Showing:

Annotations
Attributes
Diagrams
Facets
Identity Constraints
Source
Used by
Imported schema cybox_core.xsd
Namespace http://cybox.mitre.org/cybox-2
Annotations
This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org.
Element cybox:ObservableType / cybox:Title
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Title field provides a mechanism to specify a short title or description for this Observable.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Title" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Title field provides a mechanism to specify a short title or description for this Observable.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ObservableType / cybox:Description
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Description field provides a mechanism to specify a structured text description of this Observable.
Diagram
Diagram cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType_structuring_format cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType
Type cyboxCommon:StructuredTextType
Attributes
QName Type Use Annotation
structuring_format xs:string optional
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interfering with XML validation of the CybOX document. If this attribute is absent, the implication is that no markup is being used.
Source
<xs:element name="Description" type="cyboxCommon:StructuredTextType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Description field provides a mechanism to specify a structured text description of this Observable.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ObservableType / cybox:Keywords
Namespace http://cybox.mitre.org/cybox-2
Annotations
Keywords enables capture of relevant keywords for this cyber observable.
Diagram
Diagram cybox_core_xsd.tmp#KeywordsType_Keyword cybox_core_xsd.tmp#KeywordsType
Type cybox:KeywordsType
Children cybox:Keyword
Source
<xs:element name="Keywords" type="cybox:KeywordsType" minOccurs="0" maxOccurs="1">
  <xs:annotation>
    <xs:documentation>Keywords enables capture of relevant keywords for this cyber observable.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:KeywordsType / cybox:Keyword
Namespace http://cybox.mitre.org/cybox-2
Annotations
Each keyword element contains one keyword.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Keyword" type="xs:string" minOccurs="1" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>Each keyword element contains one keyword.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ObservableType / cybox:Observable_Source
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Observable_Source field is optional and enables descriptive specification of how this Observable was identified and specified.
Diagram
Diagram cybox_common_xsd.tmp#MeasureSourceType_class cybox_common_xsd.tmp#MeasureSourceType_source_type cybox_common_xsd.tmp#MeasureSourceType_name cybox_common_xsd.tmp#MeasureSourceType_sighting_count cybox_common_xsd.tmp#MeasureSourceType_Information_Source_Type cybox_common_xsd.tmp#MeasureSourceType_Tool_Type cybox_common_xsd.tmp#MeasureSourceType_Description cybox_common_xsd.tmp#MeasureSourceType_Contributors cybox_common_xsd.tmp#MeasureSourceType_Time cybox_common_xsd.tmp#MeasureSourceType_Observation_Location cybox_common_xsd.tmp#MeasureSourceType_Tools cybox_common_xsd.tmp#MeasureSourceType_Platform cybox_common_xsd.tmp#MeasureSourceType_System cybox_common_xsd.tmp#MeasureSourceType_Instance cybox_common_xsd.tmp#MeasureSourceType_Observable_Location cybox_common_xsd.tmp#MeasureSourceType
Type cyboxCommon:MeasureSourceType
Children cyboxCommon:Contributors, cyboxCommon:Description, cyboxCommon:Information_Source_Type, cyboxCommon:Instance, cyboxCommon:Observable_Location, cyboxCommon:Observation_Location, cyboxCommon:Platform, cyboxCommon:System, cyboxCommon:Time, cyboxCommon:Tool_Type, cyboxCommon:Tools
Attributes
QName Type Use Annotation
class cyboxCommon:SourceClassTypeEnum optional
The class field is optional and enables identification of the high-level class of this cyber observation source.
name xs:string optional
The name field is optional and enables the assignment of a relevant name to this Discovery Method.
sighting_count xs:positiveInteger optional
The sighting_count field specifies how many different identical instances of a given Observable may have been seen/sighted by the observation source.
source_type cyboxCommon:SourceTypeEnum optional
The source_type field is optional and enables identification of the broad type of this cyber observation source.
Source
<xs:element name="Observable_Source" type="cyboxCommon:MeasureSourceType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Observable_Source field is optional and enables descriptive specification of how this Observable was identified and specified.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:Object
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Object construct identifies and specificies the characteristics of a specific cyber-relevant object (e.g. a file, a registry key or a process).
