Showing:

Annotations
Attributes
Diagrams
Facets
Source
Used by
Imported schema cybox_common.xsd
Namespace http://cybox.mitre.org/common-2
Annotations
This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org.
Element cyboxCommon:ObjectPropertiesType / cyboxCommon:Custom_Properties
Namespace http://cybox.mitre.org/common-2
Annotations
The Custom_Properties construct is optional and enables the specification of a set of custom Object Properties that may not be defined in existing Properties schemas.
Diagram
Diagram cybox_common_xsd.tmp#CustomPropertiesType_Property cybox_common_xsd.tmp#CustomPropertiesType
Type cyboxCommon:CustomPropertiesType
Children cyboxCommon:Property
Source
<xs:element name="Custom_Properties" type="cyboxCommon:CustomPropertiesType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Custom_Properties construct is optional and enables the specification of a set of custom Object Properties that may not be defined in existing Properties schemas.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:CustomPropertiesType / cyboxCommon:Property
Namespace http://cybox.mitre.org/common-2
Annotations
The Property construct enables the specification of a single Object Property.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#PropertyType_name cybox_common_xsd.tmp#PropertyType_description cybox_common_xsd.tmp#PropertyType
Type cyboxCommon:PropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional
This attribute is optional and specifies the expected type for the value of the specified property.
defanging_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
description xs:string optional
A description of what this property represents.
has_changed xs:boolean optional
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional
The id field specifies a unique ID for this Object Property.
idref xs:QName optional
The idref field specifies a unique ID reference for this Object Property.
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional
This field is optional and conveys whether the associated Object property has been obfuscated.
name xs:string optional
The name field specifies a name for this property.
obfuscation_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
<xs:element name="Property" type="cyboxCommon:PropertyType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Property construct enables the specification of a single Object Property.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:LocationType / cyboxCommon:Name
Namespace http://cybox.mitre.org/common-2
Annotations
The Name field allows for expression of an location through a simple name.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Name" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Name field allows for expression of an location through a simple name.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:MeasureSourceType / cyboxCommon:Information_Source_Type
Namespace http://cybox.mitre.org/common-2
Annotations
The Information_Source_Type field is optional and utilizes a standardized controlled vocabulary to identify the type of information source leveraged for this cyber observation source.
This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is InformationSourceTypeVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.
Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.
Diagram
Diagram cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#PatternableFieldType cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_name cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_reference cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType
Type cyboxCommon:ControlledVocabularyStringType
Type hierarchy
Attributes
QName Type Default Use Annotation
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional
This field is optional and defines the relevant condition to apply to the value.
delimiter xs:string ##comma## optional
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
is_case_sensitive xs:boolean true optional
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
pattern_type cyboxCommon:PatternTypeEnum optional
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
regex_syntax xs:string optional
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
vocab_name xs:string optional
The vocab_name field specifies the name of the controlled vocabulary.
vocab_reference xs:anyURI optional
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
<xs:element name="Information_Source_Type" type="cyboxCommon:ControlledVocabularyStringType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Information_Source_Type field is optional and utilizes a standardized controlled vocabulary to identify the type of information source leveraged for this cyber observation source.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is InformationSourceTypeVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.</xs:documentation>
    <xs:documentation>Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:MeasureSourceType / cyboxCommon:Tool_Type
Namespace http://cybox.mitre.org/common-2
Annotations
The Tool_Type field is optional and (when tools are used) enables identification of the type of tool leveraged as part of this cyber observation source, via a standardized controlled vocabulary.
This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is ToolTypeVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.
Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.
Diagram
Diagram cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#PatternableFieldType cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_name cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_reference cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType
Type cyboxCommon:ControlledVocabularyStringType
Type hierarchy
Attributes
QName Type Default Use Annotation
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional
This field is optional and defines the relevant condition to apply to the value.
delimiter xs:string ##comma## optional
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
is_case_sensitive xs:boolean true optional
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
pattern_type cyboxCommon:PatternTypeEnum optional
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
regex_syntax xs:string optional
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
vocab_name xs:string optional
The vocab_name field specifies the name of the controlled vocabulary.
vocab_reference xs:anyURI optional
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
<xs:element name="Tool_Type" type="cyboxCommon:ControlledVocabularyStringType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Tool_Type field is optional and (when tools are used) enables identification of the type of tool leveraged as part of this cyber observation source, via a standardized controlled vocabulary.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is ToolTypeVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.</xs:documentation>
    <xs:documentation>Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:MeasureSourceType / cyboxCommon:Description
Namespace http://cybox.mitre.org/common-2
Annotations
The Description field is optional and enables a generalized but structured description of this syber observation source.
Diagram
Diagram cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType_structuring_format cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType
Type cyboxCommon:StructuredTextType
Attributes
QName Type Use Annotation
structuring_format xs:string optional
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interfering with XML validation of the CybOX document. If this attribute is absent, the implication is that no markup is being used.
Source
<xs:element name="Description" type="cyboxCommon:StructuredTextType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Description field is optional and enables a generalized but structured description of this syber observation source.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:MeasureSourceType / cyboxCommon:Contributors
Namespace http://cybox.mitre.org/common-2
Annotations
The Contributors field is optional and enables description of the individual contributors involved in this cyber observation source.
Diagram
Diagram cybox_common_xsd.tmp#PersonnelType_Contributor cybox_common_xsd.tmp#PersonnelType
Type cyboxCommon:PersonnelType
Children cyboxCommon:Contributor
Source
<xs:element name="Contributors" type="cyboxCommon:PersonnelType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Contributors field is optional and enables description of the individual contributors involved in this cyber observation source.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:PersonnelType / cyboxCommon:Contributor
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains information describing the identify, resources and timing of involvement for a single contributor.
