation>Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:ResourceType / ttp:Infrastructure
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Infrastructure field characterizes specific classes or instances of infrastructure observed to have been utilized for cyber attack.
Diagram
Diagram ttp_xsd.tmp#InfrastructureType_id ttp_xsd.tmp#InfrastructureType_idref ttp_xsd.tmp#InfrastructureType_Title ttp_xsd.tmp#InfrastructureType_Type ttp_xsd.tmp#InfrastructureType_Description ttp_xsd.tmp#InfrastructureType_Short_Description ttp_xsd.tmp#InfrastructureType_Observable_Characterization ttp_xsd.tmp#InfrastructureType
Type ttp:InfrastructureType
Children ttp:Description, ttp:Observable_Characterization, ttp:Short_Description, ttp:Title, ttp:Type
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a unique ID for this class or instance of Infrastructure.
idref xs:QName optional 
Specifies a reference to the ID for this class or instance of Infrastructure specified elsewhere.
Source
 
<xs:element name="Infrastructure" type="ttp:InfrastructureType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Infrastructure field characterizes specific classes or instances of infrastructure observed to have been utilized for cyber attack.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:InfrastructureType / ttp:Title
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Title field provides a simple title for a class or instance of Infrastructure utilized for cyber attack.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Title" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Title field provides a simple title for a class or instance of Infrastructure utilized for cyber attack.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:InfrastructureType / ttp:Type
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Type field represents the type of infrastructure being described.
 
This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is AttackerInfrastructureTypeVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.
 
Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.
Diagram
Diagram stix_common_xsd.tmp#ControlledVocabularyStringType_vocab_name stix_common_xsd.tmp#ControlledVocabularyStringType_vocab_reference stix_common_xsd.tmp#ControlledVocabularyStringType
Type stixCommon:ControlledVocabularyStringType
Attributes
QName Type Use Annotation
vocab_name xs:string optional 
The vocab_name field specifies the name of the controlled vocabulary.
vocab_reference xs:anyURI optional 
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
 
<xs:element name="Type" type="stixCommon:ControlledVocabularyStringType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Type field represents the type of infrastructure being described.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is AttackerInfrastructureTypeVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.</xs:documentation>
    <xs:documentation>Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:InfrastructureType / ttp:Description
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Description field is optional and provides an unstructured, text description of specific classes or instances of infrastructure utilized for cyber attack.
Diagram
Diagram stix_common_xsd.tmp#StructuredTextType_id stix_common_xsd.tmp#StructuredTextType_ordinality stix_common_xsd.tmp#StructuredTextType_structuring_format stix_common_xsd.tmp#StructuredTextType
Type stixCommon:StructuredTextType
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a globally unique identifier for this Description.
ordinality xs:positiveInteger optional 
Specifies the intended order position of this construct instance (e.g. Description) within a set of potentially multiple peer construct instances. If only a single construct instance is present its ordinality can be assumed to be 1. If multiple construct instances are present, the ordinality field should be specified with unique values for each instance.
structuring_format xs:string optional 
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interferring with XML validation of the STIX document. If this attribute is absent, the implication is that no markup is being used.
Source
 
<xs:element name="Description" type="stixCommon:StructuredTextType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Description field is optional and provides an unstructured, text description of specific classes or instances of infrastructure utilized for cyber attack.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:InfrastructureType / ttp:Short_Description
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Short_Description field is optional and provides a short, unstructured, text description of specific classes or instances of infrastructure utilized for cyber attack.
Diagram
Diagram stix_common_xsd.tmp#StructuredTextType_id stix_common_xsd.tmp#StructuredTextType_ordinality stix_common_xsd.tmp#StructuredTextType_structuring_format stix_common_xsd.tmp#StructuredTextType
Type stixCommon:StructuredTextType
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a globally unique identifier for this Description.
ordinality xs:positiveInteger optional 
Specifies the intended order position of this construct instance (e.g. Description) within a set of potentially multiple peer construct instances. If only a single construct instance is present its ordinality can be assumed to be 1. If multiple construct instances are present, the ordinality field should be specified with unique values for each instance.
structuring_format xs:string optional 
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interferring with XML validation of the STIX document. If this attribute is absent, the implication is that no markup is being used.
Source
 
<xs:element name="Short_Description" type="stixCommon:StructuredTextType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Short_Description field is optional and provides a short, unstructured, text description of specific classes or instances of infrastructure utilized for cyber attack.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:InfrastructureType / ttp:Observable_Characterization
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Observable_Characterization field provides structured characterization of the cyber observables detailing specific classes or instances of infrastructure utilized for cyber attack.
Diagram
Diagram cybox_core_xsd.tmp#ObservablesType_cybox_major_version cybox_core_xsd.tmp#ObservablesType_cybox_minor_version cybox_core_xsd.tmp#ObservablesType_cybox_update_version cybox_core_xsd.tmp#ObservablesType_Observable_Package_Source cybox_core_xsd.tmp#Observable cybox_core_xsd.tmp#ObservablesType_Pools cybox_core_xsd.tmp#ObservablesType
Type cybox:ObservablesType
Children cybox:Observable, cybox:Observable_Package_Source, cybox:Pools
Attributes
QName Type Use Annotation
cybox_major_version xs:string required 
The cybox_major_version field specifies the major version of the CybOX language utilized for this set of Observables.
cybox_minor_version xs:string required 
The cybox_minor_version field specifies the minor version of the CybOX language utilized for this set of Observables.
cybox_update_version xs:string optional 
The cybox_update_version field specifies the update version of the CybOX language utilized for this set of Observables. This field MUST be used when using an update version of CybOX.
Source
 
<xs:element name="Observable_Characterization" type="cybox:ObservablesType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Observable_Characterization field provides structured characterization of the cyber observables detailing specific classes or instances of infrastructure utilized for cyber attack.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:ResourceType / ttp:Personas
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Personas field characterizes specific classes or instances of personas (identities) leveraged by a threat to masquerade as other parties.
Diagram
Diagram ttp_xsd.tmp#PersonasType_Persona ttp_xsd.tmp#PersonasType
Type ttp:PersonasType
Children ttp:Persona
Source
 
<xs:element name="Personas" type="ttp:PersonasType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Personas field characterizes specific classes or instances of personas (identities) leveraged by a threat to masquerade as other parties.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:PersonasType / ttp:Persona
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The persona field characterizes a single persona (identity) leveraged by a threat to masquerade as another party.
Diagram
Diagram stix_common_xsd.tmp#IdentityType_id stix_common_xsd.tmp#IdentityType_idref stix_common_xsd.tmp#IdentityType_Name stix_common_xsd.tmp#IdentityType_Related_Identities stix_common_xsd.tmp#IdentityType
Type stixCommon:IdentityType
Children stixCommon:Name, stixCommon:Related_Identities
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a unique ID for this Identity.
idref xs:QName optional 
Specifies a reference to a unique ID defined elsewhere.
 