Diagram
Diagram cybox_core_xsd.tmp#ObjectType_id cybox_core_xsd.tmp#ObjectType_idref cybox_core_xsd.tmp#ObjectType_has_changed cybox_core_xsd.tmp#ObjectType_State cybox_core_xsd.tmp#ObjectType_Description cybox_core_xsd.tmp#ObjectType_Properties cybox_core_xsd.tmp#ObjectType_Domain_Specific_Object_Properties cybox_core_xsd.tmp#ObjectType_Location cybox_core_xsd.tmp#ObjectType_Related_Objects cybox_core_xsd.tmp#ObjectType_Defined_Effect cybox_core_xsd.tmp#ObjectType_Discovery_Method cybox_core_xsd.tmp#ObjectType
Type cybox:ObjectType
Used by
Complex Type cybox:ObservableType
Children cybox:Defined_Effect, cybox:Description, cybox:Discovery_Method, cybox:Domain_Specific_Object_Properties, cybox:Location, cybox:Properties, cybox:Related_Objects, cybox:State
Attributes
QName Type Use Annotation
has_changed xs:boolean optional
The has_changed field is optional and conveys a targeted observation pattern of whether the associated object specified has changed in some way without requiring further specific detail. This field would be leveraged within a pattern observable triggering on whether the value of an object specification has changed at all. This field is NOT intended to be used for versioning of CybOX content.
id xs:QName optional
The id field specifies a unique id for this Object.
idref xs:QName optional
The idref field specifies a unique id reference to an Object defined elsewhere.
When idref is specified, the id attribute must not be specified, and any instance of this Object should not hold content unless an extension of the Object allows it.
Source
<xs:element name="Object" type="cybox:ObjectType">
  <xs:annotation>
    <xs:documentation>The Object construct identifies and specificies the characteristics of a specific cyber-relevant object (e.g. a file, a registry key or a process).</xs:documentation>
  </xs:annotation>
  <xs:unique name="unique-object-id">
    <xs:selector xpath=".//*"/>
    <xs:field xpath="@id"/>
  </xs:unique>
</xs:element>
Element cybox:ObjectType / cybox:State
Namespace http://cybox.mitre.org/cybox-2
Annotations
The State field enables the description of the current state of the object, through a standardized controlled vocabulary.
This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is ObjectStateVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.
Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.
Diagram
Diagram cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#PatternableFieldType cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_name cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_reference cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType
Type cyboxCommon:ControlledVocabularyStringType
Type hierarchy
Attributes
QName Type Default Use Annotation
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional
This field is optional and defines the relevant condition to apply to the value.
delimiter xs:string ##comma## optional
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
is_case_sensitive xs:boolean true optional
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
pattern_type cyboxCommon:PatternTypeEnum optional
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
regex_syntax xs:string optional
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
vocab_name xs:string optional
The vocab_name field specifies the name of the controlled vocabulary.
vocab_reference xs:anyURI optional
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
<xs:element name="State" type="cyboxCommon:ControlledVocabularyStringType" minOccurs="0" maxOccurs="1">
  <xs:annotation>
    <xs:documentation>The State field enables the description of the current state of the object, through a standardized controlled vocabulary.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is ObjectStateVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.</xs:documentation>
    <xs:documentation>Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ObjectType / cybox:Description
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Description field provides a mechanism to specify a structured text description of this Object.
Diagram
Diagram cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType_structuring_format cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType
Type cyboxCommon:StructuredTextType
Attributes
QName Type Use Annotation
structuring_format xs:string optional
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interfering with XML validation of the CybOX document. If this attribute is absent, the implication is that no markup is being used.
Source
<xs:element name="Description" type="cyboxCommon:StructuredTextType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Description field provides a mechanism to specify a structured text description of this Object.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ObjectType / cybox:Properties
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Properties construct is an abstract placeholder for various predefined Object type schemas (e.g. File, Process or System) that can be instantiated in its place through extension of the ObjectPropertiesType. This mechanism enables the specification of a broad range of Object types with consistent Object Property naming and structure. The set of Properties schemas are maintained independent of the core CybOX schema.