Diagram
Diagram cybox_common_xsd.tmp#ContributorType_Role cybox_common_xsd.tmp#ContributorType_Name cybox_common_xsd.tmp#ContributorType_Email cybox_common_xsd.tmp#ContributorType_Phone cybox_common_xsd.tmp#ContributorType_Organization cybox_common_xsd.tmp#ContributorType_Date cybox_common_xsd.tmp#ContributorType_Contribution_Location cybox_common_xsd.tmp#ContributorType
Type cyboxCommon:ContributorType
Children cyboxCommon:Contribution_Location, cyboxCommon:Date, cyboxCommon:Email, cyboxCommon:Name, cyboxCommon:Organization, cyboxCommon:Phone, cyboxCommon:Role
Source
<xs:element name="Contributor" type="cyboxCommon:ContributorType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field contains information describing the identify, resources and timing of involvement for a single contributor.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ContributorType / cyboxCommon:Role
Namespace http://cybox.mitre.org/common-2
Annotations
This field describes the role played by this contributor.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Role" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field describes the role played by this contributor.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ContributorType / cyboxCommon:Name
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains the name of this contributor.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Name" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the name of this contributor.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ContributorType / cyboxCommon:Email
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains the email of this contributor.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Email" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the email of this contributor.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ContributorType / cyboxCommon:Phone
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains a telephone number of this contributor.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Phone" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains a telephone number of this contributor.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ContributorType / cyboxCommon:Organization
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains the organization name of this contributor.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Organization" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the organization name of this contributor.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ContributorType / cyboxCommon:Date
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains a description (bounding) of the timing of this contributor's involvement.
Diagram
Diagram cybox_common_xsd.tmp#DateRangeType_Start_Date cybox_common_xsd.tmp#DateRangeType_End_Date cybox_common_xsd.tmp#DateRangeType
Type cyboxCommon:DateRangeType
Children cyboxCommon:End_Date, cyboxCommon:Start_Date
Source
<xs:element name="Date" type="cyboxCommon:DateRangeType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains a description (bounding) of the timing of this contributor's involvement.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:DateRangeType / cyboxCommon:Start_Date
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains the start date for this contributor's involvement. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
Diagram
Diagram cybox_common_xsd.tmp#DateWithPrecisionType_precision cybox_common_xsd.tmp#DateWithPrecisionType
Type cyboxCommon:DateWithPrecisionType
Attributes
QName Type Default Use Annotation
precision cyboxCommon:DatePrecisionEnum day optional
The precision of the associated date. If omitted, the default is "day", meaning the full field value.
Source
<xs:element name="Start_Date" type="cyboxCommon:DateWithPrecisionType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the start date for this contributor's involvement. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:DateRangeType / cyboxCommon:End_Date
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains the end date for this contributor's involvement. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
Diagram
Diagram cybox_common_xsd.tmp#DateWithPrecisionType_precision cybox_common_xsd.tmp#DateWithPrecisionType
Type cyboxCommon:DateWithPrecisionType
Attributes
QName Type Default Use Annotation
precision cyboxCommon:DatePrecisionEnum day optional
The precision of the associated date. If omitted, the default is "day", meaning the full field value.
Source
<xs:element name="End_Date" type="cyboxCommon:DateWithPrecisionType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the end date for this contributor's involvement. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ContributorType / cyboxCommon:Contribution_Location
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains information describing the location at which the contributory activity occured.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Contribution_Location" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains information describing the location at which the contributory activity occured.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:MeasureSourceType / cyboxCommon:Time
Namespace http://cybox.mitre.org/common-2
Annotations
The Time field is optional and enables description of various time-related properties for this cyber observation source instance.
Diagram
Diagram cybox_common_xsd.tmp#TimeType_Start_Time cybox_common_xsd.tmp#TimeType_End_Time cybox_common_xsd.tmp#TimeType_Produced_Time cybox_common_xsd.tmp#TimeType_Received_Time cybox_common_xsd.tmp#TimeType
Type cyboxCommon:TimeType
Children cyboxCommon:End_Time, cyboxCommon:Produced_Time, cyboxCommon:Received_Time, cyboxCommon:Start_Time
Source
<xs:element name="Time" type="cyboxCommon:TimeType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Time field is optional and enables description of various time-related properties for this cyber observation source instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:TimeType / cyboxCommon:Start_Time
Namespace http://cybox.mitre.org/common-2
Annotations
The Start_Time field is optional and describes the starting time for this construct. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
Diagram
Diagram cybox_common_xsd.tmp#DateTimeWithPrecisionType_precision cybox_common_xsd.tmp#DateTimeWithPrecisionType
Type cyboxCommon:DateTimeWithPrecisionType
Attributes
QName Type Default Use Annotation
precision cyboxCommon:DateTimePrecisionEnum second optional
The precision of the associated dateTime. If omitted, the default is "second", meaning the full field value (including fractional seconds).
Source
<xs:element name="Start_Time" type="cyboxCommon:DateTimeWithPrecisionType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Start_Time field is optional and describes the starting time for this construct. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:TimeType / cyboxCommon:End_Time
Namespace http://cybox.mitre.org/common-2
Annotations
The End_Time field is optional and describes the ending time for this construct. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
Diagram
Diagram cybox_common_xsd.tmp#DateTimeWithPrecisionType_precision cybox_common_xsd.tmp#DateTimeWithPrecisionType
Type cyboxCommon:DateTimeWithPrecisionType
Attributes
QName Type Default Use Annotation
precision cyboxCommon:DateTimePrecisionEnum second optional
The precision of the associated dateTime. If omitted, the default is "second", meaning the full field value (including fractional seconds).
Source
<xs:element name="End_Time" type="cyboxCommon:DateTimeWithPrecisionType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The End_Time field is optional and describes the ending time for this construct. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:TimeType / cyboxCommon:Produced_Time
Namespace http://cybox.mitre.org/common-2
Annotations
The Produced_Time field is optional and describes the time that this construct was produced. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
Diagram
Diagram cybox_common_xsd.tmp#DateTimeWithPrecisionType_precision cybox_common_xsd.tmp#DateTimeWithPrecisionType
Type cyboxCommon:DateTimeWithPrecisionType
Attributes
QName Type Default Use Annotation
precision cyboxCommon:DateTimePrecisionEnum second optional
The precision of the associated dateTime. If omitted, the default is "second", meaning the full field value (including fractional seconds).
