Showing:

Annotations
Attributes
Diagrams
Facets
Source
Used by
Imported schema cybox_common.xsd
Namespace http://cybox.mitre.org/common-2
Annotations
 
This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org.
Element cyboxCommon:MeasureSourceType / cyboxCommon:Information_Source_Type
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Information_Source_Type field is optional and utilizes a standardized controlled vocabulary to identify the type of information source leveraged for this cyber observation source.
 
This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is InformationSourceTypeVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.
 
Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.
Diagram
Diagram cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#PatternableFieldType cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_name cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_reference cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType
Type cyboxCommon:ControlledVocabularyStringType
Type hierarchy
Attributes
QName Type Default Use Annotation
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
vocab_name xs:string optional 
The vocab_name field specifies the name of the controlled vocabulary.
vocab_reference xs:anyURI optional 
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
 
<xs:element name="Information_Source_Type" type="cyboxCommon:ControlledVocabularyStringType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Information_Source_Type field is optional and utilizes a standardized controlled vocabulary to identify the type of information source leveraged for this cyber observation source.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is InformationSourceTypeVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.</xs:documentation>
    <xs:documentation>Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:MeasureSourceType / cyboxCommon:Tool_Type
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Tool_Type field is optional and (when tools are used) enables identification of the type of tool leveraged as part of this cyber observation source, via a standardized controlled vocabulary.
 
This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is ToolTypeVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.
 
Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.
Diagram
Diagram cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#PatternableFieldType cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_name cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_reference cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType
Type cyboxCommon:ControlledVocabularyStringType
Type hierarchy
Attributes
QName Type Default Use Annotation
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
vocab_name xs:string optional 
The vocab_name field specifies the name of the controlled vocabulary.
vocab_reference xs:anyURI optional 
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
 
<xs:element name="Tool_Type" type="cyboxCommon:ControlledVocabularyStringType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Tool_Type field is optional and (when tools are used) enables identification of the type of tool leveraged as part of this cyber observation source, via a standardized controlled vocabulary.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is ToolTypeVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.</xs:documentation>
    <xs:documentation>Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:MeasureSourceType / cyboxCommon:Description
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Description field is optional and enables a generalized but structured description of this syber observation source.
Diagram
Diagram cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType_structuring_format cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType
Type cyboxCommon:StructuredTextType
Attributes
QName Type Use Annotation
structuring_format xs:string optional 
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interfering with XML validation of the CybOX document. If this attribute is absent, the implication is that no markup is being used.
Source
 
<xs:element name="Description" type="cyboxCommon:StructuredTextType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Description field is optional and enables a generalized but structured description of this syber observation source.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:MeasureSourceType / cyboxCommon:Contributors
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Contributors field is optional and enables description of the individual contributors involved in this cyber observation source.
Diagram
Diagram cybox_common_xsd.tmp#PersonnelType_Contributor cybox_common_xsd.tmp#PersonnelType
Type cyboxCommon:PersonnelType
Children cyboxCommon:Contributor
Source
 
<xs:element name="Contributors" type="cyboxCommon:PersonnelType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Contributors field is optional and enables description of the individual contributors involved in this cyber observation source.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:PersonnelType / cyboxCommon:Contributor
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains information describing the identify, resources and timing of involvement for a single contributor.
Diagram
Diagram cybox_common_xsd.tmp#ContributorType_Role cybox_common_xsd.tmp#ContributorType_Name cybox_common_xsd.tmp#ContributorType_Email cybox_common_xsd.tmp#ContributorType_Phone cybox_common_xsd.tmp#ContributorType_Organization cybox_common_xsd.tmp#ContributorType_Date cybox_common_xsd.tmp#ContributorType_Contribution_Location cybox_common_xsd.tmp#ContributorType
Type cyboxCommon:ContributorType
Children cyboxCommon:Contribution_Location, cyboxCommon:Date, cyboxCommon:Email, cyboxCommon:Name, cyboxCommon:Organization, cyboxCommon:Phone, cyboxCommon:Role
Source
 
<xs:element name="Contributor" type="cyboxCommon:ContributorType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field contains information describing the identify, resources and timing of involvement for a single contributor.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ContributorType / cyboxCommon:Role
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field describes the role played by this contributor.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Role" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field describes the role played by this contributor.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ContributorType / cyboxCommon:Name
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the name of this contributor.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Name" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the name of this contributor.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ContributorType / cyboxCommon:Email
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the email of this contributor.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Email" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the email of this contributor.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ContributorType / cyboxCommon:Phone
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains a telephone number of this contributor.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Phone" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains a telephone number of this contributor.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ContributorType / cyboxCommon:Organization
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the organization name of this contributor.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Organization" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the organization name of this contributor.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ContributorType / cyboxCommon:Date
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains a description (bounding) of the timing of this contributor's involvement.
Diagram
Diagram cybox_common_xsd.tmp#DateRangeType_Start_Date cybox_common_xsd.tmp#DateRangeType_End_Date cybox_common_xsd.tmp#DateRangeType
Type cyboxCommon:DateRangeType
Children cyboxCommon:End_Date, cyboxCommon:Start_Date
Source
 
<xs:element name="Date" type="cyboxCommon:DateRangeType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains a description (bounding) of the timing of this contributor's involvement.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:DateRangeType / cyboxCommon:Start_Date
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the start date for this contributor's involvement. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
Diagram
Diagram cybox_common_xsd.tmp#DateWithPrecisionType_precision cybox_common_xsd.tmp#DateWithPrecisionType
Type cyboxCommon:DateWithPrecisionType
Attributes
QName Type Default Use Annotation
precision cyboxCommon:DatePrecisionEnum day optional 
The precision of the associated date. If omitted, the default is "day", meaning the full field value.
Source
 
<xs:element name="Start_Date" type="cyboxCommon:DateWithPrecisionType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the start date for this contributor's involvement. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:DateRangeType / cyboxCommon:End_Date
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the end date for this contributor's involvement. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
Diagram
Diagram cybox_common_xsd.tmp#DateWithPrecisionType_precision cybox_common_xsd.tmp#DateWithPrecisionType
Type cyboxCommon:DateWithPrecisionType
Attributes
QName Type Default Use Annotation
precision cyboxCommon:DatePrecisionEnum day optional 
The precision of the associated date. If omitted, the default is "day", meaning the full field value.
Source
 
<xs:element name="End_Date" type="cyboxCommon:DateWithPrecisionType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the end date for this contributor's involvement. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ContributorType / cyboxCommon:Contribution_Location
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains information describing the location at which the contributory activity occured.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Contribution_Location" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains information describing the location at which the contributory activity occured.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:MeasureSourceType / cyboxCommon:Time
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Time field is optional and enables description of various time-related properties for this cyber observation source instance.
Diagram
Diagram cybox_common_xsd.tmp#TimeType_Start_Time cybox_common_xsd.tmp#TimeType_End_Time cybox_common_xsd.tmp#TimeType_Produced_Time cybox_common_xsd.tmp#TimeType_Received_Time cybox_common_xsd.tmp#TimeType
Type cyboxCommon:TimeType
Children cyboxCommon:End_Time, cyboxCommon:Produced_Time, cyboxCommon:Received_Time, cyboxCommon:Start_Time
Source
 
<xs:element name="Time" type="cyboxCommon:TimeType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Time field is optional and enables description of various time-related properties for this cyber observation source instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:TimeType / cyboxCommon:Start_Time
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Start_Time field is optional and describes the starting time for this construct. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
Diagram
Diagram cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_DateTimeWithPrecisionType_precision cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_DateTimeWithPrecisionType
Type cyboxCommon:DateTimeWithPrecisionType
Attributes
QName Type Default Use Annotation
precision cyboxCommon:DateTimePrecisionEnum second optional 
The precision of the associated dateTime. If omitted, the default is "second", meaning the full field value (including fractional seconds).
Source
 
<xs:element name="Start_Time" type="cyboxCommon:DateTimeWithPrecisionType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Start_Time field is optional and describes the starting time for this construct. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:TimeType / cyboxCommon:End_Time
Namespace http://cybox.mitre.org/common-2
Annotations
 
The End_Time field is optional and describes the ending time for this construct. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
Diagram
Diagram cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_DateTimeWithPrecisionType_precision cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_DateTimeWithPrecisionType
Type cyboxCommon:DateTimeWithPrecisionType
Attributes
QName Type Default Use Annotation
precision cyboxCommon:DateTimePrecisionEnum second optional 
The precision of the associated dateTime. If omitted, the default is "second", meaning the full field value (including fractional seconds).
Source
 
<xs:element name="End_Time" type="cyboxCommon:DateTimeWithPrecisionType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The End_Time field is optional and describes the ending time for this construct. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:TimeType / cyboxCommon:Produced_Time
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Produced_Time field is optional and describes the time that this construct was produced. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
Diagram
Diagram cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_DateTimeWithPrecisionType_precision cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_DateTimeWithPrecisionType
Type cyboxCommon:DateTimeWithPrecisionType
Attributes
QName Type Default Use Annotation
precision cyboxCommon:DateTimePrecisionEnum second optional 
The precision of the associated dateTime. If omitted, the default is "second", meaning the full field value (including fractional seconds).
Source
 
<xs:element name="Produced_Time" type="cyboxCommon:DateTimeWithPrecisionType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Produced_Time field is optional and describes the time that this construct was produced. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:TimeType / cyboxCommon:Received_Time
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Received_Time field is optional and describes the time that this construct was received. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
Diagram
Diagram cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_DateTimeWithPrecisionType_precision cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_DateTimeWithPrecisionType
Type cyboxCommon:DateTimeWithPrecisionType
Attributes
QName Type Default Use Annotation
precision cyboxCommon:DateTimePrecisionEnum second optional 
The precision of the associated dateTime. If omitted, the default is "second", meaning the full field value (including fractional seconds).
Source
 
<xs:element name="Received_Time" type="cyboxCommon:DateTimeWithPrecisionType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Received_Time field is optional and describes the time that this construct was received. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:MeasureSourceType / cyboxCommon:Observation_Location
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Observation_Location field specifies a relevant physical location for the observation measurement of the associated Observable.
 
This field is implemented through the xsi:type extension mechanism. The default type is CIQAddressInstanceType in the http://cybox.mitre.org/extensions/Identity#CIQAddress-1 namespace. This type is defined in the extensions/location/ciq_address_3.0.xsd file or at the URL http://cybox.mitre.org/XMLSchema/extensions/location/ciq_address/1.0/ciq_address_3.0.xsd.
 
Those who wish to express a simple name may also do so by not specifying an xsi:type and using the Name field.
Diagram
Diagram cybox_common_xsd.tmp#LocationType_id cybox_common_xsd.tmp#LocationType_idref cybox_common_xsd.tmp#LocationType_Name cybox_common_xsd.tmp#LocationType
Type cyboxCommon:LocationType
Children cyboxCommon:Name
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a unique ID for this Location.
idref xs:QName optional 
Specifies a reference to a unique ID defined elsewhere.
Source
 
<xs:element name="Observation_Location" type="cyboxCommon:LocationType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Observation_Location field specifies a relevant physical location for the observation measurement of the associated Observable.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type extension mechanism. The default type is CIQAddressInstanceType in the http://cybox.mitre.org/extensions/Identity#CIQAddress-1 namespace. This type is defined in the extensions/location/ciq_address_3.0.xsd file or at the URL http://cybox.mitre.org/XMLSchema/extensions/location/ciq_address/1.0/ciq_address_3.0.xsd.</xs:documentation>
    <xs:documentation>Those who wish to express a simple name may also do so by not specifying an xsi:type and using the Name field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:LocationType / cyboxCommon:Name
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Name field allows for expression of an location through a simple name.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Name" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Name field allows for expression of an location through a simple name.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:MeasureSourceType / cyboxCommon:Tools
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Tools field is optional and enables description of the tools utilized for this cyber observation source.
Diagram
Diagram cybox_common_xsd.tmp#ToolsInformationType_Tool cybox_common_xsd.tmp#ToolsInformationType
Type cyboxCommon:ToolsInformationType
Children cyboxCommon:Tool
Source
 
<xs:element name="Tools" type="cyboxCommon:ToolsInformationType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Tools field is optional and enables description of the tools utilized for this cyber observation source.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolsInformationType / cyboxCommon:Tool
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Tool field is optional and enables description of a single tool utilized for this cyber observation source.
Diagram
Diagram cybox_common_xsd.tmp#ToolInformationType_id cybox_common_xsd.tmp#ToolInformationType_idref cybox_common_xsd.tmp#ToolInformationType_Name cybox_common_xsd.tmp#ToolInformationType_Type cybox_common_xsd.tmp#ToolInformationType_Description cybox_common_xsd.tmp#ToolInformationType_References cybox_common_xsd.tmp#ToolInformationType_Vendor cybox_common_xsd.tmp#ToolInformationType_Version cybox_common_xsd.tmp#ToolInformationType_Service_Pack cybox_common_xsd.tmp#ToolInformationType_Tool_Specific_Data cybox_common_xsd.tmp#ToolInformationType_Tool_Hashes cybox_common_xsd.tmp#ToolInformationType_Tool_Configuration cybox_common_xsd.tmp#ToolInformationType_Execution_Environment cybox_common_xsd.tmp#ToolInformationType_Errors cybox_common_xsd.tmp#ToolInformationType_Metadata cybox_common_xsd.tmp#ToolInformationType_Compensation_Model cybox_common_xsd.tmp#ToolInformationType
Type cyboxCommon:ToolInformationType
Children cyboxCommon:Compensation_Model, cyboxCommon:Description, cyboxCommon:Errors, cyboxCommon:Execution_Environment, cyboxCommon:Metadata, cyboxCommon:Name, cyboxCommon:References, cyboxCommon:Service_Pack, cyboxCommon:Tool_Configuration, cyboxCommon:Tool_Hashes, cyboxCommon:Tool_Specific_Data, cyboxCommon:Type, cyboxCommon:Vendor, cyboxCommon:Version
Attributes
QName Type Use Annotation
id xs:QName optional 
The id field specifies a unique ID for this Tool.
idref xs:QName optional 
The idref field specifies reference to a unique ID for this Tool.
 
When idref is specified, the id attribute must not be specified, and any instance of this type should not hold content unless an extension of the type allows it.
Source
 
<xs:element name="Tool" type="cyboxCommon:ToolInformationType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Tool field is optional and enables description of a single tool utilized for this cyber observation source.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Name
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the name of the tool leveraged.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Name" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the name of the tool leveraged.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Type
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the type of the tool leveraged.
 
This field is implemented through the xsi:type controlled vocabulary extension mechanism. No default vocabulary type has been defined for CybOX 2.0. Users may either define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a free string field. Additionally, locations where the ToolInformationType is used may define default vocabularies for this field.
Diagram
Diagram cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#PatternableFieldType cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_name cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_reference cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType
Type cyboxCommon:ControlledVocabularyStringType
Type hierarchy
Attributes
QName Type Default Use Annotation
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
vocab_name xs:string optional 
The vocab_name field specifies the name of the controlled vocabulary.
vocab_reference xs:anyURI optional 
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
 
<xs:element name="Type" type="cyboxCommon:ControlledVocabularyStringType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field contains the type of the tool leveraged.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. No default vocabulary type has been defined for CybOX 2.0. Users may either define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a free string field. Additionally, locations where the ToolInformationType is used may define default vocabularies for this field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Description
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains general descriptive information for this tool.
Diagram
Diagram cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType_structuring_format cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType
Type cyboxCommon:StructuredTextType
Attributes
QName Type Use Annotation
structuring_format xs:string optional 
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interfering with XML validation of the CybOX document. If this attribute is absent, the implication is that no markup is being used.
Source
 
<xs:element name="Description" type="cyboxCommon:StructuredTextType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains general descriptive information for this tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:References
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains references to instances or additional information for this tool.
Diagram
Diagram cybox_common_xsd.tmp#ToolReferencesType_Reference cybox_common_xsd.tmp#ToolReferencesType
Type cyboxCommon:ToolReferencesType
Children cyboxCommon:Reference
Source
 
<xs:element name="References" type="cyboxCommon:ToolReferencesType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains references to instances or additional information for this tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolReferencesType / cyboxCommon:Reference
Namespace http://cybox.mitre.org/common-2
Annotations
 
Contains one reference to information or instances of a given tool.
Diagram
Diagram cybox_common_xsd.tmp#ToolReferenceType_reference_type cybox_common_xsd.tmp#ToolReferenceType
Type cyboxCommon:ToolReferenceType
Attributes
QName Type Use Annotation
reference_type cyboxCommon:ToolReferenceTypeEnum optional 
Indicates the nature of the referenced material (documentation, source, executable, etc.).
Source
 
<xs:element name="Reference" type="cyboxCommon:ToolReferenceType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>Contains one reference to information or instances of a given tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Vendor
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains information identifying the vendor organization for this tool.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Vendor" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains information identifying the vendor organization for this tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Version
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains an appropriate version descriptor of this tool.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Version" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains an appropriate version descriptor of this tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Service_Pack
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains an appropriate service pack descriptor for this tool.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Service_Pack" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains an appropriate service pack descriptor for this tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Tool_Specific_Data
Namespace http://cybox.mitre.org/common-2
Annotations
 
This is an abstract type provided to a flexible mechanism for enabling tool-specific data to be included.
Diagram
Diagram cybox_common_xsd.tmp#ToolSpecificDataType
Type cyboxCommon:ToolSpecificDataType
Source
 
<xs:element name="Tool_Specific_Data" type="cyboxCommon:ToolSpecificDataType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This is an abstract type provided to a flexible mechanism for enabling tool-specific data to be included.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Tool_Hashes
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains a hash value computed on the tool file content in order to verify its integrity.
Diagram
Diagram cybox_common_xsd.tmp#HashListType_Hash cybox_common_xsd.tmp#HashListType
Type cyboxCommon:HashListType
Children cyboxCommon:Hash
Source
 
<xs:element name="Tool_Hashes" type="cyboxCommon:HashListType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains a hash value computed on the tool file content in order to verify its integrity.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashListType / cyboxCommon:Hash
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Hash field specifies a single calculated hash value.
Diagram
Diagram cybox_common_xsd.tmp#HashType_Type cybox_common_xsd.tmp#HashType_Simple_Hash_Value cybox_common_xsd.tmp#HashType_Fuzzy_Hash_Value cybox_common_xsd.tmp#HashType_Fuzzy_Hash_Structure cybox_common_xsd.tmp#HashType
Type cyboxCommon:HashType
Children cyboxCommon:Fuzzy_Hash_Structure, cyboxCommon:Fuzzy_Hash_Value, cyboxCommon:Simple_Hash_Value, cyboxCommon:Type
Source
 
<xs:element name="Hash" type="cyboxCommon:HashType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Hash field specifies a single calculated hash value.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashType / cyboxCommon:Type
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Type field utilizes a standardized controlled vocabulary to capture the type of hash used in the Simple_Hash_Value or Fuzzy_Hash_Value elements.
 
This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is HashNameVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.
 
Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.
Diagram
Diagram cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#PatternableFieldType cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_name cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_reference cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType
Type cyboxCommon:ControlledVocabularyStringType
Type hierarchy
Attributes
QName Type Default Use Annotation
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
vocab_name xs:string optional 
The vocab_name field specifies the name of the controlled vocabulary.
vocab_reference xs:anyURI optional 
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
 
<xs:element name="Type" type="cyboxCommon:ControlledVocabularyStringType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Type field utilizes a standardized controlled vocabulary to capture the type of hash used in the Simple_Hash_Value or Fuzzy_Hash_Value elements.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is HashNameVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.</xs:documentation>
    <xs:documentation>Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashType / cyboxCommon:Simple_Hash_Value
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Simple_Hash_Value field specifies a single result value of a basic cryptograhic hash function outputting a single hexbinary hash value.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#HexBinaryObjectPropertyType_datatype cybox_common_xsd.tmp#HexBinaryObjectPropertyType cybox_common_xsd.tmp#SimpleHashValueType
Type cyboxCommon:SimpleHashValueType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum hexBinary optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Simple_Hash_Value" type="cyboxCommon:SimpleHashValueType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Simple_Hash_Value field specifies a single result value of a basic cryptograhic hash function outputting a single hexbinary hash value.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashType / cyboxCommon:Fuzzy_Hash_Value
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Fuzzy_Hash_Value field specifies a single result value of a cryptograhic fuzzy hash function outputting a single complex string based hash value. (e.g. SSDEEP's Block1hash:Block2hash format).
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype cybox_common_xsd.tmp#StringObjectPropertyType cybox_common_xsd.tmp#FuzzyHashValueType
Type cyboxCommon:FuzzyHashValueType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Fuzzy_Hash_Value" type="cyboxCommon:FuzzyHashValueType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Fuzzy_Hash_Value field specifies a single result value of a cryptograhic fuzzy hash function outputting a single complex string based hash value. (e.g. SSDEEP's Block1hash:Block2hash format).</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashType / cyboxCommon:Fuzzy_Hash_Structure
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Fuzzy_Hash_Structure field is optional and enables the characterization of the key internal components of a fuzzy hash calculation with a given block size.
Diagram
Diagram cybox_common_xsd.tmp#FuzzyHashStructureType_Block_Size cybox_common_xsd.tmp#FuzzyHashStructureType_Block_Hash cybox_common_xsd.tmp#FuzzyHashStructureType
Type cyboxCommon:FuzzyHashStructureType
Children cyboxCommon:Block_Hash, cyboxCommon:Block_Size
Source
 
<xs:element name="Fuzzy_Hash_Structure" type="cyboxCommon:FuzzyHashStructureType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Fuzzy_Hash_Structure field is optional and enables the characterization of the key internal components of a fuzzy hash calculation with a given block size.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:FuzzyHashStructureType / cyboxCommon:Block_Size
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Block_Size field is optional and specifies the calculated block size for this fuzzy hash calculation.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#IntegerObjectPropertyType_datatype cybox_common_xsd.tmp#IntegerObjectPropertyType
Type cyboxCommon:IntegerObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum int optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Block_Size" type="cyboxCommon:IntegerObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Block_Size field is optional and specifies the calculated block size for this fuzzy hash calculation.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:FuzzyHashStructureType / cyboxCommon:Block_Hash
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Block_Hash field is optional and enables specification of the elemental components utilized for a fuzzy hash calculation on the hashed object utilizing Block_Size to calculate trigger points.
Diagram
Diagram cybox_common_xsd.tmp#FuzzyHashBlockType_Block_Hash_Value cybox_common_xsd.tmp#FuzzyHashBlockType_Segment_Count cybox_common_xsd.tmp#FuzzyHashBlockType_Segments cybox_common_xsd.tmp#FuzzyHashBlockType
Type cyboxCommon:FuzzyHashBlockType
Children cyboxCommon:Block_Hash_Value, cyboxCommon:Segment_Count, cyboxCommon:Segments
Source
 
<xs:element name="Block_Hash" type="cyboxCommon:FuzzyHashBlockType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Block_Hash field is optional and enables specification of the elemental components utilized for a fuzzy hash calculation on the hashed object utilizing Block_Size to calculate trigger points.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:FuzzyHashBlockType / cyboxCommon:Block_Hash_Value
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Block_Hash_Value field is optional and specifies a fuzzy hash calculation result value for this Block.
Diagram
Diagram cybox_common_xsd.tmp#HashValueType_Simple_Hash_Value cybox_common_xsd.tmp#HashValueType_Fuzzy_Hash_Value cybox_common_xsd.tmp#HashValueType
Type cyboxCommon:HashValueType
Children cyboxCommon:Fuzzy_Hash_Value, cyboxCommon:Simple_Hash_Value
Source
 
<xs:element name="Block_Hash_Value" type="cyboxCommon:HashValueType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Block_Hash_Value field is optional and specifies a fuzzy hash calculation result value for this Block.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashValueType / cyboxCommon:Simple_Hash_Value
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Simple_Hash_Value field specifies a single result value of a basic cryptograhic hash function outputting a single hexbinary hash value.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#HexBinaryObjectPropertyType_datatype cybox_common_xsd.tmp#HexBinaryObjectPropertyType cybox_common_xsd.tmp#SimpleHashValueType
Type cyboxCommon:SimpleHashValueType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum hexBinary optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Simple_Hash_Value" type="cyboxCommon:SimpleHashValueType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Simple_Hash_Value field specifies a single result value of a basic cryptograhic hash function outputting a single hexbinary hash value.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashValueType / cyboxCommon:Fuzzy_Hash_Value
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Fuzzy_Hash_Value field specifies a single result value of a cryptograhic fuzzy hash function outputting a single complex string based hash value. (e.g. SSDEEP's Block1hash:Block2hash format).
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype cybox_common_xsd.tmp#StringObjectPropertyType cybox_common_xsd.tmp#FuzzyHashValueType
Type cyboxCommon:FuzzyHashValueType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Fuzzy_Hash_Value" type="cyboxCommon:FuzzyHashValueType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Fuzzy_Hash_Value field specifies a single result value of a cryptograhic fuzzy hash function outputting a single complex string based hash value. (e.g. SSDEEP's Block1hash:Block2hash format).</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:FuzzyHashBlockType / cyboxCommon:Segment_Count
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Segment_Count field is optional and specifies the number of segments identified and utilized within this fuzzy hash calculation.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#IntegerObjectPropertyType_datatype cybox_common_xsd.tmp#IntegerObjectPropertyType
Type cyboxCommon:IntegerObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum int optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Segment_Count" type="cyboxCommon:IntegerObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Segment_Count field is optional and specifies the number of segments identified and utilized within this fuzzy hash calculation.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:FuzzyHashBlockType / cyboxCommon:Segments
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Segments field is optional and specifies the set of segments identified and utilized within this fuzzy hash calculation.
Diagram
Diagram cybox_common_xsd.tmp#HashSegmentsType_Segment cybox_common_xsd.tmp#HashSegmentsType
Type cyboxCommon:HashSegmentsType
Children cyboxCommon:Segment
Source
 
<xs:element name="Segments" type="cyboxCommon:HashSegmentsType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Segments field is optional and specifies the set of segments identified and utilized within this fuzzy hash calculation.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashSegmentsType / cyboxCommon:Segment
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Segment field is optional and specifies a single segment identified and utilized within this fuzzy hash calculation.
Diagram
Diagram cybox_common_xsd.tmp#HashSegmentType_Trigger_Point cybox_common_xsd.tmp#HashSegmentType_Segment_Hash cybox_common_xsd.tmp#HashSegmentType_Raw_Segment_Content cybox_common_xsd.tmp#HashSegmentType
Type cyboxCommon:HashSegmentType
Children cyboxCommon:Raw_Segment_Content, cyboxCommon:Segment_Hash, cyboxCommon:Trigger_Point
Source
 
<xs:element name="Segment" type="cyboxCommon:HashSegmentType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Segment field is optional and specifies a single segment identified and utilized within this fuzzy hash calculation.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashSegmentType / cyboxCommon:Trigger_Point
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Trigger_point field is optional and specifies the offset within the hashed object of the trigger point for this segment.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#HexBinaryObjectPropertyType_datatype cybox_common_xsd.tmp#HexBinaryObjectPropertyType
Type cyboxCommon:HexBinaryObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum hexBinary optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Trigger_Point" type="cyboxCommon:HexBinaryObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Trigger_point field is optional and specifies the offset within the hashed object of the trigger point for this segment.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashSegmentType / cyboxCommon:Segment_Hash
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Segment_Hash field is optional and specifies a calculated hash value for this segment.
Diagram
Diagram cybox_common_xsd.tmp#HashValueType_Simple_Hash_Value cybox_common_xsd.tmp#HashValueType_Fuzzy_Hash_Value cybox_common_xsd.tmp#HashValueType
Type cyboxCommon:HashValueType
Children cyboxCommon:Fuzzy_Hash_Value, cyboxCommon:Simple_Hash_Value
Source
 
<xs:element name="Segment_Hash" type="cyboxCommon:HashValueType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Segment_Hash field is optional and specifies a calculated hash value for this segment.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashSegmentType / cyboxCommon:Raw_Segment_Content
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Raw_Segment_Content field is optional and contains the raw content of this segment of the hashed object.
Diagram
Diagram
Source
 
<xs:element name="Raw_Segment_Content" type="xs:anyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Raw_Segment_Content field is optional and contains the raw content of this segment of the hashed object.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Tool_Configuration
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains information describing the configuration and usage of the tool.
Diagram
Diagram cybox_common_xsd.tmp#ToolConfigurationType_Configuration_Settings cybox_common_xsd.tmp#ToolConfigurationType_Dependencies cybox_common_xsd.tmp#ToolConfigurationType_Usage_Context_Assumptions cybox_common_xsd.tmp#ToolConfigurationType_Internationalization_Settings cybox_common_xsd.tmp#ToolConfigurationType_Build_Information cybox_common_xsd.tmp#ToolConfigurationType
Type cyboxCommon:ToolConfigurationType
Children cyboxCommon:Build_Information, cyboxCommon:Configuration_Settings, cyboxCommon:Dependencies, cyboxCommon:Internationalization_Settings, cyboxCommon:Usage_Context_Assumptions
Source
 
<xs:element name="Tool_Configuration" type="cyboxCommon:ToolConfigurationType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains information describing the configuration and usage of the tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolConfigurationType / cyboxCommon:Configuration_Settings
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field describes the configuration settings of this tool instance.
Diagram
Diagram cybox_common_xsd.tmp#ConfigurationSettingsType_Configuration_Setting cybox_common_xsd.tmp#ConfigurationSettingsType
Type cyboxCommon:ConfigurationSettingsType
Children cyboxCommon:Configuration_Setting
Source
 
<xs:element name="Configuration_Settings" type="cyboxCommon:ConfigurationSettingsType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field describes the configuration settings of this tool instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ConfigurationSettingsType / cyboxCommon:Configuration_Setting
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains a single configuration setting instance.
Diagram
Diagram cybox_common_xsd.tmp#ConfigurationSettingType_Item_Name cybox_common_xsd.tmp#ConfigurationSettingType_Item_Value cybox_common_xsd.tmp#ConfigurationSettingType_Item_Type cybox_common_xsd.tmp#ConfigurationSettingType_Item_Description cybox_common_xsd.tmp#ConfigurationSettingType
Type cyboxCommon:ConfigurationSettingType
Children cyboxCommon:Item_Description, cyboxCommon:Item_Name, cyboxCommon:Item_Type, cyboxCommon:Item_Value
Source
 
<xs:element name="Configuration_Setting" type="cyboxCommon:ConfigurationSettingType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field contains a single configuration setting instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ConfigurationSettingType / cyboxCommon:Item_Name
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the name of the configuration item referenced by this configuration setting instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Item_Name" type="xs:string">
  <xs:annotation>
    <xs:documentation>This field contains the name of the configuration item referenced by this configuration setting instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ConfigurationSettingType / cyboxCommon:Item_Value
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the value of this configuration setting instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Item_Value" type="xs:string">
  <xs:annotation>
    <xs:documentation>This field contains the value of this configuration setting instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ConfigurationSettingType / cyboxCommon:Item_Type
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the type of the configuration item referenced in this configuration setting instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Item_Type" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the type of the configuration item referenced in this configuration setting instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ConfigurationSettingType / cyboxCommon:Item_Description
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains a description of the configuration item referenced in this configuration setting instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Item_Description" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains a description of the configuration item referenced in this configuration setting instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolConfigurationType / cyboxCommon:Dependencies
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains information describing the relevant dependencies for this tool.
Diagram
Diagram cybox_common_xsd.tmp#DependenciesType_Dependency cybox_common_xsd.tmp#DependenciesType
Type cyboxCommon:DependenciesType
Children cyboxCommon:Dependency
Source
 
<xs:element name="Dependencies" type="cyboxCommon:DependenciesType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains information describing the relevant dependencies for this tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:DependenciesType / cyboxCommon:Dependency
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains information describing a single dependency for this tool.
Diagram
Diagram cybox_common_xsd.tmp#DependencyType_Dependency_Type cybox_common_xsd.tmp#DependencyType_Dependency_Description cybox_common_xsd.tmp#DependencyType
Type cyboxCommon:DependencyType
Children cyboxCommon:Dependency_Description, cyboxCommon:Dependency_Type
Source
 
<xs:element name="Dependency" type="cyboxCommon:DependencyType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field contains information describing a single dependency for this tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:DependencyType / cyboxCommon:Dependency_Type
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field describes the type of this dependency instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Dependency_Type" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field describes the type of this dependency instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:DependencyType / cyboxCommon:Dependency_Description
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains a description of this dependency instance.
Diagram
Diagram cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType_structuring_format cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType
Type cyboxCommon:StructuredTextType
Attributes
QName Type Use Annotation
structuring_format xs:string optional 
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interfering with XML validation of the CybOX document. If this attribute is absent, the implication is that no markup is being used.
Source
 
<xs:element name="Dependency_Description" type="cyboxCommon:StructuredTextType">
  <xs:annotation>
    <xs:documentation>This field contains a description of this dependency instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolConfigurationType / cyboxCommon:Usage_Context_Assumptions
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains descriptions of the various relevant usage context assumptions for this tool .
Diagram
Diagram cybox_common_xsd.tmp#UsageContextAssumptionsType_Usage_Context_Assumption cybox_common_xsd.tmp#UsageContextAssumptionsType
Type cyboxCommon:UsageContextAssumptionsType
Children cyboxCommon:Usage_Context_Assumption
Source
 
<xs:element name="Usage_Context_Assumptions" type="cyboxCommon:UsageContextAssumptionsType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains descriptions of the various relevant usage context assumptions for this tool .</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:UsageContextAssumptionsType / cyboxCommon:Usage_Context_Assumption
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains a single usage context assumption for this tool.
Diagram
Diagram cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType_structuring_format cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType
Type cyboxCommon:StructuredTextType
Attributes
QName Type Use Annotation
structuring_format xs:string optional 
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interfering with XML validation of the CybOX document. If this attribute is absent, the implication is that no markup is being used.
Source
 
<xs:element name="Usage_Context_Assumption" type="cyboxCommon:StructuredTextType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field contains a single usage context assumption for this tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolConfigurationType / cyboxCommon:Internationalization_Settings
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains information describing relevant internationalization setting for this tool .
Diagram
Diagram cybox_common_xsd.tmp#InternationalizationSettingsType_Internal_Strings cybox_common_xsd.tmp#InternationalizationSettingsType
Type cyboxCommon:InternationalizationSettingsType
Children cyboxCommon:Internal_Strings
Source
 
<xs:element name="Internationalization_Settings" type="cyboxCommon:InternationalizationSettingsType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains information describing relevant internationalization setting for this tool .</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:InternationalizationSettingsType / cyboxCommon:Internal_Strings
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains a single internal string instance for this internationalization setting instance.
Diagram
Diagram cybox_common_xsd.tmp#InternalStringsType_Key cybox_common_xsd.tmp#InternalStringsType_Content cybox_common_xsd.tmp#InternalStringsType
Type cyboxCommon:InternalStringsType
Children cyboxCommon:Content, cyboxCommon:Key
Source
 
<xs:element name="Internal_Strings" type="cyboxCommon:InternalStringsType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field contains a single internal string instance for this internationalization setting instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:InternalStringsType / cyboxCommon:Key
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the actual key of this internal string instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Key" type="xs:string">
  <xs:annotation>
    <xs:documentation>This field contains the actual key of this internal string instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:InternalStringsType / cyboxCommon:Content
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the actual content of this internal string instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Content" type="xs:string">
  <xs:annotation>
    <xs:documentation>This field contains the actual content of this internal string instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolConfigurationType / cyboxCommon:Build_Information
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains information describing how this tool was built.
Diagram
Diagram cybox_common_xsd.tmp#BuildInformationType_Build_ID cybox_common_xsd.tmp#BuildInformationType_Build_Project cybox_common_xsd.tmp#BuildInformationType_Build_Utility cybox_common_xsd.tmp#BuildInformationType_Build_Version cybox_common_xsd.tmp#BuildInformationType_Build_Label cybox_common_xsd.tmp#BuildInformationType_Compilers cybox_common_xsd.tmp#BuildInformationType_Compilation_Date cybox_common_xsd.tmp#BuildInformationType_Build_Configuration cybox_common_xsd.tmp#BuildInformationType_Build_Script cybox_common_xsd.tmp#BuildInformationType_Libraries cybox_common_xsd.tmp#BuildInformationType_Build_Output_Log cybox_common_xsd.tmp#BuildInformationType
Type cyboxCommon:BuildInformationType
Children cyboxCommon:Build_Configuration, cyboxCommon:Build_ID, cyboxCommon:Build_Label, cyboxCommon:Build_Output_Log, cyboxCommon:Build_Project, cyboxCommon:Build_Script, cyboxCommon:Build_Utility, cyboxCommon:Build_Version, cyboxCommon:Compilation_Date, cyboxCommon:Compilers, cyboxCommon:Libraries
Source
 
<xs:element name="Build_Information" type="cyboxCommon:BuildInformationType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains information describing how this tool was built.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildInformationType / cyboxCommon:Build_ID
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains an externally defined unique identifier of this build of this application instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Build_ID" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains an externally defined unique identifier of this build of this application instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildInformationType / cyboxCommon:Build_Project
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the project name of this build of this application instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Build_Project" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the project name of this build of this application instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildInformationType / cyboxCommon:Build_Utility
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains information identifying the utility used to build this application.
Diagram
Diagram cybox_common_xsd.tmp#BuildUtilityType_Build_Utility_Name cybox_common_xsd.tmp#BuildUtilityType_Build_Utility_Platform_Specification cybox_common_xsd.tmp#BuildUtilityType
Type cyboxCommon:BuildUtilityType
Children cyboxCommon:Build_Utility_Name, cyboxCommon:Build_Utility_Platform_Specification
Source
 
<xs:element name="Build_Utility" type="cyboxCommon:BuildUtilityType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains information identifying the utility used to build this application.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildUtilityType / cyboxCommon:Build_Utility_Name
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the informally defined name of the utility used to build this application instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Build_Utility_Name" type="xs:string">
  <xs:annotation>
    <xs:documentation>This field contains the informally defined name of the utility used to build this application instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildUtilityType / cyboxCommon:Build_Utility_Platform_Specification
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field identifies the build utility used to build this application.
Diagram
Diagram cybox_common_xsd.tmp#PlatformSpecificationType_Description cybox_common_xsd.tmp#PlatformSpecificationType_Identifier cybox_common_xsd.tmp#PlatformSpecificationType
Type cyboxCommon:PlatformSpecificationType
Children cyboxCommon:Description, cyboxCommon:Identifier
Source
 
<xs:element name="Build_Utility_Platform_Specification" type="cyboxCommon:PlatformSpecificationType">
  <xs:annotation>
    <xs:documentation>This field identifies the build utility used to build this application.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:PlatformSpecificationType / cyboxCommon:Description
Namespace http://cybox.mitre.org/common-2
Annotations
 
A prose description of the indicated platform.
Diagram
Diagram cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType_structuring_format cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType
Type cyboxCommon:StructuredTextType
Attributes
QName Type Use Annotation
structuring_format xs:string optional 
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interfering with XML validation of the CybOX document. If this attribute is absent, the implication is that no markup is being used.
Source
 
<xs:element name="Description" type="cyboxCommon:StructuredTextType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>A prose description of the indicated platform.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:PlatformSpecificationType / cyboxCommon:Identifier
Namespace http://cybox.mitre.org/common-2
Annotations
 
Indicates a pre-defined name for the given platform using some naming scheme. For example, one could provide a CPE (Common Platform Enumeration) name using the CPE naming format.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype cybox_common_xsd.tmp#StringObjectPropertyType cybox_common_xsd.tmp#PlatformIdentifierType_system cybox_common_xsd.tmp#PlatformIdentifierType_system-ref cybox_common_xsd.tmp#PlatformIdentifierType
Type cyboxCommon:PlatformIdentifierType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
system xs:string optional 
Indicates the naming system from which the indicated name was drawn.
system-ref xs:anyURI optional 
A reference to information about the naming system from which the indicated name was drawn.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Identifier" type="cyboxCommon:PlatformIdentifierType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>Indicates a pre-defined name for the given platform using some naming scheme. For example, one could provide a CPE (Common Platform Enumeration) name using the CPE naming format.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildInformationType / cyboxCommon:Build_Version
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the appropriate version descriptor of this build of this application instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Build_Version" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the appropriate version descriptor of this build of this application instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildInformationType / cyboxCommon:Build_Label
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains any relevant label for this build of this application instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Build_Label" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains any relevant label for this build of this application instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildInformationType / cyboxCommon:Compilers
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field describes the compilers utilized during this build of this application.
Diagram
Diagram cybox_common_xsd.tmp#CompilersType_Compiler cybox_common_xsd.tmp#CompilersType
Type cyboxCommon:CompilersType
Children cyboxCommon:Compiler
Source
 
<xs:element name="Compilers" type="cyboxCommon:CompilersType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field describes the compilers utilized during this build of this application.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:CompilersType / cyboxCommon:Compiler
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field describes a single compiler utilized during this build of this application.
Diagram
Diagram cybox_common_xsd.tmp#CompilerType_Compiler_Informal_Description cybox_common_xsd.tmp#CompilerType_Compiler_Platform_Specification cybox_common_xsd.tmp#CompilerType
Type cyboxCommon:CompilerType
Children cyboxCommon:Compiler_Informal_Description, cyboxCommon:Compiler_Platform_Specification
Source
 
<xs:element name="Compiler" type="cyboxCommon:CompilerType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field describes a single compiler utilized during this build of this application.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:CompilerType / cyboxCommon:Compiler_Informal_Description
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the informal description of this compiler instance.
Diagram
Diagram cybox_common_xsd.tmp#CompilerInformalDescriptionType_Compiler_Name cybox_common_xsd.tmp#CompilerInformalDescriptionType_Compiler_Version cybox_common_xsd.tmp#CompilerInformalDescriptionType
Type cyboxCommon:CompilerInformalDescriptionType
Children cyboxCommon:Compiler_Name, cyboxCommon:Compiler_Version
Source
 
<xs:element name="Compiler_Informal_Description" type="cyboxCommon:CompilerInformalDescriptionType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the informal description of this compiler instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:CompilerInformalDescriptionType / cyboxCommon:Compiler_Name
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the name of the compiler.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Compiler_Name" type="xs:string">
  <xs:annotation>
    <xs:documentation>This field contains the name of the compiler.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:CompilerInformalDescriptionType / cyboxCommon:Compiler_Version
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the version of the compiler.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Compiler_Version" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the version of the compiler.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:CompilerType / cyboxCommon:Compiler_Platform_Specification
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field identifies this compiler instance.
Diagram
Diagram cybox_common_xsd.tmp#PlatformSpecificationType_Description cybox_common_xsd.tmp#PlatformSpecificationType_Identifier cybox_common_xsd.tmp#PlatformSpecificationType
Type cyboxCommon:PlatformSpecificationType
Children cyboxCommon:Description, cyboxCommon:Identifier
Source
 
<xs:element name="Compiler_Platform_Specification" type="cyboxCommon:PlatformSpecificationType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field identifies this compiler instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildInformationType / cyboxCommon:Compilation_Date
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field identifies the compilation date for the build of the tool. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
Diagram
Diagram cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_DateTimeWithPrecisionType_precision cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_DateTimeWithPrecisionType
Type cyboxCommon:DateTimeWithPrecisionType
Attributes
QName Type Default Use Annotation
precision cyboxCommon:DateTimePrecisionEnum second optional 
The precision of the associated dateTime. If omitted, the default is "second", meaning the full field value (including fractional seconds).
Source
 
<xs:element name="Compilation_Date" type="cyboxCommon:DateTimeWithPrecisionType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field identifies the compilation date for the build of the tool. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildInformationType / cyboxCommon:Build_Configuration
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field describes how the build utility was configured for this build of this application.
Diagram
Diagram cybox_common_xsd.tmp#BuildConfigurationType_Configuration_Setting_Description cybox_common_xsd.tmp#BuildConfigurationType_Configuration_Settings cybox_common_xsd.tmp#BuildConfigurationType
Type cyboxCommon:BuildConfigurationType
Children cyboxCommon:Configuration_Setting_Description, cyboxCommon:Configuration_Settings
Source
 
<xs:element name="Build_Configuration" type="cyboxCommon:BuildConfigurationType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field describes how the build utility was configured for this build of this application.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildConfigurationType / cyboxCommon:Configuration_Setting_Description
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the description of the configuration settings for this build of this application instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Configuration_Setting_Description" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the description of the configuration settings for this build of this application instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildConfigurationType / cyboxCommon:Configuration_Settings
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the configuration settings for this build of this application instance.
Diagram
Diagram cybox_common_xsd.tmp#ConfigurationSettingsType_Configuration_Setting cybox_common_xsd.tmp#ConfigurationSettingsType
Type cyboxCommon:ConfigurationSettingsType
Children cyboxCommon:Configuration_Setting
Source
 