Diagram
Diagram cybox_common_xsd.tmp#ObjectPropertiesType_object_reference cybox_common_xsd.tmp#ObjectPropertiesType_Custom_Properties cybox_common_xsd.tmp#ObjectPropertiesType
Type cyboxCommon:ObjectPropertiesType
Children cyboxCommon:Custom_Properties
Attributes
QName Type Use Annotation
object_reference xs:QName optional
The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
Source
<xs:element name="Properties" type="cyboxCommon:ObjectPropertiesType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Properties construct is an abstract placeholder for various predefined Object type schemas (e.g. File, Process or System) that can be instantiated in its place through extension of the ObjectPropertiesType. This mechanism enables the specification of a broad range of Object types with consistent Object Property naming and structure. The set of Properties schemas are maintained independent of the core CybOX schema.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ObjectType / cybox:Domain_Specific_Object_Properties
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Domain_Specific_Object_Properties construct is of an Abstract type placeholder within the CybOX schema enabling the inclusion of domain-specific metadata for an object through the use of a custom type defined as an extension of this base Abstract type. This enables domains utilizing CybOX such as malware analysis or forensics to incorporate non-generalized object metadata from their domains into CybOX objects.
Diagram
Diagram cybox_core_xsd.tmp#DomainSpecificObjectPropertiesType
Type cybox:DomainSpecificObjectPropertiesType
Source
<xs:element name="Domain_Specific_Object_Properties" type="cybox:DomainSpecificObjectPropertiesType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Domain_Specific_Object_Properties construct is of an Abstract type placeholder within the CybOX schema enabling the inclusion of domain-specific metadata for an object through the use of a custom type defined as an extension of this base Abstract type. This enables domains utilizing CybOX such as malware analysis or forensics to incorporate non-generalized object metadata from their domains into CybOX objects.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ObjectType / cybox:Location
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Location field specifies a relevant physical location.
This field is implemented through the xsi:type extension mechanism. The default type is CIQAddressInstanceType in the http://cybox.mitre.org/extensions/Identity#CIQAddress-1 namespace. This type is defined in the extensions/location/ciq_address_3.0.xsd file or at the URL http://cybox.mitre.org/XMLSchema/extensions/location/ciq_address/1.0/ciq_address_3.0.xsd.
Those who wish to express a simple name may also do so by not specifying an xsi:type and using the Name field.
Diagram
Diagram cybox_common_xsd.tmp#LocationType_id cybox_common_xsd.tmp#LocationType_idref cybox_common_xsd.tmp#LocationType_Name cybox_common_xsd.tmp#LocationType
Type cyboxCommon:LocationType
Children cyboxCommon:Name
Attributes
QName Type Use Annotation
id xs:QName optional
Specifies a unique ID for this Location.
idref xs:QName optional
Specifies a reference to a unique ID defined elsewhere.
Source
<xs:element name="Location" type="cyboxCommon:LocationType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Location field specifies a relevant physical location.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type extension mechanism. The default type is CIQAddressInstanceType in the http://cybox.mitre.org/extensions/Identity#CIQAddress-1 namespace. This type is defined in the extensions/location/ciq_address_3.0.xsd file or at the URL http://cybox.mitre.org/XMLSchema/extensions/location/ciq_address/1.0/ciq_address_3.0.xsd.</xs:documentation>
    <xs:documentation>Those who wish to express a simple name may also do so by not specifying an xsi:type and using the Name field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ObjectType / cybox:Related_Objects
Namespace http://cybox.mitre.org/cybox-2
Annotations
Diagram
Type cybox:RelatedObjectsType
Children cybox:Related_Object
Source
Element cybox:RelatedObjectsType / cybox:Related_Object
Namespace http://cybox.mitre.org/cybox-2
Annotations
Diagram
Type cybox:RelatedObjectType
Type hierarchy
Children cybox:Defined_Effect, cybox:Description, cybox:Discovery_Method, cybox:Domain_Specific_Object_Properties, cybox:Location, cybox:Properties, cybox:Related_Objects, cybox:Relationship, cybox:State
Attributes
Source
Element cybox:ObjectType / cybox:Defined_Effect
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Defined_Effect construct is an abstract placeholder for various predefined Object Effect types (e.g. DataReadEffect, ValuesEnumeratedEffect or StateChangeEffect) that can be instantiated in its place through extension of the DefinedEffectType. This mechanism enables the specification of a broad range of types of potential complex action effects on Objects. The set of Defined_Effect types (extending the DefinedEffectType) are maintained as part of the core CybOX schema.