Source
<xs:element name="Produced_Time" type="cyboxCommon:DateTimeWithPrecisionType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Produced_Time field is optional and describes the time that this construct was produced. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:TimeType / cyboxCommon:Received_Time
Namespace http://cybox.mitre.org/common-2
Annotations
The Received_Time field is optional and describes the time that this construct was received. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
Diagram
Diagram cybox_common_xsd.tmp#DateTimeWithPrecisionType_precision cybox_common_xsd.tmp#DateTimeWithPrecisionType
Type cyboxCommon:DateTimeWithPrecisionType
Attributes
QName Type Default Use Annotation
precision cyboxCommon:DateTimePrecisionEnum second optional
The precision of the associated dateTime. If omitted, the default is "second", meaning the full field value (including fractional seconds).
Source
<xs:element name="Received_Time" type="cyboxCommon:DateTimeWithPrecisionType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Received_Time field is optional and describes the time that this construct was received. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:MeasureSourceType / cyboxCommon:Observation_Location
Namespace http://cybox.mitre.org/common-2
Annotations
The Observation_Location field specifies a relevant physical location for the observation measurement of the associated Observable.
This field is implemented through the xsi:type extension mechanism. The default type is CIQAddressInstanceType in the http://cybox.mitre.org/extensions/Identity#CIQAddress-1 namespace. This type is defined in the extensions/location/ciq_address_3.0.xsd file or at the URL http://cybox.mitre.org/XMLSchema/extensions/location/ciq_address/1.0/ciq_address_3.0.xsd.
Those who wish to express a simple name may also do so by not specifying an xsi:type and using the Name field.
Diagram
Diagram cybox_common_xsd.tmp#LocationType_id cybox_common_xsd.tmp#LocationType_idref cybox_common_xsd.tmp#LocationType_Name cybox_common_xsd.tmp#LocationType
Type cyboxCommon:LocationType
Children cyboxCommon:Name
Attributes
QName Type Use Annotation
id xs:QName optional
Specifies a unique ID for this Location.
idref xs:QName optional
Specifies a reference to a unique ID defined elsewhere.
Source
<xs:element name="Observation_Location" type="cyboxCommon:LocationType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Observation_Location field specifies a relevant physical location for the observation measurement of the associated Observable.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type extension mechanism. The default type is CIQAddressInstanceType in the http://cybox.mitre.org/extensions/Identity#CIQAddress-1 namespace. This type is defined in the extensions/location/ciq_address_3.0.xsd file or at the URL http://cybox.mitre.org/XMLSchema/extensions/location/ciq_address/1.0/ciq_address_3.0.xsd.</xs:documentation>
    <xs:documentation>Those who wish to express a simple name may also do so by not specifying an xsi:type and using the Name field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:MeasureSourceType / cyboxCommon:Tools
Namespace http://cybox.mitre.org/common-2
Annotations
The Tools field is optional and enables description of the tools utilized for this cyber observation source.
Diagram
Diagram cybox_common_xsd.tmp#ToolsInformationType_Tool cybox_common_xsd.tmp#ToolsInformationType
Type cyboxCommon:ToolsInformationType
Children cyboxCommon:Tool
Source
<xs:element name="Tools" type="cyboxCommon:ToolsInformationType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Tools field is optional and enables description of the tools utilized for this cyber observation source.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolsInformationType / cyboxCommon:Tool
Namespace http://cybox.mitre.org/common-2
Annotations
The Tool field is optional and enables description of a single tool utilized for this cyber observation source.
Diagram
Diagram cybox_common_xsd.tmp#ToolInformationType_id cybox_common_xsd.tmp#ToolInformationType_idref cybox_common_xsd.tmp#ToolInformationType_Name cybox_common_xsd.tmp#ToolInformationType_Type cybox_common_xsd.tmp#ToolInformationType_Description cybox_common_xsd.tmp#ToolInformationType_References cybox_common_xsd.tmp#ToolInformationType_Vendor cybox_common_xsd.tmp#ToolInformationType_Version cybox_common_xsd.tmp#ToolInformationType_Service_Pack cybox_common_xsd.tmp#ToolInformationType_Tool_Specific_Data cybox_common_xsd.tmp#ToolInformationType_Tool_Hashes cybox_common_xsd.tmp#ToolInformationType_Tool_Configuration cybox_common_xsd.tmp#ToolInformationType_Execution_Environment cybox_common_xsd.tmp#ToolInformationType_Errors cybox_common_xsd.tmp#ToolInformationType_Metadata cybox_common_xsd.tmp#ToolInformationType_Compensation_Model cybox_common_xsd.tmp#ToolInformationType
Type cyboxCommon:ToolInformationType
Children cyboxCommon:Compensation_Model, cyboxCommon:Description, cyboxCommon:Errors, cyboxCommon:Execution_Environment, cyboxCommon:Metadata, cyboxCommon:Name, cyboxCommon:References, cyboxCommon:Service_Pack, cyboxCommon:Tool_Configuration, cyboxCommon:Tool_Hashes, cyboxCommon:Tool_Specific_Data, cyboxCommon:Type, cyboxCommon:Vendor, cyboxCommon:Version
Attributes
QName Type Use Annotation
id xs:QName optional
The id field specifies a unique ID for this Tool.
idref xs:QName optional
The idref field specifies reference to a unique ID for this Tool.
When idref is specified, the id attribute must not be specified, and any instance of this type should not hold content unless an extension of the type allows it.
Source
<xs:element name="Tool" type="cyboxCommon:ToolInformationType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Tool field is optional and enables description of a single tool utilized for this cyber observation source.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Name
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains the name of the tool leveraged.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Name" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the name of the tool leveraged.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Type
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains the type of the tool leveraged.
This field is implemented through the xsi:type controlled vocabulary extension mechanism. No default vocabulary type has been defined for CybOX 2.0. Users may either define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a free string field. Additionally, locations where the ToolInformationType is used may define default vocabularies for this field.
Diagram
Diagram cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#PatternableFieldType cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_name cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_reference cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType
Type cyboxCommon:ControlledVocabularyStringType
Type hierarchy
Attributes
QName Type Default Use Annotation
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional
This field is optional and defines the relevant condition to apply to the value.
delimiter xs:string ##comma## optional
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
is_case_sensitive xs:boolean true optional
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
pattern_type cyboxCommon:PatternTypeEnum optional
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
regex_syntax xs:string optional
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
vocab_name xs:string optional
The vocab_name field specifies the name of the controlled vocabulary.
vocab_reference xs:anyURI optional
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
<xs:element name="Type" type="cyboxCommon:ControlledVocabularyStringType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field contains the type of the tool leveraged.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. No default vocabulary type has been defined for CybOX 2.0. Users may either define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a free string field. Additionally, locations where the ToolInformationType is used may define default vocabularies for this field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Description
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains general descriptive information for this tool.