When idref is specified, the id attribute must not be specified, and any instance of this Identity should not hold content.
Source
 
<xs:element name="Persona" type="stixCommon:IdentityType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The persona field characterizes a single persona (identity) leveraged by a threat to masquerade as another party.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:TTPType / ttp:Victim_Targeting
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Victim_Targeting field characterizes the people, organizations, information or access being targeted.
Diagram
Diagram ttp_xsd.tmp#VictimTargetingType_Identity ttp_xsd.tmp#VictimTargetingType_Targeted_Systems ttp_xsd.tmp#VictimTargetingType_Targeted_Information ttp_xsd.tmp#VictimTargetingType_Targeted_Technical_Details ttp_xsd.tmp#VictimTargetingType
Type ttp:VictimTargetingType
Children ttp:Identity, ttp:Targeted_Information, ttp:Targeted_Systems, ttp:Targeted_Technical_Details
Source
 
<xs:element name="Victim_Targeting" type="ttp:VictimTargetingType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Victim_Targeting field characterizes the people, organizations, information or access being targeted.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:VictimTargetingType / ttp:Identity
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Identity field characterizes information about the identity or characteristics of the targeted people or organizations.
 
This field is implemented through the xsi:type extension mechanism. The default type is CIQIdentity3.0InstanceType in the http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1 namespace. This type is defined in the extensions/identity/ciq_identity_3.0.xsd file or at the URL http://stix.mitre.org/XMLSchema/extensions/identity/ciq_identity_3.0/1.1/ciq_identity_3.0.xsd.
Diagram
Diagram stix_common_xsd.tmp#IdentityType_id stix_common_xsd.tmp#IdentityType_idref stix_common_xsd.tmp#IdentityType_Name stix_common_xsd.tmp#IdentityType_Related_Identities stix_common_xsd.tmp#IdentityType
Type stixCommon:IdentityType
Children stixCommon:Name, stixCommon:Related_Identities
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a unique ID for this Identity.
idref xs:QName optional 
Specifies a reference to a unique ID defined elsewhere.
 
When idref is specified, the id attribute must not be specified, and any instance of this Identity should not hold content.
Source
 
<xs:element name="Identity" type="stixCommon:IdentityType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Identity field characterizes information about the identity or characteristics of the targeted people or organizations.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type extension mechanism. The default type is CIQIdentity3.0InstanceType in the http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1 namespace. This type is defined in the extensions/identity/ciq_identity_3.0.xsd file or at the URL http://stix.mitre.org/XMLSchema/extensions/identity/ciq_identity_3.0/1.1/ciq_identity_3.0.xsd.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:VictimTargetingType / ttp:Targeted_Systems
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Targeted_Systems field characterizes a type of system that is targeted. It may be included multiple times to specify multiple types of targeted systems.
 
This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is SystemTypeVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.
 
Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.
Diagram
Diagram stix_common_xsd.tmp#ControlledVocabularyStringType_vocab_name stix_common_xsd.tmp#ControlledVocabularyStringType_vocab_reference stix_common_xsd.tmp#ControlledVocabularyStringType
Type stixCommon:ControlledVocabularyStringType
Attributes
QName Type Use Annotation
vocab_name xs:string optional 
The vocab_name field specifies the name of the controlled vocabulary.
vocab_reference xs:anyURI optional 
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
 
<xs:element name="Targeted_Systems" type="stixCommon:ControlledVocabularyStringType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Targeted_Systems field characterizes a type of system that is targeted. It may be included multiple times to specify multiple types of targeted systems.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is SystemTypeVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.</xs:documentation>
    <xs:documentation>Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:VictimTargetingType / ttp:Targeted_Information
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Targeted_Systems field characterizes a type of information that is targeted. It may be included multiple times to specify multiple types of targeted information.
 
This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is InformationTypeVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.
 
Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.
Diagram
Diagram stix_common_xsd.tmp#ControlledVocabularyStringType_vocab_name stix_common_xsd.tmp#ControlledVocabularyStringType_vocab_reference stix_common_xsd.tmp#ControlledVocabularyStringType
Type stixCommon:ControlledVocabularyStringType
Attributes
QName Type Use Annotation
vocab_name xs:string optional 
The vocab_name field specifies the name of the controlled vocabulary.
vocab_reference xs:anyURI optional 
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
 
<xs:element name="Targeted_Information" type="stixCommon:ControlledVocabularyStringType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Targeted_Systems field characterizes a type of information that is targeted. It may be included multiple times to specify multiple types of targeted information.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is InformationTypeVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.</xs:documentation>
    <xs:documentation>Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:VictimTargetingType / ttp:Targeted_Technical_Details
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Targeted_Technical_Details field characterizes the technical information about what is targeted. It is implemented using the CybOX observables type, which allows for the representation of products, platforms, and code that are targeted.
Diagram
Diagram cybox_core_xsd.tmp#ObservablesType_cybox_major_version cybox_core_xsd.tmp#ObservablesType_cybox_minor_version cybox_core_xsd.tmp#ObservablesType_cybox_update_version cybox_core_xsd.tmp#ObservablesType_Observable_Package_Source cybox_core_xsd.tmp#Observable cybox_core_xsd.tmp#ObservablesType_Pools cybox_core_xsd.tmp#ObservablesType
Type cybox:ObservablesType
Children cybox:Observable, cybox:Observable_Package_Source, cybox:Pools
Attributes
QName Type Use Annotation
cybox_major_version xs:string required 
The cybox_major_version field specifies the major version of the CybOX language utilized for this set of Observables.
cybox_minor_version xs:string required 
The cybox_minor_version field specifies the minor version of the CybOX language utilized for this set of Observables.
cybox_update_version xs:string optional 
The cybox_update_version field specifies the update version of the CybOX language utilized for this set of Observables. This field MUST be used when using an update version of CybOX.
Source
 