Diagram
Diagram cybox_core_xsd.tmp#DefinedEffectType_effect_type cybox_core_xsd.tmp#DefinedEffectType
Type cybox:DefinedEffectType
Attributes
QName Type Use Annotation
effect_type cybox:EffectTypeEnum optional
The effect_type field specifies the nature of the Defined Effect instantiated in the place of the Defined_Effect element.
Source
<xs:element name="Defined_Effect" type="cybox:DefinedEffectType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Defined_Effect construct is an abstract placeholder for various predefined Object Effect types (e.g. DataReadEffect, ValuesEnumeratedEffect or StateChangeEffect) that can be instantiated in its place through extension of the DefinedEffectType. This mechanism enables the specification of a broad range of types of potential complex action effects on Objects. The set of Defined_Effect types (extending the DefinedEffectType) are maintained as part of the core CybOX schema.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ObjectType / cybox:Discovery_Method
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Discovery_Method field is optional and enables descriptive specification of how this Object was observed (in the case of a Cyber Observable Object instance) or could potentially be observed (in the case of a Cyber Observable Object pattern).
Diagram
Diagram cybox_common_xsd.tmp#MeasureSourceType_class cybox_common_xsd.tmp#MeasureSourceType_source_type cybox_common_xsd.tmp#MeasureSourceType_name cybox_common_xsd.tmp#MeasureSourceType_sighting_count cybox_common_xsd.tmp#MeasureSourceType_Information_Source_Type cybox_common_xsd.tmp#MeasureSourceType_Tool_Type cybox_common_xsd.tmp#MeasureSourceType_Description cybox_common_xsd.tmp#MeasureSourceType_Contributors cybox_common_xsd.tmp#MeasureSourceType_Time cybox_common_xsd.tmp#MeasureSourceType_Observation_Location cybox_common_xsd.tmp#MeasureSourceType_Tools cybox_common_xsd.tmp#MeasureSourceType_Platform cybox_common_xsd.tmp#MeasureSourceType_System cybox_common_xsd.tmp#MeasureSourceType_Instance cybox_common_xsd.tmp#MeasureSourceType_Observable_Location cybox_common_xsd.tmp#MeasureSourceType
Type cyboxCommon:MeasureSourceType
Children cyboxCommon:Contributors, cyboxCommon:Description, cyboxCommon:Information_Source_Type, cyboxCommon:Instance, cyboxCommon:Observable_Location, cyboxCommon:Observation_Location, cyboxCommon:Platform, cyboxCommon:System, cyboxCommon:Time, cyboxCommon:Tool_Type, cyboxCommon:Tools
Attributes
QName Type Use Annotation
class cyboxCommon:SourceClassTypeEnum optional
The class field is optional and enables identification of the high-level class of this cyber observation source.
name xs:string optional
The name field is optional and enables the assignment of a relevant name to this Discovery Method.
sighting_count xs:positiveInteger optional
The sighting_count field specifies how many different identical instances of a given Observable may have been seen/sighted by the observation source.
source_type cyboxCommon:SourceTypeEnum optional
The source_type field is optional and enables identification of the broad type of this cyber observation source.
Source
<xs:element name="Discovery_Method" type="cyboxCommon:MeasureSourceType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Discovery_Method field is optional and enables descriptive specification of how this Object was observed (in the case of a Cyber Observable Object instance) or could potentially be observed (in the case of a Cyber Observable Object pattern).</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:RelatedObjectType / cybox:Relationship
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Relationship field uses a standardized controlled vocabulary to capture the nature of the relationship between this Object and the Related_Object.