Diagram
Diagram cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType_structuring_format cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType
Type cyboxCommon:StructuredTextType
Attributes
QName Type Use Annotation
structuring_format xs:string optional
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interfering with XML validation of the CybOX document. If this attribute is absent, the implication is that no markup is being used.
Source
<xs:element name="Description" type="cyboxCommon:StructuredTextType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains general descriptive information for this tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:References
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains references to instances or additional information for this tool.
Diagram
Diagram cybox_common_xsd.tmp#ToolReferencesType_Reference cybox_common_xsd.tmp#ToolReferencesType
Type cyboxCommon:ToolReferencesType
Children cyboxCommon:Reference
Source
<xs:element name="References" type="cyboxCommon:ToolReferencesType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains references to instances or additional information for this tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolReferencesType / cyboxCommon:Reference
Namespace http://cybox.mitre.org/common-2
Annotations
Contains one reference to information or instances of a given tool.
Diagram
Diagram cybox_common_xsd.tmp#ToolReferenceType_reference_type cybox_common_xsd.tmp#ToolReferenceType
Type cyboxCommon:ToolReferenceType
Attributes
QName Type Use Annotation
reference_type cyboxCommon:ToolReferenceTypeEnum optional
Indicates the nature of the referenced material (documentation, source, executable, etc.).
Source
<xs:element name="Reference" type="cyboxCommon:ToolReferenceType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>Contains one reference to information or instances of a given tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Vendor
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains information identifying the vendor organization for this tool.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Vendor" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains information identifying the vendor organization for this tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Version
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains an appropriate version descriptor of this tool.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Version" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains an appropriate version descriptor of this tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Service_Pack
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains an appropriate service pack descriptor for this tool.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Service_Pack" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains an appropriate service pack descriptor for this tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Tool_Specific_Data
Namespace http://cybox.mitre.org/common-2
Annotations
This is an abstract type provided to a flexible mechanism for enabling tool-specific data to be included.
Diagram
Diagram cybox_common_xsd.tmp#ToolSpecificDataType
Type cyboxCommon:ToolSpecificDataType
Source
<xs:element name="Tool_Specific_Data" type="cyboxCommon:ToolSpecificDataType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This is an abstract type provided to a flexible mechanism for enabling tool-specific data to be included.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Tool_Hashes
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains a hash value computed on the tool file content in order to verify its integrity.
Diagram
Diagram cybox_common_xsd.tmp#HashListType_Hash cybox_common_xsd.tmp#HashListType
Type cyboxCommon:HashListType
Children cyboxCommon:Hash
Source
<xs:element name="Tool_Hashes" type="cyboxCommon:HashListType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains a hash value computed on the tool file content in order to verify its integrity.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashListType / cyboxCommon:Hash
Namespace http://cybox.mitre.org/common-2
Annotations
The Hash field specifies a single calculated hash value.
Diagram
Diagram cybox_common_xsd.tmp#HashType_Type cybox_common_xsd.tmp#HashType_Simple_Hash_Value cybox_common_xsd.tmp#HashType_Fuzzy_Hash_Value cybox_common_xsd.tmp#HashType_Fuzzy_Hash_Structure cybox_common_xsd.tmp#HashType
Type cyboxCommon:HashType
Children cyboxCommon:Fuzzy_Hash_Structure, cyboxCommon:Fuzzy_Hash_Value, cyboxCommon:Simple_Hash_Value, cyboxCommon:Type
Source
<xs:element name="Hash" type="cyboxCommon:HashType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Hash field specifies a single calculated hash value.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashType / cyboxCommon:Type
Namespace http://cybox.mitre.org/common-2
Annotations
The Type field utilizes a standardized controlled vocabulary to capture the type of hash used in the Simple_Hash_Value or Fuzzy_Hash_Value elements.
This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is HashNameVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.
Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.
Diagram
Diagram cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#PatternableFieldType cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_name cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_reference cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType
Type cyboxCommon:ControlledVocabularyStringType
Type hierarchy
Attributes
QName Type Default Use Annotation
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional
This field is optional and defines the relevant condition to apply to the value.
delimiter xs:string ##comma## optional
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
is_case_sensitive xs:boolean true optional
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
pattern_type cyboxCommon:PatternTypeEnum optional
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
regex_syntax xs:string optional
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
vocab_name xs:string optional
The vocab_name field specifies the name of the controlled vocabulary.
vocab_reference xs:anyURI optional
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
<xs:element name="Type" type="cyboxCommon:ControlledVocabularyStringType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Type field utilizes a standardized controlled vocabulary to capture the type of hash used in the Simple_Hash_Value or Fuzzy_Hash_Value elements.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is HashNameVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.</xs:documentation>
    <xs:documentation>Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashType / cyboxCommon:Simple_Hash_Value
Namespace http://cybox.mitre.org/common-2
Annotations
The Simple_Hash_Value field specifies a single result value of a basic cryptograhic hash function outputting a single hexbinary hash value.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#HexBinaryObjectPropertyType_datatype cybox_common_xsd.tmp#HexBinaryObjectPropertyType cybox_common_xsd.tmp#SimpleHashValueType
Type cyboxCommon:SimpleHashValueType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum hexBinary optional
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional
The id field specifies a unique ID for this Object Property.
idref xs:QName optional
The idref field specifies a unique ID reference for this Object Property.
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
<xs:element name="Simple_Hash_Value" type="cyboxCommon:SimpleHashValueType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Simple_Hash_Value field specifies a single result value of a basic cryptograhic hash function outputting a single hexbinary hash value.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashType / cyboxCommon:Fuzzy_Hash_Value
Namespace http://cybox.mitre.org/common-2
Annotations
The Fuzzy_Hash_Value field specifies a single result value of a cryptograhic fuzzy hash function outputting a single complex string based hash value. (e.g. SSDEEP's Block1hash:Block2hash format).