<xs:element name="Targeted_Technical_Details" type="cybox:ObservablesType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Targeted_Technical_Details field characterizes the technical information about what is targeted. It is implemented using the CybOX observables type, which allows for the representation of products, platforms, and code that are targeted.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:TTPType / ttp:Exploit_Targets
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Exploit_Targets field characterizes potential vulnerability, weakness or configuration targets for exploitation by this TTP.
Diagram
Diagram stix_common_xsd.tmp#GenericRelationshipListType_scope stix_common_xsd.tmp#GenericRelationshipListType ttp_xsd.tmp#ExploitTargetsType_Exploit_Target ttp_xsd.tmp#ExploitTargetsType
Type ttp:ExploitTargetsType
Type hierarchy
Children ttp:Exploit_Target
Attributes
QName Type Default Use Annotation
scope stixCommon:RelationshipScopeEnum exclusive optional 
Indicates how multiple related items should be interpreted in this relationship. If "inclusive" is specified, then a single conceptual relationship is being defined between the subject and the collection of objects indicated by the related items (i.e. the relationship is not necessarily relevant for any one particular object being referenced, but for the aggregated collection of objects referenced). If "exclusive" is specified, then multiple relationships are being defined between the specific subject and each object individually.
Source
 
<xs:element name="Exploit_Targets" type="ttp:ExploitTargetsType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Exploit_Targets field characterizes potential vulnerability, weakness or configuration targets for exploitation by this TTP.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:ExploitTargetsType / ttp:Exploit_Target
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Exploit_Target field characterizes potential vulnerability, weakness or configuration targets for exploitation by this TTP.
Diagram
Diagram stix_common_xsd.tmp#GenericRelationshipType_Confidence stix_common_xsd.tmp#GenericRelationshipType_Information_Source stix_common_xsd.tmp#GenericRelationshipType_Relationship stix_common_xsd.tmp#GenericRelationshipType stix_common_xsd.tmp#RelatedExploitTargetType_Exploit_Target stix_common_xsd.tmp#RelatedExploitTargetType
Type stixCommon:RelatedExploitTargetType
Type hierarchy
Children stixCommon:Confidence, stixCommon:Exploit_Target, stixCommon:Information_Source, stixCommon:Relationship
Source
 
<xs:element name="Exploit_Target" type="stixCommon:RelatedExploitTargetType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Exploit_Target field characterizes potential vulnerability, weakness or configuration targets for exploitation by this TTP.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:TTPType / ttp:Related_TTPs
Namespace http://stix.mitre.org/TTP-1
Annotations
Diagram
Type ttp:RelatedTTPsType
Type hierarchy
Children ttp:Related_TTP
Attributes
Source
Element ttp:RelatedTTPsType / ttp:Related_TTP
Namespace http://stix.mitre.org/TTP-1
Annotations
Diagram
Type stixCommon:RelatedTTPType
Type hierarchy
Children stixCommon:Confidence, stixCommon:Information_Source, stixCommon:Relationship, stixCommon:TTP
Source
Element ttp:TTPType / ttp:Kill_Chain_Phases
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Kill_Chain_Phases field specifies one or more Kill Chain phases associated with this TTP item.
Diagram
Diagram stix_common_xsd.tmp#KillChainPhasesReferenceType_Kill_Chain_Phase stix_common_xsd.tmp#KillChainPhasesReferenceType
Type stixCommon:KillChainPhasesReferenceType
Children stixCommon:Kill_Chain_Phase
Source
 
<xs:element name="Kill_Chain_Phases" type="stixCommon:KillChainPhasesReferenceType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Kill_Chain_Phases field specifies one or more Kill Chain phases associated with this TTP item.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:TTPType / ttp:Information_Source
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Information_Source field details the source of this entry.
Diagram
Diagram stix_common_xsd.tmp#InformationSourceType_Description stix_common_xsd.tmp#InformationSourceType_Identity stix_common_xsd.tmp#InformationSourceType_Role stix_common_xsd.tmp#InformationSourceType_Contributing_Sources stix_common_xsd.tmp#InformationSourceType_Time stix_common_xsd.tmp#InformationSourceType_Tools stix_common_xsd.tmp#InformationSourceType_References stix_common_xsd.tmp#InformationSourceType
Type stixCommon:InformationSourceType
Children stixCommon:Contributing_Sources, stixCommon:Description, stixCommon:Identity, stixCommon:References, stixCommon:Role, stixCommon:Time, stixCommon:Tools
Source
 
<xs:element name="Information_Source" type="stixCommon:InformationSourceType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Information_Source field details the source of this entry.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:TTPType / ttp:Kill_Chains
Namespace http://stix.mitre.org/TTP-1
Annotations
 
The Kill_Chains field characterizes specific Kill Chain definitions for reference within specific TTP entries, Indicators and elsewhere.
Diagram
Diagram stix_common_xsd.tmp#KillChainsType_Kill_Chain stix_common_xsd.tmp#KillChainsType
Type stixCommon:KillChainsType
Children stixCommon:Kill_Chain
Source
 
<xs:element name="Kill_Chains" type="stixCommon:KillChainsType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Kill_Chains field characterizes specific Kill Chain definitions for reference within specific TTP entries, Indicators and elsewhere.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:TTPType / ttp:Handling
Namespace http://stix.mitre.org/TTP-1
Annotations
 
Specifies the relevant handling guidance for this TTP. The valid marking scope is the nearest TTPBaseType ancestor of this Handling element and all its descendants.
Diagram
Diagram data_marking_xsd.tmp#MarkingType_Marking data_marking_xsd.tmp#MarkingType
Type marking:MarkingType
Children marking:Marking
Source
 
<xs:element name="Handling" type="marking:MarkingType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>Specifies the relevant handling guidance for this TTP. The valid marking scope is the nearest TTPBaseType ancestor of this Handling element and all its descendants.</xs:documentation>
  </xs:annotation>
</xs:element>
Element ttp:TTPType / ttp:Related_Packages
Namespace http://stix.mitre.org/TTP-1
Annotations
Diagram
Type stixCommon:RelatedPackageRefsType
Children stixCommon:Package_Reference
Source
Complex Type ttp:MalwareInstanceType
Namespace http://stix.mitre.org/TTP-1
Annotations
 
Captures basic information about an individual malware instance.
 