This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is ObjectRelationshipVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.
Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.
When idref is specified, by design, an instance may declare a Relationship child.
Diagram
Diagram cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#PatternableFieldType cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_name cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_reference cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType
Type cyboxCommon:ControlledVocabularyStringType
Type hierarchy
Attributes
QName Type Default Use Annotation
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional
This field is optional and defines the relevant condition to apply to the value.
delimiter xs:string ##comma## optional
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
is_case_sensitive xs:boolean true optional
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
pattern_type cyboxCommon:PatternTypeEnum optional
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
regex_syntax xs:string optional
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
vocab_name xs:string optional
The vocab_name field specifies the name of the controlled vocabulary.
vocab_reference xs:anyURI optional
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
<xs:element name="Relationship" type="cyboxCommon:ControlledVocabularyStringType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Relationship field uses a standardized controlled vocabulary to capture the nature of the relationship between this Object and the Related_Object.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is ObjectRelationshipVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.</xs:documentation>
    <xs:documentation>Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.</xs:documentation>
    <xs:documentation>When idref is specified, by design, an instance may declare a Relationship child.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:Event
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Event construct enables specification of a cyber observable event that is dynamic in nature with specific action(s) taken against specific cyber relevant objects (e.g. a file is deleted, a registry key is created or an HTTP Get Request is received).
Diagram
Diagram cybox_core_xsd.tmp#EventType_id cybox_core_xsd.tmp#EventType_idref cybox_core_xsd.tmp#EventType_Type cybox_core_xsd.tmp#EventType_Description cybox_core_xsd.tmp#EventType_Observation_Method cybox_core_xsd.tmp#EventType_Actions cybox_core_xsd.tmp#EventType_Location cybox_core_xsd.tmp#EventType_Frequency cybox_core_xsd.tmp#EventType_Event cybox_core_xsd.tmp#EventType
Type cybox:EventType
Used by
Complex Type cybox:ObservableType
Children cybox:Actions, cybox:Description, cybox:Event, cybox:Frequency, cybox:Location, cybox:Observation_Method, cybox:Type
Attributes
QName Type Use Annotation
id xs:QName optional
The id field specifies a unique id for this Event.
idref xs:QName optional
The idref field specifies a unique id reference to an Event defined elsewhere.
When idref is specified, the id attribute must not be specified, and any instance of this Event should not hold content unless an extension of the Event allows it.
Source
<xs:element name="Event" type="cybox:EventType">
  <xs:annotation>
    <xs:documentation>The Event construct enables specification of a cyber observable event that is dynamic in nature with specific action(s) taken against specific cyber relevant objects (e.g. a file is deleted, a registry key is created or an HTTP Get Request is received).</xs:documentation>
  </xs:annotation>
  <xs:unique name="unique-event-id">
    <xs:selector xpath=".//*"/>
    <xs:field xpath="@id"/>
  </xs:unique>
</xs:element>
Element cybox:EventType / cybox:Type
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Type field uses a standardized controlled vocabulary to capture what type of Event this is.
This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is EventTypeVocab-1.0.1 in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.
Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.
Diagram
Diagram cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#PatternableFieldType cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_name cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_reference cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType
Type cyboxCommon:ControlledVocabularyStringType
Type hierarchy
Attributes
QName Type Default Use Annotation
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional
This field is optional and defines the relevant condition to apply to the value.
delimiter xs:string ##comma## optional
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
is_case_sensitive xs:boolean true optional
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
pattern_type cyboxCommon:PatternTypeEnum optional
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
regex_syntax xs:string optional
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
vocab_name xs:string optional
The vocab_name field specifies the name of the controlled vocabulary.
vocab_reference xs:anyURI optional
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
<xs:element name="Type" type="cyboxCommon:ControlledVocabularyStringType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Type field uses a standardized controlled vocabulary to capture what type of Event this is.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is EventTypeVocab-1.0.1 in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.</xs:documentation>
    <xs:documentation>Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:EventType / cybox:Description
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Description field provides a mechanism to specify a structured text description of this Event.