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype cybox_common_xsd.tmp#StringObjectPropertyType cybox_common_xsd.tmp#FuzzyHashValueType
Type cyboxCommon:FuzzyHashValueType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional
The id field specifies a unique ID for this Object Property.
idref xs:QName optional
The idref field specifies a unique ID reference for this Object Property.
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
<xs:element name="Fuzzy_Hash_Value" type="cyboxCommon:FuzzyHashValueType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Fuzzy_Hash_Value field specifies a single result value of a cryptograhic fuzzy hash function outputting a single complex string based hash value. (e.g. SSDEEP's Block1hash:Block2hash format).</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashType / cyboxCommon:Fuzzy_Hash_Structure
Namespace http://cybox.mitre.org/common-2
Annotations
The Fuzzy_Hash_Structure field is optional and enables the characterization of the key internal components of a fuzzy hash calculation with a given block size.
Diagram
Diagram cybox_common_xsd.tmp#FuzzyHashStructureType_Block_Size cybox_common_xsd.tmp#FuzzyHashStructureType_Block_Hash cybox_common_xsd.tmp#FuzzyHashStructureType
Type cyboxCommon:FuzzyHashStructureType
Children cyboxCommon:Block_Hash, cyboxCommon:Block_Size
Source
<xs:element name="Fuzzy_Hash_Structure" type="cyboxCommon:FuzzyHashStructureType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Fuzzy_Hash_Structure field is optional and enables the characterization of the key internal components of a fuzzy hash calculation with a given block size.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:FuzzyHashStructureType / cyboxCommon:Block_Size
Namespace http://cybox.mitre.org/common-2
Annotations
The Block_Size field is optional and specifies the calculated block size for this fuzzy hash calculation.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#IntegerObjectPropertyType_datatype cybox_common_xsd.tmp#IntegerObjectPropertyType
Type cyboxCommon:IntegerObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum int optional
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional
The id field specifies a unique ID for this Object Property.
idref xs:QName optional
The idref field specifies a unique ID reference for this Object Property.
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
<xs:element name="Block_Size" type="cyboxCommon:IntegerObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Block_Size field is optional and specifies the calculated block size for this fuzzy hash calculation.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:FuzzyHashStructureType / cyboxCommon:Block_Hash
Namespace http://cybox.mitre.org/common-2
Annotations
The Block_Hash field is optional and enables specification of the elemental components utilized for a fuzzy hash calculation on the hashed object utilizing Block_Size to calculate trigger points.
Diagram
Diagram cybox_common_xsd.tmp#FuzzyHashBlockType_Block_Hash_Value cybox_common_xsd.tmp#FuzzyHashBlockType_Segment_Count cybox_common_xsd.tmp#FuzzyHashBlockType_Segments cybox_common_xsd.tmp#FuzzyHashBlockType
Type cyboxCommon:FuzzyHashBlockType
Children cyboxCommon:Block_Hash_Value, cyboxCommon:Segment_Count, cyboxCommon:Segments
Source
<xs:element name="Block_Hash" type="cyboxCommon:FuzzyHashBlockType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Block_Hash field is optional and enables specification of the elemental components utilized for a fuzzy hash calculation on the hashed object utilizing Block_Size to calculate trigger points.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:FuzzyHashBlockType / cyboxCommon:Block_Hash_Value
Namespace http://cybox.mitre.org/common-2
Annotations
The Block_Hash_Value field is optional and specifies a fuzzy hash calculation result value for this Block.
Diagram
Diagram cybox_common_xsd.tmp#HashValueType_Simple_Hash_Value cybox_common_xsd.tmp#HashValueType_Fuzzy_Hash_Value cybox_common_xsd.tmp#HashValueType
Type cyboxCommon:HashValueType
Children cyboxCommon:Fuzzy_Hash_Value, cyboxCommon:Simple_Hash_Value
Source
<xs:element name="Block_Hash_Value" type="cyboxCommon:HashValueType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Block_Hash_Value field is optional and specifies a fuzzy hash calculation result value for this Block.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashValueType / cyboxCommon:Simple_Hash_Value
Namespace http://cybox.mitre.org/common-2
Annotations
The Simple_Hash_Value field specifies a single result value of a basic cryptograhic hash function outputting a single hexbinary hash value.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#HexBinaryObjectPropertyType_datatype cybox_common_xsd.tmp#HexBinaryObjectPropertyType cybox_common_xsd.tmp#SimpleHashValueType
Type cyboxCommon:SimpleHashValueType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum hexBinary optional
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional
The id field specifies a unique ID for this Object Property.
idref xs:QName optional
The idref field specifies a unique ID reference for this Object Property.
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
<xs:element name="Simple_Hash_Value" type="cyboxCommon:SimpleHashValueType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Simple_Hash_Value field specifies a single result value of a basic cryptograhic hash function outputting a single hexbinary hash value.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashValueType / cyboxCommon:Fuzzy_Hash_Value
Namespace http://cybox.mitre.org/common-2
Annotations
The Fuzzy_Hash_Value field specifies a single result value of a cryptograhic fuzzy hash function outputting a single complex string based hash value. (e.g. SSDEEP's Block1hash:Block2hash format).
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype cybox_common_xsd.tmp#StringObjectPropertyType cybox_common_xsd.tmp#FuzzyHashValueType
Type cyboxCommon:FuzzyHashValueType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional
The id field specifies a unique ID for this Object Property.
idref xs:QName optional
The idref field specifies a unique ID reference for this Object Property.
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
<xs:element name="Fuzzy_Hash_Value" type="cyboxCommon:FuzzyHashValueType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Fuzzy_Hash_Value field specifies a single result value of a cryptograhic fuzzy hash function outputting a single complex string based hash value. (e.g. SSDEEP's Block1hash:Block2hash format).</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:FuzzyHashBlockType / cyboxCommon:Segment_Count
Namespace http://cybox.mitre.org/common-2
Annotations
The Segment_Count field is optional and specifies the number of segments identified and utilized within this fuzzy hash calculation.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#IntegerObjectPropertyType_datatype cybox_common_xsd.tmp#IntegerObjectPropertyType
Type cyboxCommon:IntegerObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum int optional
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional
The id field specifies a unique ID for this Object Property.
idref xs:QName optional
The idref field specifies a unique ID reference for this Object Property.