<xs:element name="Configuration_Settings" type="cyboxCommon:ConfigurationSettingsType">
  <xs:annotation>
    <xs:documentation>This field contains the configuration settings for this build of this application instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildInformationType / cyboxCommon:Build_Script
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the actual build script for this build of this application instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Build_Script" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the actual build script for this build of this application instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildInformationType / cyboxCommon:Libraries
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field identifies the libraries incorporated into the build of the tool.
Diagram
Diagram cybox_common_xsd.tmp#LibrariesType_Library cybox_common_xsd.tmp#LibrariesType
Type cyboxCommon:LibrariesType
Children cyboxCommon:Library
Source
 
<xs:element name="Libraries" type="cyboxCommon:LibrariesType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field identifies the libraries incorporated into the build of the tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:LibrariesType / cyboxCommon:Library
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field identifies a library incorporated into the build of the tool.
Diagram
Diagram cybox_common_xsd.tmp#LibraryType_name cybox_common_xsd.tmp#LibraryType_version cybox_common_xsd.tmp#LibraryType
Type cyboxCommon:LibraryType
Attributes
QName Type Use Annotation
name xs:string optional 
This field identifies the name of the library.
version xs:string optional 
This field identifies the version of the library.
Source
 
<xs:element name="Library" type="cyboxCommon:LibraryType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field identifies a library incorporated into the build of the tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildInformationType / cyboxCommon:Build_Output_Log
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains a capture of the output log of the build process.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Build_Output_Log" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains a capture of the output log of the build process.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Execution_Environment
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains information describing the execution environment of the tool.
Diagram
Diagram cybox_common_xsd.tmp#ExecutionEnvironmentType_System cybox_common_xsd.tmp#ExecutionEnvironmentType_User_Account_Info cybox_common_xsd.tmp#ExecutionEnvironmentType_Command_Line cybox_common_xsd.tmp#ExecutionEnvironmentType_Start_Time cybox_common_xsd.tmp#ExecutionEnvironmentType
Type cyboxCommon:ExecutionEnvironmentType
Children cyboxCommon:Command_Line, cyboxCommon:Start_Time, cyboxCommon:System, cyboxCommon:User_Account_Info
Source
 
<xs:element name="Execution_Environment" type="cyboxCommon:ExecutionEnvironmentType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains information describing the execution environment of the tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ExecutionEnvironmentType / cyboxCommon:System
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains information describing the system on which the tool was executed. System should be of type SystemObj:SystemObjectType.
Diagram
Diagram cybox_common_xsd.tmp#ObjectPropertiesType_object_reference cybox_common_xsd.tmp#ObjectPropertiesType_Custom_Properties cybox_common_xsd.tmp#ObjectPropertiesType
Type cyboxCommon:ObjectPropertiesType
Children cyboxCommon:Custom_Properties
Attributes
QName Type Use Annotation
object_reference xs:QName optional 
The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
Source
 
<xs:element name="System" type="cyboxCommon:ObjectPropertiesType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains information describing the system on which the tool was executed. System should be of type SystemObj:SystemObjectType.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ObjectPropertiesType / cyboxCommon:Custom_Properties
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Custom_Properties construct is optional and enables the specification of a set of custom Object Properties that may not be defined in existing Properties schemas.
Diagram
Diagram cybox_common_xsd.tmp#CustomPropertiesType_Property cybox_common_xsd.tmp#CustomPropertiesType
Type cyboxCommon:CustomPropertiesType
Children cyboxCommon:Property
Source
 
<xs:element name="Custom_Properties" type="cyboxCommon:CustomPropertiesType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Custom_Properties construct is optional and enables the specification of a set of custom Object Properties that may not be defined in existing Properties schemas.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:CustomPropertiesType / cyboxCommon:Property
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Property construct enables the specification of a single Object Property.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#PropertyType_name cybox_common_xsd.tmp#PropertyType_description cybox_common_xsd.tmp#PropertyType
Type cyboxCommon:PropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the expected type for the value of the specified property.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
description xs:string optional 
A description of what this property represents.
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
name xs:string optional 
The name field specifies a name for this property.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Property" type="cyboxCommon:PropertyType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Property construct enables the specification of a single Object Property.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ExecutionEnvironmentType / cyboxCommon:User_Account_Info
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains information describing the user account that executed the tool. User_Account_Info should be of type UserAccountObj:UserAccountObjectType.
Diagram
Diagram cybox_common_xsd.tmp#ObjectPropertiesType_object_reference cybox_common_xsd.tmp#ObjectPropertiesType_Custom_Properties cybox_common_xsd.tmp#ObjectPropertiesType
Type cyboxCommon:ObjectPropertiesType
Children cyboxCommon:Custom_Properties
Attributes
QName Type Use Annotation
object_reference xs:QName optional 
The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
Source
 
<xs:element name="User_Account_Info" type="cyboxCommon:ObjectPropertiesType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains information describing the user account that executed the tool. User_Account_Info should be of type UserAccountObj:UserAccountObjectType.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ExecutionEnvironmentType / cyboxCommon:Command_Line
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field specifies the command line string used to run the tool.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Command_Line" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field specifies the command line string used to run the tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ExecutionEnvironmentType / cyboxCommon:Start_Time
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field specifies when the tool was run. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
Diagram
Diagram cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_DateTimeWithPrecisionType_precision cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_DateTimeWithPrecisionType
Type cyboxCommon:DateTimeWithPrecisionType
Attributes
QName Type Default Use Annotation
precision cyboxCommon:DateTimePrecisionEnum second optional 
The precision of the associated dateTime. If omitted, the default is "second", meaning the full field value (including fractional seconds).
Source
 
<xs:element name="Start_Time" type="cyboxCommon:DateTimeWithPrecisionType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field specifies when the tool was run. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Errors
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field captures any errors generated during the run of the tool.
Diagram
Diagram cybox_common_xsd.tmp#ErrorsType_Error cybox_common_xsd.tmp#ErrorsType
Type cyboxCommon:ErrorsType
Children cyboxCommon:Error
Source
 
<xs:element name="Errors" type="cyboxCommon:ErrorsType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field captures any errors generated during the run of the tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ErrorsType / cyboxCommon:Error
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field captures a single type of error generated during the run of the tool.
Diagram
Diagram cybox_common_xsd.tmp#ErrorType_Error_Type cybox_common_xsd.tmp#ErrorType_Error_Count cybox_common_xsd.tmp#ErrorType_Error_Instances cybox_common_xsd.tmp#ErrorType
Type cyboxCommon:ErrorType
Children cyboxCommon:Error_Count, cyboxCommon:Error_Instances, cyboxCommon:Error_Type
Source
 
<xs:element name="Error" type="cyboxCommon:ErrorType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field captures a single type of error generated during the run of the tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ErrorType / cyboxCommon:Error_Type
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field specifies the type for this tool run error.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Error_Type" type="xs:string">
  <xs:annotation>
    <xs:documentation>This field specifies the type for this tool run error.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ErrorType / cyboxCommon:Error_Count
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field specifies the count of instances for this error in the tool run.
Diagram
Diagram
Type xs:integer
Source
 
<xs:element name="Error_Count" type="xs:integer" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field specifies the count of instances for this error in the tool run.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ErrorType / cyboxCommon:Error_Instances
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field captures the actual error output for each instance of this type of error.
Diagram
Diagram cybox_common_xsd.tmp#ErrorInstancesType_Error_Instance cybox_common_xsd.tmp#ErrorInstancesType
Type cyboxCommon:ErrorInstancesType
Children cyboxCommon:Error_Instance
Source
 
<xs:element name="Error_Instances" type="cyboxCommon:ErrorInstancesType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field captures the actual error output for each instance of this type of error.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ErrorInstancesType / cyboxCommon:Error_Instance
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field captures the actual error output for a single instance of this type of error.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Error_Instance" type="xs:string" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field captures the actual error output for a single instance of this type of error.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Metadata
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field captures other relevant metadata including tool-specific fields.
Diagram
Diagram cybox_common_xsd.tmp#MetadataType_type cybox_common_xsd.tmp#MetadataType_Value cybox_common_xsd.tmp#MetadataType_SubDatum cybox_common_xsd.tmp#MetadataType
Type cyboxCommon:MetadataType
Children cyboxCommon:SubDatum, cyboxCommon:Value
Attributes
QName Type Use Annotation
type xs:string optional 
This field specifies the type of name of a single metadata field.
Source
 
<xs:element name="Metadata" type="cyboxCommon:MetadataType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field captures other relevant metadata including tool-specific fields.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:MetadataType / cyboxCommon:Value
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field specifies the value of name of a single metadata field.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Value" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field specifies the value of name of a single metadata field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:MetadataType / cyboxCommon:SubDatum
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field uses recursion of the MetadataType specify subdatum structures for this metadata field.
Diagram
Diagram cybox_common_xsd.tmp#MetadataType_type cybox_common_xsd.tmp#MetadataType_Value cybox_common_xsd.tmp#MetadataType_SubDatum cybox_common_xsd.tmp#MetadataType
Type cyboxCommon:MetadataType
Children cyboxCommon:SubDatum, cyboxCommon:Value
Attributes
QName Type Use Annotation
type xs:string optional 
This field specifies the type of name of a single metadata field.
Source
 
<xs:element name="SubDatum" type="cyboxCommon:MetadataType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field uses recursion of the MetadataType specify subdatum structures for this metadata field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Compensation_Model
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the name of the compensation model used for the tool.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#CompensationModelType_datatype cybox_common_xsd.tmp#CompensationModelType
Type cyboxCommon:CompensationModelType
Type hierarchy
Attributes
QName Type Fixed Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the expected type for the value of the specified property.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Compensation_Model" type="cyboxCommon:CompensationModelType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the name of the compensation model used for the tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:MeasureSourceType / cyboxCommon:Platform
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Platform field is optional and enables a formal, standardized specification of the platform for this cyber observation source.
Diagram
Diagram cybox_common_xsd.tmp#PlatformSpecificationType_Description cybox_common_xsd.tmp#PlatformSpecificationType_Identifier cybox_common_xsd.tmp#PlatformSpecificationType
Type cyboxCommon:PlatformSpecificationType
Children cyboxCommon:Description, cyboxCommon:Identifier
Source
 
<xs:element name="Platform" type="cyboxCommon:PlatformSpecificationType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Platform field is optional and enables a formal, standardized specification of the platform for this cyber observation source.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:MeasureSourceType / cyboxCommon:System
Namespace http://cybox.mitre.org/common-2
Annotations
 
The System field is optional and enables characterization of the system on which the mechanism of cyber observation executed. System should be an object of type SystemObj:SystemObjectType.
Diagram
Diagram cybox_common_xsd.tmp#ObjectPropertiesType_object_reference cybox_common_xsd.tmp#ObjectPropertiesType_Custom_Properties cybox_common_xsd.tmp#ObjectPropertiesType
Type cyboxCommon:ObjectPropertiesType
Children cyboxCommon:Custom_Properties
Attributes
QName Type Use Annotation
object_reference xs:QName optional 
The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
Source
 
<xs:element name="System" type="cyboxCommon:ObjectPropertiesType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The System field is optional and enables characterization of the system on which the mechanism of cyber observation executed. System should be an object of type SystemObj:SystemObjectType.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:MeasureSourceType / cyboxCommon:Instance
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Instance field is optional and enables characterization of the process instance in which the mechanism of cyber observation executed. Instance should be of type ProcessObj:ProcessObjectType.
Diagram
Diagram cybox_common_xsd.tmp#ObjectPropertiesType_object_reference cybox_common_xsd.tmp#ObjectPropertiesType_Custom_Properties cybox_common_xsd.tmp#ObjectPropertiesType
Type cyboxCommon:ObjectPropertiesType
Children cyboxCommon:Custom_Properties
Attributes
QName Type Use Annotation
object_reference xs:QName optional 
The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
Source
 
<xs:element name="Instance" type="cyboxCommon:ObjectPropertiesType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Instance field is optional and enables characterization of the process instance in which the mechanism of cyber observation executed. Instance should be of type ProcessObj:ProcessObjectType.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:MeasureSourceType / cyboxCommon:Observable_Location
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Observable_Location field specifies a relevant physical location for the associated Observable.
 
This field is implemented through the xsi:type extension mechanism. The default type is CIQAddressInstanceType in the http://cybox.mitre.org/extensions/Identity#CIQAddress-1 namespace. This type is defined in the extensions/location/ciq_address_3.0.xsd file or at the URL http://cybox.mitre.org/XMLSchema/extensions/location/ciq_address/1.0/ciq_address_3.0.xsd.
 
Those who wish to express a simple name may also do so by not specifying an xsi:type and using the Name field.
Diagram
Diagram cybox_common_xsd.tmp#LocationType_id cybox_common_xsd.tmp#LocationType_idref cybox_common_xsd.tmp#LocationType_Name cybox_common_xsd.tmp#LocationType
Type cyboxCommon:LocationType
Children cyboxCommon:Name
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a unique ID for this Location.
idref xs:QName optional 
Specifies a reference to a unique ID defined elsewhere.
Source
 
<xs:element name="Observable_Location" type="cyboxCommon:LocationType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Observable_Location field specifies a relevant physical location for the associated Observable.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type extension mechanism. The default type is CIQAddressInstanceType in the http://cybox.mitre.org/extensions/Identity#CIQAddress-1 namespace. This type is defined in the extensions/location/ciq_address_3.0.xsd file or at the URL http://cybox.mitre.org/XMLSchema/extensions/location/ciq_address/1.0/ciq_address_3.0.xsd.</xs:documentation>
    <xs:documentation>Those who wish to express a simple name may also do so by not specifying an xsi:type and using the Name field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:DataSegmentType / cyboxCommon:Data_Format
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Data_Format field refers to the type of data contained in the Data_Segment element.
Diagram
Diagram cybox_common_xsd.tmp#DataFormatEnum
Type cyboxCommon:DataFormatEnum
Facets
enumeration Binary 
Specifies binary data.
enumeration Hexadecimal 
Specifies hexadecimal data.
enumeration Text 
Specifies text.
enumeration Other 
Specifies any other type of data from the ones listed.
Source
 
<xs:element name="Data_Format" type="cyboxCommon:DataFormatEnum" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Data_Format field refers to the type of data contained in the Data_Segment element.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:DataSegmentType / cyboxCommon:Data_Size
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Data_Size field contains the size of the data contained in this element.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype cybox_common_xsd.tmp#StringObjectPropertyType cybox_common_xsd.tmp#DataSizeType_units cybox_common_xsd.tmp#DataSizeType
Type cyboxCommon:DataSizeType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
units cyboxCommon:DataSizeUnitsEnum required 
This field represents the Units used in the object size element.
Source
 
<xs:element name="Data_Size" type="cyboxCommon:DataSizeType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Data_Size field contains the size of the data contained in this element.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:DataSegmentType / cyboxCommon:Byte_Order
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Byte_Order field specifies the endianness of the unpacked (e.g., decoded, unencrypted, etc.) data stored within the Data_Segment field.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#EndiannessType_datatype cybox_common_xsd.tmp#EndiannessType
Type cyboxCommon:EndiannessType
Type hierarchy
Attributes
QName Type Fixed Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the expected type for the value of the specified property.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Byte_Order" type="cyboxCommon:EndiannessType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Byte_Order field specifies the endianness of the unpacked (e.g., decoded, unencrypted, etc.) data stored within the Data_Segment field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:DataSegmentType / cyboxCommon:Data_Segment
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Data_Segment field contains the actual segment of data being characterized.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype cybox_common_xsd.tmp#StringObjectPropertyType
Type cyboxCommon:StringObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Data_Segment" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Data_Segment field contains the actual segment of data being characterized.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:DataSegmentType / cyboxCommon:Offset
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Offset field allows for the specification of where to start searching for the specified data segment in an object, in bytes.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#IntegerObjectPropertyType_datatype cybox_common_xsd.tmp#IntegerObjectPropertyType
Type cyboxCommon:IntegerObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum int optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Offset" type="cyboxCommon:IntegerObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Offset field allows for the specification of where to start searching for the specified data segment in an object, in bytes.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:DataSegmentType / cyboxCommon:Search_Distance
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Search_Distance field specifies how far into an object should be ignored, in bytes, before starting to search for the specified data segment relative to the end of the previous data segment.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#IntegerObjectPropertyType_datatype cybox_common_xsd.tmp#IntegerObjectPropertyType
Type cyboxCommon:IntegerObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum int optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Search_Distance" type="cyboxCommon:IntegerObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Search_Distance field specifies how far into an object should be ignored, in bytes, before starting to search for the specified data segment relative to the end of the previous data segment.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:DataSegmentType / cyboxCommon:Search_Within
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Search_Within field specifies that at most N bytes are between data segments in related objects.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#IntegerObjectPropertyType_datatype cybox_common_xsd.tmp#IntegerObjectPropertyType
Type cyboxCommon:IntegerObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum int optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Search_Within" type="cyboxCommon:IntegerObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Search_Within field specifies that at most N bytes are between data segments in related objects.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ExtractedFeaturesType / cyboxCommon:Strings
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field enables description of a set of static strings extracted from a raw cyber object.
Diagram
Diagram cybox_common_xsd.tmp#ExtractedStringsType_String cybox_common_xsd.tmp#ExtractedStringsType
Type cyboxCommon:ExtractedStringsType
Children cyboxCommon:String
Source
 
<xs:element name="Strings" type="cyboxCommon:ExtractedStringsType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field enables description of a set of static strings extracted from a raw cyber object.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ExtractedStringsType / cyboxCommon:String
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field enables description of a single static string extracted from a raw cyber object.
Diagram
Diagram cybox_common_xsd.tmp#ExtractedStringType_Encoding cybox_common_xsd.tmp#ExtractedStringType_String_Value cybox_common_xsd.tmp#ExtractedStringType_Byte_String_Value cybox_common_xsd.tmp#ExtractedStringType_Hashes cybox_common_xsd.tmp#ExtractedStringType_Address cybox_common_xsd.tmp#ExtractedStringType_Length cybox_common_xsd.tmp#ExtractedStringType_Language cybox_common_xsd.tmp#ExtractedStringType_English_Translation cybox_common_xsd.tmp#ExtractedStringType
Type cyboxCommon:ExtractedStringType
Children cyboxCommon:Address, cyboxCommon:Byte_String_Value, cyboxCommon:Encoding, cyboxCommon:English_Translation, cyboxCommon:Hashes, cyboxCommon:Language, cyboxCommon:Length, cyboxCommon:String_Value
Source
 
<xs:element name="String" type="cyboxCommon:ExtractedStringType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field enables description of a single static string extracted from a raw cyber object.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ExtractedStringType / cyboxCommon:Encoding
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Encoding field refers to the encoding method used for the string extracted from the CybOX object, via a standardized controlled vocabulary.
 
This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is CharacterEncodingVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.
 
Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.
Diagram
Diagram cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#PatternableFieldType cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_name cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_reference cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType
Type cyboxCommon:ControlledVocabularyStringType
Type hierarchy
Attributes
QName Type Default Use Annotation
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
vocab_name xs:string optional 
The vocab_name field specifies the name of the controlled vocabulary.
vocab_reference xs:anyURI optional 
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
 
<xs:element name="Encoding" type="cyboxCommon:ControlledVocabularyStringType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Encoding field refers to the encoding method used for the string extracted from the CybOX object, via a standardized controlled vocabulary.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is CharacterEncodingVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.</xs:documentation>
    <xs:documentation>Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ExtractedStringType / cyboxCommon:String_Value
Namespace http://cybox.mitre.org/common-2
Annotations
 
The String_Value field specifies the actual value of the string extracted from the CybOX object, if it is capable of being represented in the encoding scheme used in the document (most commonly UTF-8).
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype cybox_common_xsd.tmp#StringObjectPropertyType
Type cyboxCommon:StringObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="String_Value" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The String_Value field specifies the actual value of the string extracted from the CybOX object, if it is capable of being represented in the encoding scheme used in the document (most commonly UTF-8).</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ExtractedStringType / cyboxCommon:Byte_String_Value
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Byte_String_Value field specifies the raw, byte-string representation of the string extracted from the CybOX object, in hexadecimal format.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#HexBinaryObjectPropertyType_datatype cybox_common_xsd.tmp#HexBinaryObjectPropertyType
Type cyboxCommon:HexBinaryObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum hexBinary optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Byte_String_Value" type="cyboxCommon:HexBinaryObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Byte_String_Value field specifies the raw, byte-string representation of the string extracted from the CybOX object, in hexadecimal format.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ExtractedStringType / cyboxCommon:Hashes
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Hashes field is used to include any hash values computed using the string extracted from the CybOX object as input.
Diagram
Diagram cybox_common_xsd.tmp#HashListType_Hash cybox_common_xsd.tmp#HashListType
Type cyboxCommon:HashListType
Children cyboxCommon:Hash
Source
 
<xs:element name="Hashes" type="cyboxCommon:HashListType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Hashes field is used to include any hash values computed using the string extracted from the CybOX object as input.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ExtractedStringType / cyboxCommon:Address
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Address field specifies the location or offset of the specified string in the CybOX objects.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#HexBinaryObjectPropertyType_datatype cybox_common_xsd.tmp#HexBinaryObjectPropertyType
Type cyboxCommon:HexBinaryObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum hexBinary optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Address" type="cyboxCommon:HexBinaryObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Address field specifies the location or offset of the specified string in the CybOX objects.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ExtractedStringType / cyboxCommon:Length
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Length field specifies the length, in characters, of the string extracted from the CybOX object.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#PositiveIntegerObjectPropertyType_datatype cybox_common_xsd.tmp#PositiveIntegerObjectPropertyType
Type cyboxCommon:PositiveIntegerObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum positiveInteger optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Length" type="cyboxCommon:PositiveIntegerObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Length field specifies the length, in characters, of the string extracted from the CybOX object.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ExtractedStringType / cyboxCommon:Language
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Language field specifies the language the string is written in, e.g. English. For consistency, we strongly recommend using the ISO 639-2 language code, if available. Please see http://www.loc.gov/standards/iso639-2/php/code_list.php for a list of ISO 639-2 codes.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype cybox_common_xsd.tmp#StringObjectPropertyType
Type cyboxCommon:StringObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Language" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Language field specifies the language the string is written in, e.g. English. For consistency, we strongly recommend using the ISO 639-2 language code, if available. Please see http://www.loc.gov/standards/iso639-2/php/code_list.php for a list of ISO 639-2 codes.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ExtractedStringType / cyboxCommon:English_Translation
Namespace http://cybox.mitre.org/common-2
Annotations
 
The English_Translation field specifies the English translation of the string, if it is not written in English.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype cybox_common_xsd.tmp#StringObjectPropertyType
Type cyboxCommon:StringObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="English_Translation" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The English_Translation field specifies the English translation of the string, if it is not written in English.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ExtractedFeaturesType / cyboxCommon:Imports
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field enables description of a set of references to external resources imported by a raw cyber object.
Diagram
Diagram cybox_common_xsd.tmp#ImportsType_Import cybox_common_xsd.tmp#ImportsType
Type cyboxCommon:ImportsType
Children cyboxCommon:Import
Source
 
<xs:element name="Imports" type="cyboxCommon:ImportsType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field enables description of a set of references to external resources imported by a raw cyber object.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ImportsType / cyboxCommon:Import
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field enables description of a single reference to an external resource imported by a raw cyber object.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype cybox_common_xsd.tmp#StringObjectPropertyType
Type cyboxCommon:StringObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Import" type="cyboxCommon:StringObjectPropertyType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field enables description of a single reference to an external resource imported by a raw cyber object.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ExtractedFeaturesType / cyboxCommon:Functions
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field enables description of a set of references to functions called by a raw cyber object.
Diagram
Diagram cybox_common_xsd.tmp#FunctionsType_Function cybox_common_xsd.tmp#FunctionsType
Type cyboxCommon:FunctionsType
Children cyboxCommon:Function
Source
 
<xs:element name="Functions" type="cyboxCommon:FunctionsType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field enables description of a set of references to functions called by a raw cyber object.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:FunctionsType / cyboxCommon:Function
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field enables description of a single reference to a function called by a raw cyber object.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype cybox_common_xsd.tmp#StringObjectPropertyType
Type cyboxCommon:StringObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Function" type="cyboxCommon:StringObjectPropertyType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field enables description of a single reference to a function called by a raw cyber object.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ExtractedFeaturesType / cyboxCommon:Code_Snippets
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field enables description of a set of code snippets extracted from a raw cyber object.
Diagram
Diagram cybox_common_xsd.tmp#CodeSnippetsType_Code_Snippet cybox_common_xsd.tmp#CodeSnippetsType
Type cyboxCommon:CodeSnippetsType
Children cyboxCommon:Code_Snippet
Source
 
<xs:element name="Code_Snippets" type="cyboxCommon:CodeSnippetsType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field enables description of a set of code snippets extracted from a raw cyber object.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:CodeSnippetsType / cyboxCommon:Code_Snippet
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field enables description of a single code snippet extracted from a raw cyber object. Code_Snippet should be of CodeObj:CodeObjectType.
Diagram
Diagram cybox_common_xsd.tmp#ObjectPropertiesType_object_reference cybox_common_xsd.tmp#ObjectPropertiesType_Custom_Properties cybox_common_xsd.tmp#ObjectPropertiesType
Type cyboxCommon:ObjectPropertiesType
Children cyboxCommon:Custom_Properties
Attributes
QName Type Use Annotation
object_reference xs:QName optional 
The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
Source
 
<xs:element name="Code_Snippet" type="cyboxCommon:ObjectPropertiesType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field enables description of a single code snippet extracted from a raw cyber object. Code_Snippet should be of CodeObj:CodeObjectType.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ByteRunsType / cyboxCommon:Byte_Run
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Byte_Run field contains a single byte run from the raw object.
Diagram
Diagram cybox_common_xsd.tmp#ByteRunType_Offset cybox_common_xsd.tmp#ByteRunType_Byte_Order cybox_common_xsd.tmp#ByteRunType_File_System_Offset cybox_common_xsd.tmp#ByteRunType_Image_Offset cybox_common_xsd.tmp#ByteRunType_Length cybox_common_xsd.tmp#ByteRunType_Hashes cybox_common_xsd.tmp#ByteRunType_Byte_Run_Data cybox_common_xsd.tmp#ByteRunType
Type cyboxCommon:ByteRunType
Children cyboxCommon:Byte_Order, cyboxCommon:Byte_Run_Data, cyboxCommon:File_System_Offset, cyboxCommon:Hashes, cyboxCommon:Image_Offset, cyboxCommon:Length, cyboxCommon:Offset
Source
 
<xs:element name="Byte_Run" type="cyboxCommon:ByteRunType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Byte_Run field contains a single byte run from the raw object.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ByteRunType / cyboxCommon:Offset
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Offset field specifies the offset of the beginning of the byte run as measured from the beginning of the object.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#IntegerObjectPropertyType_datatype cybox_common_xsd.tmp#IntegerObjectPropertyType
Type cyboxCommon:IntegerObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum int optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Offset" type="cyboxCommon:IntegerObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Offset field specifies the offset of the beginning of the byte run as measured from the beginning of the object.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ByteRunType / cyboxCommon:Byte_Order
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Byte_Order field specifies the endianness of the unpacked (e.g., unencoded, unencrypted, etc.) data contained within the Byte_Run_Data field.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#EndiannessType_datatype cybox_common_xsd.tmp#EndiannessType
Type cyboxCommon:EndiannessType
Type hierarchy
Attributes
QName Type Fixed Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the expected type for the value of the specified property.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Byte_Order" type="cyboxCommon:EndiannessType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Byte_Order field specifies the endianness of the unpacked (e.g., unencoded, unencrypted, etc.) data contained within the Byte_Run_Data field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ByteRunType / cyboxCommon:File_System_Offset
Namespace http://cybox.mitre.org/common-2
Annotations
 
The File_System_Offset field is relevant only for byte runs of files in forensic analysis.It specifies the offset of the beginning of the byte run as measured from the beginning of the relevant file system.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#IntegerObjectPropertyType_datatype cybox_common_xsd.tmp#IntegerObjectPropertyType
Type cyboxCommon:IntegerObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum int optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="File_System_Offset" type="cyboxCommon:IntegerObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The File_System_Offset field is relevant only for byte runs of files in forensic analysis.It specifies the offset of the beginning of the byte run as measured from the beginning of the relevant file system.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ByteRunType / cyboxCommon:Image_Offset
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Image_Offset field is provided for forensic analysis purposes and specifies the offset of the beginning of the byte run as measured from the beginning of the relevant forensic image.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#IntegerObjectPropertyType_datatype cybox_common_xsd.tmp#IntegerObjectPropertyType
Type cyboxCommon:IntegerObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum int optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Image_Offset" type="cyboxCommon:IntegerObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Image_Offset field is provided for forensic analysis purposes and specifies the offset of the beginning of the byte run as measured from the beginning of the relevant forensic image.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ByteRunType / cyboxCommon:Length
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Length field specifies the number of bytes in the byte run.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#IntegerObjectPropertyType_datatype cybox_common_xsd.tmp#IntegerObjectPropertyType
Type cyboxCommon:IntegerObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum int optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Length" type="cyboxCommon:IntegerObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Length field specifies the number of bytes in the byte run.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ByteRunType / cyboxCommon:Hashes
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Hashes field contains computed hash values for this the data in this byte run.
Diagram
Diagram cybox_common_xsd.tmp#HashListType_Hash cybox_common_xsd.tmp#HashListType
Type cyboxCommon:HashListType
Children cyboxCommon:Hash
Source
 
<xs:element name="Hashes" type="cyboxCommon:HashListType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Hashes field contains computed hash values for this the data in this byte run.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ByteRunType / cyboxCommon:Byte_Run_Data
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Byte_Run_Data field contains a raw dump of the byte run data, typically enclosed within an XML CDATA section.
Diagram
Diagram
Source
 
<xs:element name="Byte_Run_Data" type="xs:anyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Byte_Run_Data field contains a raw dump of the byte run data, typically enclosed within an XML CDATA section.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:EnvironmentVariableListType / cyboxCommon:Environment_Variable
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Environment_Variable field is used for representing environment variables using a name/value pair.
Diagram
Diagram cybox_common_xsd.tmp#EnvironmentVariableType_Name cybox_common_xsd.tmp#EnvironmentVariableType_Value cybox_common_xsd.tmp#EnvironmentVariableType
Type cyboxCommon:EnvironmentVariableType
Children cyboxCommon:Name, cyboxCommon:Value
Source
 
<xs:element name="Environment_Variable" type="cyboxCommon:EnvironmentVariableType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Environment_Variable field is used for representing environment variables using a name/value pair.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:EnvironmentVariableType / cyboxCommon:Name
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Name field specifies the name of the environment variable.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype cybox_common_xsd.tmp#StringObjectPropertyType
Type cyboxCommon:StringObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Name" type="cyboxCommon:StringObjectPropertyType">
  <xs:annotation>
    <xs:documentation>The Name field specifies the name of the environment variable.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:EnvironmentVariableType / cyboxCommon:Value
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Value field specifies the value of the environment variable.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype cybox_common_xsd.tmp#StringObjectPropertyType
Type cyboxCommon:StringObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Value" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Value field specifies the value of the environment variable.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:DigitalSignaturesType / cyboxCommon:Digital_Signature
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Digital_Signature field is optional and captures a single digital signature for this Object.
Diagram
Diagram cybox_common_xsd.tmp#DigitalSignatureInfoType_signature_exists cybox_common_xsd.tmp#DigitalSignatureInfoType_signature_verified cybox_common_xsd.tmp#DigitalSignatureInfoType_Certificate_Issuer cybox_common_xsd.tmp#DigitalSignatureInfoType_Certificate_Subject cybox_common_xsd.tmp#DigitalSignatureInfoType_Signature_Description cybox_common_xsd.tmp#DigitalSignatureInfoType
Type cyboxCommon:DigitalSignatureInfoType
Children cyboxCommon:Certificate_Issuer, cyboxCommon:Certificate_Subject, cyboxCommon:Signature_Description
Attributes
QName Type Use Annotation
signature_exists xs:boolean optional 
Specifies whether the digital signature exists.
signature_verified xs:boolean optional 
Specifies if the digital signature is verified.
Source
 
<xs:element name="Digital_Signature" type="cyboxCommon:DigitalSignatureInfoType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Digital_Signature field is optional and captures a single digital signature for this Object.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:DigitalSignatureInfoType / cyboxCommon:Certificate_Issuer
Namespace http://cybox.mitre.org/common-2
Annotations
 
The certificate issuer of the digital signature.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype cybox_common_xsd.tmp#StringObjectPropertyType
Type cyboxCommon:StringObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Certificate_Issuer" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The certificate issuer of the digital signature.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:DigitalSignatureInfoType / cyboxCommon:Certificate_Subject
Namespace http://cybox.mitre.org/common-2
Annotations
 
The certificate subject of the digital signature.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype cybox_common_xsd.tmp#StringObjectPropertyType
Type cyboxCommon:StringObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Certificate_Subject" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The certificate subject of the digital signature.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:DigitalSignatureInfoType / cyboxCommon:Signature_Description
Namespace http://cybox.mitre.org/common-2
Annotations
 
A description of the digital signature.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype cybox_common_xsd.tmp#StringObjectPropertyType
Type cyboxCommon:StringObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Signature_Description" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>A description of the digital signature.</xs:documentation>
  </xs:annotation>
</xs:element>
Complex Type cyboxCommon:StructuredTextType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The StructuredTextType is a type representing a generalized structure for capturing structured or unstructured textual information such as descriptions of things.
Diagram
Diagram cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType_structuring_format
Type extension of xs:string
Used by
Elements cybox:ActionType/cybox:Description, cybox:EventType/cybox:Description, cybox:ObfuscationTechniqueType/cybox:Description, cybox:ObjectType/cybox:Description, cybox:ObservableType/cybox:Description, cyboxCommon:DependencyType/cyboxCommon:Dependency_Description, cyboxCommon:MeasureSourceType/cyboxCommon:Description, cyboxCommon:PlatformSpecificationType/cyboxCommon:Description, cyboxCommon:ToolInformationType/cyboxCommon:Description, cyboxCommon:UsageContextAssumptionsType/cyboxCommon:Usage_Context_Assumption
Attributes
QName Type Use Annotation
structuring_format xs:string optional 
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interfering with XML validation of the CybOX document. If this attribute is absent, the implication is that no markup is being used.
Source
 
<xs:complexType name="StructuredTextType">
  <xs:annotation>
    <xs:documentation>The StructuredTextType is a type representing a generalized structure for capturing structured or unstructured textual information such as descriptions of things.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:extension base="xs:string">
      <xs:attribute name="structuring_format" type="xs:string" use="optional">
        <xs:annotation>
          <xs:documentation>Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interfering with XML validation of the CybOX document. If this attribute is absent, the implication is that no markup is being used.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:extension>
  </xs:simpleContent>
</xs:complexType>
Complex Type cyboxCommon:MeasureSourceType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The MeasureSourceType is a type representing a description of a single cyber observation source.
Diagram
Diagram cybox_common_xsd.tmp#MeasureSourceType_class cybox_common_xsd.tmp#MeasureSourceType_source_type cybox_common_xsd.tmp#MeasureSourceType_name cybox_common_xsd.tmp#MeasureSourceType_sighting_count cybox_common_xsd.tmp#MeasureSourceType_Information_Source_Type cybox_common_xsd.tmp#MeasureSourceType_Tool_Type cybox_common_xsd.tmp#MeasureSourceType_Description cybox_common_xsd.tmp#MeasureSourceType_Contributors cybox_common_xsd.tmp#MeasureSourceType_Time cybox_common_xsd.tmp#MeasureSourceType_Observation_Location cybox_common_xsd.tmp#MeasureSourceType_Tools cybox_common_xsd.tmp#MeasureSourceType_Platform cybox_common_xsd.tmp#MeasureSourceType_System cybox_common_xsd.tmp#MeasureSourceType_Instance cybox_common_xsd.tmp#MeasureSourceType_Observable_Location
Used by
Children cyboxCommon:Contributors, cyboxCommon:Description, cyboxCommon:Information_Source_Type, cyboxCommon:Instance, cyboxCommon:Observable_Location, cyboxCommon:Observation_Location, cyboxCommon:Platform, cyboxCommon:System, cyboxCommon:Time, cyboxCommon:Tool_Type, cyboxCommon:Tools
Attributes
QName Type Use Annotation
class cyboxCommon:SourceClassTypeEnum optional 
The class field is optional and enables identification of the high-level class of this cyber observation source.
name xs:string optional 
The name field is optional and enables the assignment of a relevant name to this Discovery Method.
sighting_count xs:positiveInteger optional 
The sighting_count field specifies how many different identical instances of a given Observable may have been seen/sighted by the observation source.
source_type cyboxCommon:SourceTypeEnum optional 
The source_type field is optional and enables identification of the broad type of this cyber observation source.
Source
 
<xs:complexType name="MeasureSourceType">
  <xs:annotation>
    <xs:documentation>The MeasureSourceType is a type representing a description of a single cyber observation source.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Information_Source_Type" type="cyboxCommon:ControlledVocabularyStringType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Information_Source_Type field is optional and utilizes a standardized controlled vocabulary to identify the type of information source leveraged for this cyber observation source.</xs:documentation>
        <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is InformationSourceTypeVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.</xs:documentation>
        <xs:documentation>Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Tool_Type" type="cyboxCommon:ControlledVocabularyStringType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Tool_Type field is optional and (when tools are used) enables identification of the type of tool leveraged as part of this cyber observation source, via a standardized controlled vocabulary.</xs:documentation>
        <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is ToolTypeVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.</xs:documentation>
        <xs:documentation>Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Description" type="cyboxCommon:StructuredTextType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Description field is optional and enables a generalized but structured description of this syber observation source.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Contributors" type="cyboxCommon:PersonnelType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Contributors field is optional and enables description of the individual contributors involved in this cyber observation source.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Time" type="cyboxCommon:TimeType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Time field is optional and enables description of various time-related properties for this cyber observation source instance.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Observation_Location" type="cyboxCommon:LocationType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Observation_Location field specifies a relevant physical location for the observation measurement of the associated Observable.</xs:documentation>
        <xs:documentation>This field is implemented through the xsi:type extension mechanism. The default type is CIQAddressInstanceType in the http://cybox.mitre.org/extensions/Identity#CIQAddress-1 namespace. This type is defined in the extensions/location/ciq_address_3.0.xsd file or at the URL http://cybox.mitre.org/XMLSchema/extensions/location/ciq_address/1.0/ciq_address_3.0.xsd.</xs:documentation>
        <xs:documentation>Those who wish to express a simple name may also do so by not specifying an xsi:type and using the Name field.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Tools" type="cyboxCommon:ToolsInformationType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Tools field is optional and enables description of the tools utilized for this cyber observation source.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Platform" type="cyboxCommon:PlatformSpecificationType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Platform field is optional and enables a formal, standardized specification of the platform for this cyber observation source.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="System" type="cyboxCommon:ObjectPropertiesType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The System field is optional and enables characterization of the system on which the mechanism of cyber observation executed. System should be an object of type SystemObj:SystemObjectType.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Instance" type="cyboxCommon:ObjectPropertiesType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Instance field is optional and enables characterization of the process instance in which the mechanism of cyber observation executed. Instance should be of type ProcessObj:ProcessObjectType.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Observable_Location" type="cyboxCommon:LocationType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Observable_Location field specifies a relevant physical location for the associated Observable.</xs:documentation>
        <xs:documentation>This field is implemented through the xsi:type extension mechanism. The default type is CIQAddressInstanceType in the http://cybox.mitre.org/extensions/Identity#CIQAddress-1 namespace. This type is defined in the extensions/location/ciq_address_3.0.xsd file or at the URL http://cybox.mitre.org/XMLSchema/extensions/location/ciq_address/1.0/ciq_address_3.0.xsd.</xs:documentation>
        <xs:documentation>Those who wish to express a simple name may also do so by not specifying an xsi:type and using the Name field.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
  <xs:attribute name="class" type="cyboxCommon:SourceClassTypeEnum">
    <xs:annotation>
      <xs:documentation>The class field is optional and enables identification of the high-level class of this cyber observation source.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="source_type" type="cyboxCommon:SourceTypeEnum">
    <xs:annotation>
      <xs:documentation>The source_type field is optional and enables identification of the broad type of this cyber observation source.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="name" type="xs:string">
    <xs:annotation>
      <xs:documentation>The name field is optional and enables the assignment of a relevant name to this Discovery Method.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="sighting_count" type="xs:positiveInteger">
    <xs:annotation>
      <xs:documentation>The sighting_count field specifies how many different identical instances of a given Observable may have been seen/sighted by the observation source.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
</xs:complexType>
Complex Type cyboxCommon:ControlledVocabularyStringType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The ControlledVocabularyStringType is used as the basis for defining controlled vocabularies.
Diagram
Diagram cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#PatternableFieldType cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_name cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_reference
Type extension of cyboxCommon:PatternableFieldType
Type hierarchy
Used by
Elements cybox:ActionArgumentType/cybox:Argument_Name, cybox:ActionRelationshipType/cybox:Type, cybox:ActionType/cybox:Name, cybox:ActionType/cybox:Type, cybox:AssociatedObjectType/cybox:Association_Type, cybox:EventType/cybox:Type, cybox:ObjectType/cybox:State, cybox:RelatedObjectType/cybox:Relationship, cyboxCommon:ExtractedStringType/cyboxCommon:Encoding, cyboxCommon:HashType/cyboxCommon:Type, cyboxCommon:MeasureSourceType/cyboxCommon:Information_Source_Type, cyboxCommon:MeasureSourceType/cyboxCommon:Tool_Type, cyboxCommon:ToolInformationType/cyboxCommon:Type
Attributes
QName Type Default Use Annotation
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
vocab_name xs:string optional 
The vocab_name field specifies the name of the controlled vocabulary.
vocab_reference xs:anyURI optional 
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
 
<xs:complexType name="ControlledVocabularyStringType">
  <xs:annotation>
    <xs:documentation>The ControlledVocabularyStringType is used as the basis for defining controlled vocabularies.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:extension base="cyboxCommon:PatternableFieldType">
      <xs:attribute name="vocab_name" type="xs:string" use="optional">
        <xs:annotation>
          <xs:documentation>The vocab_name field specifies the name of the controlled vocabulary.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
      <xs:attribute name="vocab_reference" type="xs:anyURI" use="optional">
        <xs:annotation>
          <xs:documentation>The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:extension>
  </xs:simpleContent>
</xs:complexType>
Complex Type cyboxCommon:PatternableFieldType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The PatternableFieldType is a grouping of attributes applicable to defining patterns on a specific field.
Diagram
Diagram cybox_common_xsd.tmp#PatternFieldGroup
Type extension of xs:anySimpleType
Used by
Attributes
QName Type Default Use Annotation
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="PatternableFieldType">
  <xs:annotation>
    <xs:documentation>The PatternableFieldType is a grouping of attributes applicable to defining patterns on a specific field.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:extension base="xs:anySimpleType">
      <xs:attributeGroup ref="cyboxCommon:PatternFieldGroup"/>
    </xs:extension>
  </xs:simpleContent>
</xs:complexType>
Simple Type cyboxCommon:ConditionTypeEnum
Namespace http://cybox.mitre.org/common-2
Annotations
 
ConditionTypeEnum is a (non-exhaustive) enumeration of condition types.
Diagram
Diagram
Type restriction of xs:string
Facets
enumeration Equals 
Specifies the equality or = condition.
enumeration DoesNotEqual 
Specifies the "does not equal" or != condition.
enumeration Contains 
Specifies the "contains" condition.
enumeration DoesNotContain 
Specifies the "does not contain" condition.
enumeration StartsWith 
Specifies the "starts with" condition.
enumeration EndsWith 
Specifies the "ends with" condition.
enumeration GreaterThan 
Specifies the "greater than" condition.
enumeration GreaterThanOrEqual 
Specifies the "greater than or equal to" condition.
enumeration LessThan 
Specifies the "less than" condition.
enumeration LessThanOrEqual 
Specifies the "less than or equal" condition.
enumeration InclusiveBetween 
The pattern is met if the given value lies between the values indicated in the field value body, inclusive of the bounding values themselves. The field value body MUST contain at least 2 values to be valid. If the field value body contains more than 2 values, then only the greatest and least values are considered. (I.e., If the body contains "2,4,6", then an InclusiveBetween condition would be satisfied if the observed value fell between 2 and 6, inclusive. Since this is an inclusive range, an observed value of 2 or 6 would fit the pattern in this example.) As such, always treat the InclusiveBetween condition as applying to a single range for the purpose of evaluating the apply_condition attribute.
enumeration ExclusiveBetween 
The pattern is met if the given value lies between the values indicated in the field value body, exclusive of the bounding values themselves. The field value body MUST contain at least 2 values to be valid. If the field value body contains more than 2 values, then only the greatest and least values are considered. (I.e., If the body contains "2,4,6", then an InclusiveBetween condition would be satisfied if the observed value fell between 2 and 6, exclusive. Since this is an exclusive range, an observed value of 2 or 6 would not fit the pattern in this example.) As such, always treat the ExclusiveBetween condition as applying to a single range for the purpose of evaluating the apply_condition attribute.
enumeration FitsPattern 
Specifies the condition that a value fits a given pattern.
enumeration BitwiseAnd 
Specifies the condition of bitwise AND. Specifically, when applying this pattern, a given value is bitwise-ANDed with the bit_mask attribute value (which must be present). If the result is identical to the value provided in the body of this field value, the pattern is considered fulfilled.
enumeration BitwiseOr 
Specifies the condition of bitwise OR. Specifically, when applying this pattern, a given value is bitwise-ORed with the bit_mask attribute value (which must be present). If the result is identical to the value provided in the body of this field value, the pattern is considered fulfilled.
enumeration BitwiseXor 
Specifies the condition of bitwise XOR. Specifically, when applying this pattern, a given value is bitwise-XORed with the bit_mask attribute value (which must be present). If the result is identical to the value provided in the body of this field value, the pattern is considered fulfilled.
Used by
Source
 