In addition to capturing basic information, this type is intended to be extended to enable the structured description of a malware instance using the XML Schema extension feature. The STIX default extension uses the Malware Attribute Enumeration and Classification (MAEC) schema to do so. The extension that defines this is captured in the MAEC4.1InstanceType in the http://stix.mitre.org/extensions/Malware#MAEC4.1-1 namespace. This type is defined in the extensions/malware/maec_4.1_malware.xsd file or at the URL http://stix.mitre.org/XMLSchema/extensions/malware/maec_4.1/1.0/maec_4.1_malware.xsd.
Diagram
Diagram ttp_xsd.tmp#MalwareInstanceType_id ttp_xsd.tmp#MalwareInstanceType_idref ttp_xsd.tmp#MalwareInstanceType_Type ttp_xsd.tmp#MalwareInstanceType_Name ttp_xsd.tmp#MalwareInstanceType_Title ttp_xsd.tmp#MalwareInstanceType_Description ttp_xsd.tmp#MalwareInstanceType_Short_Description
Used by
Children ttp:Description, ttp:Name, ttp:Short_Description, ttp:Title, ttp:Type
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a unique ID for this Malware Instance.
idref xs:QName optional 
Specifies a reference to the ID for this Malware Instance specified elsewhere.
Source
 
<xs:complexType name="MalwareInstanceType">
  <xs:annotation>
    <xs:documentation>Captures basic information about an individual malware instance.</xs:documentation>
    <xs:documentation>In addition to capturing basic information, this type is intended to be extended to enable the structured description of a malware instance using the XML Schema extension feature. The STIX default extension uses the Malware Attribute Enumeration and Classification (MAEC) schema to do so. The extension that defines this is captured in the MAEC4.1InstanceType in the http://stix.mitre.org/extensions/Malware#MAEC4.1-1 namespace. This type is defined in the extensions/malware/maec_4.1_malware.xsd file or at the URL http://stix.mitre.org/XMLSchema/extensions/malware/maec_4.1/1.0/maec_4.1_malware.xsd.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Type" type="stixCommon:ControlledVocabularyStringType" minOccurs="0" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Type field provides a characterization of what type of malware this MalwareInstance is.</xs:documentation>
        <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is MalwareTypeVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.</xs:documentation>
        <xs:documentation>Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Name" type="stixCommon:ControlledVocabularyStringType" minOccurs="0" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Name field specifies a name associated with this MalwareInstance.</xs:documentation>
        <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. No default vocabulary type has been defined for STIX 1.2. Users may either define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a free string field.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Title" type="xs:string" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Title field is optional and provides an unstructured, text description of an individual Malware Instance.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Description" type="stixCommon:StructuredTextType" minOccurs="0" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Description field provides an text description of an individual Malware Instance.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Short_Description" type="stixCommon:StructuredTextType" minOccurs="0" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Short_Description field provides a short text description of an individual Malware Instance.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
  <xs:attribute name="id" type="xs:QName">
    <xs:annotation>
      <xs:documentation>Specifies a unique ID for this Malware Instance.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="idref" type="xs:QName">
    <xs:annotation>
      <xs:documentation>Specifies a reference to the ID for this Malware Instance specified elsewhere.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
</xs:complexType>
Complex Type ttp:TTPType
Namespace http://stix.mitre.org/TTP-1
Annotations
 
Represents a single STIX TTP.
 
TTPs are representations of the behavior or modus operandi of cyber adversaries. It is a term taken from the traditional military sphere and is used to characterize what an adversary does and how they do it in increasing levels of detail. For instance, to give a simple example, a tactic may be to use malware to steal credit card credentials. A related technique (at a lower level of detail) may be to send targeted emails to potential victims, which have documents attached containing malicious code which executes upon opening, captures credit card information from keystrokes, and uses http to communicate with a command and control server to transfer information. A related procedure (at a lower level of detail) may be to perform open source research to identify potentially gullible individuals, craft a convincing socially engineered email and document, create malware/exploit that will bypass current antivirus detection, establish a command and control server by registering a domain called mychasebank.org, and send mail to victims from a Gmail account called accounts-mychasebank@gmail.com.
 
TTPs consist of the specific adversary behavior (attack patterns, malware, exploits) exhibited, resources leveraged (tools, infrastructure, personas), information on the victims targeted (who, what or where), relevant ExploitTargets being targeted, intended effects, relevant kill chain phases, handling guidance, source of the TTP information, etc.
 
TTPs play a central role in cyber threat information and cyber threat intelligence. They are relevant for Indicators, Incidents, Campaigns, and ThreatActors. In addition, they hold a close relationship with ExploitTargets that characterize the specific targets that the TTPs seek to exploit.
Diagram
Diagram stix_common_xsd.tmp#TTPBaseType_id stix_common_xsd.tmp#TTPBaseType_idref stix_common_xsd.tmp#TTPBaseType_timestamp stix_common_xsd.tmp#TTPBaseType ttp_xsd.tmp#TTPType_version ttp_xsd.tmp#TTPType_Title ttp_xsd.tmp#TTPType_Description ttp_xsd.tmp#TTPType_Short_Description ttp_xsd.tmp#TTPType_Intended_Effect ttp_xsd.tmp#TTPType_Behavior ttp_xsd.tmp#TTPType_Resources ttp_xsd.tmp#TTPType_Victim_Targeting ttp_xsd.tmp#TTPType_Exploit_Targets ttp_xsd.tmp#TTPType_Related_TTPs ttp_xsd.tmp#TTPType_Kill_Chain_Phases ttp_xsd.tmp#TTPType_Information_Source ttp_xsd.tmp#TTPType_Kill_Chains ttp_xsd.tmp#TTPType_Handling ttp_xsd.tmp#TTPType_Related_Packages
Type extension of stixCommon:TTPBaseType
Type hierarchy
Used by
Element ttp:TTP
Children ttp:Behavior, ttp:Description, ttp:Exploit_Targets, ttp:Handling, ttp:Information_Source, ttp:Intended_Effect, ttp:Kill_Chain_Phases, ttp:Kill_Chains, ttp:Related_Packages, ttp:Related_TTPs, ttp:Resources, ttp:Short_Description, ttp:Title, ttp:Victim_Targeting
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a globally unique identifier for this TTP item.
idref xs:QName optional 
Specifies a globally unique identifier of a TTP item specified elsewhere.
 
When idref is specified, the id attribute must not be specified, and any instance of this TTP item should not hold content.
timestamp xs:dateTime optional 
Specifies a timestamp for the definition of a specific version of a TTP item. When used in conjunction with the id, this field is specifying the definition time for the specific version of the TTP item. When used in conjunction with the idref, this field is specifying a reference to a specific version of a TTP item defined elsewhere. This field has no defined semantic meaning if used in the absence of either the id or idref fields.
version ttp:TTPVersionType optional 
Specifies the relevant STIX-TTP schema version for this content.
Source
 