Diagram
Diagram cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType_structuring_format cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType
Type cyboxCommon:StructuredTextType
Attributes
QName Type Use Annotation
structuring_format xs:string optional
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interfering with XML validation of the CybOX document. If this attribute is absent, the implication is that no markup is being used.
Source
<xs:element name="Description" type="cyboxCommon:StructuredTextType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Description field provides a mechanism to specify a structured text description of this Event.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:EventType / cybox:Observation_Method
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Observation_Method field is optional and enables descriptive specification of how this Event was observed (in the case of a Cyber Observable Event instance) or could potentially be observed (in the case of a Cyber Observable Event pattern).
Diagram
Diagram cybox_common_xsd.tmp#MeasureSourceType_class cybox_common_xsd.tmp#MeasureSourceType_source_type cybox_common_xsd.tmp#MeasureSourceType_name cybox_common_xsd.tmp#MeasureSourceType_sighting_count cybox_common_xsd.tmp#MeasureSourceType_Information_Source_Type cybox_common_xsd.tmp#MeasureSourceType_Tool_Type cybox_common_xsd.tmp#MeasureSourceType_Description cybox_common_xsd.tmp#MeasureSourceType_Contributors cybox_common_xsd.tmp#MeasureSourceType_Time cybox_common_xsd.tmp#MeasureSourceType_Observation_Location cybox_common_xsd.tmp#MeasureSourceType_Tools cybox_common_xsd.tmp#MeasureSourceType_Platform cybox_common_xsd.tmp#MeasureSourceType_System cybox_common_xsd.tmp#MeasureSourceType_Instance cybox_common_xsd.tmp#MeasureSourceType_Observable_Location cybox_common_xsd.tmp#MeasureSourceType
Type cyboxCommon:MeasureSourceType
Children cyboxCommon:Contributors, cyboxCommon:Description, cyboxCommon:Information_Source_Type, cyboxCommon:Instance, cyboxCommon:Observable_Location, cyboxCommon:Observation_Location, cyboxCommon:Platform, cyboxCommon:System, cyboxCommon:Time, cyboxCommon:Tool_Type, cyboxCommon:Tools
Attributes
QName Type Use Annotation
class cyboxCommon:SourceClassTypeEnum optional
The class field is optional and enables identification of the high-level class of this cyber observation source.
name xs:string optional
The name field is optional and enables the assignment of a relevant name to this Discovery Method.
sighting_count xs:positiveInteger optional
The sighting_count field specifies how many different identical instances of a given Observable may have been seen/sighted by the observation source.
source_type cyboxCommon:SourceTypeEnum optional
The source_type field is optional and enables identification of the broad type of this cyber observation source.
Source
<xs:element name="Observation_Method" type="cyboxCommon:MeasureSourceType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Observation_Method field is optional and enables descriptive specification of how this Event was observed (in the case of a Cyber Observable Event instance) or could potentially be observed (in the case of a Cyber Observable Event pattern).</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:EventType / cybox:Actions
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Actions construct enables description/specification of one or more cyber observable actions.
Diagram
Diagram cybox_core_xsd.tmp#Action cybox_core_xsd.tmp#ActionsType
Type cybox:ActionsType
Children cybox:Action
Source
<xs:element name="Actions" type="cybox:ActionsType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Actions construct enables description/specification of one or more cyber observable actions.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:Action
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Action construct enables description/specification of a single cyber observable action.