<xs:simpleType name="ConditionTypeEnum">
  <xs:annotation>
    <xs:documentation>ConditionTypeEnum is a (non-exhaustive) enumeration of condition types.</xs:documentation>
  </xs:annotation>
  <xs:restriction base="xs:string">
    <xs:enumeration value="Equals">
      <xs:annotation>
        <xs:documentation>Specifies the equality or = condition.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="DoesNotEqual">
      <xs:annotation>
        <xs:documentation>Specifies the "does not equal" or != condition.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Contains">
      <xs:annotation>
        <xs:documentation>Specifies the "contains" condition.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="DoesNotContain">
      <xs:annotation>
        <xs:documentation>Specifies the "does not contain" condition.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="StartsWith">
      <xs:annotation>
        <xs:documentation>Specifies the "starts with" condition.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="EndsWith">
      <xs:annotation>
        <xs:documentation>Specifies the "ends with" condition.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="GreaterThan">
      <xs:annotation>
        <xs:documentation>Specifies the "greater than" condition.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="GreaterThanOrEqual">
      <xs:annotation>
        <xs:documentation>Specifies the "greater than or equal to" condition.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="LessThan">
      <xs:annotation>
        <xs:documentation>Specifies the "less than" condition.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="LessThanOrEqual">
      <xs:annotation>
        <xs:documentation>Specifies the "less than or equal" condition.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="InclusiveBetween">
      <xs:annotation>
        <xs:documentation>The pattern is met if the given value lies between the values indicated in the field value body, inclusive of the bounding values themselves. The field value body MUST contain at least 2 values to be valid. If the field value body contains more than 2 values, then only the greatest and least values are considered. (I.e., If the body contains "2,4,6", then an InclusiveBetween condition would be satisfied if the observed value fell between 2 and 6, inclusive. Since this is an inclusive range, an observed value of 2 or 6 would fit the pattern in this example.) As such, always treat the InclusiveBetween condition as applying to a single range for the purpose of evaluating the apply_condition attribute.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="ExclusiveBetween">
      <xs:annotation>
        <xs:documentation>The pattern is met if the given value lies between the values indicated in the field value body, exclusive of the bounding values themselves. The field value body MUST contain at least 2 values to be valid. If the field value body contains more than 2 values, then only the greatest and least values are considered. (I.e., If the body contains "2,4,6", then an InclusiveBetween condition would be satisfied if the observed value fell between 2 and 6, exclusive. Since this is an exclusive range, an observed value of 2 or 6 would not fit the pattern in this example.) As such, always treat the ExclusiveBetween condition as applying to a single range for the purpose of evaluating the apply_condition attribute.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="FitsPattern">
      <xs:annotation>
        <xs:documentation>Specifies the condition that a value fits a given pattern.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="BitwiseAnd">
      <xs:annotation>
        <xs:documentation>Specifies the condition of bitwise AND. Specifically, when applying this pattern, a given value is bitwise-ANDed with the bit_mask attribute value (which must be present). If the result is identical to the value provided in the body of this field value, the pattern is considered fulfilled.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="BitwiseOr">
      <xs:annotation>
        <xs:documentation>Specifies the condition of bitwise OR. Specifically, when applying this pattern, a given value is bitwise-ORed with the bit_mask attribute value (which must be present). If the result is identical to the value provided in the body of this field value, the pattern is considered fulfilled.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="BitwiseXor">
      <xs:annotation>
        <xs:documentation>Specifies the condition of bitwise XOR. Specifically, when applying this pattern, a given value is bitwise-XORed with the bit_mask attribute value (which must be present). If the result is identical to the value provided in the body of this field value, the pattern is considered fulfilled.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
  </xs:restriction>
</xs:simpleType>
Simple Type cyboxCommon:ConditionApplicationEnum
Namespace http://cybox.mitre.org/common-2
Annotations
 
Used to indicate how a condition should be applied to a list of values.
Diagram
Diagram
Type restriction of xs:string
Facets
enumeration ANY 
Indicates that a pattern holds if the given condition can be successfully applied to any of the field values.
enumeration ALL 
Indicates that a pattern holds only if the given condition can be successfully applied to all of the field values.
enumeration NONE 
Indicates that a pattern holds only if the given condition can be successfully applied to none of the field values.
Used by
Source
 
<xs:simpleType name="ConditionApplicationEnum">
  <xs:annotation>
    <xs:documentation>Used to indicate how a condition should be applied to a list of values.</xs:documentation>
  </xs:annotation>
  <xs:restriction base="xs:string">
    <xs:enumeration value="ANY">
      <xs:annotation>
        <xs:documentation>Indicates that a pattern holds if the given condition can be successfully applied to any of the field values.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="ALL">
      <xs:annotation>
        <xs:documentation>Indicates that a pattern holds only if the given condition can be successfully applied to all of the field values.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="NONE">
      <xs:annotation>
        <xs:documentation>Indicates that a pattern holds only if the given condition can be successfully applied to none of the field values.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
  </xs:restriction>
</xs:simpleType>
Simple Type cyboxCommon:PatternTypeEnum
Namespace http://cybox.mitre.org/common-2
Annotations
 
The PatternTypeEnum type is a non-exhaustive enumeration of potentially relevant pattern types.
Diagram
Diagram
Type restriction of xs:string
Facets
enumeration Regex 
Specifies the regular expression pattern type.
enumeration Binary 
Specifies the binary (bit operations) pattern type.
enumeration XPath 
Specifies the XPath 1.0 expression pattern type.
Used by
Source
 
<xs:simpleType name="PatternTypeEnum">
  <xs:annotation>
    <xs:documentation>The PatternTypeEnum type is a non-exhaustive enumeration of potentially relevant pattern types.</xs:documentation>
  </xs:annotation>
  <xs:restriction base="xs:string">
    <xs:enumeration value="Regex">
      <xs:annotation>
        <xs:documentation>Specifies the regular expression pattern type.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Binary">
      <xs:annotation>
        <xs:documentation>Specifies the binary (bit operations) pattern type.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="XPath">
      <xs:annotation>
        <xs:documentation>Specifies the XPath 1.0 expression pattern type.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
  </xs:restriction>
</xs:simpleType>
Complex Type cyboxCommon:PersonnelType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The PersonnelType is an abstracted data type to standardize the description of sets of personnel.
Diagram
Diagram cybox_common_xsd.tmp#PersonnelType_Contributor
Used by
Children cyboxCommon:Contributor
Source
 
<xs:complexType name="PersonnelType">
  <xs:annotation>
    <xs:documentation>The PersonnelType is an abstracted data type to standardize the description of sets of personnel.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Contributor" type="cyboxCommon:ContributorType" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>This field contains information describing the identify, resources and timing of involvement for a single contributor.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:ContributorType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The ContributorType represents a description of an individual who contributed as a source of cyber observation data.
Diagram
Diagram cybox_common_xsd.tmp#ContributorType_Role cybox_common_xsd.tmp#ContributorType_Name cybox_common_xsd.tmp#ContributorType_Email cybox_common_xsd.tmp#ContributorType_Phone cybox_common_xsd.tmp#ContributorType_Organization cybox_common_xsd.tmp#ContributorType_Date cybox_common_xsd.tmp#ContributorType_Contribution_Location
Used by
Children cyboxCommon:Contribution_Location, cyboxCommon:Date, cyboxCommon:Email, cyboxCommon:Name, cyboxCommon:Organization, cyboxCommon:Phone, cyboxCommon:Role
Source
 
<xs:complexType name="ContributorType">
  <xs:annotation>
    <xs:documentation>The ContributorType represents a description of an individual who contributed as a source of cyber observation data.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Role" type="xs:string" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field describes the role played by this contributor.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Name" type="xs:string" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains the name of this contributor.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Email" type="xs:string" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains the email of this contributor.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Phone" type="xs:string" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains a telephone number of this contributor.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Organization" type="xs:string" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains the organization name of this contributor.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Date" type="cyboxCommon:DateRangeType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains a description (bounding) of the timing of this contributor's involvement.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Contribution_Location" type="xs:string" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains information describing the location at which the contributory activity occured.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:DateRangeType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The DateRangeType specifies a range of dates.
Diagram
Diagram cybox_common_xsd.tmp#DateRangeType_Start_Date cybox_common_xsd.tmp#DateRangeType_End_Date
Used by
Children cyboxCommon:End_Date, cyboxCommon:Start_Date
Source
 
<xs:complexType name="DateRangeType">
  <xs:annotation>
    <xs:documentation>The DateRangeType specifies a range of dates.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Start_Date" type="cyboxCommon:DateWithPrecisionType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains the start date for this contributor's involvement. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="End_Date" type="cyboxCommon:DateWithPrecisionType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains the end date for this contributor's involvement. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:DateWithPrecisionType
Namespace http://cybox.mitre.org/common-2
Annotations
 
This type is used as a replacement for the standard xs:date type but allows for the representation of the precision of the date. If the precision is given, consumers must ignore the portions of this field that is more precise than the given precision. Producers should zero-out (fill with zeros) digits in the date that are required by the xs:date datatype but are beyond the specified precision.
 
In order to avoid ambiguity, it is strongly suggested that all dates include a specification of the timezone if it is known.
Diagram
Diagram cybox_common_xsd.tmp#DateWithPrecisionType_precision
Type extension of xs:date
Used by
Attributes
QName Type Default Use Annotation
precision cyboxCommon:DatePrecisionEnum day optional 
The precision of the associated date. If omitted, the default is "day", meaning the full field value.
Source
 
<xs:complexType name="DateWithPrecisionType">
  <xs:annotation>
    <xs:documentation>This type is used as a replacement for the standard xs:date type but allows for the representation of the precision of the date. If the precision is given, consumers must ignore the portions of this field that is more precise than the given precision. Producers should zero-out (fill with zeros) digits in the date that are required by the xs:date datatype but are beyond the specified precision.</xs:documentation>
    <xs:documentation>In order to avoid ambiguity, it is strongly suggested that all dates include a specification of the timezone if it is known.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:extension base="xs:date">
      <xs:attribute name="precision" type="cyboxCommon:DatePrecisionEnum" default="day">
        <xs:annotation>
          <xs:documentation>The precision of the associated date. If omitted, the default is "day", meaning the full field value.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:extension>
  </xs:simpleContent>
</xs:complexType>
Simple Type cyboxCommon:DatePrecisionEnum
Namespace http://cybox.mitre.org/common-2
Annotations
 
Possible values for representing date precision.
Diagram
Diagram
Type restriction of xs:string
Facets
enumeration year 
Date is precise to the given year.
enumeration month 
Date is precise to the given month.
enumeration day 
Date is precise to the given day.
Used by
Source
 
<xs:simpleType name="DatePrecisionEnum">
  <xs:annotation>
    <xs:documentation>Possible values for representing date precision.</xs:documentation>
  </xs:annotation>
  <xs:restriction base="xs:string">
    <xs:enumeration value="year">
      <xs:annotation>
        <xs:documentation>Date is precise to the given year.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="month">
      <xs:annotation>
        <xs:documentation>Date is precise to the given month.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="day">
      <xs:annotation>
        <xs:documentation>Date is precise to the given day.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
  </xs:restriction>
</xs:simpleType>
Complex Type cyboxCommon:TimeType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The TimeType specifies various time properties for this construct.
Diagram
Diagram cybox_common_xsd.tmp#TimeType_Start_Time cybox_common_xsd.tmp#TimeType_End_Time cybox_common_xsd.tmp#TimeType_Produced_Time cybox_common_xsd.tmp#TimeType_Received_Time
Used by
Children cyboxCommon:End_Time, cyboxCommon:Produced_Time, cyboxCommon:Received_Time, cyboxCommon:Start_Time
Source
 
<xs:complexType name="TimeType">
  <xs:annotation>
    <xs:documentation>The TimeType specifies various time properties for this construct.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Start_Time" type="cyboxCommon:DateTimeWithPrecisionType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Start_Time field is optional and describes the starting time for this construct. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="End_Time" type="cyboxCommon:DateTimeWithPrecisionType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The End_Time field is optional and describes the ending time for this construct. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Produced_Time" type="cyboxCommon:DateTimeWithPrecisionType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Produced_Time field is optional and describes the time that this construct was produced. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Received_Time" type="cyboxCommon:DateTimeWithPrecisionType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Received_Time field is optional and describes the time that this construct was received. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:DateTimeWithPrecisionType
Namespace http://cybox.mitre.org/common-2
Annotations
 
This type is used as a replacement for the standard xs:dateTime type but allows for the representation of the precision of the dateTime.  If the precision is given, consumers must ignore the portions of this field that is more precise than the given precision. Producers should zero-out (fill with zeros) digits in the dateTime that are required by the xs:dateTime datatype but are beyond the specified precision.
 
In order to avoid ambiguity, it is strongly suggested that all dateTimes include a specification of the timezone if it is known.
Diagram
Diagram cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_DateTimeWithPrecisionType_precision
Type extension of xs:dateTime
Used by
Elements cyboxCommon:BuildInformationType/cyboxCommon:Compilation_Date, cyboxCommon:ExecutionEnvironmentType/cyboxCommon:Start_Time, cyboxCommon:TimeType/cyboxCommon:End_Time, cyboxCommon:TimeType/cyboxCommon:Produced_Time, cyboxCommon:TimeType/cyboxCommon:Received_Time, cyboxCommon:TimeType/cyboxCommon:Start_Time
Attributes
QName Type Default Use Annotation
precision cyboxCommon:DateTimePrecisionEnum second optional 
The precision of the associated dateTime. If omitted, the default is "second", meaning the full field value (including fractional seconds).
Source
 
<xs:complexType name="DateTimeWithPrecisionType">
  <xs:annotation>
    <xs:documentation>This type is used as a replacement for the standard xs:dateTime type but allows for the representation of the precision of the dateTime. If the precision is given, consumers must ignore the portions of this field that is more precise than the given precision. Producers should zero-out (fill with zeros) digits in the dateTime that are required by the xs:dateTime datatype but are beyond the specified precision.</xs:documentation>
    <xs:documentation>In order to avoid ambiguity, it is strongly suggested that all dateTimes include a specification of the timezone if it is known.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:extension base="xs:dateTime">
      <xs:attribute name="precision" type="cyboxCommon:DateTimePrecisionEnum" default="second">
        <xs:annotation>
          <xs:documentation>The precision of the associated dateTime. If omitted, the default is "second", meaning the full field value (including fractional seconds).</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:extension>
  </xs:simpleContent>
</xs:complexType>
Simple Type cyboxCommon:DateTimePrecisionEnum
Namespace http://cybox.mitre.org/common-2
Annotations
 
Possible values for representing time precision.
Diagram
Diagram cybox_common_xsd.tmp#DatePrecisionEnum cybox_common_xsd.tmp#TimePrecisionEnum
Type union of(cyboxCommon:DatePrecisionEnum, cyboxCommon:TimePrecisionEnum)
Used by
Attributes cybox:ActionType/@timestamp_precision, cyboxCommon:DateTimeObjectPropertyType/@precision, cyboxCommon:DateTimeWithPrecisionType/@precision
Source
 
<xs:simpleType name="DateTimePrecisionEnum">
  <xs:annotation>
    <xs:documentation>Possible values for representing time precision.</xs:documentation>
  </xs:annotation>
  <xs:union memberTypes="cyboxCommon:DatePrecisionEnum cyboxCommon:TimePrecisionEnum"/>
</xs:simpleType>
Complex Type cyboxCommon:LocationType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The LocationType is used to express geographic location information.
 
This type is extended through the xsi:type mechanism. The default type is CIQAddress3.0InstanceType in the http://cybox.mitre.org/extensions/Address#CIQAddress3.0-1 namespace. This type is defined in the extensions/location/ciq_address_3.0.xsd file or at the URL http://cybox.mitre.org/XMLSchema/extensions/location/ciq_address_3.0/1.0/ciq_address_3.0.xsd.
 
Those who wish to express a simple name may also do so by not specifying an xsi:type and using the Name field of this type.
Diagram
Diagram cybox_common_xsd.tmp#LocationType_id cybox_common_xsd.tmp#LocationType_idref cybox_common_xsd.tmp#LocationType_Name
Used by
Children cyboxCommon:Name
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a unique ID for this Location.
idref xs:QName optional 
Specifies a reference to a unique ID defined elsewhere.
Source
 
<xs:complexType name="LocationType">
  <xs:annotation>
    <xs:documentation>The LocationType is used to express geographic location information.</xs:documentation>
    <xs:documentation>This type is extended through the xsi:type mechanism. The default type is CIQAddress3.0InstanceType in the http://cybox.mitre.org/extensions/Address#CIQAddress3.0-1 namespace. This type is defined in the extensions/location/ciq_address_3.0.xsd file or at the URL http://cybox.mitre.org/XMLSchema/extensions/location/ciq_address_3.0/1.0/ciq_address_3.0.xsd.</xs:documentation>
    <xs:documentation>Those who wish to express a simple name may also do so by not specifying an xsi:type and using the Name field of this type.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Name" type="xs:string" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Name field allows for expression of an location through a simple name.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
  <xs:attribute name="id" type="xs:QName">
    <xs:annotation>
      <xs:documentation>Specifies a unique ID for this Location.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="idref" type="xs:QName">
    <xs:annotation>
      <xs:documentation>Specifies a reference to a unique ID defined elsewhere.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
</xs:complexType>
Complex Type cyboxCommon:ToolsInformationType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The ToolsInformationType represents a description of a set of automated tools.
Diagram
Diagram cybox_common_xsd.tmp#ToolsInformationType_Tool
Used by
Children cyboxCommon:Tool
Source
 
<xs:complexType name="ToolsInformationType">
  <xs:annotation>
    <xs:documentation>The ToolsInformationType represents a description of a set of automated tools.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Tool" type="cyboxCommon:ToolInformationType" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Tool field is optional and enables description of a single tool utilized for this cyber observation source.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:ToolInformationType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The ToolInformationType is intended to characterize the properties of a hardware or software tool, including those related to instances of its use.
Diagram
Diagram cybox_common_xsd.tmp#ToolInformationType_id cybox_common_xsd.tmp#ToolInformationType_idref cybox_common_xsd.tmp#ToolInformationType_Name cybox_common_xsd.tmp#ToolInformationType_Type cybox_common_xsd.tmp#ToolInformationType_Description cybox_common_xsd.tmp#ToolInformationType_References cybox_common_xsd.tmp#ToolInformationType_Vendor cybox_common_xsd.tmp#ToolInformationType_Version cybox_common_xsd.tmp#ToolInformationType_Service_Pack cybox_common_xsd.tmp#ToolInformationType_Tool_Specific_Data cybox_common_xsd.tmp#ToolInformationType_Tool_Hashes cybox_common_xsd.tmp#ToolInformationType_Tool_Configuration cybox_common_xsd.tmp#ToolInformationType_Execution_Environment cybox_common_xsd.tmp#ToolInformationType_Errors cybox_common_xsd.tmp#ToolInformationType_Metadata cybox_common_xsd.tmp#ToolInformationType_Compensation_Model
Used by
Children cyboxCommon:Compensation_Model, cyboxCommon:Description, cyboxCommon:Errors, cyboxCommon:Execution_Environment, cyboxCommon:Metadata, cyboxCommon:Name, cyboxCommon:References, cyboxCommon:Service_Pack, cyboxCommon:Tool_Configuration, cyboxCommon:Tool_Hashes, cyboxCommon:Tool_Specific_Data, cyboxCommon:Type, cyboxCommon:Vendor, cyboxCommon:Version
Attributes
QName Type Use Annotation
id xs:QName optional 
The id field specifies a unique ID for this Tool.
idref xs:QName optional 
The idref field specifies reference to a unique ID for this Tool.
 
When idref is specified, the id attribute must not be specified, and any instance of this type should not hold content unless an extension of the type allows it.
Source
 
<xs:complexType name="ToolInformationType">
  <xs:annotation>
    <xs:documentation>The ToolInformationType is intended to characterize the properties of a hardware or software tool, including those related to instances of its use.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Name" type="xs:string" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains the name of the tool leveraged.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Type" type="cyboxCommon:ControlledVocabularyStringType" minOccurs="0" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>This field contains the type of the tool leveraged.</xs:documentation>
        <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. No default vocabulary type has been defined for CybOX 2.0. Users may either define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a free string field. Additionally, locations where the ToolInformationType is used may define default vocabularies for this field.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Description" type="cyboxCommon:StructuredTextType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains general descriptive information for this tool.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="References" type="cyboxCommon:ToolReferencesType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains references to instances or additional information for this tool.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Vendor" type="xs:string" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains information identifying the vendor organization for this tool.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Version" type="xs:string" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains an appropriate version descriptor of this tool.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Service_Pack" type="xs:string" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains an appropriate service pack descriptor for this tool.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Tool_Specific_Data" type="cyboxCommon:ToolSpecificDataType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This is an abstract type provided to a flexible mechanism for enabling tool-specific data to be included.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Tool_Hashes" type="cyboxCommon:HashListType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains a hash value computed on the tool file content in order to verify its integrity.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Tool_Configuration" type="cyboxCommon:ToolConfigurationType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains information describing the configuration and usage of the tool.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Execution_Environment" type="cyboxCommon:ExecutionEnvironmentType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains information describing the execution environment of the tool.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Errors" type="cyboxCommon:ErrorsType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field captures any errors generated during the run of the tool.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Metadata" type="cyboxCommon:MetadataType" minOccurs="0" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>This field captures other relevant metadata including tool-specific fields.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Compensation_Model" type="cyboxCommon:CompensationModelType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains the name of the compensation model used for the tool.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
  <xs:attribute name="id" type="xs:QName">
    <xs:annotation>
      <xs:documentation>The id field specifies a unique ID for this Tool.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="idref" type="xs:QName">
    <xs:annotation>
      <xs:documentation>The idref field specifies reference to a unique ID for this Tool.</xs:documentation>
      <xs:documentation>When idref is specified, the id attribute must not be specified, and any instance of this type should not hold content unless an extension of the type allows it.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
</xs:complexType>
Complex Type cyboxCommon:ToolReferencesType
Namespace http://cybox.mitre.org/common-2
Annotations
 
Used to indicate one or more references to tool instances and information.
Diagram
Diagram cybox_common_xsd.tmp#ToolReferencesType_Reference
Used by
Children cyboxCommon:Reference
Source
 
<xs:complexType name="ToolReferencesType">
  <xs:annotation>
    <xs:documentation>Used to indicate one or more references to tool instances and information.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Reference" type="cyboxCommon:ToolReferenceType" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>Contains one reference to information or instances of a given tool.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:ToolReferenceType
Namespace http://cybox.mitre.org/common-2
Annotations
 
Contains one reference to information or instances of a given tool.
Diagram
Diagram cybox_common_xsd.tmp#ToolReferenceType_reference_type
Type extension of xs:anyURI
Used by
Attributes
QName Type Use Annotation
reference_type cyboxCommon:ToolReferenceTypeEnum optional 
Indicates the nature of the referenced material (documentation, source, executable, etc.).
Source
 
<xs:complexType name="ToolReferenceType">
  <xs:annotation>
    <xs:documentation>Contains one reference to information or instances of a given tool.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:extension base="xs:anyURI">
      <xs:attribute name="reference_type" type="cyboxCommon:ToolReferenceTypeEnum">
        <xs:annotation>
          <xs:documentation>Indicates the nature of the referenced material (documentation, source, executable, etc.).</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:extension>
  </xs:simpleContent>
</xs:complexType>
Simple Type cyboxCommon:ToolReferenceTypeEnum
Namespace http://cybox.mitre.org/common-2
Annotations
 
The nature of referenced material regarding a tool.
Diagram
Diagram
Type restriction of xs:string
Facets
enumeration Documentation 
The reference is to documentation about the identified tool.
enumeration Source 
The reference is to source code for the identified tool.
enumeration Download 
The reference is to where an executable version of the tool can be downloaded.
enumeration Execute 
The reference is to the tool implemented as an online service.
enumeration Other 
The reference is to material about the tool not covered by other values in this enumeration.
Used by
Source
 
<xs:simpleType name="ToolReferenceTypeEnum">
  <xs:annotation>
    <xs:documentation>The nature of referenced material regarding a tool.</xs:documentation>
  </xs:annotation>
  <xs:restriction base="xs:string">
    <xs:enumeration value="Documentation">
      <xs:annotation>
        <xs:documentation>The reference is to documentation about the identified tool.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Source">
      <xs:annotation>
        <xs:documentation>The reference is to source code for the identified tool.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Download">
      <xs:annotation>
        <xs:documentation>The reference is to where an executable version of the tool can be downloaded.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Execute">
      <xs:annotation>
        <xs:documentation>The reference is to the tool implemented as an online service.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Other">
      <xs:annotation>
        <xs:documentation>The reference is to material about the tool not covered by other values in this enumeration.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
  </xs:restriction>
</xs:simpleType>
Complex Type cyboxCommon:ToolSpecificDataType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The ToolSpecificDataType is an Abstract type placeholder within the CybOX schema enabling the inclusion of metadata for a specific type of tool through the use of a custom type defined as an extension of this base Abstract type.
Diagram
Diagram
Used by
Source
 
<xs:complexType name="ToolSpecificDataType" abstract="true">
  <xs:annotation>
    <xs:documentation>The ToolSpecificDataType is an Abstract type placeholder within the CybOX schema enabling the inclusion of metadata for a specific type of tool through the use of a custom type defined as an extension of this base Abstract type.</xs:documentation>
  </xs:annotation>
</xs:complexType>
Complex Type cyboxCommon:HashListType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The HashListType type is used for representing a list of hash values.
Diagram
Diagram cybox_common_xsd.tmp#HashListType_Hash
Used by
Children cyboxCommon:Hash
Source
 
<xs:complexType name="HashListType">
  <xs:annotation>
    <xs:documentation>The HashListType type is used for representing a list of hash values.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Hash" type="cyboxCommon:HashType" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Hash field specifies a single calculated hash value.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:HashType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The HashType type is intended to characterize hash values.
Diagram
Diagram cybox_common_xsd.tmp#HashType_Type cybox_common_xsd.tmp#HashType_Simple_Hash_Value cybox_common_xsd.tmp#HashType_Fuzzy_Hash_Value cybox_common_xsd.tmp#HashType_Fuzzy_Hash_Structure
Used by
Children cyboxCommon:Fuzzy_Hash_Structure, cyboxCommon:Fuzzy_Hash_Value, cyboxCommon:Simple_Hash_Value, cyboxCommon:Type
Source
 
<xs:complexType name="HashType">
  <xs:annotation>
    <xs:documentation>The HashType type is intended to characterize hash values.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Type" type="cyboxCommon:ControlledVocabularyStringType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Type field utilizes a standardized controlled vocabulary to capture the type of hash used in the Simple_Hash_Value or Fuzzy_Hash_Value elements.</xs:documentation>
        <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is HashNameVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.</xs:documentation>
        <xs:documentation>Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:choice>
      <xs:element name="Simple_Hash_Value" type="cyboxCommon:SimpleHashValueType" minOccurs="0">
        <xs:annotation>
          <xs:documentation>The Simple_Hash_Value field specifies a single result value of a basic cryptograhic hash function outputting a single hexbinary hash value.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Fuzzy_Hash_Value" type="cyboxCommon:FuzzyHashValueType" minOccurs="0">
        <xs:annotation>
          <xs:documentation>The Fuzzy_Hash_Value field specifies a single result value of a cryptograhic fuzzy hash function outputting a single complex string based hash value. (e.g. SSDEEP's Block1hash:Block2hash format).</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:choice>
    <xs:element name="Fuzzy_Hash_Structure" type="cyboxCommon:FuzzyHashStructureType" minOccurs="0" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Fuzzy_Hash_Structure field is optional and enables the characterization of the key internal components of a fuzzy hash calculation with a given block size.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:SimpleHashValueType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The SimpleHashValueType is used for characterizing the output of basic cryptograhic hash functions outputting a single hexbinary hash value.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#HexBinaryObjectPropertyType_datatype cybox_common_xsd.tmp#HexBinaryObjectPropertyType
Type extension of cyboxCommon:HexBinaryObjectPropertyType
Type hierarchy
Used by
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum hexBinary optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="SimpleHashValueType">
  <xs:annotation>
    <xs:documentation>The SimpleHashValueType is used for characterizing the output of basic cryptograhic hash functions outputting a single hexbinary hash value.</xs:documentation>
  </xs:annotation>
  <xs:complexContent>
    <xs:extension base="cyboxCommon:HexBinaryObjectPropertyType"/>
  </xs:complexContent>
</xs:complexType>
Complex Type cyboxCommon:HexBinaryObjectPropertyType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The HexBinaryObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type HexBinary. This type will be assigned to any property of a CybOX object that should contain content of type HexBinary and enables the use of relevant metadata for the property.
 
Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#HexBinaryObjectPropertyType_datatype
Type restriction of cyboxCommon:BaseObjectPropertyType
Type hierarchy
Used by
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum hexBinary optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="HexBinaryObjectPropertyType">
  <xs:annotation>
    <xs:documentation>The HexBinaryObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type HexBinary. This type will be assigned to any property of a CybOX object that should contain content of type HexBinary and enables the use of relevant metadata for the property.</xs:documentation>
    <xs:documentation>Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
      <xs:simpleType>
        <xs:union memberTypes="xs:string"/>
      </xs:simpleType>
      <xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="hexBinary">
        <xs:annotation>
          <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:restriction>
  </xs:simpleContent>
</xs:complexType>
Complex Type cyboxCommon:BaseObjectPropertyType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The BaseObjectPropertyType is a type representing a common typing foundation for the specification of a single Object Property.
 
Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup
Type extension of xs:anySimpleType
Used by
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the expected type for the value of the specified property.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="BaseObjectPropertyType" abstract="true">
  <xs:annotation>
    <xs:documentation>The BaseObjectPropertyType is a type representing a common typing foundation for the specification of a single Object Property.</xs:documentation>
    <xs:documentation>Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:extension base="xs:anySimpleType">
      <xs:attributeGroup ref="cyboxCommon:BaseObjectPropertyGroup"/>
      <xs:attributeGroup ref="cyboxCommon:PatternFieldGroup"/>
    </xs:extension>
  </xs:simpleContent>
</xs:complexType>
Simple Type cyboxCommon:DatatypeEnum
Namespace http://cybox.mitre.org/common-2
Annotations
 
DataTypeEnum is a (non-exhaustive) enumeration of data types.
Diagram
Diagram
Type restriction of xs:string
Facets
enumeration string 
Specifies the string datatype as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#string for more information.
enumeration int 
Specifies the int datatype as it applies to the W3C standard for int. See http://www.w3.org/TR/xmlschema-2/#int for more information.
enumeration float 
Specifies the float datatype as it apples to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#float for more information.
enumeration date 
Specifies a date, which is usually in the form yyyy-mm--dd as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#date for more information.
enumeration positiveInteger 
Specifies a positive integer in the infinite set {1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#positiveInteger for more information.
enumeration unsignedInt 
Specifies an unsigned integer, which is a nonnegative integer in the set {0,1,2,...,4294967295} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedInt for more information.
enumeration dateTime 
Specifies a date in full format including both date and time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#dateTime for more information.
enumeration time 
Specifies a time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#time for more information.
enumeration boolean 
Specifies a boolean value in the set {true,false,1,0} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#boolean for more information.
enumeration name 
Specifies a name (which represents XML Names) as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#Name and http://www.w3.org/TR/2000/WD-xml-2e-20000814#dt-name for more information.
enumeration long 
Specifies a long integer, which is an integer whose maximum value is 9223372036854775807 and minimum value is -9223372036854775808 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#long for more information.
enumeration unsignedLong 
Specifies an unsigned long integer, which is an integer whose maximum value is 18446744073709551615 and minimum value is 0 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedLong for more information.
enumeration duration 
Specifies a length of time in the extended format PnYn MnDTnH nMnS, where nY represents the number of years, nM the number of months, nD the number of days, 'T' is the date/time separator, nH the number of hours, nM the number of minutes and nS the number of seconds, as it applies to the W3 standard. See http://www.w3.org/TR/xmlschema-2/#duration for more information.
enumeration double 
Specifies a decimal of datatype double as it is patterned after the IEEE double-precision 64-bit floating point type (IEEE 754-1985) and as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#double for more information.
enumeration nonNegativeInteger 
Specifies a non-negative integer in the infinite set {0,1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#nonNegativeInteger for more information.
enumeration hexBinary 
Specifies arbitrary hex-encoded binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#hexBinary for more information.
enumeration anyURI 
Specifies a Uniform Resource Identifier Reference (URI) as it applies to the W3C standard and to RFC 2396, as amended by RFC 2732. See http://www.w3.org/TR/xmlschema-2/#anyURI for more information.
enumeration base64Binary 
Specifies base64-encoded arbitrary binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#base64Binary for more information.
enumeration IPv4 Address 
Specifies an IPV4 address in dotted decimal form. CIDR notation is also accepted.
enumeration IPv6 Address 
Specifies an IPV6 address, which is represented by eight groups of 16-bit hexadecimal values separated by colons (:) in the form a:b:c:d:e:f:g:h. CIDR notation is also accepted.
enumeration Host Name 
Specifies a host name. For compatibility reasons, this could be any string. Even so, it is best to use the proper notation for the given host type. For example, web hostnames should be written as fully qualified hostnames in practice.
enumeration MAC Address 
Specifies a MAC address, which is represented by six groups of 2 hexdecimal digits, separated by hyphens (-) or colons (:) in transmission order.
enumeration Domain Name 
Specifies a domain name, which is represented by a series of labels concatenated with dots conforming to the rules in RFC 1035, RFC 1123, and RFC 2181.
enumeration URI 
Specifies a Uniform Resource Identifier, which identifies a name or resource and can act as a URL or URN.
enumeration TimeZone 
Specifies a timezone in UTC notation (UTC+number).
enumeration Octal 
Specifies arbitrary octal (base-8) encoded data.
enumeration Binary 
Specifies arbitrary binary encoded data.
enumeration BinHex 
Specifies arbitrary data encoded in the Mac OS-originated BinHex format.
enumeration Subnet Mask 
Specifies a subnet mask in IPv4 or IPv6 notation.
enumeration UUID/GUID 
Specifies a globally/universally unique ID represented as a 32-character hexadecimal string. See ISO/IEC 11578:1996 Information technology -- Open Systems Interconnection -- Remote Procedure Call - http://www.iso.ch/cate/d2229.html.
enumeration Collection 
Specifies data represented as a container of multiple data of a shared elemental type.
enumeration CVE ID 
Specifies a CVE ID, expressed as CVE- appended by a four-digit integer, a - and another four-digit integer, as in CVE-2012-1234.
enumeration CWE ID 
Specifies a CWE ID, expressed as CWE- appended by an integer.
enumeration CAPEC ID 
Specifies a CAPEC ID, expressed as CAPEC- appended by an integer.
enumeration CCE ID 
Specifies a CCE ID, expressed as CCE- appended by an integer.
enumeration CPE Name 
Specifies a CPE Name. See http://cpe.mitre.org/specification/archive/version2.0/cpe-specification_2.0.pdf for more information.
Used by
Source
 
<xs:simpleType name="DatatypeEnum">
  <xs:annotation>
    <xs:documentation>DataTypeEnum is a (non-exhaustive) enumeration of data types.</xs:documentation>
  </xs:annotation>
  <xs:restriction base="xs:string">
    <xs:enumeration value="string">
      <xs:annotation>
        <xs:documentation>Specifies the string datatype as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#string for more information.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="int">
      <xs:annotation>
        <xs:documentation>Specifies the int datatype as it applies to the W3C standard for int. See http://www.w3.org/TR/xmlschema-2/#int for more information.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="float">
      <xs:annotation>
        <xs:documentation>Specifies the float datatype as it apples to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#float for more information.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="date">
      <xs:annotation>
        <xs:documentation>Specifies a date, which is usually in the form yyyy-mm--dd as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#date for more information.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="positiveInteger">
      <xs:annotation>
        <xs:documentation>Specifies a positive integer in the infinite set {1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#positiveInteger for more information.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="unsignedInt">
      <xs:annotation>
        <xs:documentation>Specifies an unsigned integer, which is a nonnegative integer in the set {0,1,2,...,4294967295} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedInt for more information.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="dateTime">
      <xs:annotation>
        <xs:documentation>Specifies a date in full format including both date and time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#dateTime for more information.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="time">
      <xs:annotation>
        <xs:documentation>Specifies a time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#time for more information.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="boolean">
      <xs:annotation>
        <xs:documentation>Specifies a boolean value in the set {true,false,1,0} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#boolean for more information.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="name">
      <xs:annotation>
        <xs:documentation>Specifies a name (which represents XML Names) as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#Name and http://www.w3.org/TR/2000/WD-xml-2e-20000814#dt-name for more information.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="long">
      <xs:annotation>
        <xs:documentation>Specifies a long integer, which is an integer whose maximum value is 9223372036854775807 and minimum value is -9223372036854775808 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#long for more information.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="unsignedLong">
      <xs:annotation>
        <xs:documentation>Specifies an unsigned long integer, which is an integer whose maximum value is 18446744073709551615 and minimum value is 0 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedLong for more information.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="duration">
      <xs:annotation>
        <xs:documentation>Specifies a length of time in the extended format PnYn MnDTnH nMnS, where nY represents the number of years, nM the number of months, nD the number of days, 'T' is the date/time separator, nH the number of hours, nM the number of minutes and nS the number of seconds, as it applies to the W3 standard. See http://www.w3.org/TR/xmlschema-2/#duration for more information.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="double">
      <xs:annotation>
        <xs:documentation>Specifies a decimal of datatype double as it is patterned after the IEEE double-precision 64-bit floating point type (IEEE 754-1985) and as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#double for more information.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="nonNegativeInteger">
      <xs:annotation>
        <xs:documentation>Specifies a non-negative integer in the infinite set {0,1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#nonNegativeInteger for more information.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="hexBinary">
      <xs:annotation>
        <xs:documentation>Specifies arbitrary hex-encoded binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#hexBinary for more information.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="anyURI">
      <xs:annotation>
        <xs:documentation>Specifies a Uniform Resource Identifier Reference (URI) as it applies to the W3C standard and to RFC 2396, as amended by RFC 2732. See http://www.w3.org/TR/xmlschema-2/#anyURI for more information.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="base64Binary">
      <xs:annotation>
        <xs:documentation>Specifies base64-encoded arbitrary binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#base64Binary for more information.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="IPv4 Address">
      <xs:annotation>
        <xs:documentation>Specifies an IPV4 address in dotted decimal form. CIDR notation is also accepted.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="IPv6 Address">
      <xs:annotation>
        <xs:documentation>Specifies an IPV6 address, which is represented by eight groups of 16-bit hexadecimal values separated by colons (:) in the form a:b:c:d:e:f:g:h. CIDR notation is also accepted.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Host Name">
      <xs:annotation>
        <xs:documentation>Specifies a host name. For compatibility reasons, this could be any string. Even so, it is best to use the proper notation for the given host type. For example, web hostnames should be written as fully qualified hostnames in practice.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="MAC Address">
      <xs:annotation>
        <xs:documentation>Specifies a MAC address, which is represented by six groups of 2 hexdecimal digits, separated by hyphens (-) or colons (:) in transmission order.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Domain Name">
      <xs:annotation>
        <xs:documentation>Specifies a domain name, which is represented by a series of labels concatenated with dots conforming to the rules in RFC 1035, RFC 1123, and RFC 2181.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="URI">
      <xs:annotation>
        <xs:documentation>Specifies a Uniform Resource Identifier, which identifies a name or resource and can act as a URL or URN.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="TimeZone">
      <xs:annotation>
        <xs:documentation>Specifies a timezone in UTC notation (UTC+number).</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Octal">
      <xs:annotation>
        <xs:documentation>Specifies arbitrary octal (base-8) encoded data.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Binary">
      <xs:annotation>
        <xs:documentation>Specifies arbitrary binary encoded data.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="BinHex">
      <xs:annotation>
        <xs:documentation>Specifies arbitrary data encoded in the Mac OS-originated BinHex format.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Subnet Mask">
      <xs:annotation>
        <xs:documentation>Specifies a subnet mask in IPv4 or IPv6 notation.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="UUID/GUID">
      <xs:annotation>
        <xs:documentation>Specifies a globally/universally unique ID represented as a 32-character hexadecimal string. See ISO/IEC 11578:1996 Information technology -- Open Systems Interconnection -- Remote Procedure Call - http://www.iso.ch/cate/d2229.html.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Collection">
      <xs:annotation>
        <xs:documentation>Specifies data represented as a container of multiple data of a shared elemental type.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="CVE ID">
      <xs:annotation>
        <xs:documentation>Specifies a CVE ID, expressed as CVE- appended by a four-digit integer, a - and another four-digit integer, as in CVE-2012-1234.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="CWE ID">
      <xs:annotation>
        <xs:documentation>Specifies a CWE ID, expressed as CWE- appended by an integer.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="CAPEC ID">
      <xs:annotation>
        <xs:documentation>Specifies a CAPEC ID, expressed as CAPEC- appended by an integer.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="CCE ID">
      <xs:annotation>
        <xs:documentation>Specifies a CCE ID, expressed as CCE- appended by an integer.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="CPE Name">
      <xs:annotation>
        <xs:documentation>Specifies a CPE Name. See http://cpe.mitre.org/specification/archive/version2.0/cpe-specification_2.0.pdf for more information.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
  </xs:restriction>
</xs:simpleType>
Complex Type cyboxCommon:FuzzyHashValueType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The FuzzyHashValueType is used for characterizing the output of cryptograhic fuzzy hash functions outputting a single complex string based hash value.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype cybox_common_xsd.tmp#StringObjectPropertyType
Type extension of cyboxCommon:StringObjectPropertyType
Type hierarchy
Used by
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="FuzzyHashValueType">
  <xs:annotation>
    <xs:documentation>The FuzzyHashValueType is used for characterizing the output of cryptograhic fuzzy hash functions outputting a single complex string based hash value.</xs:documentation>
  </xs:annotation>
  <xs:complexContent>
    <xs:extension base="cyboxCommon:StringObjectPropertyType"/>
  </xs:complexContent>
</xs:complexType>
Complex Type cyboxCommon:StringObjectPropertyType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The StringObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type String. This type will be assigned to any property of a CybOX object that should contain content of type String and enables the use of relevant metadata for the property.
 
Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype
Type restriction of cyboxCommon:BaseObjectPropertyType
Type hierarchy
Used by
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="StringObjectPropertyType">
  <xs:annotation>
    <xs:documentation>The StringObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type String. This type will be assigned to any property of a CybOX object that should contain content of type String and enables the use of relevant metadata for the property.</xs:documentation>
    <xs:documentation>Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
      <xs:simpleType>
        <xs:union memberTypes="xs:string"/>
      </xs:simpleType>
      <xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="string">
        <xs:annotation>
          <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:restriction>
  </xs:simpleContent>
</xs:complexType>
Complex Type cyboxCommon:FuzzyHashStructureType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The FuzzyHashStructureType is used for characterizing the internal components of a cryptograhic fuzzy hash algorithmic calculation.
Diagram
Diagram cybox_common_xsd.tmp#FuzzyHashStructureType_Block_Size cybox_common_xsd.tmp#FuzzyHashStructureType_Block_Hash
Used by
Children cyboxCommon:Block_Hash, cyboxCommon:Block_Size
Source
 
<xs:complexType name="FuzzyHashStructureType">
  <xs:annotation>
    <xs:documentation>The FuzzyHashStructureType is used for characterizing the internal components of a cryptograhic fuzzy hash algorithmic calculation.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Block_Size" type="cyboxCommon:IntegerObjectPropertyType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Block_Size field is optional and specifies the calculated block size for this fuzzy hash calculation.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Block_Hash" type="cyboxCommon:FuzzyHashBlockType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Block_Hash field is optional and enables specification of the elemental components utilized for a fuzzy hash calculation on the hashed object utilizing Block_Size to calculate trigger points.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:IntegerObjectPropertyType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The IntegerObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type Int. This type will be assigned to any property of a CybOX object that should contain content of type Integer and enables the use of relevant metadata for the property.
 
Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#IntegerObjectPropertyType_datatype
Type restriction of cyboxCommon:BaseObjectPropertyType
Type hierarchy
Used by
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum int optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="IntegerObjectPropertyType">
  <xs:annotation>
    <xs:documentation>The IntegerObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type Int. This type will be assigned to any property of a CybOX object that should contain content of type Integer and enables the use of relevant metadata for the property.</xs:documentation>
    <xs:documentation>Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
      <xs:simpleType>
        <xs:union memberTypes="xs:string"/>
      </xs:simpleType>
      <xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="int">
        <xs:annotation>
          <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:restriction>
  </xs:simpleContent>
</xs:complexType>
Complex Type cyboxCommon:FuzzyHashBlockType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The FuzzyHashBlockType is used for characterizing the internal components of a single block in a cryptograhic fuzzy hash algorithmic calculation.
Diagram
Diagram cybox_common_xsd.tmp#FuzzyHashBlockType_Block_Hash_Value cybox_common_xsd.tmp#FuzzyHashBlockType_Segment_Count cybox_common_xsd.tmp#FuzzyHashBlockType_Segments
Used by
Children cyboxCommon:Block_Hash_Value, cyboxCommon:Segment_Count, cyboxCommon:Segments
Source
 
<xs:complexType name="FuzzyHashBlockType">
  <xs:annotation>
    <xs:documentation>The FuzzyHashBlockType is used for characterizing the internal components of a single block in a cryptograhic fuzzy hash algorithmic calculation.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Block_Hash_Value" type="cyboxCommon:HashValueType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Block_Hash_Value field is optional and specifies a fuzzy hash calculation result value for this Block.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Segment_Count" type="cyboxCommon:IntegerObjectPropertyType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Segment_Count field is optional and specifies the number of segments identified and utilized within this fuzzy hash calculation.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Segments" type="cyboxCommon:HashSegmentsType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Segments field is optional and specifies the set of segments identified and utilized within this fuzzy hash calculation.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:HashValueType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The HashValueType is used for specifying the resulting value from a hash calculation.
Diagram
Diagram cybox_common_xsd.tmp#HashValueType_Simple_Hash_Value cybox_common_xsd.tmp#HashValueType_Fuzzy_Hash_Value
Used by
Children cyboxCommon:Fuzzy_Hash_Value, cyboxCommon:Simple_Hash_Value
Source
 
<xs:complexType name="HashValueType">
  <xs:annotation>
    <xs:documentation>The HashValueType is used for specifying the resulting value from a hash calculation.</xs:documentation>
  </xs:annotation>
  <xs:choice>
    <xs:element name="Simple_Hash_Value" type="cyboxCommon:SimpleHashValueType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Simple_Hash_Value field specifies a single result value of a basic cryptograhic hash function outputting a single hexbinary hash value.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Fuzzy_Hash_Value" type="cyboxCommon:FuzzyHashValueType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Fuzzy_Hash_Value field specifies a single result value of a cryptograhic fuzzy hash function outputting a single complex string based hash value. (e.g. SSDEEP's Block1hash:Block2hash format).</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:choice>
</xs:complexType>
Complex Type cyboxCommon:HashSegmentsType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The HashSegmentsType is used for characterizing the internal components of a set of trigger point-delimited segments in a cryptographic fuzzy hash algorithmic calculation.
Diagram
Diagram cybox_common_xsd.tmp#HashSegmentsType_Segment
Used by
Children cyboxCommon:Segment
Source
 
<xs:complexType name="HashSegmentsType">
  <xs:annotation>
    <xs:documentation>The HashSegmentsType is used for characterizing the internal components of a set of trigger point-delimited segments in a cryptographic fuzzy hash algorithmic calculation.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Segment" type="cyboxCommon:HashSegmentType" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Segment field is optional and specifies a single segment identified and utilized within this fuzzy hash calculation.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:HashSegmentType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The HashSegmentType is used for characterizing the internal components of a single trigger point-delimited segment in a cryptograhic fuzzy hash algorithmic calculation.
Diagram
Diagram cybox_common_xsd.tmp#HashSegmentType_Trigger_Point cybox_common_xsd.tmp#HashSegmentType_Segment_Hash cybox_common_xsd.tmp#HashSegmentType_Raw_Segment_Content
Used by
Children cyboxCommon:Raw_Segment_Content, cyboxCommon:Segment_Hash, cyboxCommon:Trigger_Point
Source
 
<xs:complexType name="HashSegmentType">
  <xs:annotation>
    <xs:documentation>The HashSegmentType is used for characterizing the internal components of a single trigger point-delimited segment in a cryptograhic fuzzy hash algorithmic calculation.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Trigger_Point" type="cyboxCommon:HexBinaryObjectPropertyType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Trigger_point field is optional and specifies the offset within the hashed object of the trigger point for this segment.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Segment_Hash" type="cyboxCommon:HashValueType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Segment_Hash field is optional and specifies a calculated hash value for this segment.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Raw_Segment_Content" type="xs:anyType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Raw_Segment_Content field is optional and contains the raw content of this segment of the hashed object.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:ToolConfigurationType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The ToolConfigurationType characterizes the configuration for a tool used as a cyber observation source.
Diagram
Diagram cybox_common_xsd.tmp#ToolConfigurationType_Configuration_Settings cybox_common_xsd.tmp#ToolConfigurationType_Dependencies cybox_common_xsd.tmp#ToolConfigurationType_Usage_Context_Assumptions cybox_common_xsd.tmp#ToolConfigurationType_Internationalization_Settings cybox_common_xsd.tmp#ToolConfigurationType_Build_Information
Used by
Children cyboxCommon:Build_Information, cyboxCommon:Configuration_Settings, cyboxCommon:Dependencies, cyboxCommon:Internationalization_Settings, cyboxCommon:Usage_Context_Assumptions
Source
 
<xs:complexType name="ToolConfigurationType">
  <xs:annotation>
    <xs:documentation>The ToolConfigurationType characterizes the configuration for a tool used as a cyber observation source.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Configuration_Settings" type="cyboxCommon:ConfigurationSettingsType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field describes the configuration settings of this tool instance.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Dependencies" type="cyboxCommon:DependenciesType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains information describing the relevant dependencies for this tool.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Usage_Context_Assumptions" type="cyboxCommon:UsageContextAssumptionsType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains descriptions of the various relevant usage context assumptions for this tool .</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Internationalization_Settings" type="cyboxCommon:InternationalizationSettingsType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains information describing relevant internationalization setting for this tool .</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Build_Information" type="cyboxCommon:BuildInformationType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains information describing how this tool was built.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:ConfigurationSettingsType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The ConfigurationSettingsType is a modularized data type used to provide a consistent approach to describing configuration settings for a tool, application or other cyber object.
Diagram
Diagram cybox_common_xsd.tmp#ConfigurationSettingsType_Configuration_Setting
Used by
Children cyboxCommon:Configuration_Setting
Source
 
<xs:complexType name="ConfigurationSettingsType">
  <xs:annotation>
    <xs:documentation>The ConfigurationSettingsType is a modularized data type used to provide a consistent approach to describing configuration settings for a tool, application or other cyber object.</xs:documentation>
  </xs:annotation>
  <xs:sequence minOccurs="0">
    <xs:element name="Configuration_Setting" type="cyboxCommon:ConfigurationSettingType" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>This field contains a single configuration setting instance.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:ConfigurationSettingType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The ConfigurationSettingType is a modularized data type used to provide a consistent approach to describing a particular configuration setting for a tool, application or other cyber object.
Diagram
Diagram cybox_common_xsd.tmp#ConfigurationSettingType_Item_Name cybox_common_xsd.tmp#ConfigurationSettingType_Item_Value cybox_common_xsd.tmp#ConfigurationSettingType_Item_Type cybox_common_xsd.tmp#ConfigurationSettingType_Item_Description
Used by
Children cyboxCommon:Item_Description, cyboxCommon:Item_Name, cyboxCommon:Item_Type, cyboxCommon:Item_Value
Source
 
<xs:complexType name="ConfigurationSettingType">
  <xs:annotation>
    <xs:documentation>The ConfigurationSettingType is a modularized data type used to provide a consistent approach to describing a particular configuration setting for a tool, application or other cyber object.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Item_Name" type="xs:string">
      <xs:annotation>
        <xs:documentation>This field contains the name of the configuration item referenced by this configuration setting instance.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Item_Value" type="xs:string">
      <xs:annotation>
        <xs:documentation>This field contains the value of this configuration setting instance.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Item_Type" type="xs:string" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains the type of the configuration item referenced in this configuration setting instance.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Item_Description" type="xs:string" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains a description of the configuration item referenced in this configuration setting instance.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:DependenciesType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The DependenciesType contains information describing a set of dependencies for this tool.
Diagram
Diagram cybox_common_xsd.tmp#DependenciesType_Dependency
Used by
Children cyboxCommon:Dependency
Source
 
<xs:complexType name="DependenciesType">
  <xs:annotation>
    <xs:documentation>The DependenciesType contains information describing a set of dependencies for this tool.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Dependency" type="cyboxCommon:DependencyType" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>This field contains information describing a single dependency for this tool.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:DependencyType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The DependencyType contains information describing a single dependency for this tool.
Diagram
Diagram cybox_common_xsd.tmp#DependencyType_Dependency_Type cybox_common_xsd.tmp#DependencyType_Dependency_Description
Used by
Children cyboxCommon:Dependency_Description, cyboxCommon:Dependency_Type
Source
 
<xs:complexType name="DependencyType">
  <xs:annotation>
    <xs:documentation>The DependencyType contains information describing a single dependency for this tool.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Dependency_Type" type="xs:string" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field describes the type of this dependency instance.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Dependency_Description" type="cyboxCommon:StructuredTextType">
      <xs:annotation>
        <xs:documentation>This field contains a description of this dependency instance.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:UsageContextAssumptionsType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The UsageContextAssumptionsType contains descriptions of the various relevant usage context assumptions for this tool.
Diagram
Diagram cybox_common_xsd.tmp#UsageContextAssumptionsType_Usage_Context_Assumption
Used by
Children cyboxCommon:Usage_Context_Assumption
Source
 
<xs:complexType name="UsageContextAssumptionsType">
  <xs:annotation>
    <xs:documentation>The UsageContextAssumptionsType contains descriptions of the various relevant usage context assumptions for this tool.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Usage_Context_Assumption" type="cyboxCommon:StructuredTextType" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>This field contains a single usage context assumption for this tool.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:InternationalizationSettingsType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The InternationalizationSettingsType contains information describing relevant internationalization setting for this tool.
Diagram
Diagram cybox_common_xsd.tmp#InternationalizationSettingsType_Internal_Strings
Used by
Children cyboxCommon:Internal_Strings
Source
 
<xs:complexType name="InternationalizationSettingsType">
  <xs:annotation>
    <xs:documentation>The InternationalizationSettingsType contains information describing relevant internationalization setting for this tool.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Internal_Strings" type="cyboxCommon:InternalStringsType" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>This field contains a single internal string instance for this internationalization setting instance.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:InternalStringsType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The InternalStringsType contains a single internal string instance for this internationalization setting instance.
Diagram
Diagram cybox_common_xsd.tmp#InternalStringsType_Key cybox_common_xsd.tmp#InternalStringsType_Content
Used by
Children cyboxCommon:Content, cyboxCommon:Key
Source
 
<xs:complexType name="InternalStringsType">
  <xs:annotation>
    <xs:documentation>The InternalStringsType contains a single internal string instance for this internationalization setting instance.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Key" type="xs:string">
      <xs:annotation>
        <xs:documentation>This field contains the actual key of this internal string instance.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Content" type="xs:string">
      <xs:annotation>
        <xs:documentation>This field contains the actual content of this internal string instance.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:BuildInformationType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The BuildInformationType contains information describing how this tool was built.
Diagram
Diagram cybox_common_xsd.tmp#BuildInformationType_Build_ID cybox_common_xsd.tmp#BuildInformationType_Build_Project cybox_common_xsd.tmp#BuildInformationType_Build_Utility cybox_common_xsd.tmp#BuildInformationType_Build_Version cybox_common_xsd.tmp#BuildInformationType_Build_Label cybox_common_xsd.tmp#BuildInformationType_Compilers cybox_common_xsd.tmp#BuildInformationType_Compilation_Date cybox_common_xsd.tmp#BuildInformationType_Build_Configuration cybox_common_xsd.tmp#BuildInformationType_Build_Script cybox_common_xsd.tmp#BuildInformationType_Libraries cybox_common_xsd.tmp#BuildInformationType_Build_Output_Log
Used by
Children cyboxCommon:Build_Configuration, cyboxCommon:Build_ID, cyboxCommon:Build_Label, cyboxCommon:Build_Output_Log, cyboxCommon:Build_Project, cyboxCommon:Build_Script, cyboxCommon:Build_Utility, cyboxCommon:Build_Version, cyboxCommon:Compilation_Date, cyboxCommon:Compilers, cyboxCommon:Libraries
Source
 
<xs:complexType name="BuildInformationType">
  <xs:annotation>
    <xs:documentation>The BuildInformationType contains information describing how this tool was built.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Build_ID" type="xs:string" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains an externally defined unique identifier of this build of this application instance.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Build_Project" type="xs:string" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains the project name of this build of this application instance.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Build_Utility" type="cyboxCommon:BuildUtilityType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains information identifying the utility used to build this application.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Build_Version" type="xs:string" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains the appropriate version descriptor of this build of this application instance.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Build_Label" type="xs:string" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains any relevant label for this build of this application instance.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Compilers" type="cyboxCommon:CompilersType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field describes the compilers utilized during this build of this application.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Compilation_Date" type="cyboxCommon:DateTimeWithPrecisionType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field identifies the compilation date for the build of the tool. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Build_Configuration" type="cyboxCommon:BuildConfigurationType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field describes how the build utility was configured for this build of this application.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Build_Script" type="xs:string" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains the actual build script for this build of this application instance.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Libraries" type="cyboxCommon:LibrariesType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field identifies the libraries incorporated into the build of the tool.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Build_Output_Log" type="xs:string" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains a capture of the output log of the build process.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:BuildUtilityType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The BuildUtilityType contains information identifying the utility used to build this application.
Diagram
Diagram cybox_common_xsd.tmp#BuildUtilityType_Build_Utility_Name cybox_common_xsd.tmp#BuildUtilityType_Build_Utility_Platform_Specification
Used by
Children cyboxCommon:Build_Utility_Name, cyboxCommon:Build_Utility_Platform_Specification
Source
 
<xs:complexType name="BuildUtilityType">
  <xs:annotation>
    <xs:documentation>The BuildUtilityType contains information identifying the utility used to build this application.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Build_Utility_Name" type="xs:string">
      <xs:annotation>
        <xs:documentation>This field contains the informally defined name of the utility used to build this application instance.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Build_Utility_Platform_Specification" type="cyboxCommon:PlatformSpecificationType">
      <xs:annotation>
        <xs:documentation>This field identifies the build utility used to build this application.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:PlatformSpecificationType
Namespace http://cybox.mitre.org/common-2
Annotations
 
PlatformSpecificationType is a modularized data type intended for providing a consistent approach to uniquely specifying the identity of a specific platform.
 
In addition to capturing basic information, this type is intended to be extended to enable the structured description of a platform instance using the XML Schema extension feature. The CybOX default extension uses the Common Platform Enumeration (CPE) Applicability Language schema to do so. The extension that defines this is captured in the CPE23PlatformSpecificationType in the http://cybox.mitre.org/extensions/platform#CPE2.3-1 namespace. This type is defined in the extensions/platform/cpe2.3.xsd file.
Diagram
Diagram cybox_common_xsd.tmp#PlatformSpecificationType_Description cybox_common_xsd.tmp#PlatformSpecificationType_Identifier
Used by
Children cyboxCommon:Description, cyboxCommon:Identifier
Source
 
<xs:complexType name="PlatformSpecificationType">
  <xs:annotation>
    <xs:documentation>PlatformSpecificationType is a modularized data type intended for providing a consistent approach to uniquely specifying the identity of a specific platform.</xs:documentation>
    <xs:documentation>In addition to capturing basic information, this type is intended to be extended to enable the structured description of a platform instance using the XML Schema extension feature. The CybOX default extension uses the Common Platform Enumeration (CPE) Applicability Language schema to do so. The extension that defines this is captured in the CPE23PlatformSpecificationType in the http://cybox.mitre.org/extensions/platform#CPE2.3-1 namespace. This type is defined in the extensions/platform/cpe2.3.xsd file.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Description" type="cyboxCommon:StructuredTextType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>A prose description of the indicated platform.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Identifier" type="cyboxCommon:PlatformIdentifierType" minOccurs="0" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>Indicates a pre-defined name for the given platform using some naming scheme. For example, one could provide a CPE (Common Platform Enumeration) name using the CPE naming format.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:PlatformIdentifierType
Namespace http://cybox.mitre.org/common-2
Annotations
 
Used to specify a name for a platform using a particular naming system and also allowing a reference pointing to more information about that naming scheme. For example, one could provide a CPE (Common Platform Enumeration) name using the CPE naming format. In this case, the system value could be "CPE" while the system_ref value could be "http://scap.nist.gov/specifications/cpe/".
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype cybox_common_xsd.tmp#StringObjectPropertyType cybox_common_xsd.tmp#PlatformIdentifierType_system cybox_common_xsd.tmp#PlatformIdentifierType_system-ref
Type extension of cyboxCommon:StringObjectPropertyType
Type hierarchy
Used by
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
system xs:string optional 
Indicates the naming system from which the indicated name was drawn.
system-ref xs:anyURI optional 
A reference to information about the naming system from which the indicated name was drawn.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="PlatformIdentifierType">
  <xs:annotation>
    <xs:documentation>Used to specify a name for a platform using a particular naming system and also allowing a reference pointing to more information about that naming scheme. For example, one could provide a CPE (Common Platform Enumeration) name using the CPE naming format. In this case, the system value could be "CPE" while the system_ref value could be "http://scap.nist.gov/specifications/cpe/".</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:extension base="cyboxCommon:StringObjectPropertyType">
      <xs:attribute name="system" type="xs:string">
        <xs:annotation>
          <xs:documentation>Indicates the naming system from which the indicated name was drawn.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
      <xs:attribute name="system-ref" type="xs:anyURI">
        <xs:annotation>
          <xs:documentation>A reference to information about the naming system from which the indicated name was drawn.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:extension>
  </xs:simpleContent>
</xs:complexType>
Complex Type cyboxCommon:CompilersType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The CompilersType describes the compilers utilized during this build of this application.
Diagram
Diagram cybox_common_xsd.tmp#CompilersType_Compiler
Used by
Children cyboxCommon:Compiler
Source
 
<xs:complexType name="CompilersType">
  <xs:annotation>
    <xs:documentation>The CompilersType describes the compilers utilized during this build of this application.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Compiler" type="cyboxCommon:CompilerType" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>This field describes a single compiler utilized during this build of this application.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:CompilerType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The CompilerType describes a single compiler utilized during this build of this application.
Diagram
Diagram cybox_common_xsd.tmp#CompilerType_Compiler_Informal_Description cybox_common_xsd.tmp#CompilerType_Compiler_Platform_Specification
Used by
Children cyboxCommon:Compiler_Informal_Description, cyboxCommon:Compiler_Platform_Specification
Source
 
<xs:complexType name="CompilerType">
  <xs:annotation>
    <xs:documentation>The CompilerType describes a single compiler utilized during this build of this application.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Compiler_Informal_Description" type="cyboxCommon:CompilerInformalDescriptionType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains the informal description of this compiler instance.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Compiler_Platform_Specification" type="cyboxCommon:PlatformSpecificationType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field identifies this compiler instance.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:CompilerInformalDescriptionType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The CompilerInformalDescriptionType contains the informal description of this compiler instance.
Diagram
Diagram cybox_common_xsd.tmp#CompilerInformalDescriptionType_Compiler_Name cybox_common_xsd.tmp#CompilerInformalDescriptionType_Compiler_Version
Used by
Children cyboxCommon:Compiler_Name, cyboxCommon:Compiler_Version
Source
 
<xs:complexType name="CompilerInformalDescriptionType">
  <xs:annotation>
    <xs:documentation>The CompilerInformalDescriptionType contains the informal description of this compiler instance.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Compiler_Name" type="xs:string">
      <xs:annotation>
        <xs:documentation>This field contains the name of the compiler.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Compiler_Version" type="xs:string" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains the version of the compiler.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:BuildConfigurationType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The BuildConfigurationType describes how the build utility was configured for this build of this application.
Diagram
Diagram cybox_common_xsd.tmp#BuildConfigurationType_Configuration_Setting_Description cybox_common_xsd.tmp#BuildConfigurationType_Configuration_Settings
Used by
Children cyboxCommon:Configuration_Setting_Description, cyboxCommon:Configuration_Settings
Source
 
<xs:complexType name="BuildConfigurationType">
  <xs:annotation>
    <xs:documentation>The BuildConfigurationType describes how the build utility was configured for this build of this application.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Configuration_Setting_Description" type="xs:string" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains the description of the configuration settings for this build of this application instance.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Configuration_Settings" type="cyboxCommon:ConfigurationSettingsType">
      <xs:annotation>
        <xs:documentation>This field contains the configuration settings for this build of this application instance.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:LibrariesType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The LibrariesType identifies the libraries incorporated into the build of the tool.
Diagram
Diagram cybox_common_xsd.tmp#LibrariesType_Library
Used by
Children cyboxCommon:Library
Source
 
<xs:complexType name="LibrariesType">
  <xs:annotation>
    <xs:documentation>The LibrariesType identifies the libraries incorporated into the build of the tool.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Library" type="cyboxCommon:LibraryType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field identifies a library incorporated into the build of the tool.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:LibraryType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The LibraryType identifies a single library incorporated into the build of the tool.
Diagram
Diagram cybox_common_xsd.tmp#LibraryType_name cybox_common_xsd.tmp#LibraryType_version
Used by
Attributes
QName Type Use Annotation
name xs:string optional 
This field identifies the name of the library.
version xs:string optional 
This field identifies the version of the library.
Source
 
<xs:complexType name="LibraryType">
  <xs:annotation>
    <xs:documentation>The LibraryType identifies a single library incorporated into the build of the tool.</xs:documentation>
  </xs:annotation>
  <xs:attribute name="name" type="xs:string">
    <xs:annotation>
      <xs:documentation>This field identifies the name of the library.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="version" type="xs:string">
    <xs:annotation>
      <xs:documentation>This field identifies the version of the library.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
</xs:complexType>
Complex Type cyboxCommon:ExecutionEnvironmentType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The ExecutionEnvironmentType contains information describing the execution environment of the tool.
Diagram
Diagram cybox_common_xsd.tmp#ExecutionEnvironmentType_System cybox_common_xsd.tmp#ExecutionEnvironmentType_User_Account_Info cybox_common_xsd.tmp#ExecutionEnvironmentType_Command_Line cybox_common_xsd.tmp#ExecutionEnvironmentType_Start_Time
Used by
Children cyboxCommon:Command_Line, cyboxCommon:Start_Time, cyboxCommon:System, cyboxCommon:User_Account_Info
Source
 
<xs:complexType name="ExecutionEnvironmentType">
  <xs:annotation>
    <xs:documentation>The ExecutionEnvironmentType contains information describing the execution environment of the tool.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="System" type="cyboxCommon:ObjectPropertiesType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains information describing the system on which the tool was executed. System should be of type SystemObj:SystemObjectType.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="User_Account_Info" type="cyboxCommon:ObjectPropertiesType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field contains information describing the user account that executed the tool. User_Account_Info should be of type UserAccountObj:UserAccountObjectType.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Command_Line" type="xs:string" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field specifies the command line string used to run the tool.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Start_Time" type="cyboxCommon:DateTimeWithPrecisionType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field specifies when the tool was run. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:ObjectPropertiesType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The ObjectPropertiesType is an Abstract type placeholder within the CybOX schema enabling the inclusion of contextually varying object properties descriptions. This Abstract type is leveraged as the extension base for all predefined CybOX object properties schemas. Through this extension mechanism any object instance data based on an object properties schema extended from ObjectPropertiesType (e.g. File_Object, Address_Object, etc.) can be directly integrated into any instance document where a field is defined as ObjectPropertiesType. For flexibility and extensibility purposes any user of CybOX can specify their own externally defined object properties schemas (outside of or derived from the set of predefined objects) extended from ObjectPropertiesType and utilize them as part of their CybOX content.
Diagram
Diagram cybox_common_xsd.tmp#ObjectPropertiesType_object_reference cybox_common_xsd.tmp#ObjectPropertiesType_Custom_Properties
Used by
Children cyboxCommon:Custom_Properties
Attributes
QName Type Use Annotation
object_reference xs:QName optional 
The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
Source
 
<xs:complexType name="ObjectPropertiesType" abstract="true">
  <xs:annotation>
    <xs:documentation>The ObjectPropertiesType is an Abstract type placeholder within the CybOX schema enabling the inclusion of contextually varying object properties descriptions. This Abstract type is leveraged as the extension base for all predefined CybOX object properties schemas. Through this extension mechanism any object instance data based on an object properties schema extended from ObjectPropertiesType (e.g. File_Object, Address_Object, etc.) can be directly integrated into any instance document where a field is defined as ObjectPropertiesType. For flexibility and extensibility purposes any user of CybOX can specify their own externally defined object properties schemas (outside of or derived from the set of predefined objects) extended from ObjectPropertiesType and utilize them as part of their CybOX content.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Custom_Properties" type="cyboxCommon:CustomPropertiesType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Custom_Properties construct is optional and enables the specification of a set of custom Object Properties that may not be defined in existing Properties schemas.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
  <xs:attribute name="object_reference" type="xs:QName">
    <xs:annotation>
      <xs:documentation>The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
</xs:complexType>
Complex Type cyboxCommon:CustomPropertiesType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The CustomPropertiesType enables the specification of a set of custom Object Properties that may not be defined in existing Properties schemas.
Diagram
Diagram cybox_common_xsd.tmp#CustomPropertiesType_Property
Used by
Children cyboxCommon:Property
Source
 
<xs:complexType name="CustomPropertiesType">
  <xs:annotation>
    <xs:documentation>The CustomPropertiesType enables the specification of a set of custom Object Properties that may not be defined in existing Properties schemas.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Property" type="cyboxCommon:PropertyType" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Property construct enables the specification of a single Object Property.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:PropertyType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The PropertyType is a type representing the specification of a single Object Property.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#PropertyType_name cybox_common_xsd.tmp#PropertyType_description
Type extension of cyboxCommon:BaseObjectPropertyType
Type hierarchy
Used by
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the expected type for the value of the specified property.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
description xs:string optional 
A description of what this property represents.
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
name xs:string optional 
The name field specifies a name for this property.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="PropertyType">
  <xs:annotation>
    <xs:documentation>The PropertyType is a type representing the specification of a single Object Property.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:extension base="cyboxCommon:BaseObjectPropertyType">
      <xs:attribute name="name" type="xs:string">
        <xs:annotation>
          <xs:documentation>The name field specifies a name for this property.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
      <xs:attribute name="description" type="xs:string">
        <xs:annotation>
          <xs:documentation>A description of what this property represents.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:extension>
  </xs:simpleContent>
</xs:complexType>
Complex Type cyboxCommon:ErrorsType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The ErrorsType captures any errors generated during the run of the tool.
Diagram
Diagram cybox_common_xsd.tmp#ErrorsType_Error
Used by
Children cyboxCommon:Error
Source
 
<xs:complexType name="ErrorsType">
  <xs:annotation>
    <xs:documentation>The ErrorsType captures any errors generated during the run of the tool.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Error" type="cyboxCommon:ErrorType" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>This field captures a single type of error generated during the run of the tool.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:ErrorType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The ErrorType captures a single error generated during the run of the tool.
Diagram
Diagram cybox_common_xsd.tmp#ErrorType_Error_Type cybox_common_xsd.tmp#ErrorType_Error_Count cybox_common_xsd.tmp#ErrorType_Error_Instances
Used by
Children cyboxCommon:Error_Count, cyboxCommon:Error_Instances, cyboxCommon:Error_Type
Source
 
<xs:complexType name="ErrorType">
  <xs:annotation>
    <xs:documentation>The ErrorType captures a single error generated during the run of the tool.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Error_Type" type="xs:string">
      <xs:annotation>
        <xs:documentation>This field specifies the type for this tool run error.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Error_Count" type="xs:integer" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field specifies the count of instances for this error in the tool run.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Error_Instances" type="cyboxCommon:ErrorInstancesType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field captures the actual error output for each instance of this type of error.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:ErrorInstancesType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The ErrorInstancesType captures the actual error output for each instance of this type of error.
Diagram
Diagram cybox_common_xsd.tmp#ErrorInstancesType_Error_Instance
Used by
Children cyboxCommon:Error_Instance
Source
 
<xs:complexType name="ErrorInstancesType">
  <xs:annotation>
    <xs:documentation>The ErrorInstancesType captures the actual error output for each instance of this type of error.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Error_Instance" type="xs:string" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>This field captures the actual error output for a single instance of this type of error.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:MetadataType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The MetadataType is intended as mechanism to capture any non-context-specific metadata.
Diagram
Diagram cybox_common_xsd.tmp#MetadataType_type cybox_common_xsd.tmp#MetadataType_Value cybox_common_xsd.tmp#MetadataType_SubDatum
Used by
Children cyboxCommon:SubDatum, cyboxCommon:Value
Attributes
QName Type Use Annotation
type xs:string optional 
This field specifies the type of name of a single metadata field.
Source
 
<xs:complexType name="MetadataType">
  <xs:annotation>
    <xs:documentation>The MetadataType is intended as mechanism to capture any non-context-specific metadata.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Value" type="xs:string" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field specifies the value of name of a single metadata field.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="SubDatum" type="cyboxCommon:MetadataType" minOccurs="0" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>This field uses recursion of the MetadataType specify subdatum structures for this metadata field.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
  <xs:attribute name="type" type="xs:string">
    <xs:annotation>
      <xs:documentation>This field specifies the type of name of a single metadata field.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
</xs:complexType>
Complex Type cyboxCommon:CompensationModelType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The CompensationModelType characterizes the compensation model for a tool.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#CompensationModelType_datatype
Type restriction of cyboxCommon:BaseObjectPropertyType
Type hierarchy
Used by
Attributes
QName Type Fixed Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the expected type for the value of the specified property.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="CompensationModelType">
  <xs:annotation>
    <xs:documentation>The CompensationModelType characterizes the compensation model for a tool.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
      <xs:simpleType>
        <xs:union memberTypes="cyboxCommon:CompensationModelEnum xs:string"/>
      </xs:simpleType>
      <xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" fixed="string">
        <xs:annotation>
          <xs:documentation>This attribute is optional and specifies the expected type for the value of the specified property.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:restriction>
  </xs:simpleContent>
</xs:complexType>
Simple Type cyboxCommon:SourceClassTypeEnum
Namespace http://cybox.mitre.org/common-2
Annotations
 
The SourceClassTypeEnum is a (non-exhaustive) enumeration of cyber observation source classes.
Diagram
Diagram
Type restriction of xs:string
Facets
enumeration Network 
Describes a Network-based cyber observation.
enumeration System 
Describes a System-based cyber observation.
enumeration Software 
Describes a Software-based cyber observation.
Used by
Source
 
<xs:simpleType name="SourceClassTypeEnum">
  <xs:annotation>
    <xs:documentation>The SourceClassTypeEnum is a (non-exhaustive) enumeration of cyber observation source classes.</xs:documentation>
  </xs:annotation>
  <xs:restriction base="xs:string">
    <xs:enumeration value="Network">
      <xs:annotation>
        <xs:documentation>Describes a Network-based cyber observation.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="System">
      <xs:annotation>
        <xs:documentation>Describes a System-based cyber observation.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Software">
      <xs:annotation>
        <xs:documentation>Describes a Software-based cyber observation.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
  </xs:restriction>
</xs:simpleType>
Simple Type cyboxCommon:SourceTypeEnum
Namespace http://cybox.mitre.org/common-2
Annotations
 
The SourceTypeEnum is a (non-exhaustive) enumeration of cyber observation source types.
Diagram
Diagram
Type restriction of xs:string
Facets
enumeration Tool 
Describes a cyber observation made using various tools, such as scanners, firewalls, gateways, protection systems, and detection systems. See ToolTypeEnum for a more complete list of tools that CybOX supports.
enumeration Analysis 
Describes a cyber observation made from analysis methods, such as Static and Dynamic methods. See AnalysisMethodTypeEnum for a more complete list of methods that CybOX supports.
enumeration Information Source 
Describes a cyber observation made using other information sources, such as logs, Device Driver APIs, and TPM output data. See InformationSourceTypeEnum for a more complete list of information sources that CybOX supports.
Used by
Source
 
<xs:simpleType name="SourceTypeEnum">
  <xs:annotation>
    <xs:documentation>The SourceTypeEnum is a (non-exhaustive) enumeration of cyber observation source types.</xs:documentation>
  </xs:annotation>
  <xs:restriction base="xs:string">
    <xs:enumeration value="Tool">
      <xs:annotation>
        <xs:documentation>Describes a cyber observation made using various tools, such as scanners, firewalls, gateways, protection systems, and detection systems. See ToolTypeEnum for a more complete list of tools that CybOX supports.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Analysis">
      <xs:annotation>
        <xs:documentation>Describes a cyber observation made from analysis methods, such as Static and Dynamic methods. See AnalysisMethodTypeEnum for a more complete list of methods that CybOX supports.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Information Source">
      <xs:annotation>
        <xs:documentation>Describes a cyber observation made using other information sources, such as logs, Device Driver APIs, and TPM output data. See InformationSourceTypeEnum for a more complete list of information sources that CybOX supports.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
  </xs:restriction>
</xs:simpleType>
Complex Type cyboxCommon:DataSegmentType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The DataSegmentType is intended to provide a relatively abstract way of characterizing data segments that may be written/read/transmitted or otherwise utilized in actions or behaviors.
Diagram
Diagram cybox_common_xsd.tmp#DataSegmentType_id cybox_common_xsd.tmp#DataSegmentType_Data_Format cybox_common_xsd.tmp#DataSegmentType_Data_Size cybox_common_xsd.tmp#DataSegmentType_Byte_Order cybox_common_xsd.tmp#DataSegmentType_Data_Segment cybox_common_xsd.tmp#DataSegmentType_Offset cybox_common_xsd.tmp#DataSegmentType_Search_Distance cybox_common_xsd.tmp#DataSegmentType_Search_Within
Used by
Children cyboxCommon:Byte_Order, cyboxCommon:Data_Format, cyboxCommon:Data_Segment, cyboxCommon:Data_Size, cyboxCommon:Offset, cyboxCommon:Search_Distance, cyboxCommon:Search_Within
Attributes
QName Type Use Annotation
id xs:QName optional 
The id field specifies a unique id for this data segment.
Source
 
<xs:complexType name="DataSegmentType">
  <xs:annotation>
    <xs:documentation>The DataSegmentType is intended to provide a relatively abstract way of characterizing data segments that may be written/read/transmitted or otherwise utilized in actions or behaviors.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Data_Format" type="cyboxCommon:DataFormatEnum" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Data_Format field refers to the type of data contained in the Data_Segment element.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Data_Size" type="cyboxCommon:DataSizeType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Data_Size field contains the size of the data contained in this element.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Byte_Order" type="cyboxCommon:EndiannessType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Byte_Order field specifies the endianness of the unpacked (e.g., decoded, unencrypted, etc.) data stored within the Data_Segment field.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Data_Segment" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Data_Segment field contains the actual segment of data being characterized.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Offset" type="cyboxCommon:IntegerObjectPropertyType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Offset field allows for the specification of where to start searching for the specified data segment in an object, in bytes.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Search_Distance" type="cyboxCommon:IntegerObjectPropertyType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Search_Distance field specifies how far into an object should be ignored, in bytes, before starting to search for the specified data segment relative to the end of the previous data segment.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Search_Within" type="cyboxCommon:IntegerObjectPropertyType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Search_Within field specifies that at most N bytes are between data segments in related objects.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
  <xs:attribute name="id" type="xs:QName">
    <xs:annotation>
      <xs:documentation>The id field specifies a unique id for this data segment.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
</xs:complexType>
Simple Type cyboxCommon:DataFormatEnum
Namespace http://cybox.mitre.org/common-2
Annotations
 
The DataFormatEnum is a (non-exhaustive) enumeration of data formats.
Diagram
Diagram
Type restriction of xs:string
Facets
enumeration Binary 
Specifies binary data.
enumeration Hexadecimal 
Specifies hexadecimal data.
enumeration Text 
Specifies text.
enumeration Other 
Specifies any other type of data from the ones listed.
Used by
Source
 
<xs:simpleType name="DataFormatEnum">
  <xs:annotation>
    <xs:documentation>The DataFormatEnum is a (non-exhaustive) enumeration of data formats.</xs:documentation>
  </xs:annotation>
  <xs:restriction base="xs:string">
    <xs:enumeration value="Binary">
      <xs:annotation>
        <xs:documentation>Specifies binary data.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Hexadecimal">
      <xs:annotation>
        <xs:documentation>Specifies hexadecimal data.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Text">
      <xs:annotation>
        <xs:documentation>Specifies text.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Other">
      <xs:annotation>
        <xs:documentation>Specifies any other type of data from the ones listed.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
  </xs:restriction>
</xs:simpleType>
Complex Type cyboxCommon:DataSizeType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The DataSizeType specifies the size of the data segment.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype cybox_common_xsd.tmp#StringObjectPropertyType cybox_common_xsd.tmp#DataSizeType_units
Type extension of cyboxCommon:StringObjectPropertyType
Type hierarchy
Used by
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
units cyboxCommon:DataSizeUnitsEnum required 
This field represents the Units used in the object size element.
Source
 
<xs:complexType name="DataSizeType">
  <xs:annotation>
    <xs:documentation>The DataSizeType specifies the size of the data segment.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:extension base="cyboxCommon:StringObjectPropertyType">
      <xs:attribute name="units" type="cyboxCommon:DataSizeUnitsEnum" use="required">
        <xs:annotation>
          <xs:documentation>This field represents the Units used in the object size element.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:extension>
  </xs:simpleContent>
</xs:complexType>
Simple Type cyboxCommon:DataSizeUnitsEnum
Namespace http://cybox.mitre.org/common-2
Annotations
 
The DataSizeUnitsEnum is a (non-exhaustive) enumeration of data size units.
Diagram
Diagram
Type restriction of xs:string
Facets
enumeration Bytes 
Specifies an object size in Bytes.
enumeration Kilobytes 
Specifies an object size in Kilobytes.
enumeration Megabytes 
Specifies an object size in Megabytes.
Used by
Source
 
<xs:simpleType name="DataSizeUnitsEnum">
  <xs:annotation>
    <xs:documentation>The DataSizeUnitsEnum is a (non-exhaustive) enumeration of data size units.</xs:documentation>
  </xs:annotation>
  <xs:restriction base="xs:string">
    <xs:enumeration value="Bytes">
      <xs:annotation>
        <xs:documentation>Specifies an object size in Bytes.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Kilobytes">
      <xs:annotation>
        <xs:documentation>Specifies an object size in Kilobytes.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Megabytes">
      <xs:annotation>
        <xs:documentation>Specifies an object size in Megabytes.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
  </xs:restriction>
</xs:simpleType>
Complex Type cyboxCommon:EndiannessType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The EndiannessType specifies names for byte ordering methods.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#EndiannessType_datatype
Type restriction of cyboxCommon:BaseObjectPropertyType
Type hierarchy
Used by
Attributes
QName Type Fixed Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the expected type for the value of the specified property.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="EndiannessType">
  <xs:annotation>
    <xs:documentation>The EndiannessType specifies names for byte ordering methods.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
      <xs:simpleType>
        <xs:union memberTypes="cyboxCommon:EndiannessTypeEnum xs:string"/>
      </xs:simpleType>
      <xs:attribute fixed="string" name="datatype" type="cyboxCommon:DatatypeEnum" use="optional">
        <xs:annotation>
          <xs:documentation>This attribute is optional and specifies the expected type for the value of the specified property.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:restriction>
  </xs:simpleContent>
</xs:complexType>
Simple Type cyboxCommon:CompensationModelEnum
Namespace http://cybox.mitre.org/common-2
Annotations
 
The CompensationModelEnum is a (non-exhaustive) enumeration of compensation models for tools.
Diagram
Diagram
Type restriction of xs:string
Facets
enumeration Freeware 
Specifies that the tool is available for use at no monetary cost as the compensation model.
enumeration Shareware 
Specifies that the tool is proprietary and offers a limited use license as the compensation model.
enumeration Commercial 
Specifies that the tool is produced for sale or serves commercial purposes as the compensation model.
enumeration Adware 
Specifies that the tool uses automatically rendered advertisements as the compensation model.
Source
 
<xs:simpleType name="CompensationModelEnum">
  <xs:annotation>
    <xs:documentation>The CompensationModelEnum is a (non-exhaustive) enumeration of compensation models for tools.</xs:documentation>
  </xs:annotation>
  <xs:restriction base="xs:string">
    <xs:enumeration value="Freeware">
      <xs:annotation>
        <xs:documentation>Specifies that the tool is available for use at no monetary cost as the compensation model.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Shareware">
      <xs:annotation>
        <xs:documentation>Specifies that the tool is proprietary and offers a limited use license as the compensation model.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Commercial">
      <xs:annotation>
        <xs:documentation>Specifies that the tool is produced for sale or serves commercial purposes as the compensation model.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Adware">
      <xs:annotation>
        <xs:documentation>Specifies that the tool uses automatically rendered advertisements as the compensation model.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
  </xs:restriction>
</xs:simpleType>
Complex Type cyboxCommon:NameObjectPropertyType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The NameObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type Name. This type will be assigned to any property of a CybOX object that should contain content of type Name and enables the use of relevant metadata for the property.
 
Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#NameObjectPropertyType_datatype
Type restriction of cyboxCommon:BaseObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum name optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="NameObjectPropertyType">
  <xs:annotation>
    <xs:documentation>The NameObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type Name. This type will be assigned to any property of a CybOX object that should contain content of type Name and enables the use of relevant metadata for the property.</xs:documentation>
    <xs:documentation>Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
      <xs:simpleType>
        <xs:union memberTypes="xs:string"/>
      </xs:simpleType>
      <xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="name">
        <xs:annotation>
          <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:restriction>
  </xs:simpleContent>
</xs:complexType>
Complex Type cyboxCommon:DateObjectPropertyRestrictionType
Namespace http://cybox.mitre.org/common-2
Annotations
 
This type is an intermediate type to allow for the addition of the precision attribute to DateObjectPropertyType. It should not be used directly.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#DateObjectPropertyRestrictionType_datatype
Type restriction of cyboxCommon:BaseObjectPropertyType
Type hierarchy
Used by
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum date optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="DateObjectPropertyRestrictionType">
  <xs:annotation>
    <xs:documentation>This type is an intermediate type to allow for the addition of the precision attribute to DateObjectPropertyType. It should not be used directly.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
      <xs:simpleType>
        <xs:union memberTypes="xs:string"/>
      </xs:simpleType>
      <xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="date">
        <xs:annotation>
          <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:restriction>
  </xs:simpleContent>
</xs:complexType>
Complex Type cyboxCommon:DateObjectPropertyType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The DateObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type Date. This type will be assigned to any property of a CybOX object that should contain content of type Date and enables the use of relevant metadata for the property. In order to avoid ambiguity, it is strongly suggested that any date representation in this field include a timezone if it is known. As with the rest of the field, this should be formatted per the xs:date specification.
 
Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.
 
For fields of this type using CybOX patterning, it is strongly suggested that the condition (pattern type) is limited to one of Equals, DoesNotEqual, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, ExclusiveBetween, or InclusiveBetween. The use of other conditions may lead to ambiguity or unexpected results. When evaluating data against a pattern, the evaluator should take into account the precision of the field (as given by the precision attribute) and any timezone information that is available to perform a data-aware comparison. The usage of simple string comparisons is discouraged due to ambiguities in how precision and timezone information is processed.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#DateObjectPropertyRestrictionType_datatype cybox_common_xsd.tmp#DateObjectPropertyRestrictionType cybox_common_xsd.tmp#DateObjectPropertyType_precision
Type extension of cyboxCommon:DateObjectPropertyRestrictionType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum date optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
precision cyboxCommon:DatePrecisionEnum day optional 
The precision of the associated time. If omitted, the default is "day", meaning the full field value. Digits in the date that are required by the xs:date datatype but are beyond the specified precision should be zeroed out.
 