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
<xs:element name="Segment_Count" type="cyboxCommon:IntegerObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Segment_Count field is optional and specifies the number of segments identified and utilized within this fuzzy hash calculation.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:FuzzyHashBlockType / cyboxCommon:Segments
Namespace http://cybox.mitre.org/common-2
Annotations
The Segments field is optional and specifies the set of segments identified and utilized within this fuzzy hash calculation.
Diagram
Diagram cybox_common_xsd.tmp#HashSegmentsType_Segment cybox_common_xsd.tmp#HashSegmentsType
Type cyboxCommon:HashSegmentsType
Children cyboxCommon:Segment
Source
<xs:element name="Segments" type="cyboxCommon:HashSegmentsType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Segments field is optional and specifies the set of segments identified and utilized within this fuzzy hash calculation.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashSegmentsType / cyboxCommon:Segment
Namespace http://cybox.mitre.org/common-2
Annotations
The Segment field is optional and specifies a single segment identified and utilized within this fuzzy hash calculation.
Diagram
Diagram cybox_common_xsd.tmp#HashSegmentType_Trigger_Point cybox_common_xsd.tmp#HashSegmentType_Segment_Hash cybox_common_xsd.tmp#HashSegmentType_Raw_Segment_Content cybox_common_xsd.tmp#HashSegmentType
Type cyboxCommon:HashSegmentType
Children cyboxCommon:Raw_Segment_Content, cyboxCommon:Segment_Hash, cyboxCommon:Trigger_Point
Source
<xs:element name="Segment" type="cyboxCommon:HashSegmentType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Segment field is optional and specifies a single segment identified and utilized within this fuzzy hash calculation.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashSegmentType / cyboxCommon:Trigger_Point
Namespace http://cybox.mitre.org/common-2
Annotations
The Trigger_point field is optional and specifies the offset within the hashed object of the trigger point for this segment.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#HexBinaryObjectPropertyType_datatype cybox_common_xsd.tmp#HexBinaryObjectPropertyType
Type cyboxCommon:HexBinaryObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum hexBinary optional
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional
The id field specifies a unique ID for this Object Property.
idref xs:QName optional
The idref field specifies a unique ID reference for this Object Property.
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
<xs:element name="Trigger_Point" type="cyboxCommon:HexBinaryObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Trigger_point field is optional and specifies the offset within the hashed object of the trigger point for this segment.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashSegmentType / cyboxCommon:Segment_Hash
Namespace http://cybox.mitre.org/common-2
Annotations
The Segment_Hash field is optional and specifies a calculated hash value for this segment.
Diagram
Diagram cybox_common_xsd.tmp#HashValueType_Simple_Hash_Value cybox_common_xsd.tmp#HashValueType_Fuzzy_Hash_Value cybox_common_xsd.tmp#HashValueType
Type cyboxCommon:HashValueType
Children cyboxCommon:Fuzzy_Hash_Value, cyboxCommon:Simple_Hash_Value
Source
<xs:element name="Segment_Hash" type="cyboxCommon:HashValueType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Segment_Hash field is optional and specifies a calculated hash value for this segment.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashSegmentType / cyboxCommon:Raw_Segment_Content
Namespace http://cybox.mitre.org/common-2
Annotations
The Raw_Segment_Content field is optional and contains the raw content of this segment of the hashed object.
Diagram
Diagram
Source
<xs:element name="Raw_Segment_Content" type="xs:anyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Raw_Segment_Content field is optional and contains the raw content of this segment of the hashed object.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Tool_Configuration
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains information describing the configuration and usage of the tool.
Diagram
Diagram cybox_common_xsd.tmp#ToolConfigurationType_Configuration_Settings cybox_common_xsd.tmp#ToolConfigurationType_Dependencies cybox_common_xsd.tmp#ToolConfigurationType_Usage_Context_Assumptions cybox_common_xsd.tmp#ToolConfigurationType_Internationalization_Settings cybox_common_xsd.tmp#ToolConfigurationType_Build_Information cybox_common_xsd.tmp#ToolConfigurationType
Type cyboxCommon:ToolConfigurationType
Children cyboxCommon:Build_Information, cyboxCommon:Configuration_Settings, cyboxCommon:Dependencies, cyboxCommon:Internationalization_Settings, cyboxCommon:Usage_Context_Assumptions
Source
<xs:element name="Tool_Configuration" type="cyboxCommon:ToolConfigurationType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains information describing the configuration and usage of the tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolConfigurationType / cyboxCommon:Configuration_Settings
Namespace http://cybox.mitre.org/common-2
Annotations
This field describes the configuration settings of this tool instance.
Diagram
Diagram cybox_common_xsd.tmp#ConfigurationSettingsType_Configuration_Setting cybox_common_xsd.tmp#ConfigurationSettingsType
Type cyboxCommon:ConfigurationSettingsType
Children cyboxCommon:Configuration_Setting
Source
<xs:element name="Configuration_Settings" type="cyboxCommon:ConfigurationSettingsType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field describes the configuration settings of this tool instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ConfigurationSettingsType / cyboxCommon:Configuration_Setting
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains a single configuration setting instance.
Diagram
Diagram cybox_common_xsd.tmp#ConfigurationSettingType_Item_Name cybox_common_xsd.tmp#ConfigurationSettingType_Item_Value cybox_common_xsd.tmp#ConfigurationSettingType_Item_Type cybox_common_xsd.tmp#ConfigurationSettingType_Item_Description cybox_common_xsd.tmp#ConfigurationSettingType
Type cyboxCommon:ConfigurationSettingType
Children cyboxCommon:Item_Description, cyboxCommon:Item_Name, cyboxCommon:Item_Type, cyboxCommon:Item_Value
Source
<xs:element name="Configuration_Setting" type="cyboxCommon:ConfigurationSettingType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field contains a single configuration setting instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ConfigurationSettingType / cyboxCommon:Item_Name
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains the name of the configuration item referenced by this configuration setting instance.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Item_Name" type="xs:string">
  <xs:annotation>
    <xs:documentation>This field contains the name of the configuration item referenced by this configuration setting instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ConfigurationSettingType / cyboxCommon:Item_Value
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains the value of this configuration setting instance.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Item_Value" type="xs:string">
  <xs:annotation>
    <xs:documentation>This field contains the value of this configuration setting instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ConfigurationSettingType / cyboxCommon:Item_Type
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains the type of the configuration item referenced in this configuration setting instance.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Item_Type" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the type of the configuration item referenced in this configuration setting instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ConfigurationSettingType / cyboxCommon:Item_Description
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains a description of the configuration item referenced in this configuration setting instance.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Item_Description" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains a description of the configuration item referenced in this configuration setting instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolConfigurationType / cyboxCommon:Dependencies
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains information describing the relevant dependencies for this tool.