Diagram
Diagram cybox_core_xsd.tmp#ActionType_id cybox_core_xsd.tmp#ActionType_idref cybox_core_xsd.tmp#ActionType_ordinal_position cybox_core_xsd.tmp#ActionType_action_status cybox_core_xsd.tmp#ActionType_context cybox_core_xsd.tmp#ActionType_timestamp cybox_core_xsd.tmp#ActionType_timestamp_precision cybox_core_xsd.tmp#ActionType_Type cybox_core_xsd.tmp#ActionType_Name cybox_core_xsd.tmp#ActionType_Description cybox_core_xsd.tmp#ActionType_Action_Aliases cybox_core_xsd.tmp#ActionType_Action_Arguments cybox_core_xsd.tmp#ActionType_Location cybox_core_xsd.tmp#ActionType_Discovery_Method cybox_core_xsd.tmp#ActionType_Associated_Objects cybox_core_xsd.tmp#ActionType_Relationships cybox_core_xsd.tmp#ActionType_Frequency cybox_core_xsd.tmp#ActionType
Type cybox:ActionType
Used by
Complex Type cybox:ActionsType
Children cybox:Action_Aliases, cybox:Action_Arguments, cybox:Associated_Objects, cybox:Description, cybox:Discovery_Method, cybox:Frequency, cybox:Location, cybox:Name, cybox:Relationships, cybox:Type
Attributes
QName Type Default Use Annotation
action_status cybox:ActionStatusTypeEnum optional
The action_status field enables description of the status of the action being described.
context cybox:ActionContextTypeEnum optional
The context field is optional and enables simple characterization of the broad operational context in which the Action is relevant.
id xs:QName optional
The id field specifies a unique id for this Action.
idref xs:QName optional
The idref field specifies a unique id reference to an Action defined elsewhere.
When idref is specified, the id attribute must not be specified, and any instance of this Action should not hold content unless an extension of the Action allows it.
ordinal_position xs:positiveInteger optional
The ordinal_position field is intended to reference the ordinal position of the action with within a series of actions.
timestamp xs:dateTime optional
The timestamp field represents the local or relative time at which the action occurred or was observed. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
timestamp_precision cyboxCommon:DateTimePrecisionEnum second optional
Represents the precision of the associated timestamp value. If omitted, the default is "second", meaning the timestamp is precise to the full field value. Digits in the timestamp that are required by the xs:dateTime datatype but are beyond the specified precision should be zeroed out.
Source
<xs:element name="Action" type="cybox:ActionType">
  <xs:annotation>
    <xs:documentation>The Action construct enables description/specification of a single cyber observable action.</xs:documentation>
  </xs:annotation>
  <xs:unique name="unique-action-id">
    <xs:selector xpath=".//*"/>
    <xs:field xpath="@id"/>
  </xs:unique>
</xs:element>
Element cybox:ActionType / cybox:Type
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Type field is optional and utilizes a standardized controlled vocabulary to specify the basic type of the action that was performed.
This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is ActionTypeVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.
Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.
Diagram
Diagram cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#PatternableFieldType cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_name cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_reference cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType
Type cyboxCommon:ControlledVocabularyStringType
Type hierarchy
Attributes
QName Type Default Use Annotation
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional
This field is optional and defines the relevant condition to apply to the value.
delimiter xs:string ##comma## optional
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
is_case_sensitive xs:boolean true optional
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
pattern_type cyboxCommon:PatternTypeEnum optional
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
regex_syntax xs:string optional
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
vocab_name xs:string optional
The vocab_name field specifies the name of the controlled vocabulary.
vocab_reference xs:anyURI optional
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
<xs:element name="Type" type="cyboxCommon:ControlledVocabularyStringType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Type field is optional and utilizes a standardized controlled vocabulary to specify the basic type of the action that was performed.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is ActionTypeVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.</xs:documentation>
    <xs:documentation>Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ActionType / cybox:Name
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Name field is optional and utilizes a standardized controlled vocabulary to identify/characterize the specific name of the action that was performed.
This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is ActionNameVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.
Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.
Diagram
Diagram cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#PatternableFieldType cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_name cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_reference cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType
Type cyboxCommon:ControlledVocabularyStringType
Type hierarchy
Attributes
QName Type Default Use Annotation
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional
This field is optional and defines the relevant condition to apply to the value.
delimiter xs:string ##comma## optional
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
is_case_sensitive xs:boolean true optional
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
pattern_type cyboxCommon:PatternTypeEnum optional
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
regex_syntax xs:string optional
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
vocab_name xs:string optional
The vocab_name field specifies the name of the controlled vocabulary.
vocab_reference xs:anyURI optional
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
<xs:element name="Name" type="cyboxCommon:ControlledVocabularyStringType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Name field is optional and utilizes a standardized controlled vocabulary to identify/characterize the specific name of the action that was performed.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is ActionNameVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.</xs:documentation>
    <xs:documentation>Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ActionType / cybox:Description
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Description field contains a textual description of the action.