<xs:complexType name="TTPType">
  <xs:annotation>
    <xs:documentation>Represents a single STIX TTP.</xs:documentation>
    <xs:documentation>TTPs are representations of the behavior or modus operandi of cyber adversaries. It is a term taken from the traditional military sphere and is used to characterize what an adversary does and how they do it in increasing levels of detail. For instance, to give a simple example, a tactic may be to use malware to steal credit card credentials. A related technique (at a lower level of detail) may be to send targeted emails to potential victims, which have documents attached containing malicious code which executes upon opening, captures credit card information from keystrokes, and uses http to communicate with a command and control server to transfer information. A related procedure (at a lower level of detail) may be to perform open source research to identify potentially gullible individuals, craft a convincing socially engineered email and document, create malware/exploit that will bypass current antivirus detection, establish a command and control server by registering a domain called mychasebank.org, and send mail to victims from a Gmail account called accounts-mychasebank@gmail.com.</xs:documentation>
    <xs:documentation>TTPs consist of the specific adversary behavior (attack patterns, malware, exploits) exhibited, resources leveraged (tools, infrastructure, personas), information on the victims targeted (who, what or where), relevant ExploitTargets being targeted, intended effects, relevant kill chain phases, handling guidance, source of the TTP information, etc.</xs:documentation>
    <xs:documentation>TTPs play a central role in cyber threat information and cyber threat intelligence. They are relevant for Indicators, Incidents, Campaigns, and ThreatActors. In addition, they hold a close relationship with ExploitTargets that characterize the specific targets that the TTPs seek to exploit.</xs:documentation>
  </xs:annotation>
  <xs:complexContent>
    <xs:extension base="stixCommon:TTPBaseType">
      <xs:sequence>
        <xs:element name="Title" type="xs:string" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Title field provides a simple title for this TTP.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Description" type="stixCommon:StructuredTextType" minOccurs="0" maxOccurs="unbounded">
          <xs:annotation>
            <xs:documentation>The Description field is optional and provides an unstructured, text description of this TTP.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Short_Description" type="stixCommon:StructuredTextType" minOccurs="0" maxOccurs="unbounded">
          <xs:annotation>
            <xs:documentation>The Short_Description field is optional and provides a short, unstructured, text description of this TTP.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Intended_Effect" type="stixCommon:StatementType" minOccurs="0" maxOccurs="unbounded">
          <xs:annotation>
            <xs:documentation>The Intended_Effect field specifies the suspected intended effect for this TTP.</xs:documentation>
            <xs:documentation>It is implemented through the StatementType, which allows for the expression of a statement in a vocabulary (Value), a description of the statement (Description), a confidence in the statement (Confidence), and the source of the statement (Source). The default vocabulary type for the Value is IntendedEffectVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.</xs:documentation>
            <xs:documentation>Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Behavior" type="ttp:BehaviorType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>Behavior describes the attack patterns, malware, or exploits that the attacker leverages to execute this TTP.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Resources" type="ttp:ResourceType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>Resources describe the infrastructure or tools that the adversary uses to execute this TTP.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Victim_Targeting" type="ttp:VictimTargetingType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Victim_Targeting field characterizes the people, organizations, information or access being targeted.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Exploit_Targets" type="ttp:ExploitTargetsType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Exploit_Targets field characterizes potential vulnerability, weakness or configuration targets for exploitation by this TTP.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Related_TTPs" type="ttp:RelatedTTPsType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Related_TTPs field specifies other TTPs asserted to be related to this cyber threat TTP.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Kill_Chain_Phases" type="stixCommon:KillChainPhasesReferenceType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Kill_Chain_Phases field specifies one or more Kill Chain phases associated with this TTP item.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Information_Source" type="stixCommon:InformationSourceType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Information_Source field details the source of this entry.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Kill_Chains" type="stixCommon:KillChainsType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Kill_Chains field characterizes specific Kill Chain definitions for reference within specific TTP entries, Indicators and elsewhere.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Handling" type="marking:MarkingType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>Specifies the relevant handling guidance for this TTP. The valid marking scope is the nearest TTPBaseType ancestor of this Handling element and all its descendants.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Related_Packages" type="stixCommon:RelatedPackageRefsType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Related_Packages field identifies or characterizes relationships to set of related Packages.</xs:documentation>
            <xs:documentation>DEPRECATED: This field is deprecated and will be removed in the next major version of STIX. Its use is strongly discouraged except for legacy applications.</xs:documentation>
            <xs:appinfo>
              <deprecated>true</deprecated>
            </xs:appinfo>
          </xs:annotation>
        </xs:element>
      </xs:sequence>
      <xs:attribute name="version" type="ttp:TTPVersionType">
        <xs:annotation>
          <xs:documentation>Specifies the relevant STIX-TTP schema version for this content.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:extension>
  </xs:complexContent>
</xs:complexType>
Complex Type ttp:BehaviorType
Namespace http://stix.mitre.org/TTP-1
Diagram
Diagram ttp_xsd.tmp#http___stix.mitre.org_TTP-1_BehaviorType_Attack_Patterns ttp_xsd.tmp#http___stix.mitre.org_TTP-1_BehaviorType_Malware ttp_xsd.tmp#http___stix.mitre.org_TTP-1_BehaviorType_Exploits
Used by
Element ttp:TTPType/ttp:Behavior
Children ttp:Attack_Patterns, ttp:Exploits, ttp:Malware
Source
 
<xs:complexType name="BehaviorType">
  <xs:sequence>
    <xs:element name="Attack_Patterns" type="ttp:AttackPatternsType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Attack_Patterns field specifies one or more Attack Patterns for this TTP item.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Malware" type="ttp:MalwareType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Malware field specifies one or more instances of Malware for this TTP item.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Exploits" type="ttp:ExploitsType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Exploits field specifies one or more Exploits for this TTP item.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type ttp:AttackPatternsType
Namespace http://stix.mitre.org/TTP-1
Diagram
Diagram ttp_xsd.tmp#AttackPatternsType_Attack_Pattern
Used by
Children ttp:Attack_Pattern
Source
 
<xs:complexType name="AttackPatternsType">
  <xs:sequence>
    <xs:element name="Attack_Pattern" type="ttp:AttackPatternType" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Attack_Pattern field specifies a single Attack Pattern for this TTP item.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type ttp:AttackPatternType
Namespace http://stix.mitre.org/TTP-1
Annotations
 
Captures prose information about an individual attack pattern as well as a CAPEC reference.
 