When used in conjunction with CybOX patterning, the pattern should only be evaluated against the target up to the given precision.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="DateObjectPropertyType">
  <xs:annotation>
    <xs:documentation>The DateObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type Date. This type will be assigned to any property of a CybOX object that should contain content of type Date and enables the use of relevant metadata for the property. In order to avoid ambiguity, it is strongly suggested that any date representation in this field include a timezone if it is known. As with the rest of the field, this should be formatted per the xs:date specification.</xs:documentation>
    <xs:documentation>Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.</xs:documentation>
    <xs:documentation>For fields of this type using CybOX patterning, it is strongly suggested that the condition (pattern type) is limited to one of Equals, DoesNotEqual, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, ExclusiveBetween, or InclusiveBetween. The use of other conditions may lead to ambiguity or unexpected results. When evaluating data against a pattern, the evaluator should take into account the precision of the field (as given by the precision attribute) and any timezone information that is available to perform a data-aware comparison. The usage of simple string comparisons is discouraged due to ambiguities in how precision and timezone information is processed.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:extension base="cyboxCommon:DateObjectPropertyRestrictionType">
      <xs:attribute name="precision" type="cyboxCommon:DatePrecisionEnum" default="day">
        <xs:annotation>
          <xs:documentation>The precision of the associated time. If omitted, the default is "day", meaning the full field value. Digits in the date that are required by the xs:date datatype but are beyond the specified precision should be zeroed out.</xs:documentation>
          <xs:documentation>When used in conjunction with CybOX patterning, the pattern should only be evaluated against the target up to the given precision.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:extension>
  </xs:simpleContent>
</xs:complexType>
Complex Type cyboxCommon:DateTimeObjectPropertyRestrictionType
Namespace http://cybox.mitre.org/common-2
Annotations
 
This type is an intermediate type to allow for the addition of the precision attribute to DateTimeObjectPropertyType. It should not be used directly.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#DateTimeObjectPropertyRestrictionType_datatype
Type restriction of cyboxCommon:BaseObjectPropertyType
Type hierarchy
Used by
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum dateTime optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="DateTimeObjectPropertyRestrictionType" abstract="true">
  <xs:annotation>
    <xs:documentation>This type is an intermediate type to allow for the addition of the precision attribute to DateTimeObjectPropertyType. It should not be used directly.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
      <xs:simpleType>
        <xs:union memberTypes="xs:string"/>
      </xs:simpleType>
      <xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="dateTime">
        <xs:annotation>
          <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:restriction>
  </xs:simpleContent>
</xs:complexType>
Complex Type cyboxCommon:DateTimeObjectPropertyType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The DateTimeObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type DateTime. This type will be assigned to any property of a CybOX object that should contain content of type DateTime and enables the use of relevant metadata for the property.  In order to avoid ambiguity, it is strongly suggested that any dateTime representation in this field include a timezone. As with the rest of the field, this should be formatted per the xs:dateTime specification.
 
Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.
 
For fields of this type using CybOX patterning, it is strongly suggested that the condition (pattern type) is limited to one of Equals, DoesNotEqual, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, ExclusiveBetween, or InclusiveBetween. The use of other conditions may lead to ambiguity or unexpected results. When evaluating data against a pattern, the evaluator should take into account the precision of the field (as given by the precision attribute) and any timezone information that is available to perform a data-aware comparison. The usage of simple string comparisons is discouraged due to ambiguities in how precision and timezone information is processed.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#DateTimeObjectPropertyRestrictionType_datatype cybox_common_xsd.tmp#DateTimeObjectPropertyRestrictionType cybox_common_xsd.tmp#DateTimeObjectPropertyType_precision
Type extension of cyboxCommon:DateTimeObjectPropertyRestrictionType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum dateTime optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
precision cyboxCommon:DateTimePrecisionEnum second optional 
The precision of the associated time. If omitted, the default is "second", meaning the full field value (including fractional seconds). Digits in the dateTime that are required by the xs:dateTime datatype but are beyond the specified precision should be zeroed out.
 
When used in conjunction with CybOX patterning, the pattern should only be evaluated against the target up to the given precision.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="DateTimeObjectPropertyType">
  <xs:annotation>
    <xs:documentation>The DateTimeObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type DateTime. This type will be assigned to any property of a CybOX object that should contain content of type DateTime and enables the use of relevant metadata for the property. In order to avoid ambiguity, it is strongly suggested that any dateTime representation in this field include a timezone. As with the rest of the field, this should be formatted per the xs:dateTime specification.</xs:documentation>
    <xs:documentation>Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.</xs:documentation>
    <xs:documentation>For fields of this type using CybOX patterning, it is strongly suggested that the condition (pattern type) is limited to one of Equals, DoesNotEqual, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, ExclusiveBetween, or InclusiveBetween. The use of other conditions may lead to ambiguity or unexpected results. When evaluating data against a pattern, the evaluator should take into account the precision of the field (as given by the precision attribute) and any timezone information that is available to perform a data-aware comparison. The usage of simple string comparisons is discouraged due to ambiguities in how precision and timezone information is processed.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:extension base="cyboxCommon:DateTimeObjectPropertyRestrictionType">
      <xs:attribute name="precision" type="cyboxCommon:DateTimePrecisionEnum" default="second">
        <xs:annotation>
          <xs:documentation>The precision of the associated time. If omitted, the default is "second", meaning the full field value (including fractional seconds). Digits in the dateTime that are required by the xs:dateTime datatype but are beyond the specified precision should be zeroed out.</xs:documentation>
          <xs:documentation>When used in conjunction with CybOX patterning, the pattern should only be evaluated against the target up to the given precision.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:extension>
  </xs:simpleContent>
</xs:complexType>
Complex Type cyboxCommon:FloatObjectPropertyType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The FloatObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type Float. This type will be assigned to any property of a CybOX object that should contain content of type Float and enables the use of relevant metadata for the property.
 
Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#FloatObjectPropertyType_datatype
Type restriction of cyboxCommon:BaseObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum float optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="FloatObjectPropertyType">
  <xs:annotation>
    <xs:documentation>The FloatObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type Float. This type will be assigned to any property of a CybOX object that should contain content of type Float and enables the use of relevant metadata for the property.</xs:documentation>
    <xs:documentation>Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
      <xs:simpleType>
        <xs:union memberTypes="xs:string"/>
      </xs:simpleType>
      <xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="float">
        <xs:annotation>
          <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:restriction>
  </xs:simpleContent>
</xs:complexType>
Complex Type cyboxCommon:DoubleObjectPropertyType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The DoubleObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type Double. This type will be assigned to any property of a CybOX object that should contain content of type Double and enables the use of relevant metadata for the property.
 
Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#DoubleObjectPropertyType_datatype
Type restriction of cyboxCommon:BaseObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum double optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="DoubleObjectPropertyType">
  <xs:annotation>
    <xs:documentation>The DoubleObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type Double. This type will be assigned to any property of a CybOX object that should contain content of type Double and enables the use of relevant metadata for the property.</xs:documentation>
    <xs:documentation>Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
      <xs:simpleType>
        <xs:union memberTypes="xs:string"/>
      </xs:simpleType>
      <xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="double">
        <xs:annotation>
          <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:restriction>
  </xs:simpleContent>
</xs:complexType>
Complex Type cyboxCommon:UnsignedLongObjectPropertyType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The UnsignedLongObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type UnsignedLong. This type will be assigned to any property of a CybOX object that should contain content of type UnsignedLong and enables the use of relevant metadata for the property.
 
Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#UnsignedLongObjectPropertyType_datatype
Type restriction of cyboxCommon:BaseObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum unsignedLong optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="UnsignedLongObjectPropertyType">
  <xs:annotation>
    <xs:documentation>The UnsignedLongObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type UnsignedLong. This type will be assigned to any property of a CybOX object that should contain content of type UnsignedLong and enables the use of relevant metadata for the property.</xs:documentation>
    <xs:documentation>Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
      <xs:simpleType>
        <xs:union memberTypes="xs:string"/>
      </xs:simpleType>
      <xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="unsignedLong">
        <xs:annotation>
          <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:restriction>
  </xs:simpleContent>
</xs:complexType>
Complex Type cyboxCommon:UnsignedIntegerObjectPropertyType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The UnsignedIntegerObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type UnsignedInt. This type will be assigned to any property of a CybOX object that should contain content of type UnsignedInteger and enables the use of relevant metadata for the property.
 
Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#UnsignedIntegerObjectPropertyType_datatype
Type restriction of cyboxCommon:BaseObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum unsignedInt optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="UnsignedIntegerObjectPropertyType">
  <xs:annotation>
    <xs:documentation>The UnsignedIntegerObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type UnsignedInt. This type will be assigned to any property of a CybOX object that should contain content of type UnsignedInteger and enables the use of relevant metadata for the property.</xs:documentation>
    <xs:documentation>Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
      <xs:simpleType>
        <xs:union memberTypes="xs:string"/>
      </xs:simpleType>
      <xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="unsignedInt">
        <xs:annotation>
          <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:restriction>
  </xs:simpleContent>
</xs:complexType>
Complex Type cyboxCommon:PositiveIntegerObjectPropertyType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The PositiveIntegerObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type PositveInteger. This type will be assigned to any property of a CybOX object that should contain content of type PositiveInteger and enables the use of relevant metadata for the property.
 
Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#PositiveIntegerObjectPropertyType_datatype
Type restriction of cyboxCommon:BaseObjectPropertyType
Type hierarchy
Used by
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum positiveInteger optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="PositiveIntegerObjectPropertyType">
  <xs:annotation>
    <xs:documentation>The PositiveIntegerObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type PositveInteger. This type will be assigned to any property of a CybOX object that should contain content of type PositiveInteger and enables the use of relevant metadata for the property.</xs:documentation>
    <xs:documentation>Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
      <xs:simpleType>
        <xs:union memberTypes="xs:string"/>
      </xs:simpleType>
      <xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="positiveInteger">
        <xs:annotation>
          <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:restriction>
  </xs:simpleContent>
</xs:complexType>
Complex Type cyboxCommon:LongObjectPropertyType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The LongObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type Long. This type will be assigned to any property of a CybOX object that should contain content of type Long and enables the use of relevant metadata for the property.
 
Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#LongObjectPropertyType_datatype
Type restriction of cyboxCommon:BaseObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum long optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="LongObjectPropertyType">
  <xs:annotation>
    <xs:documentation>The LongObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type Long. This type will be assigned to any property of a CybOX object that should contain content of type Long and enables the use of relevant metadata for the property.</xs:documentation>
    <xs:documentation>Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
      <xs:simpleType>
        <xs:union memberTypes="xs:string"/>
      </xs:simpleType>
      <xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="long">
        <xs:annotation>
          <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:restriction>
  </xs:simpleContent>
</xs:complexType>
Complex Type cyboxCommon:NonNegativeIntegerObjectPropertyType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The NonNegativeIntegerObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type nonNegativeInteger. This type will be assigned to any property of a CybOX object that should contain content of type NonNegativeInteger and enables the use of relevant metadata for the property.
 
Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#NonNegativeIntegerObjectPropertyType_datatype
Type restriction of cyboxCommon:BaseObjectPropertyType
Type hierarchy
Attributes
QName Type Fixed Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum nonNegativeInteger optional 
This attribute is optional and specifies the expected type for the value of the specified property.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="NonNegativeIntegerObjectPropertyType">
  <xs:annotation>
    <xs:documentation>The NonNegativeIntegerObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type nonNegativeInteger. This type will be assigned to any property of a CybOX object that should contain content of type NonNegativeInteger and enables the use of relevant metadata for the property.</xs:documentation>
    <xs:documentation>Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
      <xs:simpleType>
        <xs:union memberTypes="xs:string"/>
      </xs:simpleType>
      <xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" fixed="nonNegativeInteger">
        <xs:annotation>
          <xs:documentation>This attribute is optional and specifies the expected type for the value of the specified property.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:restriction>
  </xs:simpleContent>
</xs:complexType>
Complex Type cyboxCommon:AnyURIObjectPropertyType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The AnyURIObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type anyURI. This type will be assigned to any property of a CybOX object that should contain content of type AnyURI and enables the use of relevant metadata for the property.
 
Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#AnyURIObjectPropertyType_datatype
Type restriction of cyboxCommon:BaseObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum anyURI optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="AnyURIObjectPropertyType">
  <xs:annotation>
    <xs:documentation>The AnyURIObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type anyURI. This type will be assigned to any property of a CybOX object that should contain content of type AnyURI and enables the use of relevant metadata for the property.</xs:documentation>
    <xs:documentation>Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
      <xs:simpleType>
        <xs:union memberTypes="xs:string"/>
      </xs:simpleType>
      <xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="anyURI">
        <xs:annotation>
          <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:restriction>
  </xs:simpleContent>
</xs:complexType>
Complex Type cyboxCommon:DurationObjectPropertyType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The DurationObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type duration. This type will be assigned to any property of a CybOX object that should contain content of type Duration and enables the use of relevant metadata for the property.
 
Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#DurationObjectPropertyType_datatype
Type restriction of cyboxCommon:BaseObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum duration optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="DurationObjectPropertyType">
  <xs:annotation>
    <xs:documentation>The DurationObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type duration. This type will be assigned to any property of a CybOX object that should contain content of type Duration and enables the use of relevant metadata for the property.</xs:documentation>
    <xs:documentation>Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
      <xs:simpleType>
        <xs:union memberTypes="xs:string"/>
      </xs:simpleType>
      <xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="duration">
        <xs:annotation>
          <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:restriction>
  </xs:simpleContent>
</xs:complexType>
Complex Type cyboxCommon:TimeObjectPropertyRestrictionType
Namespace http://cybox.mitre.org/common-2
Annotations
 
This type is an intermediate type to allow for the addition of the precision attribute to TimeObjectPropertyType. It should not be used directly.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#TimeObjectPropertyRestrictionType_datatype
Type restriction of cyboxCommon:BaseObjectPropertyType
Type hierarchy
Used by
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum time optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="TimeObjectPropertyRestrictionType" abstract="true">
  <xs:annotation>
    <xs:documentation>This type is an intermediate type to allow for the addition of the precision attribute to TimeObjectPropertyType. It should not be used directly.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
      <xs:simpleType>
        <xs:union memberTypes="xs:string"/>
      </xs:simpleType>
      <xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="time">
        <xs:annotation>
          <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:restriction>
  </xs:simpleContent>
</xs:complexType>
Complex Type cyboxCommon:TimeObjectPropertyType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The TimeObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type time. This type will be assigned to any property of a CybOX object that should contain content of type Time and enables the use of relevant metadata for the property.  In order to avoid ambiguity, it is strongly suggested that any time representation in this field include a specification of the timezone if it is known. As with the rest of the field, this should be formatted per the xs:time specification.
 
Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.
 
For fields of this type using CybOX patterning, it is strongly suggested that the condition (pattern type) is limited to one of Equals, DoesNotEqual, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, ExclusiveBetween, or InclusiveBetween. The use of other conditions may lead to ambiguity or unexpected results. When evaluating data against a pattern, the evaluator should take into account the precision of the field (as given by the precision attribute) and any timezone information that is available to perform a data-aware comparison. The usage of simple string comparisons is discouraged due to ambiguities in how precision and timezone information is processed.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#TimeObjectPropertyRestrictionType_datatype cybox_common_xsd.tmp#TimeObjectPropertyRestrictionType cybox_common_xsd.tmp#TimeObjectPropertyType_precision
Type extension of cyboxCommon:TimeObjectPropertyRestrictionType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum time optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
precision cyboxCommon:TimePrecisionEnum second optional 
The precision of the associated time. If omitted, the default is "second", meaning the full field value (including fractional seconds). Digits in the time that are required by the xs:time datatype but are beyond the specified precision should be zeroed out.
 
When used in conjunction with CybOX patterning, the pattern should only be evaluated against the target up to the given precision.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="TimeObjectPropertyType">
  <xs:annotation>
    <xs:documentation>The TimeObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type time. This type will be assigned to any property of a CybOX object that should contain content of type Time and enables the use of relevant metadata for the property. In order to avoid ambiguity, it is strongly suggested that any time representation in this field include a specification of the timezone if it is known. As with the rest of the field, this should be formatted per the xs:time specification.</xs:documentation>
    <xs:documentation>Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.</xs:documentation>
    <xs:documentation>For fields of this type using CybOX patterning, it is strongly suggested that the condition (pattern type) is limited to one of Equals, DoesNotEqual, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, ExclusiveBetween, or InclusiveBetween. The use of other conditions may lead to ambiguity or unexpected results. When evaluating data against a pattern, the evaluator should take into account the precision of the field (as given by the precision attribute) and any timezone information that is available to perform a data-aware comparison. The usage of simple string comparisons is discouraged due to ambiguities in how precision and timezone information is processed.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:extension base="cyboxCommon:TimeObjectPropertyRestrictionType">
      <xs:attribute name="precision" type="cyboxCommon:TimePrecisionEnum" default="second">
        <xs:annotation>
          <xs:documentation>The precision of the associated time. If omitted, the default is "second", meaning the full field value (including fractional seconds). Digits in the time that are required by the xs:time datatype but are beyond the specified precision should be zeroed out.</xs:documentation>
          <xs:documentation>When used in conjunction with CybOX patterning, the pattern should only be evaluated against the target up to the given precision.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:extension>
  </xs:simpleContent>
</xs:complexType>
Simple Type cyboxCommon:TimePrecisionEnum
Namespace http://cybox.mitre.org/common-2
Annotations
 
Possible values for representing time precision.
Diagram
Diagram
Type restriction of xs:string
Facets
enumeration hour 
Time is precise to the given hour.
enumeration minute 
Time is precise to the given minute.
enumeration second 
Time is precise to the given second (including fractional seconds).
Used by
Source
 
<xs:simpleType name="TimePrecisionEnum">
  <xs:annotation>
    <xs:documentation>Possible values for representing time precision.</xs:documentation>
  </xs:annotation>
  <xs:restriction base="xs:string">
    <xs:enumeration value="hour">
      <xs:annotation>
        <xs:documentation>Time is precise to the given hour.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="minute">
      <xs:annotation>
        <xs:documentation>Time is precise to the given minute.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="second">
      <xs:annotation>
        <xs:documentation>Time is precise to the given second (including fractional seconds).</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
  </xs:restriction>
</xs:simpleType>
Complex Type cyboxCommon:Base64BinaryObjectPropertyType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Base64BinaryObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type base64Binary. This type will be assigned to any property of a CybOX object that should contain content of type Base64Binary and enables the use of relevant metadata for the property.
 
Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#Base64BinaryObjectPropertyType_datatype
Type restriction of cyboxCommon:BaseObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum base64Binary optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="Base64BinaryObjectPropertyType">
  <xs:annotation>
    <xs:documentation>The Base64BinaryObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type base64Binary. This type will be assigned to any property of a CybOX object that should contain content of type Base64Binary and enables the use of relevant metadata for the property.</xs:documentation>
    <xs:documentation>Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
      <xs:simpleType>
        <xs:union memberTypes="xs:string"/>
      </xs:simpleType>
      <xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="base64Binary">
        <xs:annotation>
          <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:restriction>
  </xs:simpleContent>
</xs:complexType>
Complex Type cyboxCommon:ExtractedFeaturesType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The ExtractedFeaturesType is a type representing a description of features extracted from an object such as a file.
Diagram
Diagram cybox_common_xsd.tmp#ExtractedFeaturesType_Strings cybox_common_xsd.tmp#ExtractedFeaturesType_Imports cybox_common_xsd.tmp#ExtractedFeaturesType_Functions cybox_common_xsd.tmp#ExtractedFeaturesType_Code_Snippets
Children cyboxCommon:Code_Snippets, cyboxCommon:Functions, cyboxCommon:Imports, cyboxCommon:Strings
Source
 
<xs:complexType name="ExtractedFeaturesType">
  <xs:annotation>
    <xs:documentation>The ExtractedFeaturesType is a type representing a description of features extracted from an object such as a file.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Strings" type="cyboxCommon:ExtractedStringsType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field enables description of a set of static strings extracted from a raw cyber object.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Imports" type="cyboxCommon:ImportsType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field enables description of a set of references to external resources imported by a raw cyber object.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Functions" type="cyboxCommon:FunctionsType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field enables description of a set of references to functions called by a raw cyber object.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Code_Snippets" type="cyboxCommon:CodeSnippetsType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>This field enables description of a set of code snippets extracted from a raw cyber object.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:ExtractedStringsType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The ExtractedStringsType type is intended as container for strings extracted from CybOX objects.
Diagram
Diagram cybox_common_xsd.tmp#ExtractedStringsType_String
Used by
Children cyboxCommon:String
Source
 
<xs:complexType name="ExtractedStringsType">
  <xs:annotation>
    <xs:documentation>The ExtractedStringsType type is intended as container for strings extracted from CybOX objects.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="String" type="cyboxCommon:ExtractedStringType" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>This field enables description of a single static string extracted from a raw cyber object.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:ExtractedStringType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The ExtractedStringType type is intended as container a single string extracted from a CybOX object.
Diagram
Diagram cybox_common_xsd.tmp#ExtractedStringType_Encoding cybox_common_xsd.tmp#ExtractedStringType_String_Value cybox_common_xsd.tmp#ExtractedStringType_Byte_String_Value cybox_common_xsd.tmp#ExtractedStringType_Hashes cybox_common_xsd.tmp#ExtractedStringType_Address cybox_common_xsd.tmp#ExtractedStringType_Length cybox_common_xsd.tmp#ExtractedStringType_Language cybox_common_xsd.tmp#ExtractedStringType_English_Translation
Used by
Children cyboxCommon:Address, cyboxCommon:Byte_String_Value, cyboxCommon:Encoding, cyboxCommon:English_Translation, cyboxCommon:Hashes, cyboxCommon:Language, cyboxCommon:Length, cyboxCommon:String_Value
Source
 
<xs:complexType name="ExtractedStringType">
  <xs:annotation>
    <xs:documentation>The ExtractedStringType type is intended as container a single string extracted from a CybOX object.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Encoding" type="cyboxCommon:ControlledVocabularyStringType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Encoding field refers to the encoding method used for the string extracted from the CybOX object, via a standardized controlled vocabulary.</xs:documentation>
        <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is CharacterEncodingVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.</xs:documentation>
        <xs:documentation>Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="String_Value" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The String_Value field specifies the actual value of the string extracted from the CybOX object, if it is capable of being represented in the encoding scheme used in the document (most commonly UTF-8).</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Byte_String_Value" type="cyboxCommon:HexBinaryObjectPropertyType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Byte_String_Value field specifies the raw, byte-string representation of the string extracted from the CybOX object, in hexadecimal format.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Hashes" type="cyboxCommon:HashListType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Hashes field is used to include any hash values computed using the string extracted from the CybOX object as input.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Address" type="cyboxCommon:HexBinaryObjectPropertyType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Address field specifies the location or offset of the specified string in the CybOX objects.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Length" type="cyboxCommon:PositiveIntegerObjectPropertyType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Length field specifies the length, in characters, of the string extracted from the CybOX object.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Language" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Language field specifies the language the string is written in, e.g. English. For consistency, we strongly recommend using the ISO 639-2 language code, if available. Please see http://www.loc.gov/standards/iso639-2/php/code_list.php for a list of ISO 639-2 codes.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="English_Translation" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The English_Translation field specifies the English translation of the string, if it is not written in English.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:ImportsType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The ImportsType is intended to represent an extracted list of imports specified within a CybOX object.
Diagram
Diagram cybox_common_xsd.tmp#ImportsType_Import
Used by
Children cyboxCommon:Import
Source
 
<xs:complexType name="ImportsType">
  <xs:annotation>
    <xs:documentation>The ImportsType is intended to represent an extracted list of imports specified within a CybOX object.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Import" type="cyboxCommon:StringObjectPropertyType" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>This field enables description of a single reference to an external resource imported by a raw cyber object.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:FunctionsType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The FunctionsType is intended to represent an extracted list of functions leveraged within a CybOX object.
Diagram
Diagram cybox_common_xsd.tmp#FunctionsType_Function
Used by
Children cyboxCommon:Function
Source
 
<xs:complexType name="FunctionsType">
  <xs:annotation>
    <xs:documentation>The FunctionsType is intended to represent an extracted list of functions leveraged within a CybOX object.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Function" type="cyboxCommon:StringObjectPropertyType" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>This field enables description of a single reference to a function called by a raw cyber object.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:CodeSnippetsType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The CodeSnippetsType is intended to represent an set of code snippets extracted from within a CybOX object.
Diagram
Diagram cybox_common_xsd.tmp#CodeSnippetsType_Code_Snippet
Used by
Children cyboxCommon:Code_Snippet
Source
 
<xs:complexType name="CodeSnippetsType">
  <xs:annotation>
    <xs:documentation>The CodeSnippetsType is intended to represent an set of code snippets extracted from within a CybOX object.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Code_Snippet" type="cyboxCommon:ObjectPropertiesType" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>This field enables description of a single code snippet extracted from a raw cyber object. Code_Snippet should be of CodeObj:CodeObjectType.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:ByteRunsType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The ByteRunsType is used for representing a list of byte runs from within a raw object.
Diagram
Diagram cybox_common_xsd.tmp#ByteRunsType_Byte_Run
Children cyboxCommon:Byte_Run
Source
 
<xs:complexType name="ByteRunsType">
  <xs:annotation>
    <xs:documentation>The ByteRunsType is used for representing a list of byte runs from within a raw object.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Byte_Run" type="cyboxCommon:ByteRunType" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Byte_Run field contains a single byte run from the raw object.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:ByteRunType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The ByteRunType is used for representing a single byte run from within a raw object.
Diagram
Diagram cybox_common_xsd.tmp#ByteRunType_Offset cybox_common_xsd.tmp#ByteRunType_Byte_Order cybox_common_xsd.tmp#ByteRunType_File_System_Offset cybox_common_xsd.tmp#ByteRunType_Image_Offset cybox_common_xsd.tmp#ByteRunType_Length cybox_common_xsd.tmp#ByteRunType_Hashes cybox_common_xsd.tmp#ByteRunType_Byte_Run_Data
Used by
Children cyboxCommon:Byte_Order, cyboxCommon:Byte_Run_Data, cyboxCommon:File_System_Offset, cyboxCommon:Hashes, cyboxCommon:Image_Offset, cyboxCommon:Length, cyboxCommon:Offset
Source
 
<xs:complexType name="ByteRunType">
  <xs:annotation>
    <xs:documentation>The ByteRunType is used for representing a single byte run from within a raw object.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Offset" type="cyboxCommon:IntegerObjectPropertyType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Offset field specifies the offset of the beginning of the byte run as measured from the beginning of the object.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Byte_Order" type="cyboxCommon:EndiannessType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Byte_Order field specifies the endianness of the unpacked (e.g., unencoded, unencrypted, etc.) data contained within the Byte_Run_Data field.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="File_System_Offset" type="cyboxCommon:IntegerObjectPropertyType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The File_System_Offset field is relevant only for byte runs of files in forensic analysis.It specifies the offset of the beginning of the byte run as measured from the beginning of the relevant file system.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Image_Offset" type="cyboxCommon:IntegerObjectPropertyType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Image_Offset field is provided for forensic analysis purposes and specifies the offset of the beginning of the byte run as measured from the beginning of the relevant forensic image.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Length" type="cyboxCommon:IntegerObjectPropertyType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Length field specifies the number of bytes in the byte run.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Hashes" type="cyboxCommon:HashListType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Hashes field contains computed hash values for this the data in this byte run.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Byte_Run_Data" type="xs:anyType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Byte_Run_Data field contains a raw dump of the byte run data, typically enclosed within an XML CDATA section.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:EnvironmentVariableListType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The EnvironmentVariableListType type is used for representing a list of environment variables.
Diagram
Diagram cybox_common_xsd.tmp#EnvironmentVariableListType_Environment_Variable
Children cyboxCommon:Environment_Variable
Source
 
<xs:complexType name="EnvironmentVariableListType">
  <xs:annotation>
    <xs:documentation>The EnvironmentVariableListType type is used for representing a list of environment variables.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Environment_Variable" type="cyboxCommon:EnvironmentVariableType" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Environment_Variable field is used for representing environment variables using a name/value pair.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:EnvironmentVariableType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The EnvironmentVariableType type is used for representing environment variables using a name/value pair.
Diagram
Diagram cybox_common_xsd.tmp#EnvironmentVariableType_Name cybox_common_xsd.tmp#EnvironmentVariableType_Value
Used by
Children cyboxCommon:Name, cyboxCommon:Value
Source
 
<xs:complexType name="EnvironmentVariableType">
  <xs:annotation>
    <xs:documentation>The EnvironmentVariableType type is used for representing environment variables using a name/value pair.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Name" type="cyboxCommon:StringObjectPropertyType">
      <xs:annotation>
        <xs:documentation>The Name field specifies the name of the environment variable.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Value" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Value field specifies the value of the environment variable.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:DigitalSignaturesType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The DigitalSignaturesType is used for representing a list of digital signatures.
Diagram
Diagram cybox_common_xsd.tmp#DigitalSignaturesType_Digital_Signature
Children cyboxCommon:Digital_Signature
Source
 
<xs:complexType name="DigitalSignaturesType">
  <xs:annotation>
    <xs:documentation>The DigitalSignaturesType is used for representing a list of digital signatures.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Digital_Signature" type="cyboxCommon:DigitalSignatureInfoType" minOccurs="0" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Digital_Signature field is optional and captures a single digital signature for this Object.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type cyboxCommon:DigitalSignatureInfoType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The DigitalSignatureInfoType type is used as a way to represent some of the basic information about a digital signature.
Diagram
Diagram cybox_common_xsd.tmp#DigitalSignatureInfoType_signature_exists cybox_common_xsd.tmp#DigitalSignatureInfoType_signature_verified cybox_common_xsd.tmp#DigitalSignatureInfoType_Certificate_Issuer cybox_common_xsd.tmp#DigitalSignatureInfoType_Certificate_Subject cybox_common_xsd.tmp#DigitalSignatureInfoType_Signature_Description
Used by
Children cyboxCommon:Certificate_Issuer, cyboxCommon:Certificate_Subject, cyboxCommon:Signature_Description
Attributes
QName Type Use Annotation
signature_exists xs:boolean optional 
Specifies whether the digital signature exists.
signature_verified xs:boolean optional 
Specifies if the digital signature is verified.
Source
 
<xs:complexType name="DigitalSignatureInfoType">
  <xs:annotation>
    <xs:documentation>The DigitalSignatureInfoType type is used as a way to represent some of the basic information about a digital signature.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Certificate_Issuer" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The certificate issuer of the digital signature.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Certificate_Subject" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The certificate subject of the digital signature.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Signature_Description" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>A description of the digital signature.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
  <xs:attribute name="signature_exists" type="xs:boolean">
    <xs:annotation>
      <xs:documentation>Specifies whether the digital signature exists.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="signature_verified" type="xs:boolean">
    <xs:annotation>
      <xs:documentation>Specifies if the digital signature is verified.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
</xs:complexType>
Complex Type cyboxCommon:SIDType
Namespace http://cybox.mitre.org/common-2
Annotations
 
SIDType specifies Windows Security ID (SID) types via a union of the SIDTypeEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.
 
Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#SIDType_datatype
Type restriction of cyboxCommon:BaseObjectPropertyType
Type hierarchy
Attributes
QName Type Fixed Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the expected type for the value of the specified property.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="SIDType">
  <xs:annotation>
    <xs:documentation>SIDType specifies Windows Security ID (SID) types via a union of the SIDTypeEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.</xs:documentation>
    <xs:documentation>Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
      <xs:simpleType>
        <xs:union memberTypes="cyboxCommon:SIDTypeEnum xs:string"/>
      </xs:simpleType>
      <xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" use="optional" fixed="string">
        <xs:annotation>
          <xs:documentation>This attribute is optional and specifies the expected type for the value of the specified property.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:restriction>
  </xs:simpleContent>
</xs:complexType>
Simple Type cyboxCommon:SIDTypeEnum
Namespace http://cybox.mitre.org/common-2
Annotations
 
The SIDTypeEnum type is an enumeration of Windows Security ID (SID) types. These correspond to the values specified by the SID_NAME_USE enumeration--see http://msdn.microsoft.com/en-us/library/windows/desktop/aa379601(v=vs.85).aspx for more information.
Diagram
Diagram
Type restriction of xs:string
Facets
enumeration SidTypeUser 
Indicates a SID of type User.
enumeration SidTypeGroup 
Indicates a SID of type Group.
enumeration SidTypeDomain 
Indicates a SID of type Domain.
enumeration SidTypeAlias 
Indicates a SID of type Alias.
enumeration SidTypeWellKnownGroup 
Indicates a SID for a well-known group.
enumeration SidTypeDeletedAccount 
Indicates a SID for a deleted account.
enumeration SidTypeInvalid 
Indicates an invalid SID.
enumeration SidTypeUnknown 
Indicates a SID of unknown type.
enumeration SidTypeComputer 
Indicates a SID for a computer.
enumeration SidTypeLabel 
Indicates a mandatory integrity label SID.
Source
 
<xs:simpleType name="SIDTypeEnum">
  <xs:annotation>
    <xs:documentation>The SIDTypeEnum type is an enumeration of Windows Security ID (SID) types. These correspond to the values specified by the SID_NAME_USE enumeration--see http://msdn.microsoft.com/en-us/library/windows/desktop/aa379601(v=vs.85).aspx for more information.</xs:documentation>
  </xs:annotation>
  <xs:restriction base="xs:string">
    <xs:enumeration value="SidTypeUser">
      <xs:annotation>
        <xs:documentation>Indicates a SID of type User.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="SidTypeGroup">
      <xs:annotation>
        <xs:documentation>Indicates a SID of type Group.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="SidTypeDomain">
      <xs:annotation>
        <xs:documentation>Indicates a SID of type Domain.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="SidTypeAlias">
      <xs:annotation>
        <xs:documentation>Indicates a SID of type Alias.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="SidTypeWellKnownGroup">
      <xs:annotation>
        <xs:documentation>Indicates a SID for a well-known group.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="SidTypeDeletedAccount">
      <xs:annotation>
        <xs:documentation>Indicates a SID for a deleted account.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="SidTypeInvalid">
      <xs:annotation>
        <xs:documentation>Indicates an invalid SID.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="SidTypeUnknown">
      <xs:annotation>
        <xs:documentation>Indicates a SID of unknown type.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="SidTypeComputer">
      <xs:annotation>
        <xs:documentation>Indicates a SID for a computer.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="SidTypeLabel">
      <xs:annotation>
        <xs:documentation>Indicates a mandatory integrity label SID.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
  </xs:restriction>
</xs:simpleType>
Complex Type cyboxCommon:Layer4ProtocolType
Namespace http://cybox.mitre.org/common-2
Annotations
 
Layer4ProtocolType specifies Layer 4 protocol types, via a union of the Layer4ProtocolEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#Layer4ProtocolType_datatype
Type restriction of cyboxCommon:BaseObjectPropertyType
Type hierarchy
Attributes
QName Type Fixed Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the expected type for the value of the specified property.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="Layer4ProtocolType">
  <xs:annotation>
    <xs:documentation>Layer4ProtocolType specifies Layer 4 protocol types, via a union of the Layer4ProtocolEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
      <xs:simpleType>
        <xs:union memberTypes="cyboxCommon:Layer4ProtocolEnum xs:string"/>
      </xs:simpleType>
      <xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" use="optional" fixed="string">
        <xs:annotation>
          <xs:documentation>This attribute is optional and specifies the expected type for the value of the specified property.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:restriction>
  </xs:simpleContent>
</xs:complexType>
Simple Type cyboxCommon:Layer4ProtocolEnum
Namespace http://cybox.mitre.org/common-2
Annotations
 
Layer4ProtocolEnum is a non-exhaustive enumeration of Layer 4 (transport) layer protocols.
Diagram
Diagram
Type restriction of xs:string
Facets
enumeration TCP 
Specifies the Transmission Control Protocol.
enumeration UDP 
Specifies the User Datagram Protocol.
enumeration AH 
Specifies the Authentication Header protocol.
enumeration ESP 
Specifies the Encapsulating Security Payload protocol.
enumeration GRE 
Specifies the Generic Routing Encapsulation protocol.
enumeration IL 
Specifies the Internet Link protocol.
enumeration SCTP 
Specifies the Stream Control Transmission Protocol.
enumeration Sinec H1 
Specifies the Siemens Sinec H1 protocol.
enumeration SPX 
Specifies the Sequenced Packet Exchange protocol.
enumeration DCCP 
Specifies the Datagram Congestion Control Protocol.
Source
 
<xs:simpleType name="Layer4ProtocolEnum">
  <xs:annotation>
    <xs:documentation>Layer4ProtocolEnum is a non-exhaustive enumeration of Layer 4 (transport) layer protocols.</xs:documentation>
  </xs:annotation>
  <xs:restriction base="xs:string">
    <xs:enumeration value="TCP">
      <xs:annotation>
        <xs:documentation>Specifies the Transmission Control Protocol.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="UDP">
      <xs:annotation>
        <xs:documentation>Specifies the User Datagram Protocol.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="AH">
      <xs:annotation>
        <xs:documentation>Specifies the Authentication Header protocol.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="ESP">
      <xs:annotation>
        <xs:documentation>Specifies the Encapsulating Security Payload protocol.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="GRE">
      <xs:annotation>
        <xs:documentation>Specifies the Generic Routing Encapsulation protocol.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="IL">
      <xs:annotation>
        <xs:documentation>Specifies the Internet Link protocol.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="SCTP">
      <xs:annotation>
        <xs:documentation>Specifies the Stream Control Transmission Protocol.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Sinec H1">
      <xs:annotation>
        <xs:documentation>Specifies the Siemens Sinec H1 protocol.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="SPX">
      <xs:annotation>
        <xs:documentation>Specifies the Sequenced Packet Exchange protocol.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="DCCP">
      <xs:annotation>
        <xs:documentation>Specifies the Datagram Congestion Control Protocol.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
  </xs:restriction>
</xs:simpleType>
Simple Type cyboxCommon:EndiannessTypeEnum
Namespace http://cybox.mitre.org/common-2
Annotations
 
The EndiannessTypeEnum is a non-exhaustive eumeration of byte ordering methods.
Diagram
Diagram
Type restriction of xs:string
Facets
enumeration Big-endian 
The Big-endian value specifies a big-endian byte ordering.
enumeration Little-endian 
The Little-endian value specifies a little-endian byte ordering.
enumeration Middle-endian 
The Middle-endian value specifies a middle-endian byte ordering.
Source
 
<xs:simpleType name="EndiannessTypeEnum">
  <xs:annotation>
    <xs:documentation>The EndiannessTypeEnum is a non-exhaustive eumeration of byte ordering methods.</xs:documentation>
  </xs:annotation>
  <xs:restriction base="xs:string">
    <xs:enumeration value="Big-endian">
      <xs:annotation>
        <xs:documentation>The Big-endian value specifies a big-endian byte ordering.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Little-endian">
      <xs:annotation>
        <xs:documentation>The Little-endian value specifies a little-endian byte ordering.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Middle-endian">
      <xs:annotation>
        <xs:documentation>The Middle-endian value specifies a middle-endian byte ordering.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
  </xs:restriction>
</xs:simpleType>
Complex Type cyboxCommon:CipherType
Namespace http://cybox.mitre.org/common-2
Annotations
 
CipherType specifies encryption algorithms, via a union of the CipherEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType
Type restriction of cyboxCommon:BaseObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the expected type for the value of the specified property.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="CipherType">
  <xs:annotation>
    <xs:documentation>CipherType specifies encryption algorithms, via a union of the CipherEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
      <xs:simpleType>
        <xs:union memberTypes="cyboxCommon:CipherEnum xs:string"/>
      </xs:simpleType>
    </xs:restriction>
  </xs:simpleContent>
</xs:complexType>
Simple Type cyboxCommon:CipherEnum
Namespace http://cybox.mitre.org/common-2
Annotations
 
CipherEnum is a non-exhaustive enumeration of encryption algorithms.
Diagram
Diagram
Type restriction of xs:string
Facets
enumeration 3DES 
Specifies the Triple Data Encryption Standard (DES) algorithm.
enumeration AES 
Specifies the Advanced Encryption Standard (AES) algorithm.
enumeration Blowfish 
Specifies the Blowfish algorithm.
enumeration CAST-128 
Specifies the CAST-128 algorithm.
enumeration CAST-256 
Specifies the CAST-256 algorithm.
enumeration DES 
Specifies the Data Encryption Standard (DES) algorithm.
enumeration IDEA 
Specifies the International Data Encryption Algorithm (IDEA).
enumeration Rijndael 
Specifies the Rijndael algorithm.
enumeration RC5 
Specifies the RC5 algorithm.
enumeration Skipjack 
Specifies the Skipjack algorithm.
Source
 
<xs:simpleType name="CipherEnum">
  <xs:annotation>
    <xs:documentation>CipherEnum is a non-exhaustive enumeration of encryption algorithms.</xs:documentation>
  </xs:annotation>
  <xs:restriction base="xs:string">
    <xs:enumeration value="3DES">
      <xs:annotation>
        <xs:documentation>Specifies the Triple Data Encryption Standard (DES) algorithm.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="AES">
      <xs:annotation>
        <xs:documentation>Specifies the Advanced Encryption Standard (AES) algorithm.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Blowfish">
      <xs:annotation>
        <xs:documentation>Specifies the Blowfish algorithm.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="CAST-128">
      <xs:annotation>
        <xs:documentation>Specifies the CAST-128 algorithm.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="CAST-256">
      <xs:annotation>
        <xs:documentation>Specifies the CAST-256 algorithm.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="DES">
      <xs:annotation>
        <xs:documentation>Specifies the Data Encryption Standard (DES) algorithm.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="IDEA">
      <xs:annotation>
        <xs:documentation>Specifies the International Data Encryption Algorithm (IDEA).</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Rijndael">
      <xs:annotation>
        <xs:documentation>Specifies the Rijndael algorithm.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="RC5">
      <xs:annotation>
        <xs:documentation>Specifies the RC5 algorithm.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="Skipjack">
      <xs:annotation>
        <xs:documentation>Specifies the Skipjack algorithm.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
  </xs:restriction>
</xs:simpleType>
Complex Type cyboxCommon:RegionalRegistryType
Namespace http://cybox.mitre.org/common-2
Annotations
 
The RegionalRegistryType specifies a Regional Internet Registry (RIR) for a given WHOIS entry. RIRs defined by the RegionalRegistryTypeEnum may be used, as well as those specified by a free form text string.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType
Type restriction of cyboxCommon:BaseObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the expected type for the value of the specified property.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:complexType name="RegionalRegistryType">
  <xs:annotation>
    <xs:documentation>The RegionalRegistryType specifies a Regional Internet Registry (RIR) for a given WHOIS entry. RIRs defined by the RegionalRegistryTypeEnum may be used, as well as those specified by a free form text string.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
      <xs:simpleType>
        <xs:union memberTypes="cyboxCommon:RegionalRegistryTypeEnum xs:string"/>
      </xs:simpleType>
    </xs:restriction>
  </xs:simpleContent>
</xs:complexType>
Simple Type cyboxCommon:RegionalRegistryTypeEnum
Namespace http://cybox.mitre.org/common-2
Annotations
 
The RegionalRegistryTypeEnum is an enumeration of Regional Internet Registries (RIRs) names, represented via their respective acronyms.
Diagram
Diagram
Type restriction of xs:string
Facets
enumeration AfriNIC 
AfriNIC stands for African Network Information Centre, and is the RIR for Africa.
enumeration ARIN 
ARIN stands for American Registry for Internet Numbers, and is the RIR for the United States, Canada, several parts of the Caribbean Region, and Antarctica.
enumeration APNIC 
APNIC stands for Asia-Pacific Network Information Centre, and is the RIR for Asia, Australia, New Zealand, and neighboring countries.
enumeration LACNIC 
LACNIC stands for Latin American and Caribbean Network Information Centre, and is the RIR for Latin America and parts of the Caribbean region.
enumeration RIPE NCC 
RIPE NCC stands for Réseaux IP Européens Network Coordination Centre, and is the RIR for Europe, Russia, the Middle East, and Central Asia.
Source
 
<xs:simpleType name="RegionalRegistryTypeEnum">
  <xs:annotation>
    <xs:documentation>The RegionalRegistryTypeEnum is an enumeration of Regional Internet Registries (RIRs) names, represented via their respective acronyms.</xs:documentation>
  </xs:annotation>
  <xs:restriction base="xs:string">
    <xs:enumeration value="AfriNIC">
      <xs:annotation>
        <xs:documentation>AfriNIC stands for African Network Information Centre, and is the RIR for Africa.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="ARIN">
      <xs:annotation>
        <xs:documentation>ARIN stands for American Registry for Internet Numbers, and is the RIR for the United States, Canada, several parts of the Caribbean Region, and Antarctica.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="APNIC">
      <xs:annotation>
        <xs:documentation>APNIC stands for Asia-Pacific Network Information Centre, and is the RIR for Asia, Australia, New Zealand, and neighboring countries.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="LACNIC">
      <xs:annotation>
        <xs:documentation>LACNIC stands for Latin American and Caribbean Network Information Centre, and is the RIR for Latin America and parts of the Caribbean region.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="RIPE NCC">
      <xs:annotation>
        <xs:documentation>RIPE NCC stands for Réseaux IP Européens Network Coordination Centre, and is the RIR for Europe, Russia, the Middle East, and Central Asia.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
  </xs:restriction>
</xs:simpleType>
Attribute cyboxCommon:StructuredTextType / @structuring_format
Namespace No namespace
Annotations
 