Diagram
Diagram cybox_common_xsd.tmp#DependenciesType_Dependency cybox_common_xsd.tmp#DependenciesType
Type cyboxCommon:DependenciesType
Children cyboxCommon:Dependency
Source
<xs:element name="Dependencies" type="cyboxCommon:DependenciesType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains information describing the relevant dependencies for this tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:DependenciesType / cyboxCommon:Dependency
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains information describing a single dependency for this tool.
Diagram
Diagram cybox_common_xsd.tmp#DependencyType_Dependency_Type cybox_common_xsd.tmp#DependencyType_Dependency_Description cybox_common_xsd.tmp#DependencyType
Type cyboxCommon:DependencyType
Children cyboxCommon:Dependency_Description, cyboxCommon:Dependency_Type
Source
<xs:element name="Dependency" type="cyboxCommon:DependencyType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field contains information describing a single dependency for this tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:DependencyType / cyboxCommon:Dependency_Type
Namespace http://cybox.mitre.org/common-2
Annotations
This field describes the type of this dependency instance.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Dependency_Type" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field describes the type of this dependency instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:DependencyType / cyboxCommon:Dependency_Description
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains a description of this dependency instance.
Diagram
Diagram cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType_structuring_format cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType
Type cyboxCommon:StructuredTextType
Attributes
QName Type Use Annotation
structuring_format xs:string optional
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interfering with XML validation of the CybOX document. If this attribute is absent, the implication is that no markup is being used.
Source
<xs:element name="Dependency_Description" type="cyboxCommon:StructuredTextType">
  <xs:annotation>
    <xs:documentation>This field contains a description of this dependency instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolConfigurationType / cyboxCommon:Usage_Context_Assumptions
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains descriptions of the various relevant usage context assumptions for this tool .
Diagram
Diagram cybox_common_xsd.tmp#UsageContextAssumptionsType_Usage_Context_Assumption cybox_common_xsd.tmp#UsageContextAssumptionsType
Type cyboxCommon:UsageContextAssumptionsType
Children cyboxCommon:Usage_Context_Assumption
Source
<xs:element name="Usage_Context_Assumptions" type="cyboxCommon:UsageContextAssumptionsType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains descriptions of the various relevant usage context assumptions for this tool .</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:UsageContextAssumptionsType / cyboxCommon:Usage_Context_Assumption
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains a single usage context assumption for this tool.
Diagram
Diagram cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType_structuring_format cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType
Type cyboxCommon:StructuredTextType
Attributes
QName Type Use Annotation
structuring_format xs:string optional
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interfering with XML validation of the CybOX document. If this attribute is absent, the implication is that no markup is being used.
Source
<xs:element name="Usage_Context_Assumption" type="cyboxCommon:StructuredTextType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field contains a single usage context assumption for this tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolConfigurationType / cyboxCommon:Internationalization_Settings
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains information describing relevant internationalization setting for this tool .
Diagram
Diagram cybox_common_xsd.tmp#InternationalizationSettingsType_Internal_Strings cybox_common_xsd.tmp#InternationalizationSettingsType
Type cyboxCommon:InternationalizationSettingsType
Children cyboxCommon:Internal_Strings
Source
<xs:element name="Internationalization_Settings" type="cyboxCommon:InternationalizationSettingsType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains information describing relevant internationalization setting for this tool .</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:InternationalizationSettingsType / cyboxCommon:Internal_Strings
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains a single internal string instance for this internationalization setting instance.
Diagram
Diagram cybox_common_xsd.tmp#InternalStringsType_Key cybox_common_xsd.tmp#InternalStringsType_Content cybox_common_xsd.tmp#InternalStringsType
Type cyboxCommon:InternalStringsType
Children cyboxCommon:Content, cyboxCommon:Key
Source
<xs:element name="Internal_Strings" type="cyboxCommon:InternalStringsType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field contains a single internal string instance for this internationalization setting instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:InternalStringsType / cyboxCommon:Key
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains the actual key of this internal string instance.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Key" type="xs:string">
  <xs:annotation>
    <xs:documentation>This field contains the actual key of this internal string instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:InternalStringsType / cyboxCommon:Content
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains the actual content of this internal string instance.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Content" type="xs:string">
  <xs:annotation>
    <xs:documentation>This field contains the actual content of this internal string instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolConfigurationType / cyboxCommon:Build_Information
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains information describing how this tool was built.
Diagram
Diagram cybox_common_xsd.tmp#BuildInformationType_Build_ID cybox_common_xsd.tmp#BuildInformationType_Build_Project cybox_common_xsd.tmp#BuildInformationType_Build_Utility cybox_common_xsd.tmp#BuildInformationType_Build_Version cybox_common_xsd.tmp#BuildInformationType_Build_Label cybox_common_xsd.tmp#BuildInformationType_Compilers cybox_common_xsd.tmp#BuildInformationType_Compilation_Date cybox_common_xsd.tmp#BuildInformationType_Build_Configuration cybox_common_xsd.tmp#BuildInformationType_Build_Script cybox_common_xsd.tmp#BuildInformationType_Libraries cybox_common_xsd.tmp#BuildInformationType_Build_Output_Log cybox_common_xsd.tmp#BuildInformationType
Type cyboxCommon:BuildInformationType
Children cyboxCommon:Build_Configuration, cyboxCommon:Build_ID, cyboxCommon:Build_Label, cyboxCommon:Build_Output_Log, cyboxCommon:Build_Project, cyboxCommon:Build_Script, cyboxCommon:Build_Utility, cyboxCommon:Build_Version, cyboxCommon:Compilation_Date, cyboxCommon:Compilers, cyboxCommon:Libraries
Source
<xs:element name="Build_Information" type="cyboxCommon:BuildInformationType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains information describing how this tool was built.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildInformationType / cyboxCommon:Build_ID
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains an externally defined unique identifier of this build of this application instance.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Build_ID" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains an externally defined unique identifier of this build of this application instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildInformationType / cyboxCommon:Build_Project
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains the project name of this build of this application instance.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Build_Project" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the project name of this build of this application instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildInformationType / cyboxCommon:Build_Utility
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains information identifying the utility used to build this application.