In addition to capturing basic information, this type is intended to be extended to enable the structured description of an attack pattern instance using the XML Schema extension feature. The STIX default extension uses the Common Attack Pattern Enumeration and Classification (CAPEC) schema to do so. The extension that defines this is captured in the CAPEC2.7InstanceType in the http://stix.mitre.org/extensions/AP#CAPEC2.7-1 namespace. This type is defined in the extensions/attack_pattern/capec_2.7_attack_pattern.xsd file or at the URL http://stix.mitre.org/XMLSchema/extensions/attack_pattern/capec_2.7/1.0.1/capec_2.7_attack_pattern.xsd.
Diagram
Diagram ttp_xsd.tmp#AttackPatternType_id ttp_xsd.tmp#AttackPatternType_idref ttp_xsd.tmp#AttackPatternType_capec_id ttp_xsd.tmp#AttackPatternType_Title ttp_xsd.tmp#AttackPatternType_Description ttp_xsd.tmp#AttackPatternType_Short_Description
Used by
Children ttp:Description, ttp:Short_Description, ttp:Title
Attributes
QName Type Use Annotation
capec_id restriction of xs:string optional 
This field specifies a reference to a particular entry within the Common Attack Pattern Enumeration and Classification (CAPEC)
id xs:QName optional 
Specifies a unique ID for this Attack Pattern.
idref xs:QName optional 
Specifies a reference to the ID for this Attack Pattern specified elsewhere.
Source
 
<xs:complexType name="AttackPatternType">
  <xs:annotation>
    <xs:documentation>Captures prose information about an individual attack pattern as well as a CAPEC reference.</xs:documentation>
    <xs:documentation>In addition to capturing basic information, this type is intended to be extended to enable the structured description of an attack pattern instance using the XML Schema extension feature. The STIX default extension uses the Common Attack Pattern Enumeration and Classification (CAPEC) schema to do so. The extension that defines this is captured in the CAPEC2.7InstanceType in the http://stix.mitre.org/extensions/AP#CAPEC2.7-1 namespace. This type is defined in the extensions/attack_pattern/capec_2.7_attack_pattern.xsd file or at the URL http://stix.mitre.org/XMLSchema/extensions/attack_pattern/capec_2.7/1.0.1/capec_2.7_attack_pattern.xsd.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Title" type="xs:string" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Title field provides a simple title for an individual Attack Pattern.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Description" type="stixCommon:StructuredTextType" minOccurs="0" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Description field is optional and provides an unstructured, text description of an individual Attack Pattern.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Short_Description" type="stixCommon:StructuredTextType" minOccurs="0" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Short_Description field is optional and provides a short, unstructured, text description of an individual Attack Pattern.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
  <xs:attribute name="id" type="xs:QName">
    <xs:annotation>
      <xs:documentation>Specifies a unique ID for this Attack Pattern.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="idref" type="xs:QName">
    <xs:annotation>
      <xs:documentation>Specifies a reference to the ID for this Attack Pattern specified elsewhere.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="capec_id">
    <xs:annotation>
      <xs:documentation>This field specifies a reference to a particular entry within the Common Attack Pattern Enumeration and Classification (CAPEC)</xs:documentation>
    </xs:annotation>
    <xs:simpleType>
      <xs:restriction base="xs:string">
        <xs:pattern value="CAPEC-\d+"/>
      </xs:restriction>
    </xs:simpleType>
  </xs:attribute>
</xs:complexType>
Complex Type ttp:MalwareType
Namespace http://stix.mitre.org/TTP-1
Diagram
Diagram ttp_xsd.tmp#MalwareType_Malware_Instance
Used by
Children ttp:Malware_Instance
Source
 
<xs:complexType name="MalwareType">
  <xs:sequence>
    <xs:element name="Malware_Instance" type="ttp:MalwareInstanceType" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Malware_Instance field specifies a single instance of Malware for this TTP item.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type ttp:ExploitsType
Namespace http://stix.mitre.org/TTP-1
Diagram
Diagram ttp_xsd.tmp#ExploitsType_Exploit
Used by
Children ttp:Exploit
Source
 
<xs:complexType name="ExploitsType">
  <xs:sequence>
    <xs:element name="Exploit" type="ttp:ExploitType" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Exploit field specifies a single Exploit for this TTP item.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type ttp:ExploitType
Namespace http://stix.mitre.org/TTP-1
Annotations
 
Characterizes a description of an individual exploit.
 
In addition to capturing basic information, this type is intended to be extended to enable the structured description of an exploit using the XML Schema extension feature. No extension is provided by STIX to support this, however those wishing to represent structured exploit information may develop such an extension.
Diagram
Diagram ttp_xsd.tmp#http___stix.mitre.org_TTP-1_ExploitType_id ttp_xsd.tmp#http___stix.mitre.org_TTP-1_ExploitType_idref ttp_xsd.tmp#http___stix.mitre.org_TTP-1_ExploitType_Title ttp_xsd.tmp#http___stix.mitre.org_TTP-1_ExploitType_Description ttp_xsd.tmp#http___stix.mitre.org_TTP-1_ExploitType_Short_Description
Used by
Element ttp:ExploitsType/ttp:Exploit
Children ttp:Description, ttp:Short_Description, ttp:Title
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a unique ID for this Exploit Instance.
idref xs:QName optional 
Specifies a reference to the ID for this Exploit Instance specified elsewhere.
Source
 
<xs:complexType name="ExploitType">
  <xs:annotation>
    <xs:documentation>Characterizes a description of an individual exploit.</xs:documentation>
    <xs:documentation>In addition to capturing basic information, this type is intended to be extended to enable the structured description of an exploit using the XML Schema extension feature. No extension is provided by STIX to support this, however those wishing to represent structured exploit information may develop such an extension.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Title" type="xs:string" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Title field provides a simple title for an individual Exploit instance.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Description" type="stixCommon:StructuredTextType" minOccurs="0" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Description field is optional and provides an unstructured, text description of an individual Exploit Instance.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Short_Description" type="stixCommon:StructuredTextType" minOccurs="0" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Short_Description field is optional and provides a short, unstructured, text description of an individual Exploit Instance.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
  <xs:attribute name="id" type="xs:QName">
    <xs:annotation>
      <xs:documentation>Specifies a unique ID for this Exploit Instance.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="idref" type="xs:QName">
    <xs:annotation>
      <xs:documentation>Specifies a reference to the ID for this Exploit Instance specified elsewhere.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
</xs:complexType>
Complex Type ttp:ResourceType
Namespace http://stix.mitre.org/TTP-1
Diagram
Diagram ttp_xsd.tmp#ResourceType_Tools ttp_xsd.tmp#ResourceType_Infrastructure ttp_xsd.tmp#ResourceType_Personas
Used by
Children ttp:Infrastructure, ttp:Personas, ttp:Tools
Source
 
<xs:complexType name="ResourceType">
  <xs:sequence>
    <xs:element name="Tools" type="ttp:ToolsType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Tools field specifies one or more Tools leveraged by this TTP item.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Infrastructure" type="ttp:InfrastructureType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Infrastructure field characterizes specific classes or instances of infrastructure observed to have been utilized for cyber attack.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Personas" type="ttp:PersonasType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Personas field characterizes specific classes or instances of personas (identities) leveraged by a threat to masquerade as other parties.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type ttp:ToolsType
Namespace http://stix.mitre.org/TTP-1
Diagram
Diagram ttp_xsd.tmp#ToolsType_Tool
Used by
Children ttp:Tool
Source
 