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interfering with XML validation of the CybOX document. If this attribute is absent, the implication is that no markup is being used.
Type xs:string
Used by
Complex Type cyboxCommon:StructuredTextType
Source
 
<xs:attribute name="structuring_format" type="xs:string" use="optional">
  <xs:annotation>
    <xs:documentation>Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interfering with XML validation of the CybOX document. If this attribute is absent, the implication is that no markup is being used.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:PatternFieldGroup / @condition
Namespace No namespace
Annotations
 
This field is optional and defines the relevant condition to apply to the value.
Type cyboxCommon:ConditionTypeEnum
Facets
enumeration Equals 
Specifies the equality or = condition.
enumeration DoesNotEqual 
Specifies the "does not equal" or != condition.
enumeration Contains 
Specifies the "contains" condition.
enumeration DoesNotContain 
Specifies the "does not contain" condition.
enumeration StartsWith 
Specifies the "starts with" condition.
enumeration EndsWith 
Specifies the "ends with" condition.
enumeration GreaterThan 
Specifies the "greater than" condition.
enumeration GreaterThanOrEqual 
Specifies the "greater than or equal to" condition.
enumeration LessThan 
Specifies the "less than" condition.
enumeration LessThanOrEqual 
Specifies the "less than or equal" condition.
enumeration InclusiveBetween 
The pattern is met if the given value lies between the values indicated in the field value body, inclusive of the bounding values themselves. The field value body MUST contain at least 2 values to be valid. If the field value body contains more than 2 values, then only the greatest and least values are considered. (I.e., If the body contains "2,4,6", then an InclusiveBetween condition would be satisfied if the observed value fell between 2 and 6, inclusive. Since this is an inclusive range, an observed value of 2 or 6 would fit the pattern in this example.) As such, always treat the InclusiveBetween condition as applying to a single range for the purpose of evaluating the apply_condition attribute.
enumeration ExclusiveBetween 
The pattern is met if the given value lies between the values indicated in the field value body, exclusive of the bounding values themselves. The field value body MUST contain at least 2 values to be valid. If the field value body contains more than 2 values, then only the greatest and least values are considered. (I.e., If the body contains "2,4,6", then an InclusiveBetween condition would be satisfied if the observed value fell between 2 and 6, exclusive. Since this is an exclusive range, an observed value of 2 or 6 would not fit the pattern in this example.) As such, always treat the ExclusiveBetween condition as applying to a single range for the purpose of evaluating the apply_condition attribute.
enumeration FitsPattern 
Specifies the condition that a value fits a given pattern.
enumeration BitwiseAnd 
Specifies the condition of bitwise AND. Specifically, when applying this pattern, a given value is bitwise-ANDed with the bit_mask attribute value (which must be present). If the result is identical to the value provided in the body of this field value, the pattern is considered fulfilled.
enumeration BitwiseOr 
Specifies the condition of bitwise OR. Specifically, when applying this pattern, a given value is bitwise-ORed with the bit_mask attribute value (which must be present). If the result is identical to the value provided in the body of this field value, the pattern is considered fulfilled.
enumeration BitwiseXor 
Specifies the condition of bitwise XOR. Specifically, when applying this pattern, a given value is bitwise-XORed with the bit_mask attribute value (which must be present). If the result is identical to the value provided in the body of this field value, the pattern is considered fulfilled.
Used by
Source
 
<xs:attribute name="condition" type="cyboxCommon:ConditionTypeEnum">
  <xs:annotation>
    <xs:documentation>This field is optional and defines the relevant condition to apply to the value.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:PatternFieldGroup / @is_case_sensitive
Namespace No namespace
Annotations
 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
Type xs:boolean
Used by
Source
 
<xs:attribute name="is_case_sensitive" type="xs:boolean" default="true">
  <xs:annotation>
    <xs:documentation>The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:PatternFieldGroup / @apply_condition
Namespace No namespace
Annotations
 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
Type cyboxCommon:ConditionApplicationEnum
Facets
enumeration ANY 
Indicates that a pattern holds if the given condition can be successfully applied to any of the field values.
enumeration ALL 
Indicates that a pattern holds only if the given condition can be successfully applied to all of the field values.
enumeration NONE 
Indicates that a pattern holds only if the given condition can be successfully applied to none of the field values.
Used by
Source
 
<xs:attribute name="apply_condition" type="cyboxCommon:ConditionApplicationEnum" default="ANY">
  <xs:annotation>
    <xs:documentation>This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:PatternFieldGroup / @delimiter
Namespace No namespace
Annotations
 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
Type xs:string
Used by
Source
 
<xs:attribute name="delimiter" type="xs:string" default="##comma##">
  <xs:annotation>
    <xs:documentation>The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:PatternFieldGroup / @bit_mask
Namespace No namespace
Annotations
 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
Type xs:hexBinary
Used by
Source
 
<xs:attribute name="bit_mask" type="xs:hexBinary">
  <xs:annotation>
    <xs:documentation>Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:PatternFieldGroup / @pattern_type
Namespace No namespace
Annotations
 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Type cyboxCommon:PatternTypeEnum
Facets
enumeration Regex 
Specifies the regular expression pattern type.
enumeration Binary 
Specifies the binary (bit operations) pattern type.
enumeration XPath 
Specifies the XPath 1.0 expression pattern type.
Used by
Source
 
<xs:attribute name="pattern_type" type="cyboxCommon:PatternTypeEnum">
  <xs:annotation>
    <xs:documentation>This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:PatternFieldGroup / @regex_syntax
Namespace No namespace
Annotations
 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
Type xs:string
Used by
Source
 
<xs:attribute name="regex_syntax" type="xs:string">
  <xs:annotation>
    <xs:documentation>This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.</xs:documentation>
    <xs:documentation>Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.</xs:documentation>
    <xs:documentation>Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:PatternFieldGroup / @has_changed
Namespace No namespace
Annotations
 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
Type xs:boolean
Used by
Source
 
<xs:attribute name="has_changed" type="xs:boolean">
  <xs:annotation>
    <xs:documentation>This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:PatternFieldGroup / @trend
Namespace No namespace
Annotations
 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Type xs:boolean
Used by
Source
 
<xs:attribute name="trend" type="xs:boolean">
  <xs:annotation>
    <xs:documentation>This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:ControlledVocabularyStringType / @vocab_name
Namespace No namespace
Annotations
 
The vocab_name field specifies the name of the controlled vocabulary.
Type xs:string
Used by
Complex Type cyboxCommon:ControlledVocabularyStringType
Source
 
<xs:attribute name="vocab_name" type="xs:string" use="optional">
  <xs:annotation>
    <xs:documentation>The vocab_name field specifies the name of the controlled vocabulary.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:ControlledVocabularyStringType / @vocab_reference
Namespace No namespace
Annotations
 
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Type xs:anyURI
Used by
Complex Type cyboxCommon:ControlledVocabularyStringType
Source
 
<xs:attribute name="vocab_reference" type="xs:anyURI" use="optional">
  <xs:annotation>
    <xs:documentation>The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:DateWithPrecisionType / @precision
Namespace No namespace
Annotations
 
The precision of the associated date. If omitted, the default is "day", meaning the full field value.
Type cyboxCommon:DatePrecisionEnum
Facets
enumeration year 
Date is precise to the given year.
enumeration month 
Date is precise to the given month.
enumeration day 
Date is precise to the given day.
Used by
Source
 
<xs:attribute name="precision" type="cyboxCommon:DatePrecisionEnum" default="day">
  <xs:annotation>
    <xs:documentation>The precision of the associated date. If omitted, the default is "day", meaning the full field value.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:DateTimeWithPrecisionType / @precision
Namespace No namespace
Annotations
 
The precision of the associated dateTime. If omitted, the default is "second", meaning the full field value (including fractional seconds).
Type cyboxCommon:DateTimePrecisionEnum
Used by
Complex Type cyboxCommon:DateTimeWithPrecisionType
Source
 
<xs:attribute name="precision" type="cyboxCommon:DateTimePrecisionEnum" default="second">
  <xs:annotation>
    <xs:documentation>The precision of the associated dateTime. If omitted, the default is "second", meaning the full field value (including fractional seconds).</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:LocationType / @id
Namespace No namespace
Annotations
 
Specifies a unique ID for this Location.
Type xs:QName
Used by
Source
 
<xs:attribute name="id" type="xs:QName">
  <xs:annotation>
    <xs:documentation>Specifies a unique ID for this Location.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:LocationType / @idref
Namespace No namespace
Annotations
 
Specifies a reference to a unique ID defined elsewhere.
Type xs:QName
Used by
Source
 
<xs:attribute name="idref" type="xs:QName">
  <xs:annotation>
    <xs:documentation>Specifies a reference to a unique ID defined elsewhere.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:ToolReferenceType / @reference_type
Namespace No namespace
Annotations
 
Indicates the nature of the referenced material (documentation, source, executable, etc.).
Type cyboxCommon:ToolReferenceTypeEnum
Facets
enumeration Documentation 
The reference is to documentation about the identified tool.
enumeration Source 
The reference is to source code for the identified tool.
enumeration Download 
The reference is to where an executable version of the tool can be downloaded.
enumeration Execute 
The reference is to the tool implemented as an online service.
enumeration Other 
The reference is to material about the tool not covered by other values in this enumeration.
Used by
Source
 
<xs:attribute name="reference_type" type="cyboxCommon:ToolReferenceTypeEnum">
  <xs:annotation>
    <xs:documentation>Indicates the nature of the referenced material (documentation, source, executable, etc.).</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:BaseObjectPropertyGroup / @id
Namespace No namespace
Annotations
 
The id field specifies a unique ID for this Object Property.
Type xs:QName
Used by
Source
 
<xs:attribute name="id" type="xs:QName">
  <xs:annotation>
    <xs:documentation>The id field specifies a unique ID for this Object Property.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:BaseObjectPropertyGroup / @idref
Namespace No namespace
Annotations
 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
Type xs:QName
Used by
Source
 
<xs:attribute name="idref" type="xs:QName">
  <xs:annotation>
    <xs:documentation>The idref field specifies a unique ID reference for this Object Property.</xs:documentation>
    <xs:documentation>When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:BaseObjectPropertyGroup / @datatype
Namespace No namespace
Annotations
 
This attribute is optional and specifies the expected type for the value of the specified property.
Type cyboxCommon:DatatypeEnum
Facets
enumeration string 
Specifies the string datatype as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#string for more information.
enumeration int 
Specifies the int datatype as it applies to the W3C standard for int. See http://www.w3.org/TR/xmlschema-2/#int for more information.
enumeration float 
Specifies the float datatype as it apples to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#float for more information.
enumeration date 
Specifies a date, which is usually in the form yyyy-mm--dd as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#date for more information.
enumeration positiveInteger 
Specifies a positive integer in the infinite set {1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#positiveInteger for more information.
enumeration unsignedInt 
Specifies an unsigned integer, which is a nonnegative integer in the set {0,1,2,...,4294967295} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedInt for more information.
enumeration dateTime 
Specifies a date in full format including both date and time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#dateTime for more information.
enumeration time 
Specifies a time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#time for more information.
enumeration boolean 
Specifies a boolean value in the set {true,false,1,0} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#boolean for more information.
enumeration name 
Specifies a name (which represents XML Names) as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#Name and http://www.w3.org/TR/2000/WD-xml-2e-20000814#dt-name for more information.
enumeration long 
Specifies a long integer, which is an integer whose maximum value is 9223372036854775807 and minimum value is -9223372036854775808 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#long for more information.
enumeration unsignedLong 
Specifies an unsigned long integer, which is an integer whose maximum value is 18446744073709551615 and minimum value is 0 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedLong for more information.
enumeration duration 
Specifies a length of time in the extended format PnYn MnDTnH nMnS, where nY represents the number of years, nM the number of months, nD the number of days, 'T' is the date/time separator, nH the number of hours, nM the number of minutes and nS the number of seconds, as it applies to the W3 standard. See http://www.w3.org/TR/xmlschema-2/#duration for more information.
enumeration double 
Specifies a decimal of datatype double as it is patterned after the IEEE double-precision 64-bit floating point type (IEEE 754-1985) and as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#double for more information.
enumeration nonNegativeInteger 
Specifies a non-negative integer in the infinite set {0,1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#nonNegativeInteger for more information.
enumeration hexBinary 
Specifies arbitrary hex-encoded binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#hexBinary for more information.
enumeration anyURI 
Specifies a Uniform Resource Identifier Reference (URI) as it applies to the W3C standard and to RFC 2396, as amended by RFC 2732. See http://www.w3.org/TR/xmlschema-2/#anyURI for more information.
enumeration base64Binary 
Specifies base64-encoded arbitrary binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#base64Binary for more information.
enumeration IPv4 Address 
Specifies an IPV4 address in dotted decimal form. CIDR notation is also accepted.
enumeration IPv6 Address 
Specifies an IPV6 address, which is represented by eight groups of 16-bit hexadecimal values separated by colons (:) in the form a:b:c:d:e:f:g:h. CIDR notation is also accepted.
enumeration Host Name 
Specifies a host name. For compatibility reasons, this could be any string. Even so, it is best to use the proper notation for the given host type. For example, web hostnames should be written as fully qualified hostnames in practice.
enumeration MAC Address 
Specifies a MAC address, which is represented by six groups of 2 hexdecimal digits, separated by hyphens (-) or colons (:) in transmission order.
enumeration Domain Name 
Specifies a domain name, which is represented by a series of labels concatenated with dots conforming to the rules in RFC 1035, RFC 1123, and RFC 2181.
enumeration URI 
Specifies a Uniform Resource Identifier, which identifies a name or resource and can act as a URL or URN.
enumeration TimeZone 
Specifies a timezone in UTC notation (UTC+number).
enumeration Octal 
Specifies arbitrary octal (base-8) encoded data.
enumeration Binary 
Specifies arbitrary binary encoded data.
enumeration BinHex 
Specifies arbitrary data encoded in the Mac OS-originated BinHex format.
enumeration Subnet Mask 
Specifies a subnet mask in IPv4 or IPv6 notation.
enumeration UUID/GUID 
Specifies a globally/universally unique ID represented as a 32-character hexadecimal string. See ISO/IEC 11578:1996 Information technology -- Open Systems Interconnection -- Remote Procedure Call - http://www.iso.ch/cate/d2229.html.
enumeration Collection 
Specifies data represented as a container of multiple data of a shared elemental type.
enumeration CVE ID 
Specifies a CVE ID, expressed as CVE- appended by a four-digit integer, a - and another four-digit integer, as in CVE-2012-1234.
enumeration CWE ID 
Specifies a CWE ID, expressed as CWE- appended by an integer.
enumeration CAPEC ID 
Specifies a CAPEC ID, expressed as CAPEC- appended by an integer.
enumeration CCE ID 
Specifies a CCE ID, expressed as CCE- appended by an integer.
enumeration CPE Name 
Specifies a CPE Name. See http://cpe.mitre.org/specification/archive/version2.0/cpe-specification_2.0.pdf for more information.
Used by
Source
 
<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="string">
  <xs:annotation>
    <xs:documentation>This attribute is optional and specifies the expected type for the value of the specified property.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:BaseObjectPropertyGroup / @appears_random
Namespace No namespace
Annotations
 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
Type xs:boolean
Used by
Source
 
<xs:attribute name="appears_random" type="xs:boolean">
  <xs:annotation>
    <xs:documentation>This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:BaseObjectPropertyGroup / @is_obfuscated
Namespace No namespace
Annotations
 
This field is optional and conveys whether the associated Object property has been obfuscated.
Type xs:boolean
Used by
Source
 
<xs:attribute name="is_obfuscated" type="xs:boolean">
  <xs:annotation>
    <xs:documentation>This field is optional and conveys whether the associated Object property has been obfuscated.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:BaseObjectPropertyGroup / @obfuscation_algorithm_ref
Namespace No namespace
Annotations
 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
Type xs:anyURI
Used by
Source
 
<xs:attribute name="obfuscation_algorithm_ref" type="xs:anyURI">
  <xs:annotation>
    <xs:documentation>This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:BaseObjectPropertyGroup / @is_defanged
Namespace No namespace
Annotations
 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
Type xs:boolean
Used by
Source
 
<xs:attribute name="is_defanged" type="xs:boolean">
  <xs:annotation>
    <xs:documentation>This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:BaseObjectPropertyGroup / @defanging_algorithm_ref
Namespace No namespace
Annotations
 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
Type xs:anyURI
Used by
Source
 
<xs:attribute name="defanging_algorithm_ref" type="xs:anyURI">
  <xs:annotation>
    <xs:documentation>This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:BaseObjectPropertyGroup / @refanging_transform_type
Namespace No namespace
Annotations
 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
Type xs:string
Used by
Source
 
<xs:attribute name="refanging_transform_type" type="xs:string">
  <xs:annotation>
    <xs:documentation>This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:BaseObjectPropertyGroup / @refanging_transform
Namespace No namespace
Annotations
 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
Type xs:string
Used by
Source
 
<xs:attribute name="refanging_transform" type="xs:string">
  <xs:annotation>
    <xs:documentation>This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:BaseObjectPropertyGroup / @observed_encoding
Namespace No namespace
Annotations
 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
Type xs:string
Used by
Source
 
<xs:attribute name="observed_encoding" type="xs:string">
  <xs:annotation>
    <xs:documentation>This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.</xs:documentation>
    <xs:documentation>It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).</xs:documentation>
    <xs:documentation>This field is intended to be applicable only to fields which contain string values.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:HexBinaryObjectPropertyType / @datatype
Namespace No namespace
Annotations
 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
Type cyboxCommon:DatatypeEnum
Facets
enumeration string 
Specifies the string datatype as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#string for more information.
enumeration int 
Specifies the int datatype as it applies to the W3C standard for int. See http://www.w3.org/TR/xmlschema-2/#int for more information.
enumeration float 
Specifies the float datatype as it apples to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#float for more information.
enumeration date 
Specifies a date, which is usually in the form yyyy-mm--dd as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#date for more information.
enumeration positiveInteger 
Specifies a positive integer in the infinite set {1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#positiveInteger for more information.
enumeration unsignedInt 
Specifies an unsigned integer, which is a nonnegative integer in the set {0,1,2,...,4294967295} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedInt for more information.
enumeration dateTime 
Specifies a date in full format including both date and time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#dateTime for more information.
enumeration time 
Specifies a time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#time for more information.
enumeration boolean 
Specifies a boolean value in the set {true,false,1,0} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#boolean for more information.
enumeration name 
Specifies a name (which represents XML Names) as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#Name and http://www.w3.org/TR/2000/WD-xml-2e-20000814#dt-name for more information.
enumeration long 
Specifies a long integer, which is an integer whose maximum value is 9223372036854775807 and minimum value is -9223372036854775808 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#long for more information.
enumeration unsignedLong 
Specifies an unsigned long integer, which is an integer whose maximum value is 18446744073709551615 and minimum value is 0 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedLong for more information.
enumeration duration 
Specifies a length of time in the extended format PnYn MnDTnH nMnS, where nY represents the number of years, nM the number of months, nD the number of days, 'T' is the date/time separator, nH the number of hours, nM the number of minutes and nS the number of seconds, as it applies to the W3 standard. See http://www.w3.org/TR/xmlschema-2/#duration for more information.
enumeration double 
Specifies a decimal of datatype double as it is patterned after the IEEE double-precision 64-bit floating point type (IEEE 754-1985) and as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#double for more information.
enumeration nonNegativeInteger 
Specifies a non-negative integer in the infinite set {0,1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#nonNegativeInteger for more information.
enumeration hexBinary 
Specifies arbitrary hex-encoded binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#hexBinary for more information.
enumeration anyURI 
Specifies a Uniform Resource Identifier Reference (URI) as it applies to the W3C standard and to RFC 2396, as amended by RFC 2732. See http://www.w3.org/TR/xmlschema-2/#anyURI for more information.
enumeration base64Binary 
Specifies base64-encoded arbitrary binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#base64Binary for more information.
enumeration IPv4 Address 
Specifies an IPV4 address in dotted decimal form. CIDR notation is also accepted.
enumeration IPv6 Address 
Specifies an IPV6 address, which is represented by eight groups of 16-bit hexadecimal values separated by colons (:) in the form a:b:c:d:e:f:g:h. CIDR notation is also accepted.
enumeration Host Name 
Specifies a host name. For compatibility reasons, this could be any string. Even so, it is best to use the proper notation for the given host type. For example, web hostnames should be written as fully qualified hostnames in practice.
enumeration MAC Address 
Specifies a MAC address, which is represented by six groups of 2 hexdecimal digits, separated by hyphens (-) or colons (:) in transmission order.
enumeration Domain Name 
Specifies a domain name, which is represented by a series of labels concatenated with dots conforming to the rules in RFC 1035, RFC 1123, and RFC 2181.
enumeration URI 
Specifies a Uniform Resource Identifier, which identifies a name or resource and can act as a URL or URN.
enumeration TimeZone 
Specifies a timezone in UTC notation (UTC+number).
enumeration Octal 
Specifies arbitrary octal (base-8) encoded data.
enumeration Binary 
Specifies arbitrary binary encoded data.
enumeration BinHex 
Specifies arbitrary data encoded in the Mac OS-originated BinHex format.
enumeration Subnet Mask 
Specifies a subnet mask in IPv4 or IPv6 notation.
enumeration UUID/GUID 
Specifies a globally/universally unique ID represented as a 32-character hexadecimal string. See ISO/IEC 11578:1996 Information technology -- Open Systems Interconnection -- Remote Procedure Call - http://www.iso.ch/cate/d2229.html.
enumeration Collection 
Specifies data represented as a container of multiple data of a shared elemental type.
enumeration CVE ID 
Specifies a CVE ID, expressed as CVE- appended by a four-digit integer, a - and another four-digit integer, as in CVE-2012-1234.
enumeration CWE ID 
Specifies a CWE ID, expressed as CWE- appended by an integer.
enumeration CAPEC ID 
Specifies a CAPEC ID, expressed as CAPEC- appended by an integer.
enumeration CCE ID 
Specifies a CCE ID, expressed as CCE- appended by an integer.
enumeration CPE Name 
Specifies a CPE Name. See http://cpe.mitre.org/specification/archive/version2.0/cpe-specification_2.0.pdf for more information.
Used by
Source
 
<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="hexBinary">
  <xs:annotation>
    <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:StringObjectPropertyType / @datatype
Namespace No namespace
Annotations
 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
Type cyboxCommon:DatatypeEnum
Facets
enumeration string 
Specifies the string datatype as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#string for more information.
enumeration int 
Specifies the int datatype as it applies to the W3C standard for int. See http://www.w3.org/TR/xmlschema-2/#int for more information.
enumeration float 
Specifies the float datatype as it apples to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#float for more information.
enumeration date 
Specifies a date, which is usually in the form yyyy-mm--dd as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#date for more information.
enumeration positiveInteger 
Specifies a positive integer in the infinite set {1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#positiveInteger for more information.
enumeration unsignedInt 
Specifies an unsigned integer, which is a nonnegative integer in the set {0,1,2,...,4294967295} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedInt for more information.
enumeration dateTime 
Specifies a date in full format including both date and time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#dateTime for more information.
enumeration time 
Specifies a time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#time for more information.
enumeration boolean 
Specifies a boolean value in the set {true,false,1,0} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#boolean for more information.
enumeration name 
Specifies a name (which represents XML Names) as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#Name and http://www.w3.org/TR/2000/WD-xml-2e-20000814#dt-name for more information.
enumeration long 
Specifies a long integer, which is an integer whose maximum value is 9223372036854775807 and minimum value is -9223372036854775808 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#long for more information.
enumeration unsignedLong 
Specifies an unsigned long integer, which is an integer whose maximum value is 18446744073709551615 and minimum value is 0 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedLong for more information.
enumeration duration 
Specifies a length of time in the extended format PnYn MnDTnH nMnS, where nY represents the number of years, nM the number of months, nD the number of days, 'T' is the date/time separator, nH the number of hours, nM the number of minutes and nS the number of seconds, as it applies to the W3 standard. See http://www.w3.org/TR/xmlschema-2/#duration for more information.
enumeration double 
Specifies a decimal of datatype double as it is patterned after the IEEE double-precision 64-bit floating point type (IEEE 754-1985) and as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#double for more information.
enumeration nonNegativeInteger 
Specifies a non-negative integer in the infinite set {0,1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#nonNegativeInteger for more information.
enumeration hexBinary 
Specifies arbitrary hex-encoded binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#hexBinary for more information.
enumeration anyURI 
Specifies a Uniform Resource Identifier Reference (URI) as it applies to the W3C standard and to RFC 2396, as amended by RFC 2732. See http://www.w3.org/TR/xmlschema-2/#anyURI for more information.
enumeration base64Binary 
Specifies base64-encoded arbitrary binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#base64Binary for more information.
enumeration IPv4 Address 
Specifies an IPV4 address in dotted decimal form. CIDR notation is also accepted.
enumeration IPv6 Address 
Specifies an IPV6 address, which is represented by eight groups of 16-bit hexadecimal values separated by colons (:) in the form a:b:c:d:e:f:g:h. CIDR notation is also accepted.
enumeration Host Name 
Specifies a host name. For compatibility reasons, this could be any string. Even so, it is best to use the proper notation for the given host type. For example, web hostnames should be written as fully qualified hostnames in practice.
enumeration MAC Address 
Specifies a MAC address, which is represented by six groups of 2 hexdecimal digits, separated by hyphens (-) or colons (:) in transmission order.
enumeration Domain Name 
Specifies a domain name, which is represented by a series of labels concatenated with dots conforming to the rules in RFC 1035, RFC 1123, and RFC 2181.
enumeration URI 
Specifies a Uniform Resource Identifier, which identifies a name or resource and can act as a URL or URN.
enumeration TimeZone 
Specifies a timezone in UTC notation (UTC+number).
enumeration Octal 
Specifies arbitrary octal (base-8) encoded data.
enumeration Binary 
Specifies arbitrary binary encoded data.
enumeration BinHex 
Specifies arbitrary data encoded in the Mac OS-originated BinHex format.
enumeration Subnet Mask 
Specifies a subnet mask in IPv4 or IPv6 notation.
enumeration UUID/GUID 
Specifies a globally/universally unique ID represented as a 32-character hexadecimal string. See ISO/IEC 11578:1996 Information technology -- Open Systems Interconnection -- Remote Procedure Call - http://www.iso.ch/cate/d2229.html.
enumeration Collection 
Specifies data represented as a container of multiple data of a shared elemental type.
enumeration CVE ID 
Specifies a CVE ID, expressed as CVE- appended by a four-digit integer, a - and another four-digit integer, as in CVE-2012-1234.
enumeration CWE ID 
Specifies a CWE ID, expressed as CWE- appended by an integer.
enumeration CAPEC ID 
Specifies a CAPEC ID, expressed as CAPEC- appended by an integer.
enumeration CCE ID 
Specifies a CCE ID, expressed as CCE- appended by an integer.
enumeration CPE Name 
Specifies a CPE Name. See http://cpe.mitre.org/specification/archive/version2.0/cpe-specification_2.0.pdf for more information.
Used by
Source
 
<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="string">
  <xs:annotation>
    <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:IntegerObjectPropertyType / @datatype
Namespace No namespace
Annotations
 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
Type cyboxCommon:DatatypeEnum
Facets
enumeration string 
Specifies the string datatype as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#string for more information.
enumeration int 
Specifies the int datatype as it applies to the W3C standard for int. See http://www.w3.org/TR/xmlschema-2/#int for more information.
enumeration float 
Specifies the float datatype as it apples to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#float for more information.
enumeration date 
Specifies a date, which is usually in the form yyyy-mm--dd as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#date for more information.
enumeration positiveInteger 
Specifies a positive integer in the infinite set {1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#positiveInteger for more information.
enumeration unsignedInt 
Specifies an unsigned integer, which is a nonnegative integer in the set {0,1,2,...,4294967295} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedInt for more information.
enumeration dateTime 
Specifies a date in full format including both date and time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#dateTime for more information.
enumeration time 
Specifies a time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#time for more information.
enumeration boolean 
Specifies a boolean value in the set {true,false,1,0} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#boolean for more information.
enumeration name 
Specifies a name (which represents XML Names) as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#Name and http://www.w3.org/TR/2000/WD-xml-2e-20000814#dt-name for more information.
enumeration long 
Specifies a long integer, which is an integer whose maximum value is 9223372036854775807 and minimum value is -9223372036854775808 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#long for more information.
enumeration unsignedLong 
Specifies an unsigned long integer, which is an integer whose maximum value is 18446744073709551615 and minimum value is 0 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedLong for more information.
enumeration duration 
Specifies a length of time in the extended format PnYn MnDTnH nMnS, where nY represents the number of years, nM the number of months, nD the number of days, 'T' is the date/time separator, nH the number of hours, nM the number of minutes and nS the number of seconds, as it applies to the W3 standard. See http://www.w3.org/TR/xmlschema-2/#duration for more information.
enumeration double 
Specifies a decimal of datatype double as it is patterned after the IEEE double-precision 64-bit floating point type (IEEE 754-1985) and as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#double for more information.
enumeration nonNegativeInteger 
Specifies a non-negative integer in the infinite set {0,1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#nonNegativeInteger for more information.
enumeration hexBinary 
Specifies arbitrary hex-encoded binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#hexBinary for more information.
enumeration anyURI 
Specifies a Uniform Resource Identifier Reference (URI) as it applies to the W3C standard and to RFC 2396, as amended by RFC 2732. See http://www.w3.org/TR/xmlschema-2/#anyURI for more information.
enumeration base64Binary 
Specifies base64-encoded arbitrary binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#base64Binary for more information.
enumeration IPv4 Address 
Specifies an IPV4 address in dotted decimal form. CIDR notation is also accepted.
enumeration IPv6 Address 
Specifies an IPV6 address, which is represented by eight groups of 16-bit hexadecimal values separated by colons (:) in the form a:b:c:d:e:f:g:h. CIDR notation is also accepted.
enumeration Host Name 
Specifies a host name. For compatibility reasons, this could be any string. Even so, it is best to use the proper notation for the given host type. For example, web hostnames should be written as fully qualified hostnames in practice.
enumeration MAC Address 
Specifies a MAC address, which is represented by six groups of 2 hexdecimal digits, separated by hyphens (-) or colons (:) in transmission order.
enumeration Domain Name 
Specifies a domain name, which is represented by a series of labels concatenated with dots conforming to the rules in RFC 1035, RFC 1123, and RFC 2181.
enumeration URI 
Specifies a Uniform Resource Identifier, which identifies a name or resource and can act as a URL or URN.
enumeration TimeZone 
Specifies a timezone in UTC notation (UTC+number).
enumeration Octal 
Specifies arbitrary octal (base-8) encoded data.
enumeration Binary 
Specifies arbitrary binary encoded data.
enumeration BinHex 
Specifies arbitrary data encoded in the Mac OS-originated BinHex format.
enumeration Subnet Mask 
Specifies a subnet mask in IPv4 or IPv6 notation.
enumeration UUID/GUID 
Specifies a globally/universally unique ID represented as a 32-character hexadecimal string. See ISO/IEC 11578:1996 Information technology -- Open Systems Interconnection -- Remote Procedure Call - http://www.iso.ch/cate/d2229.html.
enumeration Collection 
Specifies data represented as a container of multiple data of a shared elemental type.
enumeration CVE ID 
Specifies a CVE ID, expressed as CVE- appended by a four-digit integer, a - and another four-digit integer, as in CVE-2012-1234.
enumeration CWE ID 
Specifies a CWE ID, expressed as CWE- appended by an integer.
enumeration CAPEC ID 
Specifies a CAPEC ID, expressed as CAPEC- appended by an integer.
enumeration CCE ID 
Specifies a CCE ID, expressed as CCE- appended by an integer.
enumeration CPE Name 
Specifies a CPE Name. See http://cpe.mitre.org/specification/archive/version2.0/cpe-specification_2.0.pdf for more information.
Used by
Source
 
<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="int">
  <xs:annotation>
    <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:PlatformIdentifierType / @system
Namespace No namespace
Annotations
 
Indicates the naming system from which the indicated name was drawn.
Type xs:string
Used by
Source
 
<xs:attribute name="system" type="xs:string">
  <xs:annotation>
    <xs:documentation>Indicates the naming system from which the indicated name was drawn.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:PlatformIdentifierType / @system-ref
Namespace No namespace
Annotations
 
A reference to information about the naming system from which the indicated name was drawn.
Type xs:anyURI
Used by
Source
 
<xs:attribute name="system-ref" type="xs:anyURI">
  <xs:annotation>
    <xs:documentation>A reference to information about the naming system from which the indicated name was drawn.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:LibraryType / @name
Namespace No namespace
Annotations
 
This field identifies the name of the library.
Type xs:string
Used by
Source
 
<xs:attribute name="name" type="xs:string">
  <xs:annotation>
    <xs:documentation>This field identifies the name of the library.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:LibraryType / @version
Namespace No namespace
Annotations
 
This field identifies the version of the library.
Type xs:string
Used by
Source
 
<xs:attribute name="version" type="xs:string">
  <xs:annotation>
    <xs:documentation>This field identifies the version of the library.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:PropertyType / @name
Namespace No namespace
Annotations
 
The name field specifies a name for this property.
Type xs:string
Used by
Source
 
<xs:attribute name="name" type="xs:string">
  <xs:annotation>
    <xs:documentation>The name field specifies a name for this property.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:PropertyType / @description
Namespace No namespace
Annotations
 
A description of what this property represents.
Type xs:string
Used by
Source
 
<xs:attribute name="description" type="xs:string">
  <xs:annotation>
    <xs:documentation>A description of what this property represents.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:ObjectPropertiesType / @object_reference
Namespace No namespace
Annotations
 
The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
Type xs:QName
Used by
Source
 
<xs:attribute name="object_reference" type="xs:QName">
  <xs:annotation>
    <xs:documentation>The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:MetadataType / @type
Namespace No namespace
Annotations
 
This field specifies the type of name of a single metadata field.
Type xs:string
Used by
Source
 
<xs:attribute name="type" type="xs:string">
  <xs:annotation>
    <xs:documentation>This field specifies the type of name of a single metadata field.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:CompensationModelType / @datatype
Namespace No namespace
Annotations
 
This attribute is optional and specifies the expected type for the value of the specified property.
Type cyboxCommon:DatatypeEnum
Facets
enumeration string 
Specifies the string datatype as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#string for more information.
enumeration int 
Specifies the int datatype as it applies to the W3C standard for int. See http://www.w3.org/TR/xmlschema-2/#int for more information.
enumeration float 
Specifies the float datatype as it apples to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#float for more information.
enumeration date 
Specifies a date, which is usually in the form yyyy-mm--dd as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#date for more information.
enumeration positiveInteger 
Specifies a positive integer in the infinite set {1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#positiveInteger for more information.
enumeration unsignedInt 
Specifies an unsigned integer, which is a nonnegative integer in the set {0,1,2,...,4294967295} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedInt for more information.
enumeration dateTime 
Specifies a date in full format including both date and time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#dateTime for more information.
enumeration time 
Specifies a time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#time for more information.
enumeration boolean 
Specifies a boolean value in the set {true,false,1,0} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#boolean for more information.
enumeration name 
Specifies a name (which represents XML Names) as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#Name and http://www.w3.org/TR/2000/WD-xml-2e-20000814#dt-name for more information.
enumeration long 
Specifies a long integer, which is an integer whose maximum value is 9223372036854775807 and minimum value is -9223372036854775808 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#long for more information.
enumeration unsignedLong 
Specifies an unsigned long integer, which is an integer whose maximum value is 18446744073709551615 and minimum value is 0 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedLong for more information.
enumeration duration 
Specifies a length of time in the extended format PnYn MnDTnH nMnS, where nY represents the number of years, nM the number of months, nD the number of days, 'T' is the date/time separator, nH the number of hours, nM the number of minutes and nS the number of seconds, as it applies to the W3 standard. See http://www.w3.org/TR/xmlschema-2/#duration for more information.
enumeration double 
Specifies a decimal of datatype double as it is patterned after the IEEE double-precision 64-bit floating point type (IEEE 754-1985) and as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#double for more information.
enumeration nonNegativeInteger 
Specifies a non-negative integer in the infinite set {0,1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#nonNegativeInteger for more information.
enumeration hexBinary 
Specifies arbitrary hex-encoded binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#hexBinary for more information.
enumeration anyURI 
Specifies a Uniform Resource Identifier Reference (URI) as it applies to the W3C standard and to RFC 2396, as amended by RFC 2732. See http://www.w3.org/TR/xmlschema-2/#anyURI for more information.
enumeration base64Binary 
Specifies base64-encoded arbitrary binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#base64Binary for more information.
enumeration IPv4 Address 
Specifies an IPV4 address in dotted decimal form. CIDR notation is also accepted.
enumeration IPv6 Address 
Specifies an IPV6 address, which is represented by eight groups of 16-bit hexadecimal values separated by colons (:) in the form a:b:c:d:e:f:g:h. CIDR notation is also accepted.
enumeration Host Name 
Specifies a host name. For compatibility reasons, this could be any string. Even so, it is best to use the proper notation for the given host type. For example, web hostnames should be written as fully qualified hostnames in practice.
enumeration MAC Address 
Specifies a MAC address, which is represented by six groups of 2 hexdecimal digits, separated by hyphens (-) or colons (:) in transmission order.
enumeration Domain Name 
Specifies a domain name, which is represented by a series of labels concatenated with dots conforming to the rules in RFC 1035, RFC 1123, and RFC 2181.
enumeration URI 
Specifies a Uniform Resource Identifier, which identifies a name or resource and can act as a URL or URN.
enumeration TimeZone 
Specifies a timezone in UTC notation (UTC+number).
enumeration Octal 
Specifies arbitrary octal (base-8) encoded data.
enumeration Binary 
Specifies arbitrary binary encoded data.
enumeration BinHex 
Specifies arbitrary data encoded in the Mac OS-originated BinHex format.
enumeration Subnet Mask 
Specifies a subnet mask in IPv4 or IPv6 notation.
enumeration UUID/GUID 
Specifies a globally/universally unique ID represented as a 32-character hexadecimal string. See ISO/IEC 11578:1996 Information technology -- Open Systems Interconnection -- Remote Procedure Call - http://www.iso.ch/cate/d2229.html.
enumeration Collection 
Specifies data represented as a container of multiple data of a shared elemental type.
enumeration CVE ID 
Specifies a CVE ID, expressed as CVE- appended by a four-digit integer, a - and another four-digit integer, as in CVE-2012-1234.
enumeration CWE ID 
Specifies a CWE ID, expressed as CWE- appended by an integer.
enumeration CAPEC ID 
Specifies a CAPEC ID, expressed as CAPEC- appended by an integer.
enumeration CCE ID 
Specifies a CCE ID, expressed as CCE- appended by an integer.
enumeration CPE Name 
Specifies a CPE Name. See http://cpe.mitre.org/specification/archive/version2.0/cpe-specification_2.0.pdf for more information.
Used by
Source
 
<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" fixed="string">
  <xs:annotation>
    <xs:documentation>This attribute is optional and specifies the expected type for the value of the specified property.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:ToolInformationType / @id
Namespace No namespace
Annotations
 
The id field specifies a unique ID for this Tool.
Type xs:QName
Used by
Source
 
<xs:attribute name="id" type="xs:QName">
  <xs:annotation>
    <xs:documentation>The id field specifies a unique ID for this Tool.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:ToolInformationType / @idref
Namespace No namespace
Annotations
 
The idref field specifies reference to a unique ID for this Tool.
 