Diagram
Diagram cybox_common_xsd.tmp#BuildUtilityType_Build_Utility_Name cybox_common_xsd.tmp#BuildUtilityType_Build_Utility_Platform_Specification cybox_common_xsd.tmp#BuildUtilityType
Type cyboxCommon:BuildUtilityType
Children cyboxCommon:Build_Utility_Name, cyboxCommon:Build_Utility_Platform_Specification
Source
<xs:element name="Build_Utility" type="cyboxCommon:BuildUtilityType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains information identifying the utility used to build this application.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildUtilityType / cyboxCommon:Build_Utility_Name
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains the informally defined name of the utility used to build this application instance.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Build_Utility_Name" type="xs:string">
  <xs:annotation>
    <xs:documentation>This field contains the informally defined name of the utility used to build this application instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildUtilityType / cyboxCommon:Build_Utility_Platform_Specification
Namespace http://cybox.mitre.org/common-2
Annotations
This field identifies the build utility used to build this application.
Diagram
Diagram cybox_common_xsd.tmp#PlatformSpecificationType_Description cybox_common_xsd.tmp#PlatformSpecificationType_Identifier cybox_common_xsd.tmp#PlatformSpecificationType
Type cyboxCommon:PlatformSpecificationType
Children cyboxCommon:Description, cyboxCommon:Identifier
Source
<xs:element name="Build_Utility_Platform_Specification" type="cyboxCommon:PlatformSpecificationType">
  <xs:annotation>
    <xs:documentation>This field identifies the build utility used to build this application.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:PlatformSpecificationType / cyboxCommon:Description
Namespace http://cybox.mitre.org/common-2
Annotations
A prose description of the indicated platform.
Diagram
Diagram cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType_structuring_format cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType
Type cyboxCommon:StructuredTextType
Attributes
QName Type Use Annotation
structuring_format xs:string optional
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interfering with XML validation of the CybOX document. If this attribute is absent, the implication is that no markup is being used.
Source
<xs:element name="Description" type="cyboxCommon:StructuredTextType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>A prose description of the indicated platform.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:PlatformSpecificationType / cyboxCommon:Identifier
Namespace http://cybox.mitre.org/common-2
Annotations
Indicates a pre-defined name for the given platform using some naming scheme. For example, one could provide a CPE (Common Platform Enumeration) name using the CPE naming format.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype cybox_common_xsd.tmp#StringObjectPropertyType cybox_common_xsd.tmp#PlatformIdentifierType_system cybox_common_xsd.tmp#PlatformIdentifierType_system-ref cybox_common_xsd.tmp#PlatformIdentifierType
Type cyboxCommon:PlatformIdentifierType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional
The id field specifies a unique ID for this Object Property.
idref xs:QName optional
The idref field specifies a unique ID reference for this Object Property.
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
system xs:string optional
Indicates the naming system from which the indicated name was drawn.
system-ref xs:anyURI optional
A reference to information about the naming system from which the indicated name was drawn.
trend xs:boolean optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
<xs:element name="Identifier" type="cyboxCommon:PlatformIdentifierType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>Indicates a pre-defined name for the given platform using some naming scheme. For example, one could provide a CPE (Common Platform Enumeration) name using the CPE naming format.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildInformationType / cyboxCommon:Build_Version
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains the appropriate version descriptor of this build of this application instance.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Build_Version" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the appropriate version descriptor of this build of this application instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildInformationType / cyboxCommon:Build_Label
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains any relevant label for this build of this application instance.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Build_Label" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains any relevant label for this build of this application instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildInformationType / cyboxCommon:Compilers
Namespace http://cybox.mitre.org/common-2
Annotations
This field describes the compilers utilized during this build of this application.
Diagram
Diagram cybox_common_xsd.tmp#CompilersType_Compiler cybox_common_xsd.tmp#CompilersType
Type cyboxCommon:CompilersType
Children cyboxCommon:Compiler
Source
<xs:element name="Compilers" type="cyboxCommon:CompilersType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field describes the compilers utilized during this build of this application.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:CompilersType / cyboxCommon:Compiler
Namespace http://cybox.mitre.org/common-2
Annotations
This field describes a single compiler utilized during this build of this application.
Diagram
Diagram cybox_common_xsd.tmp#CompilerType_Compiler_Informal_Description cybox_common_xsd.tmp#CompilerType_Compiler_Platform_Specification cybox_common_xsd.tmp#CompilerType
Type cyboxCommon:CompilerType
Children cyboxCommon:Compiler_Informal_Description, cyboxCommon:Compiler_Platform_Specification
Source
<xs:element name="Compiler" type="cyboxCommon:CompilerType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field describes a single compiler utilized during this build of this application.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:CompilerType / cyboxCommon:Compiler_Informal_Description
Namespace http://cybox.mitre.org/common-2
Annotations
This field contains the informal description of this compiler instance.
Diagram
Diagram cybox_common_xsd.tmp#CompilerInformalDescriptionType_Compiler_Name cybox_common_xsd.tmp#CompilerInformalDescriptionType_Compiler_Version cybox_common_xsd.tmp#CompilerInformalDescriptionType
Type cyboxCommon:CompilerInformalDescriptionType
Children cyboxCommon:Compiler_Name, cyboxCommon:Compiler_Version
Source
<xs:element name="Compiler_Informal_Description" type="cyboxCommon:CompilerInformalDescriptionType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the informal description of this compiler instance.