<xs:complexType name="ToolsType">
  <xs:sequence>
    <xs:element name="Tool" type="stixCommon:ToolInformationType" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Tool field specifies a single Tool leveraged by this TTP item.</xs:documentation>
        <xs:documentation>The Type field under this field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is AttackerToolTypeVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.</xs:documentation>
        <xs:documentation>Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type ttp:InfrastructureType
Namespace http://stix.mitre.org/TTP-1
Diagram
Diagram ttp_xsd.tmp#InfrastructureType_id ttp_xsd.tmp#InfrastructureType_idref ttp_xsd.tmp#InfrastructureType_Title ttp_xsd.tmp#InfrastructureType_Type ttp_xsd.tmp#InfrastructureType_Description ttp_xsd.tmp#InfrastructureType_Short_Description ttp_xsd.tmp#InfrastructureType_Observable_Characterization
Used by
Children ttp:Description, ttp:Observable_Characterization, ttp:Short_Description, ttp:Title, ttp:Type
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a unique ID for this class or instance of Infrastructure.
idref xs:QName optional 
Specifies a reference to the ID for this class or instance of Infrastructure specified elsewhere.
Source
 
<xs:complexType name="InfrastructureType">
  <xs:sequence>
    <xs:element name="Title" type="xs:string" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Title field provides a simple title for a class or instance of Infrastructure utilized for cyber attack.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Type" type="stixCommon:ControlledVocabularyStringType" minOccurs="0" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Type field represents the type of infrastructure being described.</xs:documentation>
        <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is AttackerInfrastructureTypeVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.</xs:documentation>
        <xs:documentation>Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Description" type="stixCommon:StructuredTextType" minOccurs="0" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Description field is optional and provides an unstructured, text description of specific classes or instances of infrastructure utilized for cyber attack.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Short_Description" type="stixCommon:StructuredTextType" minOccurs="0" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Short_Description field is optional and provides a short, unstructured, text description of specific classes or instances of infrastructure utilized for cyber attack.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Observable_Characterization" type="cybox:ObservablesType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Observable_Characterization field provides structured characterization of the cyber observables detailing specific classes or instances of infrastructure utilized for cyber attack.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
  <xs:attribute name="id" type="xs:QName">
    <xs:annotation>
      <xs:documentation>Specifies a unique ID for this class or instance of Infrastructure.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="idref" type="xs:QName">
    <xs:annotation>
      <xs:documentation>Specifies a reference to the ID for this class or instance of Infrastructure specified elsewhere.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
</xs:complexType>
Complex Type ttp:PersonasType
Namespace http://stix.mitre.org/TTP-1
Diagram
Diagram ttp_xsd.tmp#PersonasType_Persona
Used by
Children ttp:Persona
Source
 
<xs:complexType name="PersonasType">
  <xs:sequence>
    <xs:element name="Persona" type="stixCommon:IdentityType" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The persona field characterizes a single persona (identity) leveraged by a threat to masquerade as another party.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type ttp:VictimTargetingType
Namespace http://stix.mitre.org/TTP-1
Diagram
Diagram ttp_xsd.tmp#VictimTargetingType_Identity ttp_xsd.tmp#VictimTargetingType_Targeted_Systems ttp_xsd.tmp#VictimTargetingType_Targeted_Information ttp_xsd.tmp#VictimTargetingType_Targeted_Technical_Details
Used by
Children ttp:Identity, ttp:Targeted_Information, ttp:Targeted_Systems, ttp:Targeted_Technical_Details
Source
 
<xs:complexType name="VictimTargetingType">
  <xs:sequence>
    <xs:element name="Identity" type="stixCommon:IdentityType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Identity field characterizes information about the identity or characteristics of the targeted people or organizations.</xs:documentation>
        <xs:documentation>This field is implemented through the xsi:type extension mechanism. The default type is CIQIdentity3.0InstanceType in the http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1 namespace. This type is defined in the extensions/identity/ciq_identity_3.0.xsd file or at the URL http://stix.mitre.org/XMLSchema/extensions/identity/ciq_identity_3.0/1.1/ciq_identity_3.0.xsd.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Targeted_Systems" type="stixCommon:ControlledVocabularyStringType" minOccurs="0" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Targeted_Systems field characterizes a type of system that is targeted. It may be included multiple times to specify multiple types of targeted systems.</xs:documentation>
        <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is SystemTypeVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.</xs:documentation>
        <xs:documentation>Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Targeted_Information" type="stixCommon:ControlledVocabularyStringType" minOccurs="0" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Targeted_Systems field characterizes a type of information that is targeted. It may be included multiple times to specify multiple types of targeted information.</xs:documentation>
        <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is InformationTypeVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.</xs:documentation>
        <xs:documentation>Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Targeted_Technical_Details" type="cybox:ObservablesType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Targeted_Technical_Details field characterizes the technical information about what is targeted. It is implemented using the CybOX observables type, which allows for the representation of products, platforms, and code that are targeted.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type ttp:ExploitTargetsType
Namespace http://stix.mitre.org/TTP-1
Diagram
Diagram stix_common_xsd.tmp#GenericRelationshipListType_scope stix_common_xsd.tmp#GenericRelationshipListType ttp_xsd.tmp#ExploitTargetsType_Exploit_Target
Type extension of stixCommon:GenericRelationshipListType
Type hierarchy
Used by
Children ttp:Exploit_Target
Attributes
QName Type Default Use Annotation
scope stixCommon:RelationshipScopeEnum exclusive optional 
Indicates how multiple related items should be interpreted in this relationship. If "inclusive" is specified, then a single conceptual relationship is being defined between the subject and the collection of objects indicated by the related items (i.e. the relationship is not necessarily relevant for any one particular object being referenced, but for the aggregated collection of objects referenced). If "exclusive" is specified, then multiple relationships are being defined between the specific subject and each object individually.
Source
 
<xs:complexType name="ExploitTargetsType">
  <xs:complexContent>
    <xs:extension base="stixCommon:GenericRelationshipListType">
      <xs:sequence>
        <xs:element name="Exploit_Target" type="stixCommon:RelatedExploitTargetType" maxOccurs="unbounded">
          <xs:annotation>
            <xs:documentation>The Exploit_Target field characterizes potential vulnerability, weakness or configuration targets for exploitation by this TTP.</xs:documentation>
          </xs:annotation>
        </xs:element>
      </xs:sequence>
    </xs:extension>
  </xs:complexContent>
</xs:complexType>
Complex Type ttp:RelatedTTPsType
Namespace http://stix.mitre.org/TTP-1
Diagram
Diagram stix_common_xsd.tmp#GenericRelationshipListType_scope stix_common_xsd.tmp#GenericRelationshipListType ttp_xsd.tmp#RelatedTTPsType_Related_TTP
Type extension of stixCommon:GenericRelationshipListType
Type hierarchy
Used by
Children ttp:Related_TTP
Attributes
QName Type Default Use Annotation
scope stixCommon:RelationshipScopeEnum exclusive optional 
Indicates how multiple related items should be interpreted in this relationship. If "inclusive" is specified, then a single conceptual relationship is being defined between the subject and the collection of objects indicated by the related items (i.e. the relationship is not necessarily relevant for any one particular object being referenced, but for the aggregated collection of objects referenced). If "exclusive" is specified, then multiple relationships are being defined between the specific subject and each object individually.
Source
 