When idref is specified, the id attribute must not be specified, and any instance of this type should not hold content unless an extension of the type allows it.
Type xs:QName
Used by
Source
 
<xs:attribute name="idref" type="xs:QName">
  <xs:annotation>
    <xs:documentation>The idref field specifies reference to a unique ID for this Tool.</xs:documentation>
    <xs:documentation>When idref is specified, the id attribute must not be specified, and any instance of this type should not hold content unless an extension of the type allows it.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:MeasureSourceType / @class
Namespace No namespace
Annotations
 
The class field is optional and enables identification of the high-level class of this cyber observation source.
Type cyboxCommon:SourceClassTypeEnum
Facets
enumeration Network 
Describes a Network-based cyber observation.
enumeration System 
Describes a System-based cyber observation.
enumeration Software 
Describes a Software-based cyber observation.
Used by
Source
 
<xs:attribute name="class" type="cyboxCommon:SourceClassTypeEnum">
  <xs:annotation>
    <xs:documentation>The class field is optional and enables identification of the high-level class of this cyber observation source.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:MeasureSourceType / @source_type
Namespace No namespace
Annotations
 
The source_type field is optional and enables identification of the broad type of this cyber observation source.
Type cyboxCommon:SourceTypeEnum
Facets
enumeration Tool 
Describes a cyber observation made using various tools, such as scanners, firewalls, gateways, protection systems, and detection systems. See ToolTypeEnum for a more complete list of tools that CybOX supports.
enumeration Analysis 
Describes a cyber observation made from analysis methods, such as Static and Dynamic methods. See AnalysisMethodTypeEnum for a more complete list of methods that CybOX supports.
enumeration Information Source 
Describes a cyber observation made using other information sources, such as logs, Device Driver APIs, and TPM output data. See InformationSourceTypeEnum for a more complete list of information sources that CybOX supports.
Used by
Source
 
<xs:attribute name="source_type" type="cyboxCommon:SourceTypeEnum">
  <xs:annotation>
    <xs:documentation>The source_type field is optional and enables identification of the broad type of this cyber observation source.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:MeasureSourceType / @name
Namespace No namespace
Annotations
 
The name field is optional and enables the assignment of a relevant name to this Discovery Method.
Type xs:string
Used by
Source
 
<xs:attribute name="name" type="xs:string">
  <xs:annotation>
    <xs:documentation>The name field is optional and enables the assignment of a relevant name to this Discovery Method.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:MeasureSourceType / @sighting_count
Namespace No namespace
Annotations
 
The sighting_count field specifies how many different identical instances of a given Observable may have been seen/sighted by the observation source.
Type xs:positiveInteger
Used by
Source
 
<xs:attribute name="sighting_count" type="xs:positiveInteger">
  <xs:annotation>
    <xs:documentation>The sighting_count field specifies how many different identical instances of a given Observable may have been seen/sighted by the observation source.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:DataSizeType / @units
Namespace No namespace
Annotations
 
This field represents the Units used in the object size element.
Type cyboxCommon:DataSizeUnitsEnum
Facets
enumeration Bytes 
Specifies an object size in Bytes.
enumeration Kilobytes 
Specifies an object size in Kilobytes.
enumeration Megabytes 
Specifies an object size in Megabytes.
Used by
Source
 
<xs:attribute name="units" type="cyboxCommon:DataSizeUnitsEnum" use="required">
  <xs:annotation>
    <xs:documentation>This field represents the Units used in the object size element.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:EndiannessType / @datatype
Namespace No namespace
Annotations
 
This attribute is optional and specifies the expected type for the value of the specified property.
Type cyboxCommon:DatatypeEnum
Facets
enumeration string 
Specifies the string datatype as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#string for more information.
enumeration int 
Specifies the int datatype as it applies to the W3C standard for int. See http://www.w3.org/TR/xmlschema-2/#int for more information.
enumeration float 
Specifies the float datatype as it apples to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#float for more information.
enumeration date 
Specifies a date, which is usually in the form yyyy-mm--dd as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#date for more information.
enumeration positiveInteger 
Specifies a positive integer in the infinite set {1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#positiveInteger for more information.
enumeration unsignedInt 
Specifies an unsigned integer, which is a nonnegative integer in the set {0,1,2,...,4294967295} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedInt for more information.
enumeration dateTime 
Specifies a date in full format including both date and time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#dateTime for more information.
enumeration time 
Specifies a time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#time for more information.
enumeration boolean 
Specifies a boolean value in the set {true,false,1,0} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#boolean for more information.
enumeration name 
Specifies a name (which represents XML Names) as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#Name and http://www.w3.org/TR/2000/WD-xml-2e-20000814#dt-name for more information.
enumeration long 
Specifies a long integer, which is an integer whose maximum value is 9223372036854775807 and minimum value is -9223372036854775808 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#long for more information.
enumeration unsignedLong 
Specifies an unsigned long integer, which is an integer whose maximum value is 18446744073709551615 and minimum value is 0 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedLong for more information.
enumeration duration 
Specifies a length of time in the extended format PnYn MnDTnH nMnS, where nY represents the number of years, nM the number of months, nD the number of days, 'T' is the date/time separator, nH the number of hours, nM the number of minutes and nS the number of seconds, as it applies to the W3 standard. See http://www.w3.org/TR/xmlschema-2/#duration for more information.
enumeration double 
Specifies a decimal of datatype double as it is patterned after the IEEE double-precision 64-bit floating point type (IEEE 754-1985) and as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#double for more information.
enumeration nonNegativeInteger 
Specifies a non-negative integer in the infinite set {0,1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#nonNegativeInteger for more information.
enumeration hexBinary 
Specifies arbitrary hex-encoded binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#hexBinary for more information.
enumeration anyURI 
Specifies a Uniform Resource Identifier Reference (URI) as it applies to the W3C standard and to RFC 2396, as amended by RFC 2732. See http://www.w3.org/TR/xmlschema-2/#anyURI for more information.
enumeration base64Binary 
Specifies base64-encoded arbitrary binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#base64Binary for more information.
enumeration IPv4 Address 
Specifies an IPV4 address in dotted decimal form. CIDR notation is also accepted.
enumeration IPv6 Address 
Specifies an IPV6 address, which is represented by eight groups of 16-bit hexadecimal values separated by colons (:) in the form a:b:c:d:e:f:g:h. CIDR notation is also accepted.
enumeration Host Name 
Specifies a host name. For compatibility reasons, this could be any string. Even so, it is best to use the proper notation for the given host type. For example, web hostnames should be written as fully qualified hostnames in practice.
enumeration MAC Address 
Specifies a MAC address, which is represented by six groups of 2 hexdecimal digits, separated by hyphens (-) or colons (:) in transmission order.
enumeration Domain Name 
Specifies a domain name, which is represented by a series of labels concatenated with dots conforming to the rules in RFC 1035, RFC 1123, and RFC 2181.
enumeration URI 
Specifies a Uniform Resource Identifier, which identifies a name or resource and can act as a URL or URN.
enumeration TimeZone 
Specifies a timezone in UTC notation (UTC+number).
enumeration Octal 
Specifies arbitrary octal (base-8) encoded data.
enumeration Binary 
Specifies arbitrary binary encoded data.
enumeration BinHex 
Specifies arbitrary data encoded in the Mac OS-originated BinHex format.
enumeration Subnet Mask 
Specifies a subnet mask in IPv4 or IPv6 notation.
enumeration UUID/GUID 
Specifies a globally/universally unique ID represented as a 32-character hexadecimal string. See ISO/IEC 11578:1996 Information technology -- Open Systems Interconnection -- Remote Procedure Call - http://www.iso.ch/cate/d2229.html.
enumeration Collection 
Specifies data represented as a container of multiple data of a shared elemental type.
enumeration CVE ID 
Specifies a CVE ID, expressed as CVE- appended by a four-digit integer, a - and another four-digit integer, as in CVE-2012-1234.
enumeration CWE ID 
Specifies a CWE ID, expressed as CWE- appended by an integer.
enumeration CAPEC ID 
Specifies a CAPEC ID, expressed as CAPEC- appended by an integer.
enumeration CCE ID 
Specifies a CCE ID, expressed as CCE- appended by an integer.
enumeration CPE Name 
Specifies a CPE Name. See http://cpe.mitre.org/specification/archive/version2.0/cpe-specification_2.0.pdf for more information.
Used by
Source
 
<xs:attribute fixed="string" name="datatype" type="cyboxCommon:DatatypeEnum" use="optional">
  <xs:annotation>
    <xs:documentation>This attribute is optional and specifies the expected type for the value of the specified property.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:DataSegmentType / @id
Namespace No namespace
Annotations
 
The id field specifies a unique id for this data segment.
Type xs:QName
Used by
Source
 
<xs:attribute name="id" type="xs:QName">
  <xs:annotation>
    <xs:documentation>The id field specifies a unique id for this data segment.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:NameObjectPropertyType / @datatype
Namespace No namespace
Annotations
 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
Type cyboxCommon:DatatypeEnum
Facets
enumeration string 
Specifies the string datatype as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#string for more information.
enumeration int 
Specifies the int datatype as it applies to the W3C standard for int. See http://www.w3.org/TR/xmlschema-2/#int for more information.
enumeration float 
Specifies the float datatype as it apples to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#float for more information.
enumeration date 
Specifies a date, which is usually in the form yyyy-mm--dd as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#date for more information.
enumeration positiveInteger 
Specifies a positive integer in the infinite set {1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#positiveInteger for more information.
enumeration unsignedInt 
Specifies an unsigned integer, which is a nonnegative integer in the set {0,1,2,...,4294967295} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedInt for more information.
enumeration dateTime 
Specifies a date in full format including both date and time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#dateTime for more information.
enumeration time 
Specifies a time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#time for more information.
enumeration boolean 
Specifies a boolean value in the set {true,false,1,0} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#boolean for more information.
enumeration name 
Specifies a name (which represents XML Names) as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#Name and http://www.w3.org/TR/2000/WD-xml-2e-20000814#dt-name for more information.
enumeration long 
Specifies a long integer, which is an integer whose maximum value is 9223372036854775807 and minimum value is -9223372036854775808 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#long for more information.
enumeration unsignedLong 
Specifies an unsigned long integer, which is an integer whose maximum value is 18446744073709551615 and minimum value is 0 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedLong for more information.
enumeration duration 
Specifies a length of time in the extended format PnYn MnDTnH nMnS, where nY represents the number of years, nM the number of months, nD the number of days, 'T' is the date/time separator, nH the number of hours, nM the number of minutes and nS the number of seconds, as it applies to the W3 standard. See http://www.w3.org/TR/xmlschema-2/#duration for more information.
enumeration double 
Specifies a decimal of datatype double as it is patterned after the IEEE double-precision 64-bit floating point type (IEEE 754-1985) and as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#double for more information.
enumeration nonNegativeInteger 
Specifies a non-negative integer in the infinite set {0,1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#nonNegativeInteger for more information.
enumeration hexBinary 
Specifies arbitrary hex-encoded binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#hexBinary for more information.
enumeration anyURI 
Specifies a Uniform Resource Identifier Reference (URI) as it applies to the W3C standard and to RFC 2396, as amended by RFC 2732. See http://www.w3.org/TR/xmlschema-2/#anyURI for more information.
enumeration base64Binary 
Specifies base64-encoded arbitrary binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#base64Binary for more information.
enumeration IPv4 Address 
Specifies an IPV4 address in dotted decimal form. CIDR notation is also accepted.
enumeration IPv6 Address 
Specifies an IPV6 address, which is represented by eight groups of 16-bit hexadecimal values separated by colons (:) in the form a:b:c:d:e:f:g:h. CIDR notation is also accepted.
enumeration Host Name 
Specifies a host name. For compatibility reasons, this could be any string. Even so, it is best to use the proper notation for the given host type. For example, web hostnames should be written as fully qualified hostnames in practice.
enumeration MAC Address 
Specifies a MAC address, which is represented by six groups of 2 hexdecimal digits, separated by hyphens (-) or colons (:) in transmission order.
enumeration Domain Name 
Specifies a domain name, which is represented by a series of labels concatenated with dots conforming to the rules in RFC 1035, RFC 1123, and RFC 2181.
enumeration URI 
Specifies a Uniform Resource Identifier, which identifies a name or resource and can act as a URL or URN.
enumeration TimeZone 
Specifies a timezone in UTC notation (UTC+number).
enumeration Octal 
Specifies arbitrary octal (base-8) encoded data.
enumeration Binary 
Specifies arbitrary binary encoded data.
enumeration BinHex 
Specifies arbitrary data encoded in the Mac OS-originated BinHex format.
enumeration Subnet Mask 
Specifies a subnet mask in IPv4 or IPv6 notation.
enumeration UUID/GUID 
Specifies a globally/universally unique ID represented as a 32-character hexadecimal string. See ISO/IEC 11578:1996 Information technology -- Open Systems Interconnection -- Remote Procedure Call - http://www.iso.ch/cate/d2229.html.
enumeration Collection 
Specifies data represented as a container of multiple data of a shared elemental type.
enumeration CVE ID 
Specifies a CVE ID, expressed as CVE- appended by a four-digit integer, a - and another four-digit integer, as in CVE-2012-1234.
enumeration CWE ID 
Specifies a CWE ID, expressed as CWE- appended by an integer.
enumeration CAPEC ID 
Specifies a CAPEC ID, expressed as CAPEC- appended by an integer.
enumeration CCE ID 
Specifies a CCE ID, expressed as CCE- appended by an integer.
enumeration CPE Name 
Specifies a CPE Name. See http://cpe.mitre.org/specification/archive/version2.0/cpe-specification_2.0.pdf for more information.
Used by
Source
 
<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="name">
  <xs:annotation>
    <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:DateObjectPropertyRestrictionType / @datatype
Namespace No namespace
Annotations
 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
Type cyboxCommon:DatatypeEnum
Facets
enumeration string 
Specifies the string datatype as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#string for more information.
enumeration int 
Specifies the int datatype as it applies to the W3C standard for int. See http://www.w3.org/TR/xmlschema-2/#int for more information.
enumeration float 
Specifies the float datatype as it apples to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#float for more information.
enumeration date 
Specifies a date, which is usually in the form yyyy-mm--dd as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#date for more information.
enumeration positiveInteger 
Specifies a positive integer in the infinite set {1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#positiveInteger for more information.
enumeration unsignedInt 
Specifies an unsigned integer, which is a nonnegative integer in the set {0,1,2,...,4294967295} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedInt for more information.
enumeration dateTime 
Specifies a date in full format including both date and time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#dateTime for more information.
enumeration time 
Specifies a time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#time for more information.
enumeration boolean 
Specifies a boolean value in the set {true,false,1,0} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#boolean for more information.
enumeration name 
Specifies a name (which represents XML Names) as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#Name and http://www.w3.org/TR/2000/WD-xml-2e-20000814#dt-name for more information.
enumeration long 
Specifies a long integer, which is an integer whose maximum value is 9223372036854775807 and minimum value is -9223372036854775808 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#long for more information.
enumeration unsignedLong 
Specifies an unsigned long integer, which is an integer whose maximum value is 18446744073709551615 and minimum value is 0 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedLong for more information.
enumeration duration 
Specifies a length of time in the extended format PnYn MnDTnH nMnS, where nY represents the number of years, nM the number of months, nD the number of days, 'T' is the date/time separator, nH the number of hours, nM the number of minutes and nS the number of seconds, as it applies to the W3 standard. See http://www.w3.org/TR/xmlschema-2/#duration for more information.
enumeration double 
Specifies a decimal of datatype double as it is patterned after the IEEE double-precision 64-bit floating point type (IEEE 754-1985) and as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#double for more information.
enumeration nonNegativeInteger 
Specifies a non-negative integer in the infinite set {0,1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#nonNegativeInteger for more information.
enumeration hexBinary 
Specifies arbitrary hex-encoded binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#hexBinary for more information.
enumeration anyURI 
Specifies a Uniform Resource Identifier Reference (URI) as it applies to the W3C standard and to RFC 2396, as amended by RFC 2732. See http://www.w3.org/TR/xmlschema-2/#anyURI for more information.
enumeration base64Binary 
Specifies base64-encoded arbitrary binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#base64Binary for more information.
enumeration IPv4 Address 
Specifies an IPV4 address in dotted decimal form. CIDR notation is also accepted.
enumeration IPv6 Address 
Specifies an IPV6 address, which is represented by eight groups of 16-bit hexadecimal values separated by colons (:) in the form a:b:c:d:e:f:g:h. CIDR notation is also accepted.
enumeration Host Name 
Specifies a host name. For compatibility reasons, this could be any string. Even so, it is best to use the proper notation for the given host type. For example, web hostnames should be written as fully qualified hostnames in practice.
enumeration MAC Address 
Specifies a MAC address, which is represented by six groups of 2 hexdecimal digits, separated by hyphens (-) or colons (:) in transmission order.
enumeration Domain Name 
Specifies a domain name, which is represented by a series of labels concatenated with dots conforming to the rules in RFC 1035, RFC 1123, and RFC 2181.
enumeration URI 
Specifies a Uniform Resource Identifier, which identifies a name or resource and can act as a URL or URN.
enumeration TimeZone 
Specifies a timezone in UTC notation (UTC+number).
enumeration Octal 
Specifies arbitrary octal (base-8) encoded data.
enumeration Binary 
Specifies arbitrary binary encoded data.
enumeration BinHex 
Specifies arbitrary data encoded in the Mac OS-originated BinHex format.
enumeration Subnet Mask 
Specifies a subnet mask in IPv4 or IPv6 notation.
enumeration UUID/GUID 
Specifies a globally/universally unique ID represented as a 32-character hexadecimal string. See ISO/IEC 11578:1996 Information technology -- Open Systems Interconnection -- Remote Procedure Call - http://www.iso.ch/cate/d2229.html.
enumeration Collection 
Specifies data represented as a container of multiple data of a shared elemental type.
enumeration CVE ID 
Specifies a CVE ID, expressed as CVE- appended by a four-digit integer, a - and another four-digit integer, as in CVE-2012-1234.
enumeration CWE ID 
Specifies a CWE ID, expressed as CWE- appended by an integer.
enumeration CAPEC ID 
Specifies a CAPEC ID, expressed as CAPEC- appended by an integer.
enumeration CCE ID 
Specifies a CCE ID, expressed as CCE- appended by an integer.
enumeration CPE Name 
Specifies a CPE Name. See http://cpe.mitre.org/specification/archive/version2.0/cpe-specification_2.0.pdf for more information.
Used by
Source
 
<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="date">
  <xs:annotation>
    <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:DateObjectPropertyType / @precision
Namespace No namespace
Annotations
 
The precision of the associated time. If omitted, the default is "day", meaning the full field value. Digits in the date that are required by the xs:date datatype but are beyond the specified precision should be zeroed out.
 
When used in conjunction with CybOX patterning, the pattern should only be evaluated against the target up to the given precision.
Type cyboxCommon:DatePrecisionEnum
Facets
enumeration year 
Date is precise to the given year.
enumeration month 
Date is precise to the given month.
enumeration day 
Date is precise to the given day.
Used by
Source
 
<xs:attribute name="precision" type="cyboxCommon:DatePrecisionEnum" default="day">
  <xs:annotation>
    <xs:documentation>The precision of the associated time. If omitted, the default is "day", meaning the full field value. Digits in the date that are required by the xs:date datatype but are beyond the specified precision should be zeroed out.</xs:documentation>
    <xs:documentation>When used in conjunction with CybOX patterning, the pattern should only be evaluated against the target up to the given precision.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:DateTimeObjectPropertyRestrictionType / @datatype
Namespace No namespace
Annotations
 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
Type cyboxCommon:DatatypeEnum
Facets
enumeration string 
Specifies the string datatype as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#string for more information.
enumeration int 
Specifies the int datatype as it applies to the W3C standard for int. See http://www.w3.org/TR/xmlschema-2/#int for more information.
enumeration float 
Specifies the float datatype as it apples to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#float for more information.
enumeration date 
Specifies a date, which is usually in the form yyyy-mm--dd as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#date for more information.
enumeration positiveInteger 
Specifies a positive integer in the infinite set {1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#positiveInteger for more information.
enumeration unsignedInt 
Specifies an unsigned integer, which is a nonnegative integer in the set {0,1,2,...,4294967295} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedInt for more information.
enumeration dateTime 
Specifies a date in full format including both date and time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#dateTime for more information.
enumeration time 
Specifies a time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#time for more information.
enumeration boolean 
Specifies a boolean value in the set {true,false,1,0} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#boolean for more information.
enumeration name 
Specifies a name (which represents XML Names) as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#Name and http://www.w3.org/TR/2000/WD-xml-2e-20000814#dt-name for more information.
enumeration long 
Specifies a long integer, which is an integer whose maximum value is 9223372036854775807 and minimum value is -9223372036854775808 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#long for more information.
enumeration unsignedLong 
Specifies an unsigned long integer, which is an integer whose maximum value is 18446744073709551615 and minimum value is 0 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedLong for more information.
enumeration duration 
Specifies a length of time in the extended format PnYn MnDTnH nMnS, where nY represents the number of years, nM the number of months, nD the number of days, 'T' is the date/time separator, nH the number of hours, nM the number of minutes and nS the number of seconds, as it applies to the W3 standard. See http://www.w3.org/TR/xmlschema-2/#duration for more information.
enumeration double 
Specifies a decimal of datatype double as it is patterned after the IEEE double-precision 64-bit floating point type (IEEE 754-1985) and as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#double for more information.
enumeration nonNegativeInteger 
Specifies a non-negative integer in the infinite set {0,1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#nonNegativeInteger for more information.
enumeration hexBinary 
Specifies arbitrary hex-encoded binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#hexBinary for more information.
enumeration anyURI 
Specifies a Uniform Resource Identifier Reference (URI) as it applies to the W3C standard and to RFC 2396, as amended by RFC 2732. See http://www.w3.org/TR/xmlschema-2/#anyURI for more information.
enumeration base64Binary 
Specifies base64-encoded arbitrary binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#base64Binary for more information.
enumeration IPv4 Address 
Specifies an IPV4 address in dotted decimal form. CIDR notation is also accepted.
enumeration IPv6 Address 
Specifies an IPV6 address, which is represented by eight groups of 16-bit hexadecimal values separated by colons (:) in the form a:b:c:d:e:f:g:h. CIDR notation is also accepted.
enumeration Host Name 
Specifies a host name. For compatibility reasons, this could be any string. Even so, it is best to use the proper notation for the given host type. For example, web hostnames should be written as fully qualified hostnames in practice.
enumeration MAC Address 
Specifies a MAC address, which is represented by six groups of 2 hexdecimal digits, separated by hyphens (-) or colons (:) in transmission order.
enumeration Domain Name 
Specifies a domain name, which is represented by a series of labels concatenated with dots conforming to the rules in RFC 1035, RFC 1123, and RFC 2181.
enumeration URI 
Specifies a Uniform Resource Identifier, which identifies a name or resource and can act as a URL or URN.
enumeration TimeZone 
Specifies a timezone in UTC notation (UTC+number).
enumeration Octal 
Specifies arbitrary octal (base-8) encoded data.
enumeration Binary 
Specifies arbitrary binary encoded data.
enumeration BinHex 
Specifies arbitrary data encoded in the Mac OS-originated BinHex format.
enumeration Subnet Mask 
Specifies a subnet mask in IPv4 or IPv6 notation.
enumeration UUID/GUID 
Specifies a globally/universally unique ID represented as a 32-character hexadecimal string. See ISO/IEC 11578:1996 Information technology -- Open Systems Interconnection -- Remote Procedure Call - http://www.iso.ch/cate/d2229.html.
enumeration Collection 
Specifies data represented as a container of multiple data of a shared elemental type.
enumeration CVE ID 
Specifies a CVE ID, expressed as CVE- appended by a four-digit integer, a - and another four-digit integer, as in CVE-2012-1234.
enumeration CWE ID 
Specifies a CWE ID, expressed as CWE- appended by an integer.
enumeration CAPEC ID 
Specifies a CAPEC ID, expressed as CAPEC- appended by an integer.
enumeration CCE ID 
Specifies a CCE ID, expressed as CCE- appended by an integer.
enumeration CPE Name 
Specifies a CPE Name. See http://cpe.mitre.org/specification/archive/version2.0/cpe-specification_2.0.pdf for more information.
Used by
Source
 
<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="dateTime">
  <xs:annotation>
    <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:DateTimeObjectPropertyType / @precision
Namespace No namespace
Annotations
 
The precision of the associated time. If omitted, the default is "second", meaning the full field value (including fractional seconds). Digits in the dateTime that are required by the xs:dateTime datatype but are beyond the specified precision should be zeroed out.
 
When used in conjunction with CybOX patterning, the pattern should only be evaluated against the target up to the given precision.
Type cyboxCommon:DateTimePrecisionEnum
Used by
Source
 
<xs:attribute name="precision" type="cyboxCommon:DateTimePrecisionEnum" default="second">
  <xs:annotation>
    <xs:documentation>The precision of the associated time. If omitted, the default is "second", meaning the full field value (including fractional seconds). Digits in the dateTime that are required by the xs:dateTime datatype but are beyond the specified precision should be zeroed out.</xs:documentation>
    <xs:documentation>When used in conjunction with CybOX patterning, the pattern should only be evaluated against the target up to the given precision.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:FloatObjectPropertyType / @datatype
Namespace No namespace
Annotations
 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
Type cyboxCommon:DatatypeEnum
Facets
enumeration string 
Specifies the string datatype as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#string for more information.
enumeration int 
Specifies the int datatype as it applies to the W3C standard for int. See http://www.w3.org/TR/xmlschema-2/#int for more information.
enumeration float 
Specifies the float datatype as it apples to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#float for more information.
enumeration date 
Specifies a date, which is usually in the form yyyy-mm--dd as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#date for more information.
enumeration positiveInteger 
Specifies a positive integer in the infinite set {1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#positiveInteger for more information.
enumeration unsignedInt 
Specifies an unsigned integer, which is a nonnegative integer in the set {0,1,2,...,4294967295} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedInt for more information.
enumeration dateTime 
Specifies a date in full format including both date and time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#dateTime for more information.
enumeration time 
Specifies a time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#time for more information.
enumeration boolean 
Specifies a boolean value in the set {true,false,1,0} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#boolean for more information.
enumeration name 
Specifies a name (which represents XML Names) as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#Name and http://www.w3.org/TR/2000/WD-xml-2e-20000814#dt-name for more information.
enumeration long 
Specifies a long integer, which is an integer whose maximum value is 9223372036854775807 and minimum value is -9223372036854775808 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#long for more information.
enumeration unsignedLong 
Specifies an unsigned long integer, which is an integer whose maximum value is 18446744073709551615 and minimum value is 0 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedLong for more information.
enumeration duration 
Specifies a length of time in the extended format PnYn MnDTnH nMnS, where nY represents the number of years, nM the number of months, nD the number of days, 'T' is the date/time separator, nH the number of hours, nM the number of minutes and nS the number of seconds, as it applies to the W3 standard. See http://www.w3.org/TR/xmlschema-2/#duration for more information.
enumeration double 
Specifies a decimal of datatype double as it is patterned after the IEEE double-precision 64-bit floating point type (IEEE 754-1985) and as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#double for more information.
enumeration nonNegativeInteger 
Specifies a non-negative integer in the infinite set {0,1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#nonNegativeInteger for more information.
enumeration hexBinary 
Specifies arbitrary hex-encoded binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#hexBinary for more information.
enumeration anyURI 
Specifies a Uniform Resource Identifier Reference (URI) as it applies to the W3C standard and to RFC 2396, as amended by RFC 2732. See http://www.w3.org/TR/xmlschema-2/#anyURI for more information.
enumeration base64Binary 
Specifies base64-encoded arbitrary binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#base64Binary for more information.
enumeration IPv4 Address 
Specifies an IPV4 address in dotted decimal form. CIDR notation is also accepted.
enumeration IPv6 Address 
Specifies an IPV6 address, which is represented by eight groups of 16-bit hexadecimal values separated by colons (:) in the form a:b:c:d:e:f:g:h. CIDR notation is also accepted.
enumeration Host Name 
Specifies a host name. For compatibility reasons, this could be any string. Even so, it is best to use the proper notation for the given host type. For example, web hostnames should be written as fully qualified hostnames in practice.
enumeration MAC Address 
Specifies a MAC address, which is represented by six groups of 2 hexdecimal digits, separated by hyphens (-) or colons (:) in transmission order.
enumeration Domain Name 
Specifies a domain name, which is represented by a series of labels concatenated with dots conforming to the rules in RFC 1035, RFC 1123, and RFC 2181.
enumeration URI 
Specifies a Uniform Resource Identifier, which identifies a name or resource and can act as a URL or URN.
enumeration TimeZone 
Specifies a timezone in UTC notation (UTC+number).
enumeration Octal 
Specifies arbitrary octal (base-8) encoded data.
enumeration Binary 
Specifies arbitrary binary encoded data.
enumeration BinHex 
Specifies arbitrary data encoded in the Mac OS-originated BinHex format.
enumeration Subnet Mask 
Specifies a subnet mask in IPv4 or IPv6 notation.
enumeration UUID/GUID 
Specifies a globally/universally unique ID represented as a 32-character hexadecimal string. See ISO/IEC 11578:1996 Information technology -- Open Systems Interconnection -- Remote Procedure Call - http://www.iso.ch/cate/d2229.html.
enumeration Collection 
Specifies data represented as a container of multiple data of a shared elemental type.
enumeration CVE ID 
Specifies a CVE ID, expressed as CVE- appended by a four-digit integer, a - and another four-digit integer, as in CVE-2012-1234.
enumeration CWE ID 
Specifies a CWE ID, expressed as CWE- appended by an integer.
enumeration CAPEC ID 
Specifies a CAPEC ID, expressed as CAPEC- appended by an integer.
enumeration CCE ID 
Specifies a CCE ID, expressed as CCE- appended by an integer.
enumeration CPE Name 
Specifies a CPE Name. See http://cpe.mitre.org/specification/archive/version2.0/cpe-specification_2.0.pdf for more information.
Used by
Source
 
<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="float">
  <xs:annotation>
    <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:DoubleObjectPropertyType / @datatype
Namespace No namespace
Annotations
 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
Type cyboxCommon:DatatypeEnum
Facets
enumeration string 
Specifies the string datatype as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#string for more information.
enumeration int 
Specifies the int datatype as it applies to the W3C standard for int. See http://www.w3.org/TR/xmlschema-2/#int for more information.
enumeration float 
Specifies the float datatype as it apples to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#float for more information.
enumeration date 
Specifies a date, which is usually in the form yyyy-mm--dd as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#date for more information.
enumeration positiveInteger 
Specifies a positive integer in the infinite set {1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#positiveInteger for more information.
enumeration unsignedInt 
Specifies an unsigned integer, which is a nonnegative integer in the set {0,1,2,...,4294967295} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedInt for more information.
enumeration dateTime 
Specifies a date in full format including both date and time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#dateTime for more information.
enumeration time 
Specifies a time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#time for more information.
enumeration boolean 
Specifies a boolean value in the set {true,false,1,0} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#boolean for more information.
enumeration name 
Specifies a name (which represents XML Names) as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#Name and http://www.w3.org/TR/2000/WD-xml-2e-20000814#dt-name for more information.
enumeration long 
Specifies a long integer, which is an integer whose maximum value is 9223372036854775807 and minimum value is -9223372036854775808 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#long for more information.
enumeration unsignedLong 
Specifies an unsigned long integer, which is an integer whose maximum value is 18446744073709551615 and minimum value is 0 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedLong for more information.
enumeration duration 
Specifies a length of time in the extended format PnYn MnDTnH nMnS, where nY represents the number of years, nM the number of months, nD the number of days, 'T' is the date/time separator, nH the number of hours, nM the number of minutes and nS the number of seconds, as it applies to the W3 standard. See http://www.w3.org/TR/xmlschema-2/#duration for more information.
enumeration double 
Specifies a decimal of datatype double as it is patterned after the IEEE double-precision 64-bit floating point type (IEEE 754-1985) and as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#double for more information.
enumeration nonNegativeInteger 
Specifies a non-negative integer in the infinite set {0,1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#nonNegativeInteger for more information.
enumeration hexBinary 
Specifies arbitrary hex-encoded binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#hexBinary for more information.
enumeration anyURI 
Specifies a Uniform Resource Identifier Reference (URI) as it applies to the W3C standard and to RFC 2396, as amended by RFC 2732. See http://www.w3.org/TR/xmlschema-2/#anyURI for more information.
enumeration base64Binary 
Specifies base64-encoded arbitrary binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#base64Binary for more information.
enumeration IPv4 Address 
Specifies an IPV4 address in dotted decimal form. CIDR notation is also accepted.
enumeration IPv6 Address 
Specifies an IPV6 address, which is represented by eight groups of 16-bit hexadecimal values separated by colons (:) in the form a:b:c:d:e:f:g:h. CIDR notation is also accepted.
enumeration Host Name 
Specifies a host name. For compatibility reasons, this could be any string. Even so, it is best to use the proper notation for the given host type. For example, web hostnames should be written as fully qualified hostnames in practice.
enumeration MAC Address 
Specifies a MAC address, which is represented by six groups of 2 hexdecimal digits, separated by hyphens (-) or colons (:) in transmission order.
enumeration Domain Name 
Specifies a domain name, which is represented by a series of labels concatenated with dots conforming to the rules in RFC 1035, RFC 1123, and RFC 2181.
enumeration URI 
Specifies a Uniform Resource Identifier, which identifies a name or resource and can act as a URL or URN.
enumeration TimeZone 
Specifies a timezone in UTC notation (UTC+number).
enumeration Octal 
Specifies arbitrary octal (base-8) encoded data.
enumeration Binary 
Specifies arbitrary binary encoded data.
enumeration BinHex 
Specifies arbitrary data encoded in the Mac OS-originated BinHex format.
enumeration Subnet Mask 
Specifies a subnet mask in IPv4 or IPv6 notation.
enumeration UUID/GUID 
Specifies a globally/universally unique ID represented as a 32-character hexadecimal string. See ISO/IEC 11578:1996 Information technology -- Open Systems Interconnection -- Remote Procedure Call - http://www.iso.ch/cate/d2229.html.
enumeration Collection 
Specifies data represented as a container of multiple data of a shared elemental type.
enumeration CVE ID 
Specifies a CVE ID, expressed as CVE- appended by a four-digit integer, a - and another four-digit integer, as in CVE-2012-1234.
enumeration CWE ID 
Specifies a CWE ID, expressed as CWE- appended by an integer.
enumeration CAPEC ID 
Specifies a CAPEC ID, expressed as CAPEC- appended by an integer.
enumeration CCE ID 
Specifies a CCE ID, expressed as CCE- appended by an integer.
enumeration CPE Name 
Specifies a CPE Name. See http://cpe.mitre.org/specification/archive/version2.0/cpe-specification_2.0.pdf for more information.
Used by
Source
 
<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="double">
  <xs:annotation>
    <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:UnsignedLongObjectPropertyType / @datatype
Namespace No namespace
Annotations
 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
Type cyboxCommon:DatatypeEnum
Facets
enumeration string 
Specifies the string datatype as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#string for more information.
enumeration int 
Specifies the int datatype as it applies to the W3C standard for int. See http://www.w3.org/TR/xmlschema-2/#int for more information.
enumeration float 
Specifies the float datatype as it apples to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#float for more information.
enumeration date 
Specifies a date, which is usually in the form yyyy-mm--dd as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#date for more information.
enumeration positiveInteger 
Specifies a positive integer in the infinite set {1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#positiveInteger for more information.
enumeration unsignedInt 
Specifies an unsigned integer, which is a nonnegative integer in the set {0,1,2,...,4294967295} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedInt for more information.
enumeration dateTime 
Specifies a date in full format including both date and time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#dateTime for more information.
enumeration time 
Specifies a time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#time for more information.
enumeration boolean 
Specifies a boolean value in the set {true,false,1,0} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#boolean for more information.
enumeration name 
Specifies a name (which represents XML Names) as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#Name and http://www.w3.org/TR/2000/WD-xml-2e-20000814#dt-name for more information.
enumeration long 
Specifies a long integer, which is an integer whose maximum value is 9223372036854775807 and minimum value is -9223372036854775808 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#long for more information.
enumeration unsignedLong 
Specifies an unsigned long integer, which is an integer whose maximum value is 18446744073709551615 and minimum value is 0 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedLong for more information.
enumeration duration 
Specifies a length of time in the extended format PnYn MnDTnH nMnS, where nY represents the number of years, nM the number of months, nD the number of days, 'T' is the date/time separator, nH the number of hours, nM the number of minutes and nS the number of seconds, as it applies to the W3 standard. See http://www.w3.org/TR/xmlschema-2/#duration for more information.
enumeration double 
Specifies a decimal of datatype double as it is patterned after the IEEE double-precision 64-bit floating point type (IEEE 754-1985) and as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#double for more information.
enumeration nonNegativeInteger 
Specifies a non-negative integer in the infinite set {0,1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#nonNegativeInteger for more information.
enumeration hexBinary 
Specifies arbitrary hex-encoded binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#hexBinary for more information.
enumeration anyURI 
Specifies a Uniform Resource Identifier Reference (URI) as it applies to the W3C standard and to RFC 2396, as amended by RFC 2732. See http://www.w3.org/TR/xmlschema-2/#anyURI for more information.
enumeration base64Binary 
Specifies base64-encoded arbitrary binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#base64Binary for more information.
enumeration IPv4 Address 
Specifies an IPV4 address in dotted decimal form. CIDR notation is also accepted.
enumeration IPv6 Address 
Specifies an IPV6 address, which is represented by eight groups of 16-bit hexadecimal values separated by colons (:) in the form a:b:c:d:e:f:g:h. CIDR notation is also accepted.
enumeration Host Name 
Specifies a host name. For compatibility reasons, this could be any string. Even so, it is best to use the proper notation for the given host type. For example, web hostnames should be written as fully qualified hostnames in practice.
enumeration MAC Address 
Specifies a MAC address, which is represented by six groups of 2 hexdecimal digits, separated by hyphens (-) or colons (:) in transmission order.
enumeration Domain Name 
Specifies a domain name, which is represented by a series of labels concatenated with dots conforming to the rules in RFC 1035, RFC 1123, and RFC 2181.
enumeration URI 
Specifies a Uniform Resource Identifier, which identifies a name or resource and can act as a URL or URN.
enumeration TimeZone 
Specifies a timezone in UTC notation (UTC+number).
enumeration Octal 
Specifies arbitrary octal (base-8) encoded data.
enumeration Binary 
Specifies arbitrary binary encoded data.
enumeration BinHex 
Specifies arbitrary data encoded in the Mac OS-originated BinHex format.
enumeration Subnet Mask 
Specifies a subnet mask in IPv4 or IPv6 notation.
enumeration UUID/GUID 
Specifies a globally/universally unique ID represented as a 32-character hexadecimal string. See ISO/IEC 11578:1996 Information technology -- Open Systems Interconnection -- Remote Procedure Call - http://www.iso.ch/cate/d2229.html.
enumeration Collection 
Specifies data represented as a container of multiple data of a shared elemental type.
enumeration CVE ID 
Specifies a CVE ID, expressed as CVE- appended by a four-digit integer, a - and another four-digit integer, as in CVE-2012-1234.
enumeration CWE ID 
Specifies a CWE ID, expressed as CWE- appended by an integer.
enumeration CAPEC ID 
Specifies a CAPEC ID, expressed as CAPEC- appended by an integer.
enumeration CCE ID 
Specifies a CCE ID, expressed as CCE- appended by an integer.
enumeration CPE Name 
Specifies a CPE Name. See http://cpe.mitre.org/specification/archive/version2.0/cpe-specification_2.0.pdf for more information.
Used by
Source
 
<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="unsignedLong">
  <xs:annotation>
    <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:UnsignedIntegerObjectPropertyType / @datatype
Namespace No namespace
Annotations
 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
Type cyboxCommon:DatatypeEnum
Facets
enumeration string 
Specifies the string datatype as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#string for more information.
enumeration int 
Specifies the int datatype as it applies to the W3C standard for int. See http://www.w3.org/TR/xmlschema-2/#int for more information.
enumeration float 
Specifies the float datatype as it apples to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#float for more information.
enumeration date 
Specifies a date, which is usually in the form yyyy-mm--dd as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#date for more information.
enumeration positiveInteger 
Specifies a positive integer in the infinite set {1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#positiveInteger for more information.
enumeration unsignedInt 
Specifies an unsigned integer, which is a nonnegative integer in the set {0,1,2,...,4294967295} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedInt for more information.
enumeration dateTime 
Specifies a date in full format including both date and time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#dateTime for more information.
enumeration time 
Specifies a time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#time for more information.
enumeration boolean 
Specifies a boolean value in the set {true,false,1,0} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#boolean for more information.
enumeration name 
Specifies a name (which represents XML Names) as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#Name and http://www.w3.org/TR/2000/WD-xml-2e-20000814#dt-name for more information.
enumeration long 
Specifies a long integer, which is an integer whose maximum value is 9223372036854775807 and minimum value is -9223372036854775808 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#long for more information.
enumeration unsignedLong 
Specifies an unsigned long integer, which is an integer whose maximum value is 18446744073709551615 and minimum value is 0 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedLong for more information.
enumeration duration 
Specifies a length of time in the extended format PnYn MnDTnH nMnS, where nY represents the number of years, nM the number of months, nD the number of days, 'T' is the date/time separator, nH the number of hours, nM the number of minutes and nS the number of seconds, as it applies to the W3 standard. See http://www.w3.org/TR/xmlschema-2/#duration for more information.
enumeration double 
Specifies a decimal of datatype double as it is patterned after the IEEE double-precision 64-bit floating point type (IEEE 754-1985) and as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#double for more information.
enumeration nonNegativeInteger 
Specifies a non-negative integer in the infinite set {0,1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#nonNegativeInteger for more information.
enumeration hexBinary 
Specifies arbitrary hex-encoded binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#hexBinary for more information.
enumeration anyURI 
Specifies a Uniform Resource Identifier Reference (URI) as it applies to the W3C standard and to RFC 2396, as amended by RFC 2732. See http://www.w3.org/TR/xmlschema-2/#anyURI for more information.
enumeration base64Binary 
Specifies base64-encoded arbitrary binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#base64Binary for more information.
enumeration IPv4 Address 
Specifies an IPV4 address in dotted decimal form. CIDR notation is also accepted.
enumeration IPv6 Address 
Specifies an IPV6 address, which is represented by eight groups of 16-bit hexadecimal values separated by colons (:) in the form a:b:c:d:e:f:g:h. CIDR notation is also accepted.
enumeration Host Name 
Specifies a host name. For compatibility reasons, this could be any string. Even so, it is best to use the proper notation for the given host type. For example, web hostnames should be written as fully qualified hostnames in practice.
enumeration MAC Address 
Specifies a MAC address, which is represented by six groups of 2 hexdecimal digits, separated by hyphens (-) or colons (:) in transmission order.
enumeration Domain Name 
Specifies a domain name, which is represented by a series of labels concatenated with dots conforming to the rules in RFC 1035, RFC 1123, and RFC 2181.
enumeration URI 
Specifies a Uniform Resource Identifier, which identifies a name or resource and can act as a URL or URN.
enumeration TimeZone 
Specifies a timezone in UTC notation (UTC+number).
enumeration Octal 
Specifies arbitrary octal (base-8) encoded data.
enumeration Binary 
Specifies arbitrary binary encoded data.
enumeration BinHex 
Specifies arbitrary data encoded in the Mac OS-originated BinHex format.
enumeration Subnet Mask 
Specifies a subnet mask in IPv4 or IPv6 notation.
enumeration UUID/GUID 
Specifies a globally/universally unique ID represented as a 32-character hexadecimal string. See ISO/IEC 11578:1996 Information technology -- Open Systems Interconnection -- Remote Procedure Call - http://www.iso.ch/cate/d2229.html.
enumeration Collection 
Specifies data represented as a container of multiple data of a shared elemental type.
enumeration CVE ID 
Specifies a CVE ID, expressed as CVE- appended by a four-digit integer, a - and another four-digit integer, as in CVE-2012-1234.
enumeration CWE ID 
Specifies a CWE ID, expressed as CWE- appended by an integer.
enumeration CAPEC ID 
Specifies a CAPEC ID, expressed as CAPEC- appended by an integer.
enumeration CCE ID 
Specifies a CCE ID, expressed as CCE- appended by an integer.
enumeration CPE Name 
Specifies a CPE Name. See http://cpe.mitre.org/specification/archive/version2.0/cpe-specification_2.0.pdf for more information.
Used by
Source
 
<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="unsignedInt">
  <xs:annotation>
    <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:PositiveIntegerObjectPropertyType / @datatype
Namespace No namespace
Annotations
 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
Type cyboxCommon:DatatypeEnum
Facets
enumeration string 
Specifies the string datatype as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#string for more information.
enumeration int 
Specifies the int datatype as it applies to the W3C standard for int. See http://www.w3.org/TR/xmlschema-2/#int for more information.
enumeration float 
Specifies the float datatype as it apples to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#float for more information.
enumeration date 
Specifies a date, which is usually in the form yyyy-mm--dd as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#date for more information.
enumeration positiveInteger 
Specifies a positive integer in the infinite set {1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#positiveInteger for more information.
enumeration unsignedInt 
Specifies an unsigned integer, which is a nonnegative integer in the set {0,1,2,...,4294967295} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedInt for more information.
enumeration dateTime 
Specifies a date in full format including both date and time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#dateTime for more information.
enumeration time 
Specifies a time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#time for more information.
enumeration boolean 
Specifies a boolean value in the set {true,false,1,0} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#boolean for more information.
enumeration name 
Specifies a name (which represents XML Names) as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#Name and http://www.w3.org/TR/2000/WD-xml-2e-20000814#dt-name for more information.
enumeration long 
Specifies a long integer, which is an integer whose maximum value is 9223372036854775807 and minimum value is -9223372036854775808 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#long for more information.
enumeration unsignedLong 
Specifies an unsigned long integer, which is an integer whose maximum value is 18446744073709551615 and minimum value is 0 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedLong for more information.
enumeration duration 
Specifies a length of time in the extended format PnYn MnDTnH nMnS, where nY represents the number of years, nM the number of months, nD the number of days, 'T' is the date/time separator, nH the number of hours, nM the number of minutes and nS the number of seconds, as it applies to the W3 standard. See http://www.w3.org/TR/xmlschema-2/#duration for more information.
enumeration double 
Specifies a decimal of datatype double as it is patterned after the IEEE double-precision 64-bit floating point type (IEEE 754-1985) and as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#double for more information.
enumeration nonNegativeInteger 
Specifies a non-negative integer in the infinite set {0,1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#nonNegativeInteger for more information.
enumeration hexBinary 
Specifies arbitrary hex-encoded binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#hexBinary for more information.
enumeration anyURI 
Specifies a Uniform Resource Identifier Reference (URI) as it applies to the W3C standard and to RFC 2396, as amended by RFC 2732. See http://www.w3.org/TR/xmlschema-2/#anyURI for more information.
enumeration base64Binary 
Specifies base64-encoded arbitrary binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#base64Binary for more information.
enumeration IPv4 Address 
Specifies an IPV4 address in dotted decimal form. CIDR notation is also accepted.
enumeration IPv6 Address 
Specifies an IPV6 address, which is represented by eight groups of 16-bit hexadecimal values separated by colons (:) in the form a:b:c:d:e:f:g:h. CIDR notation is also accepted.
enumeration Host Name 
Specifies a host name. For compatibility reasons, this could be any string. Even so, it is best to use the proper notation for the given host type. For example, web hostnames should be written as fully qualified hostnames in practice.
enumeration MAC Address 
Specifies a MAC address, which is represented by six groups of 2 hexdecimal digits, separated by hyphens (-) or colons (:) in transmission order.
enumeration Domain Name 
Specifies a domain name, which is represented by a series of labels concatenated with dots conforming to the rules in RFC 1035, RFC 1123, and RFC 2181.
enumeration URI 
Specifies a Uniform Resource Identifier, which identifies a name or resource and can act as a URL or URN.
enumeration TimeZone 
Specifies a timezone in UTC notation (UTC+number).
enumeration Octal 
Specifies arbitrary octal (base-8) encoded data.
enumeration Binary 
Specifies arbitrary binary encoded data.
enumeration BinHex 
Specifies arbitrary data encoded in the Mac OS-originated BinHex format.
enumeration Subnet Mask 
Specifies a subnet mask in IPv4 or IPv6 notation.
enumeration UUID/GUID 
Specifies a globally/universally unique ID represented as a 32-character hexadecimal string. See ISO/IEC 11578:1996 Information technology -- Open Systems Interconnection -- Remote Procedure Call - http://www.iso.ch/cate/d2229.html.
enumeration Collection 
Specifies data represented as a container of multiple data of a shared elemental type.
enumeration CVE ID 
Specifies a CVE ID, expressed as CVE- appended by a four-digit integer, a - and another four-digit integer, as in CVE-2012-1234.
enumeration CWE ID 
Specifies a CWE ID, expressed as CWE- appended by an integer.
enumeration CAPEC ID 
Specifies a CAPEC ID, expressed as CAPEC- appended by an integer.
enumeration CCE ID 
Specifies a CCE ID, expressed as CCE- appended by an integer.
enumeration CPE Name 
Specifies a CPE Name. See http://cpe.mitre.org/specification/archive/version2.0/cpe-specification_2.0.pdf for more information.
Used by
Source
 
<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="positiveInteger">
  <xs:annotation>
    <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:LongObjectPropertyType / @datatype
Namespace No namespace
Annotations
 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
Type cyboxCommon:DatatypeEnum
Facets
enumeration string 
Specifies the string datatype as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#string for more information.
enumeration int 
Specifies the int datatype as it applies to the W3C standard for int. See http://www.w3.org/TR/xmlschema-2/#int for more information.
enumeration float 
Specifies the float datatype as it apples to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#float for more information.
enumeration date 
Specifies a date, which is usually in the form yyyy-mm--dd as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#date for more information.
enumeration positiveInteger 
Specifies a positive integer in the infinite set {1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#positiveInteger for more information.
enumeration unsignedInt 
Specifies an unsigned integer, which is a nonnegative integer in the set {0,1,2,...,4294967295} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedInt for more information.
enumeration dateTime 
Specifies a date in full format including both date and time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#dateTime for more information.
enumeration time 
Specifies a time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#time for more information.
enumeration boolean 
Specifies a boolean value in the set {true,false,1,0} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#boolean for more information.
enumeration name 
Specifies a name (which represents XML Names) as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#Name and http://www.w3.org/TR/2000/WD-xml-2e-20000814#dt-name for more information.
enumeration long 
Specifies a long integer, which is an integer whose maximum value is 9223372036854775807 and minimum value is -9223372036854775808 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#long for more information.
enumeration unsignedLong 
Specifies an unsigned long integer, which is an integer whose maximum value is 18446744073709551615 and minimum value is 0 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedLong for more information.
enumeration duration 
Specifies a length of time in the extended format PnYn MnDTnH nMnS, where nY represents the number of years, nM the number of months, nD the number of days, 'T' is the date/time separator, nH the number of hours, nM the number of minutes and nS the number of seconds, as it applies to the W3 standard. See http://www.w3.org/TR/xmlschema-2/#duration for more information.
enumeration double 
Specifies a decimal of datatype double as it is patterned after the IEEE double-precision 64-bit floating point type (IEEE 754-1985) and as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#double for more information.
enumeration nonNegativeInteger 
Specifies a non-negative integer in the infinite set {0,1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#nonNegativeInteger for more information.
enumeration hexBinary 
Specifies arbitrary hex-encoded binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#hexBinary for more information.
enumeration anyURI 
Specifies a Uniform Resource Identifier Reference (URI) as it applies to the W3C standard and to RFC 2396, as amended by RFC 2732. See http://www.w3.org/TR/xmlschema-2/#anyURI for more information.
enumeration base64Binary 
Specifies base64-encoded arbitrary binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#base64Binary for more information.
enumeration IPv4 Address 
Specifies an IPV4 address in dotted decimal form. CIDR notation is also accepted.
enumeration IPv6 Address 
Specifies an IPV6 address, which is represented by eight groups of 16-bit hexadecimal values separated by colons (:) in the form a:b:c:d:e:f:g:h. CIDR notation is also accepted.
enumeration Host Name 
Specifies a host name. For compatibility reasons, this could be any string. Even so, it is best to use the proper notation for the given host type. For example, web hostnames should be written as fully qualified hostnames in practice.
enumeration MAC Address 
Specifies a MAC address, which is represented by six groups of 2 hexdecimal digits, separated by hyphens (-) or colons (:) in transmission order.
enumeration Domain Name 
Specifies a domain name, which is represented by a series of labels concatenated with dots conforming to the rules in RFC 1035, RFC 1123, and RFC 2181.
enumeration URI 
Specifies a Uniform Resource Identifier, which identifies a name or resource and can act as a URL or URN.
enumeration TimeZone 
Specifies a timezone in UTC notation (UTC+number).
enumeration Octal 
Specifies arbitrary octal (base-8) encoded data.
enumeration Binary 
Specifies arbitrary binary encoded data.
enumeration BinHex 
Specifies arbitrary data encoded in the Mac OS-originated BinHex format.
enumeration Subnet Mask 
Specifies a subnet mask in IPv4 or IPv6 notation.
enumeration UUID/GUID 
Specifies a globally/universally unique ID represented as a 32-character hexadecimal string. See ISO/IEC 11578:1996 Information technology -- Open Systems Interconnection -- Remote Procedure Call - http://www.iso.ch/cate/d2229.html.
enumeration Collection 
Specifies data represented as a container of multiple data of a shared elemental type.
enumeration CVE ID 
Specifies a CVE ID, expressed as CVE- appended by a four-digit integer, a - and another four-digit integer, as in CVE-2012-1234.
enumeration CWE ID 
Specifies a CWE ID, expressed as CWE- appended by an integer.
enumeration CAPEC ID 
Specifies a CAPEC ID, expressed as CAPEC- appended by an integer.
enumeration CCE ID 
Specifies a CCE ID, expressed as CCE- appended by an integer.
enumeration CPE Name 
Specifies a CPE Name. See http://cpe.mitre.org/specification/archive/version2.0/cpe-specification_2.0.pdf for more information.
Used by
Source
 
<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="long">
  <xs:annotation>
    <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:NonNegativeIntegerObjectPropertyType / @datatype
Namespace No namespace
Annotations
 
This attribute is optional and specifies the expected type for the value of the specified property.
Type cyboxCommon:DatatypeEnum
Facets
enumeration string 
Specifies the string datatype as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#string for more information.
enumeration int 
Specifies the int datatype as it applies to the W3C standard for int. See http://www.w3.org/TR/xmlschema-2/#int for more information.
enumeration float 
Specifies the float datatype as it apples to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#float for more information.
enumeration date 
Specifies a date, which is usually in the form yyyy-mm--dd as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#date for more information.
enumeration positiveInteger 
Specifies a positive integer in the infinite set {1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#positiveInteger for more information.
enumeration unsignedInt 
Specifies an unsigned integer, which is a nonnegative integer in the set {0,1,2,...,4294967295} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedInt for more information.
enumeration dateTime 
Specifies a date in full format including both date and time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#dateTime for more information.
enumeration time 
Specifies a time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#time for more information.
enumeration boolean 
Specifies a boolean value in the set {true,false,1,0} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#boolean for more information.
enumeration name 
Specifies a name (which represents XML Names) as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#Name and http://www.w3.org/TR/2000/WD-xml-2e-20000814#dt-name for more information.
enumeration long 
Specifies a long integer, which is an integer whose maximum value is 9223372036854775807 and minimum value is -9223372036854775808 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#long for more information.
enumeration unsignedLong 
Specifies an unsigned long integer, which is an integer whose maximum value is 18446744073709551615 and minimum value is 0 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedLong for more information.
enumeration duration 
Specifies a length of time in the extended format PnYn MnDTnH nMnS, where nY represents the number of years, nM the number of months, nD the number of days, 'T' is the date/time separator, nH the number of hours, nM the number of minutes and nS the number of seconds, as it applies to the W3 standard. See http://www.w3.org/TR/xmlschema-2/#duration for more information.
enumeration double 
Specifies a decimal of datatype double as it is patterned after the IEEE double-precision 64-bit floating point type (IEEE 754-1985) and as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#double for more information.
enumeration nonNegativeInteger 
Specifies a non-negative integer in the infinite set {0,1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#nonNegativeInteger for more information.
enumeration hexBinary 
Specifies arbitrary hex-encoded binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#hexBinary for more information.
enumeration anyURI 
Specifies a Uniform Resource Identifier Reference (URI) as it applies to the W3C standard and to RFC 2396, as amended by RFC 2732. See http://www.w3.org/TR/xmlschema-2/#anyURI for more information.
enumeration base64Binary 
Specifies base64-encoded arbitrary binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#base64Binary for more information.
enumeration IPv4 Address 
Specifies an IPV4 address in dotted decimal form. CIDR notation is also accepted.
enumeration IPv6 Address 
Specifies an IPV6 address, which is represented by eight groups of 16-bit hexadecimal values separated by colons (:) in the form a:b:c:d:e:f:g:h. CIDR notation is also accepted.
enumeration Host Name 
Specifies a host name. For compatibility reasons, this could be any string. Even so, it is best to use the proper notation for the given host type. For example, web hostnames should be written as fully qualified hostnames in practice.
enumeration MAC Address 
Specifies a MAC address, which is represented by six groups of 2 hexdecimal digits, separated by hyphens (-) or colons (:) in transmission order.
enumeration Domain Name 
Specifies a domain name, which is represented by a series of labels concatenated with dots conforming to the rules in RFC 1035, RFC 1123, and RFC 2181.
enumeration URI 
Specifies a Uniform Resource Identifier, which identifies a name or resource and can act as a URL or URN.
enumeration TimeZone 
Specifies a timezone in UTC notation (UTC+number).
enumeration Octal 
Specifies arbitrary octal (base-8) encoded data.
enumeration Binary 
Specifies arbitrary binary encoded data.
enumeration BinHex 
Specifies arbitrary data encoded in the Mac OS-originated BinHex format.
enumeration Subnet Mask 
Specifies a subnet mask in IPv4 or IPv6 notation.
enumeration UUID/GUID 
Specifies a globally/universally unique ID represented as a 32-character hexadecimal string. See ISO/IEC 11578:1996 Information technology -- Open Systems Interconnection -- Remote Procedure Call - http://www.iso.ch/cate/d2229.html.
enumeration Collection 
Specifies data represented as a container of multiple data of a shared elemental type.
enumeration CVE ID 
Specifies a CVE ID, expressed as CVE- appended by a four-digit integer, a - and another four-digit integer, as in CVE-2012-1234.
enumeration CWE ID 
Specifies a CWE ID, expressed as CWE- appended by an integer.
enumeration CAPEC ID 
Specifies a CAPEC ID, expressed as CAPEC- appended by an integer.
enumeration CCE ID 
Specifies a CCE ID, expressed as CCE- appended by an integer.
enumeration CPE Name 
Specifies a CPE Name. See http://cpe.mitre.org/specification/archive/version2.0/cpe-specification_2.0.pdf for more information.
Used by
Source
 
<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" fixed="nonNegativeInteger">
  <xs:annotation>
    <xs:documentation>This attribute is optional and specifies the expected type for the value of the specified property.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:AnyURIObjectPropertyType / @datatype
Namespace No namespace
Annotations
 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
Type cyboxCommon:DatatypeEnum
Facets
enumeration string 
Specifies the string datatype as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#string for more information.
enumeration int 
Specifies the int datatype as it applies to the W3C standard for int. See http://www.w3.org/TR/xmlschema-2/#int for more information.
enumeration float 
Specifies the float datatype as it apples to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#float for more information.
enumeration date 
Specifies a date, which is usually in the form yyyy-mm--dd as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#date for more information.
enumeration positiveInteger 
Specifies a positive integer in the infinite set {1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#positiveInteger for more information.
enumeration unsignedInt 
Specifies an unsigned integer, which is a nonnegative integer in the set {0,1,2,...,4294967295} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedInt for more information.
enumeration dateTime 
Specifies a date in full format including both date and time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#dateTime for more information.
enumeration time 
Specifies a time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#time for more information.
enumeration boolean 
Specifies a boolean value in the set {true,false,1,0} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#boolean for more information.
enumeration name 
Specifies a name (which represents XML Names) as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#Name and http://www.w3.org/TR/2000/WD-xml-2e-20000814#dt-name for more information.
enumeration long 
Specifies a long integer, which is an integer whose maximum value is 9223372036854775807 and minimum value is -9223372036854775808 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#long for more information.
enumeration unsignedLong 
Specifies an unsigned long integer, which is an integer whose maximum value is 18446744073709551615 and minimum value is 0 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedLong for more information.
enumeration duration 
Specifies a length of time in the extended format PnYn MnDTnH nMnS, where nY represents the number of years, nM the number of months, nD the number of days, 'T' is the date/time separator, nH the number of hours, nM the number of minutes and nS the number of seconds, as it applies to the W3 standard. See http://www.w3.org/TR/xmlschema-2/#duration for more information.
enumeration double 
Specifies a decimal of datatype double as it is patterned after the IEEE double-precision 64-bit floating point type (IEEE 754-1985) and as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#double for more information.
enumeration nonNegativeInteger 
Specifies a non-negative integer in the infinite set {0,1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#nonNegativeInteger for more information.
enumeration hexBinary 
Specifies arbitrary hex-encoded binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#hexBinary for more information.
enumeration anyURI 
Specifies a Uniform Resource Identifier Reference (URI) as it applies to the W3C standard and to RFC 2396, as amended by RFC 2732. See http://www.w3.org/TR/xmlschema-2/#anyURI for more information.
enumeration base64Binary 
Specifies base64-encoded arbitrary binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#base64Binary for more information.
enumeration IPv4 Address 
Specifies an IPV4 address in dotted decimal form. CIDR notation is also accepted.
enumeration IPv6 Address 
Specifies an IPV6 address, which is represented by eight groups of 16-bit hexadecimal values separated by colons (:) in the form a:b:c:d:e:f:g:h. CIDR notation is also accepted.
enumeration Host Name 
Specifies a host name. For compatibility reasons, this could be any string. Even so, it is best to use the proper notation for the given host type. For example, web hostnames should be written as fully qualified hostnames in practice.
enumeration MAC Address 
Specifies a MAC address, which is represented by six groups of 2 hexdecimal digits, separated by hyphens (-) or colons (:) in transmission order.
enumeration Domain Name 
Specifies a domain name, which is represented by a series of labels concatenated with dots conforming to the rules in RFC 1035, RFC 1123, and RFC 2181.
enumeration URI 
Specifies a Uniform Resource Identifier, which identifies a name or resource and can act as a URL or URN.
enumeration TimeZone 
Specifies a timezone in UTC notation (UTC+number).
enumeration Octal 
Specifies arbitrary octal (base-8) encoded data.
enumeration Binary 
Specifies arbitrary binary encoded data.
enumeration BinHex 
Specifies arbitrary data encoded in the Mac OS-originated BinHex format.
enumeration Subnet Mask 
Specifies a subnet mask in IPv4 or IPv6 notation.
enumeration UUID/GUID 
Specifies a globally/universally unique ID represented as a 32-character hexadecimal string. See ISO/IEC 11578:1996 Information technology -- Open Systems Interconnection -- Remote Procedure Call - http://www.iso.ch/cate/d2229.html.
enumeration Collection 
Specifies data represented as a container of multiple data of a shared elemental type.
enumeration CVE ID 
Specifies a CVE ID, expressed as CVE- appended by a four-digit integer, a - and another four-digit integer, as in CVE-2012-1234.
enumeration CWE ID 
Specifies a CWE ID, expressed as CWE- appended by an integer.
enumeration CAPEC ID 
Specifies a CAPEC ID, expressed as CAPEC- appended by an integer.
enumeration CCE ID 
Specifies a CCE ID, expressed as CCE- appended by an integer.
enumeration CPE Name 
Specifies a CPE Name. See http://cpe.mitre.org/specification/archive/version2.0/cpe-specification_2.0.pdf for more information.
Used by
Source
 
<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="anyURI">
  <xs:annotation>
    <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:DurationObjectPropertyType / @datatype
Namespace No namespace
Annotations
 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
Type cyboxCommon:DatatypeEnum
Facets
enumeration string 
Specifies the string datatype as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#string for more information.
enumeration int 
Specifies the int datatype as it applies to the W3C standard for int. See http://www.w3.org/TR/xmlschema-2/#int for more information.
enumeration float 
Specifies the float datatype as it apples to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#float for more information.
enumeration date 
Specifies a date, which is usually in the form yyyy-mm--dd as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#date for more information.
enumeration positiveInteger 
Specifies a positive integer in the infinite set {1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#positiveInteger for more information.
enumeration unsignedInt 
Specifies an unsigned integer, which is a nonnegative integer in the set {0,1,2,...,4294967295} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedInt for more information.
enumeration dateTime 
Specifies a date in full format including both date and time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#dateTime for more information.
enumeration time 
Specifies a time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#time for more information.
enumeration boolean 
Specifies a boolean value in the set {true,false,1,0} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#boolean for more information.
enumeration name 
Specifies a name (which represents XML Names) as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#Name and http://www.w3.org/TR/2000/WD-xml-2e-20000814#dt-name for more information.
enumeration long 
Specifies a long integer, which is an integer whose maximum value is 9223372036854775807 and minimum value is -9223372036854775808 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#long for more information.
enumeration unsignedLong 
Specifies an unsigned long integer, which is an integer whose maximum value is 18446744073709551615 and minimum value is 0 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedLong for more information.
enumeration duration 
Specifies a length of time in the extended format PnYn MnDTnH nMnS, where nY represents the number of years, nM the number of months, nD the number of days, 'T' is the date/time separator, nH the number of hours, nM the number of minutes and nS the number of seconds, as it applies to the W3 standard. See http://www.w3.org/TR/xmlschema-2/#duration for more information.
enumeration double 
Specifies a decimal of datatype double as it is patterned after the IEEE double-precision 64-bit floating point type (IEEE 754-1985) and as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#double for more information.
enumeration nonNegativeInteger 
Specifies a non-negative integer in the infinite set {0,1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#nonNegativeInteger for more information.
enumeration hexBinary 
Specifies arbitrary hex-encoded binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#hexBinary for more information.
enumeration anyURI 
Specifies a Uniform Resource Identifier Reference (URI) as it applies to the W3C standard and to RFC 2396, as amended by RFC 2732. See http://www.w3.org/TR/xmlschema-2/#anyURI for more information.
enumeration base64Binary 
Specifies base64-encoded arbitrary binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#base64Binary for more information.
enumeration IPv4 Address 
Specifies an IPV4 address in dotted decimal form. CIDR notation is also accepted.
enumeration IPv6 Address 
Specifies an IPV6 address, which is represented by eight groups of 16-bit hexadecimal values separated by colons (:) in the form a:b:c:d:e:f:g:h. CIDR notation is also accepted.
enumeration Host Name 
Specifies a host name. For compatibility reasons, this could be any string. Even so, it is best to use the proper notation for the given host type. For example, web hostnames should be written as fully qualified hostnames in practice.
enumeration MAC Address 
Specifies a MAC address, which is represented by six groups of 2 hexdecimal digits, separated by hyphens (-) or colons (:) in transmission order.
enumeration Domain Name 
Specifies a domain name, which is represented by a series of labels concatenated with dots conforming to the rules in RFC 1035, RFC 1123, and RFC 2181.
enumeration URI 
Specifies a Uniform Resource Identifier, which identifies a name or resource and can act as a URL or URN.
enumeration TimeZone 
Specifies a timezone in UTC notation (UTC+number).
enumeration Octal 
Specifies arbitrary octal (base-8) encoded data.
enumeration Binary 
Specifies arbitrary binary encoded data.
enumeration BinHex 
Specifies arbitrary data encoded in the Mac OS-originated BinHex format.
enumeration Subnet Mask 
Specifies a subnet mask in IPv4 or IPv6 notation.
enumeration UUID/GUID 
Specifies a globally/universally unique ID represented as a 32-character hexadecimal string. See ISO/IEC 11578:1996 Information technology -- Open Systems Interconnection -- Remote Procedure Call - http://www.iso.ch/cate/d2229.html.
enumeration Collection 
Specifies data represented as a container of multiple data of a shared elemental type.
enumeration CVE ID 
Specifies a CVE ID, expressed as CVE- appended by a four-digit integer, a - and another four-digit integer, as in CVE-2012-1234.
enumeration CWE ID 
Specifies a CWE ID, expressed as CWE- appended by an integer.
enumeration CAPEC ID 
Specifies a CAPEC ID, expressed as CAPEC- appended by an integer.
enumeration CCE ID 
Specifies a CCE ID, expressed as CCE- appended by an integer.
enumeration CPE Name 
Specifies a CPE Name. See http://cpe.mitre.org/specification/archive/version2.0/cpe-specification_2.0.pdf for more information.
Used by
Source
 
<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="duration">
  <xs:annotation>
    <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:TimeObjectPropertyRestrictionType / @datatype
Namespace No namespace
Annotations
 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
Type cyboxCommon:DatatypeEnum
Facets
enumeration string 
Specifies the string datatype as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#string for more information.
enumeration int 
Specifies the int datatype as it applies to the W3C standard for int. See http://www.w3.org/TR/xmlschema-2/#int for more information.
enumeration float 
Specifies the float datatype as it apples to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#float for more information.
enumeration date 
Specifies a date, which is usually in the form yyyy-mm--dd as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#date for more information.
enumeration positiveInteger 
Specifies a positive integer in the infinite set {1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#positiveInteger for more information.
enumeration unsignedInt 
Specifies an unsigned integer, which is a nonnegative integer in the set {0,1,2,...,4294967295} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedInt for more information.
enumeration dateTime 
Specifies a date in full format including both date and time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#dateTime for more information.
enumeration time 
Specifies a time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#time for more information.
enumeration boolean 
Specifies a boolean value in the set {true,false,1,0} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#boolean for more information.
enumeration name 
Specifies a name (which represents XML Names) as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#Name and http://www.w3.org/TR/2000/WD-xml-2e-20000814#dt-name for more information.
enumeration long 
Specifies a long integer, which is an integer whose maximum value is 9223372036854775807 and minimum value is -9223372036854775808 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#long for more information.
enumeration unsignedLong 
Specifies an unsigned long integer, which is an integer whose maximum value is 18446744073709551615 and minimum value is 0 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedLong for more information.
enumeration duration 
Specifies a length of time in the extended format PnYn MnDTnH nMnS, where nY represents the number of years, nM the number of months, nD the number of days, 'T' is the date/time separator, nH the number of hours, nM the number of minutes and nS the number of seconds, as it applies to the W3 standard. See http://www.w3.org/TR/xmlschema-2/#duration for more information.
enumeration double 
Specifies a decimal of datatype double as it is patterned after the IEEE double-precision 64-bit floating point type (IEEE 754-1985) and as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#double for more information.
enumeration nonNegativeInteger 
Specifies a non-negative integer in the infinite set {0,1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#nonNegativeInteger for more information.
enumeration hexBinary 
Specifies arbitrary hex-encoded binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#hexBinary for more information.
enumeration anyURI 
Specifies a Uniform Resource Identifier Reference (URI) as it applies to the W3C standard and to RFC 2396, as amended by RFC 2732. See http://www.w3.org/TR/xmlschema-2/#anyURI for more information.
enumeration base64Binary 
Specifies base64-encoded arbitrary binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#base64Binary for more information.
enumeration IPv4 Address 
Specifies an IPV4 address in dotted decimal form. CIDR notation is also accepted.
enumeration IPv6 Address 
Specifies an IPV6 address, which is represented by eight groups of 16-bit hexadecimal values separated by colons (:) in the form a:b:c:d:e:f:g:h. CIDR notation is also accepted.
enumeration Host Name 
Specifies a host name. For compatibility reasons, this could be any string. Even so, it is best to use the proper notation for the given host type. For example, web hostnames should be written as fully qualified hostnames in practice.
enumeration MAC Address 
Specifies a MAC address, which is represented by six groups of 2 hexdecimal digits, separated by hyphens (-) or colons (:) in transmission order.
enumeration Domain Name 
Specifies a domain name, which is represented by a series of labels concatenated with dots conforming to the rules in RFC 1035, RFC 1123, and RFC 2181.
enumeration URI 
Specifies a Uniform Resource Identifier, which identifies a name or resource and can act as a URL or URN.
enumeration TimeZone 
Specifies a timezone in UTC notation (UTC+number).
enumeration Octal 
Specifies arbitrary octal (base-8) encoded data.
enumeration Binary 
Specifies arbitrary binary encoded data.
enumeration BinHex 
Specifies arbitrary data encoded in the Mac OS-originated BinHex format.
enumeration Subnet Mask 
Specifies a subnet mask in IPv4 or IPv6 notation.
enumeration UUID/GUID 
Specifies a globally/universally unique ID represented as a 32-character hexadecimal string. See ISO/IEC 11578:1996 Information technology -- Open Systems Interconnection -- Remote Procedure Call - http://www.iso.ch/cate/d2229.html.
enumeration Collection 
Specifies data represented as a container of multiple data of a shared elemental type.
enumeration CVE ID 
Specifies a CVE ID, expressed as CVE- appended by a four-digit integer, a - and another four-digit integer, as in CVE-2012-1234.
enumeration CWE ID 
Specifies a CWE ID, expressed as CWE- appended by an integer.
enumeration CAPEC ID 
Specifies a CAPEC ID, expressed as CAPEC- appended by an integer.
enumeration CCE ID 
Specifies a CCE ID, expressed as CCE- appended by an integer.
enumeration CPE Name 
Specifies a CPE Name. See http://cpe.mitre.org/specification/archive/version2.0/cpe-specification_2.0.pdf for more information.
Used by
Source
 
<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="time">
  <xs:annotation>
    <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:TimeObjectPropertyType / @precision
Namespace No namespace
Annotations
 
The precision of the associated time. If omitted, the default is "second", meaning the full field value (including fractional seconds). Digits in the time that are required by the xs:time datatype but are beyond the specified precision should be zeroed out.
 
When used in conjunction with CybOX patterning, the pattern should only be evaluated against the target up to the given precision.
Type cyboxCommon:TimePrecisionEnum
Facets
enumeration hour 
Time is precise to the given hour.
enumeration minute 
Time is precise to the given minute.
enumeration second 
Time is precise to the given second (including fractional seconds).
Used by
Source
 
<xs:attribute name="precision" type="cyboxCommon:TimePrecisionEnum" default="second">
  <xs:annotation>
    <xs:documentation>The precision of the associated time. If omitted, the default is "second", meaning the full field value (including fractional seconds). Digits in the time that are required by the xs:time datatype but are beyond the specified precision should be zeroed out.</xs:documentation>
    <xs:documentation>When used in conjunction with CybOX patterning, the pattern should only be evaluated against the target up to the given precision.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:Base64BinaryObjectPropertyType / @datatype
Namespace No namespace
Annotations
 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
Type cyboxCommon:DatatypeEnum
Facets
enumeration string 
Specifies the string datatype as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#string for more information.
enumeration int 
Specifies the int datatype as it applies to the W3C standard for int. See http://www.w3.org/TR/xmlschema-2/#int for more information.
enumeration float 
Specifies the float datatype as it apples to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#float for more information.
enumeration date 
Specifies a date, which is usually in the form yyyy-mm--dd as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#date for more information.
enumeration positiveInteger 
Specifies a positive integer in the infinite set {1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#positiveInteger for more information.
enumeration unsignedInt 
Specifies an unsigned integer, which is a nonnegative integer in the set {0,1,2,...,4294967295} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedInt for more information.
enumeration dateTime 
Specifies a date in full format including both date and time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#dateTime for more information.
enumeration time 
Specifies a time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#time for more information.
enumeration boolean 
Specifies a boolean value in the set {true,false,1,0} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#boolean for more information.
enumeration name 
Specifies a name (which represents XML Names) as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#Name and http://www.w3.org/TR/2000/WD-xml-2e-20000814#dt-name for more information.
enumeration long 
Specifies a long integer, which is an integer whose maximum value is 9223372036854775807 and minimum value is -9223372036854775808 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#long for more information.
enumeration unsignedLong 
Specifies an unsigned long integer, which is an integer whose maximum value is 18446744073709551615 and minimum value is 0 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedLong for more information.
enumeration duration 
Specifies a length of time in the extended format PnYn MnDTnH nMnS, where nY represents the number of years, nM the number of months, nD the number of days, 'T' is the date/time separator, nH the number of hours, nM the number of minutes and nS the number of seconds, as it applies to the W3 standard. See http://www.w3.org/TR/xmlschema-2/#duration for more information.
enumeration double 
Specifies a decimal of datatype double as it is patterned after the IEEE double-precision 64-bit floating point type (IEEE 754-1985) and as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#double for more information.
enumeration nonNegativeInteger 
Specifies a non-negative integer in the infinite set {0,1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#nonNegativeInteger for more information.
enumeration hexBinary 
Specifies arbitrary hex-encoded binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#hexBinary for more information.
enumeration anyURI 
Specifies a Uniform Resource Identifier Reference (URI) as it applies to the W3C standard and to RFC 2396, as amended by RFC 2732. See http://www.w3.org/TR/xmlschema-2/#anyURI for more information.
enumeration base64Binary 
Specifies base64-encoded arbitrary binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#base64Binary for more information.
enumeration IPv4 Address 
Specifies an IPV4 address in dotted decimal form. CIDR notation is also accepted.
enumeration IPv6 Address 
Specifies an IPV6 address, which is represented by eight groups of 16-bit hexadecimal values separated by colons (:) in the form a:b:c:d:e:f:g:h. CIDR notation is also accepted.
enumeration Host Name 
Specifies a host name. For compatibility reasons, this could be any string. Even so, it is best to use the proper notation for the given host type. For example, web hostnames should be written as fully qualified hostnames in practice.
enumeration MAC Address 
Specifies a MAC address, which is represented by six groups of 2 hexdecimal digits, separated by hyphens (-) or colons (:) in transmission order.
enumeration Domain Name 
Specifies a domain name, which is represented by a series of labels concatenated with dots conforming to the rules in RFC 1035, RFC 1123, and RFC 2181.
enumeration URI 
Specifies a Uniform Resource Identifier, which identifies a name or resource and can act as a URL or URN.
enumeration TimeZone 
Specifies a timezone in UTC notation (UTC+number).
enumeration Octal 
Specifies arbitrary octal (base-8) encoded data.
enumeration Binary 
Specifies arbitrary binary encoded data.
enumeration BinHex 
Specifies arbitrary data encoded in the Mac OS-originated BinHex format.
enumeration Subnet Mask 
Specifies a subnet mask in IPv4 or IPv6 notation.
enumeration UUID/GUID 
Specifies a globally/universally unique ID represented as a 32-character hexadecimal string. See ISO/IEC 11578:1996 Information technology -- Open Systems Interconnection -- Remote Procedure Call - http://www.iso.ch/cate/d2229.html.
enumeration Collection 
Specifies data represented as a container of multiple data of a shared elemental type.
enumeration CVE ID 
Specifies a CVE ID, expressed as CVE- appended by a four-digit integer, a - and another four-digit integer, as in CVE-2012-1234.
enumeration CWE ID 
Specifies a CWE ID, expressed as CWE- appended by an integer.
enumeration CAPEC ID 
Specifies a CAPEC ID, expressed as CAPEC- appended by an integer.
enumeration CCE ID 
Specifies a CCE ID, expressed as CCE- appended by an integer.
enumeration CPE Name 
Specifies a CPE Name. See http://cpe.mitre.org/specification/archive/version2.0/cpe-specification_2.0.pdf for more information.
Used by
Source
 
<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="base64Binary">
  <xs:annotation>
    <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:DigitalSignatureInfoType / @signature_exists
Namespace No namespace
Annotations
 
Specifies whether the digital signature exists.
Type xs:boolean
Used by
Source
 
<xs:attribute name="signature_exists" type="xs:boolean">
  <xs:annotation>
    <xs:documentation>Specifies whether the digital signature exists.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:DigitalSignatureInfoType / @signature_verified
Namespace No namespace
Annotations
 
Specifies if the digital signature is verified.
Type xs:boolean
Used by
Source
 
<xs:attribute name="signature_verified" type="xs:boolean">
  <xs:annotation>
    <xs:documentation>Specifies if the digital signature is verified.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:SIDType / @datatype
Namespace No namespace
Annotations
 
This attribute is optional and specifies the expected type for the value of the specified property.
Type cyboxCommon:DatatypeEnum
Facets
enumeration string 
Specifies the string datatype as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#string for more information.
enumeration int 
Specifies the int datatype as it applies to the W3C standard for int. See http://www.w3.org/TR/xmlschema-2/#int for more information.
enumeration float 
Specifies the float datatype as it apples to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#float for more information.
enumeration date 
Specifies a date, which is usually in the form yyyy-mm--dd as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#date for more information.
enumeration positiveInteger 
Specifies a positive integer in the infinite set {1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#positiveInteger for more information.
enumeration unsignedInt 
Specifies an unsigned integer, which is a nonnegative integer in the set {0,1,2,...,4294967295} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedInt for more information.
enumeration dateTime 
Specifies a date in full format including both date and time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#dateTime for more information.
enumeration time 
Specifies a time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#time for more information.
enumeration boolean 
Specifies a boolean value in the set {true,false,1,0} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#boolean for more information.
enumeration name 
Specifies a name (which represents XML Names) as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#Name and http://www.w3.org/TR/2000/WD-xml-2e-20000814#dt-name for more information.
enumeration long 
Specifies a long integer, which is an integer whose maximum value is 9223372036854775807 and minimum value is -9223372036854775808 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#long for more information.
enumeration unsignedLong 
Specifies an unsigned long integer, which is an integer whose maximum value is 18446744073709551615 and minimum value is 0 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedLong for more information.
enumeration duration 
Specifies a length of time in the extended format PnYn MnDTnH nMnS, where nY represents the number of years, nM the number of months, nD the number of days, 'T' is the date/time separator, nH the number of hours, nM the number of minutes and nS the number of seconds, as it applies to the W3 standard. See http://www.w3.org/TR/xmlschema-2/#duration for more information.
enumeration double 
Specifies a decimal of datatype double as it is patterned after the IEEE double-precision 64-bit floating point type (IEEE 754-1985) and as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#double for more information.
enumeration nonNegativeInteger 
Specifies a non-negative integer in the infinite set {0,1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#nonNegativeInteger for more information.
enumeration hexBinary 
Specifies arbitrary hex-encoded binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#hexBinary for more information.
enumeration anyURI 
Specifies a Uniform Resource Identifier Reference (URI) as it applies to the W3C standard and to RFC 2396, as amended by RFC 2732. See http://www.w3.org/TR/xmlschema-2/#anyURI for more information.
enumeration base64Binary 
Specifies base64-encoded arbitrary binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#base64Binary for more information.
enumeration IPv4 Address 
Specifies an IPV4 address in dotted decimal form. CIDR notation is also accepted.
enumeration IPv6 Address 
Specifies an IPV6 address, which is represented by eight groups of 16-bit hexadecimal values separated by colons (:) in the form a:b:c:d:e:f:g:h. CIDR notation is also accepted.
enumeration Host Name 
Specifies a host name. For compatibility reasons, this could be any string. Even so, it is best to use the proper notation for the given host type. For example, web hostnames should be written as fully qualified hostnames in practice.
enumeration MAC Address 
Specifies a MAC address, which is represented by six groups of 2 hexdecimal digits, separated by hyphens (-) or colons (:) in transmission order.
enumeration Domain Name 
Specifies a domain name, which is represented by a series of labels concatenated with dots conforming to the rules in RFC 1035, RFC 1123, and RFC 2181.
enumeration URI 
Specifies a Uniform Resource Identifier, which identifies a name or resource and can act as a URL or URN.
enumeration TimeZone 
Specifies a timezone in UTC notation (UTC+number).
enumeration Octal 
Specifies arbitrary octal (base-8) encoded data.
enumeration Binary 
Specifies arbitrary binary encoded data.
enumeration BinHex 
Specifies arbitrary data encoded in the Mac OS-originated BinHex format.
enumeration Subnet Mask 
Specifies a subnet mask in IPv4 or IPv6 notation.
enumeration UUID/GUID 
Specifies a globally/universally unique ID represented as a 32-character hexadecimal string. See ISO/IEC 11578:1996 Information technology -- Open Systems Interconnection -- Remote Procedure Call - http://www.iso.ch/cate/d2229.html.
enumeration Collection 
Specifies data represented as a container of multiple data of a shared elemental type.
enumeration CVE ID 
Specifies a CVE ID, expressed as CVE- appended by a four-digit integer, a - and another four-digit integer, as in CVE-2012-1234.
enumeration CWE ID 
Specifies a CWE ID, expressed as CWE- appended by an integer.
enumeration CAPEC ID 
Specifies a CAPEC ID, expressed as CAPEC- appended by an integer.
enumeration CCE ID 
Specifies a CCE ID, expressed as CCE- appended by an integer.
enumeration CPE Name 
Specifies a CPE Name. See http://cpe.mitre.org/specification/archive/version2.0/cpe-specification_2.0.pdf for more information.
Used by
Complex Type cyboxCommon:SIDType
Source
 
<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" use="optional" fixed="string">
  <xs:annotation>
    <xs:documentation>This attribute is optional and specifies the expected type for the value of the specified property.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute cyboxCommon:Layer4ProtocolType / @datatype
Namespace No namespace
Annotations
 
This attribute is optional and specifies the expected type for the value of the specified property.
Type cyboxCommon:DatatypeEnum
Facets
enumeration string 
Specifies the string datatype as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#string for more information.
enumeration int 
Specifies the int datatype as it applies to the W3C standard for int. See http://www.w3.org/TR/xmlschema-2/#int for more information.
enumeration float 
Specifies the float datatype as it apples to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#float for more information.
enumeration date 
Specifies a date, which is usually in the form yyyy-mm--dd as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#date for more information.
enumeration positiveInteger 
Specifies a positive integer in the infinite set {1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#positiveInteger for more information.
enumeration unsignedInt 
Specifies an unsigned integer, which is a nonnegative integer in the set {0,1,2,...,4294967295} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedInt for more information.
enumeration dateTime 
Specifies a date in full format including both date and time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#dateTime for more information.
enumeration time 
Specifies a time as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#time for more information.
enumeration boolean 
Specifies a boolean value in the set {true,false,1,0} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#boolean for more information.
enumeration name 
Specifies a name (which represents XML Names) as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#Name and http://www.w3.org/TR/2000/WD-xml-2e-20000814#dt-name for more information.
enumeration long 
Specifies a long integer, which is an integer whose maximum value is 9223372036854775807 and minimum value is -9223372036854775808 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#long for more information.
enumeration unsignedLong 
Specifies an unsigned long integer, which is an integer whose maximum value is 18446744073709551615 and minimum value is 0 as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#unsignedLong for more information.
enumeration duration 
Specifies a length of time in the extended format PnYn MnDTnH nMnS, where nY represents the number of years, nM the number of months, nD the number of days, 'T' is the date/time separator, nH the number of hours, nM the number of minutes and nS the number of seconds, as it applies to the W3 standard. See http://www.w3.org/TR/xmlschema-2/#duration for more information.
enumeration double 
Specifies a decimal of datatype double as it is patterned after the IEEE double-precision 64-bit floating point type (IEEE 754-1985) and as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#double for more information.
enumeration nonNegativeInteger 
Specifies a non-negative integer in the infinite set {0,1,2,...} as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#nonNegativeInteger for more information.
enumeration hexBinary 
Specifies arbitrary hex-encoded binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#hexBinary for more information.
enumeration anyURI 
Specifies a Uniform Resource Identifier Reference (URI) as it applies to the W3C standard and to RFC 2396, as amended by RFC 2732. See http://www.w3.org/TR/xmlschema-2/#anyURI for more information.
enumeration base64Binary 
Specifies base64-encoded arbitrary binary data as it applies to the W3C standard. See http://www.w3.org/TR/xmlschema-2/#base64Binary for more information.
enumeration IPv4 Address 
Specifies an IPV4 address in dotted decimal form. CIDR notation is also accepted.
enumeration IPv6 Address 
Specifies an IPV6 address, which is represented by eight groups of 16-bit hexadecimal values separated by colons (:) in the form a:b:c:d:e:f:g:h. CIDR notation is also accepted.
enumeration Host Name 
Specifies a host name. For compatibility reasons, this could be any string. Even so, it is best to use the proper notation for the given host type. For example, web hostnames should be written as fully qualified hostnames in practice.
enumeration MAC Address 
Specifies a MAC address, which is represented by six groups of 2 hexdecimal digits, separated by hyphens (-) or colons (:) in transmission order.
enumeration Domain Name 
Specifies a domain name, which is represented by a series of labels concatenated with dots conforming to the rules in RFC 1035, RFC 1123, and RFC 2181.
enumeration URI 
Specifies a Uniform Resource Identifier, which identifies a name or resource and can act as a URL or URN.
enumeration TimeZone 
Specifies a timezone in UTC notation (UTC+number).
enumeration Octal 
Specifies arbitrary octal (base-8) encoded data.
enumeration Binary 
Specifies arbitrary binary encoded data.
enumeration BinHex 
Specifies arbitrary data encoded in the Mac OS-originated BinHex format.
enumeration Subnet Mask 
Specifies a subnet mask in IPv4 or IPv6 notation.
enumeration UUID/GUID 
Specifies a globally/universally unique ID represented as a 32-character hexadecimal string. See ISO/IEC 11578:1996 Information technology -- Open Systems Interconnection -- Remote Procedure Call - http://www.iso.ch/cate/d2229.html.
enumeration Collection 
Specifies data represented as a container of multiple data of a shared elemental type.
enumeration CVE ID 
Specifies a CVE ID, expressed as CVE- appended by a four-digit integer, a - and another four-digit integer, as in CVE-2012-1234.
enumeration CWE ID 
Specifies a CWE ID, expressed as CWE- appended by an integer.
enumeration CAPEC ID 
Specifies a CAPEC ID, expressed as CAPEC- appended by an integer.
enumeration CCE ID 
Specifies a CCE ID, expressed as CCE- appended by an integer.
enumeration CPE Name 
Specifies a CPE Name. See http://cpe.mitre.org/specification/archive/version2.0/cpe-specification_2.0.pdf for more information.
Used by
Source
 
<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" use="optional" fixed="string">
  <xs:annotation>
    <xs:documentation>This attribute is optional and specifies the expected type for the value of the specified property.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute Group cyboxCommon:PatternFieldGroup
Namespace http://cybox.mitre.org/common-2
Annotations
 
The PatternFieldGroup is a simple field group aggregating a set of fields for application of patterns.
Diagram
Diagram cybox_common_xsd.tmp#PatternFieldGroup_condition cybox_common_xsd.tmp#PatternFieldGroup_is_case_sensitive cybox_common_xsd.tmp#PatternFieldGroup_apply_condition cybox_common_xsd.tmp#PatternFieldGroup_delimiter cybox_common_xsd.tmp#PatternFieldGroup_bit_mask cybox_common_xsd.tmp#PatternFieldGroup_pattern_type cybox_common_xsd.tmp#PatternFieldGroup_regex_syntax cybox_common_xsd.tmp#PatternFieldGroup_has_changed cybox_common_xsd.tmp#PatternFieldGroup_trend
Used by
Attributes
QName Type Default Use Annotation
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:attributeGroup name="PatternFieldGroup">
  <xs:annotation>
    <xs:documentation>The PatternFieldGroup is a simple field group aggregating a set of fields for application of patterns.</xs:documentation>
  </xs:annotation>
  <xs:attribute name="condition" type="cyboxCommon:ConditionTypeEnum">
    <xs:annotation>
      <xs:documentation>This field is optional and defines the relevant condition to apply to the value.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="is_case_sensitive" type="xs:boolean" default="true">
    <xs:annotation>
      <xs:documentation>The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="apply_condition" type="cyboxCommon:ConditionApplicationEnum" default="ANY">
    <xs:annotation>
      <xs:documentation>This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="delimiter" type="xs:string" default="##comma##">
    <xs:annotation>
      <xs:documentation>The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="bit_mask" type="xs:hexBinary">
    <xs:annotation>
      <xs:documentation>Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="pattern_type" type="cyboxCommon:PatternTypeEnum">
    <xs:annotation>
      <xs:documentation>This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="regex_syntax" type="xs:string">
    <xs:annotation>
      <xs:documentation>This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.</xs:documentation>
      <xs:documentation>Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.</xs:documentation>
      <xs:documentation>Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="has_changed" type="xs:boolean">
    <xs:annotation>
      <xs:documentation>This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="trend" type="xs:boolean">
    <xs:annotation>
      <xs:documentation>This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
</xs:attributeGroup>
Attribute Group cyboxCommon:BaseObjectPropertyGroup
Namespace http://cybox.mitre.org/common-2
Annotations
 
The ObjectPropertyGroup is a simple field group aggregating a set of fields for Object Properties.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup_id cybox_common_xsd.tmp#BaseObjectPropertyGroup_idref cybox_common_xsd.tmp#BaseObjectPropertyGroup_datatype cybox_common_xsd.tmp#BaseObjectPropertyGroup_appears_random cybox_common_xsd.tmp#BaseObjectPropertyGroup_is_obfuscated cybox_common_xsd.tmp#BaseObjectPropertyGroup_obfuscation_algorithm_ref cybox_common_xsd.tmp#BaseObjectPropertyGroup_is_defanged cybox_common_xsd.tmp#BaseObjectPropertyGroup_defanging_algorithm_ref cybox_common_xsd.tmp#BaseObjectPropertyGroup_refanging_transform_type cybox_common_xsd.tmp#BaseObjectPropertyGroup_refanging_transform cybox_common_xsd.tmp#BaseObjectPropertyGroup_observed_encoding
Used by
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the expected type for the value of the specified property.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
Source
 
<xs:attributeGroup name="BaseObjectPropertyGroup">
  <xs:annotation>
    <xs:documentation>The ObjectPropertyGroup is a simple field group aggregating a set of fields for Object Properties.</xs:documentation>
  </xs:annotation>
  <xs:attribute name="id" type="xs:QName">
    <xs:annotation>
      <xs:documentation>The id field specifies a unique ID for this Object Property.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="idref" type="xs:QName">
    <xs:annotation>
      <xs:documentation>The idref field specifies a unique ID reference for this Object Property.</xs:documentation>
      <xs:documentation>When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="string">
    <xs:annotation>
      <xs:documentation>This attribute is optional and specifies the expected type for the value of the specified property.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="appears_random" type="xs:boolean">
    <xs:annotation>
      <xs:documentation>This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="is_obfuscated" type="xs:boolean">
    <xs:annotation>
      <xs:documentation>This field is optional and conveys whether the associated Object property has been obfuscated.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="obfuscation_algorithm_ref" type="xs:anyURI">
    <xs:annotation>
      <xs:documentation>This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="is_defanged" type="xs:boolean">
    <xs:annotation>
      <xs:documentation>This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="defanging_algorithm_ref" type="xs:anyURI">
    <xs:annotation>
      <xs:documentation>This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="refanging_transform_type" type="xs:string">
    <xs:annotation>
      <xs:documentation>This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="refanging_transform" type="xs:string">
    <xs:annotation>
      <xs:documentation>This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="observed_encoding" type="xs:string">
    <xs:annotation>
      <xs:documentation>This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.</xs:documentation>
      <xs:documentation>It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).</xs:documentation>
      <xs:documentation>This field is intended to be applicable only to fields which contain string values.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
</xs:attributeGroup>
XML Schema documentation generated by ® XML Editor.