<xs:complexType name="RelatedTTPsType">
  <xs:complexContent>
    <xs:extension base="stixCommon:GenericRelationshipListType">
      <xs:sequence>
        <xs:element name="Related_TTP" type="stixCommon:RelatedTTPType" maxOccurs="unbounded">
          <xs:annotation>
            <xs:documentation>The Related_TTP field specifies a single other TTP asserted to be related to this cyber threat TTP.</xs:documentation>
          </xs:annotation>
        </xs:element>
      </xs:sequence>
    </xs:extension>
  </xs:complexContent>
</xs:complexType>
Simple Type ttp:TTPVersionType
Namespace http://stix.mitre.org/TTP-1
Annotations
 
An enumeration of all versions of the TTP type valid in the current release of STIX.
Diagram
Diagram
Type restriction of xs:string
Facets
enumeration 1.0
enumeration 1.0.1
enumeration 1.1
enumeration 1.1.1
enumeration 1.2
Used by
Source
 
<xs:simpleType name="TTPVersionType">
  <xs:annotation>
    <xs:documentation>An enumeration of all versions of the TTP type valid in the current release of STIX.</xs:documentation>
  </xs:annotation>
  <xs:restriction base="xs:string">
    <xs:enumeration value="1.0"/>
    <xs:enumeration value="1.0.1"/>
    <xs:enumeration value="1.1"/>
    <xs:enumeration value="1.1.1"/>
    <xs:enumeration value="1.2"/>
  </xs:restriction>
</xs:simpleType>
Attribute ttp:MalwareInstanceType / @id
Namespace No namespace
Annotations
 
Specifies a unique ID for this Malware Instance.
Type xs:QName
Used by
Source
 
<xs:attribute name="id" type="xs:QName">
  <xs:annotation>
    <xs:documentation>Specifies a unique ID for this Malware Instance.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute ttp:MalwareInstanceType / @idref
Namespace No namespace
Annotations
 
Specifies a reference to the ID for this Malware Instance specified elsewhere.
Type xs:QName
Used by
Source
 
<xs:attribute name="idref" type="xs:QName">
  <xs:annotation>
    <xs:documentation>Specifies a reference to the ID for this Malware Instance specified elsewhere.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute ttp:AttackPatternType / @id
Namespace No namespace
Annotations
 
Specifies a unique ID for this Attack Pattern.
Type xs:QName
Used by
Complex Type ttp:AttackPatternType
Source
 
<xs:attribute name="id" type="xs:QName">
  <xs:annotation>
    <xs:documentation>Specifies a unique ID for this Attack Pattern.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute ttp:AttackPatternType / @idref
Namespace No namespace
Annotations
 
Specifies a reference to the ID for this Attack Pattern specified elsewhere.
Type xs:QName
Used by
Complex Type ttp:AttackPatternType
Source
 
<xs:attribute name="idref" type="xs:QName">
  <xs:annotation>
    <xs:documentation>Specifies a reference to the ID for this Attack Pattern specified elsewhere.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute ttp:AttackPatternType / @capec_id
Namespace No namespace
Annotations
 
This field specifies a reference to a particular entry within the Common Attack Pattern Enumeration and Classification (CAPEC)
Type restriction of xs:string
Facets
pattern CAPEC-\d+
Used by
Complex Type ttp:AttackPatternType
Source
 
<xs:attribute name="capec_id">
  <xs:annotation>
    <xs:documentation>This field specifies a reference to a particular entry within the Common Attack Pattern Enumeration and Classification (CAPEC)</xs:documentation>
  </xs:annotation>
  <xs:simpleType>
    <xs:restriction base="xs:string">
      <xs:pattern value="CAPEC-\d+"/>
    </xs:restriction>
  </xs:simpleType>
</xs:attribute>
Attribute ttp:ExploitType / @id
Namespace No namespace
Annotations
 
Specifies a unique ID for this Exploit Instance.
Type xs:QName
Used by
Complex Type ttp:ExploitType
Source
 
<xs:attribute name="id" type="xs:QName">
  <xs:annotation>
    <xs:documentation>Specifies a unique ID for this Exploit Instance.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute ttp:ExploitType / @idref
Namespace No namespace
Annotations
 
Specifies a reference to the ID for this Exploit Instance specified elsewhere.
Type xs:QName
Used by
Complex Type ttp:ExploitType
Source
 
<xs:attribute name="idref" type="xs:QName">
  <xs:annotation>
    <xs:documentation>Specifies a reference to the ID for this Exploit Instance specified elsewhere.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute ttp:InfrastructureType / @id
Namespace No namespace
Annotations
 
Specifies a unique ID for this class or instance of Infrastructure.
Type xs:QName
Used by
Complex Type ttp:InfrastructureType
Source
 
<xs:attribute name="id" type="xs:QName">
  <xs:annotation>
    <xs:documentation>Specifies a unique ID for this class or instance of Infrastructure.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute ttp:InfrastructureType / @idref
Namespace No namespace
Annotations
 
Specifies a reference to the ID for this class or instance of Infrastructure specified elsewhere.
Type xs:QName
Used by
Complex Type ttp:InfrastructureType
Source
 
<xs:attribute name="idref" type="xs:QName">
  <xs:annotation>
    <xs:documentation>Specifies a reference to the ID for this class or instance of Infrastructure specified elsewhere.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute ttp:TTPType / @version
Namespace No namespace
Annotations
 
Specifies the relevant STIX-TTP schema version for this content.
Type ttp:TTPVersionType
Facets
enumeration 1.0
enumeration 1.0.1
enumeration 1.1
enumeration 1.1.1
enumeration 1.2
Used by
Complex Type ttp:TTPType
Source
 
<xs:attribute name="version" type="ttp:TTPVersionType">
  <xs:annotation>
    <xs:documentation>Specifies the relevant STIX-TTP schema version for this content.</xs:documentation>
  </xs:annotation>
</xs:attribute>
XML Schema documentation generated by ® XML Editor.