Diagram
Diagram cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType_structuring_format cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType
Type cyboxCommon:StructuredTextType
Attributes
QName Type Use Annotation
structuring_format xs:string optional
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interfering with XML validation of the CybOX document. If this attribute is absent, the implication is that no markup is being used.
Source
<xs:element name="Description" type="cyboxCommon:StructuredTextType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Description field contains a textual description of the action.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ActionType / cybox:Action_Aliases
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Action_Aliases field is optional and enables identification of other potentially used names for this Action.
Diagram
Diagram cybox_core_xsd.tmp#ActionAliasesType_Action_Alias cybox_core_xsd.tmp#ActionAliasesType
Type cybox:ActionAliasesType
Children cybox:Action_Alias
Source
<xs:element name="Action_Aliases" type="cybox:ActionAliasesType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Action_Aliases field is optional and enables identification of other potentially used names for this Action.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ActionAliasesType / cybox:Action_Alias
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Action_Alias field is optional and enables identification of a single other potentially used name for this Action.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Action_Alias" type="xs:string" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Action_Alias field is optional and enables identification of a single other potentially used name for this Action.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ActionType / cybox:Action_Arguments
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Action_Arguments field is optional and enables the specification of relevant arguments/parameters for this Action.
Diagram
Diagram cybox_core_xsd.tmp#ActionArgumentsType_Action_Argument cybox_core_xsd.tmp#ActionArgumentsType
Type cybox:ActionArgumentsType
Children cybox:Action_Argument
Source
<xs:element name="Action_Arguments" type="cybox:ActionArgumentsType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Action_Arguments field is optional and enables the specification of relevant arguments/parameters for this Action.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ActionArgumentsType / cybox:Action_Argument
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Action_Argument construct is optional and enables the specification of a single relevant argument/parameter for this Action.
Diagram
Diagram cybox_core_xsd.tmp#ActionArgumentType_Argument_Name cybox_core_xsd.tmp#ActionArgumentType_Argument_Value cybox_core_xsd.tmp#ActionArgumentType
Type cybox:ActionArgumentType
Children cybox:Argument_Name, cybox:Argument_Value
Source
<xs:element name="Action_Argument" type="cybox:ActionArgumentType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Action_Argument construct is optional and enables the specification of a single relevant argument/parameter for this Action.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ActionArgumentType / cybox:Argument_Name
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Argument_Name field is optional and utilizes a standardized controlled vocabulary to identify/characterize the specific action argument utilized.
This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is ActionArgumentNameVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.
Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.
Diagram
Diagram cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#PatternableFieldType cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_name cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_reference cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType
Type cyboxCommon:ControlledVocabularyStringType
Type hierarchy
Attributes
QName Type Default Use Annotation
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional
This field is optional and defines the relevant condition to apply to the value.
delimiter xs:string ##comma## optional
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
is_case_sensitive xs:boolean true optional
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
pattern_type cyboxCommon:PatternTypeEnum optional
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
regex_syntax xs:string optional
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
vocab_name xs:string optional
The vocab_name field specifies the name of the controlled vocabulary.
vocab_reference xs:anyURI optional
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
<xs:element name="Argument_Name" type="cyboxCommon:ControlledVocabularyStringType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Argument_Name field is optional and utilizes a standardized controlled vocabulary to identify/characterize the specific action argument utilized.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is ActionArgumentNameVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.</xs:documentation>
    <xs:documentation>Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ActionArgumentType / cybox:Argument_Value
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Argument_Value field specifies the value for this action argument/parameter.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Argument_Value" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Argument_Value field specifies the value for this action argument/parameter.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ActionType / cybox:Location
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Location field specifies a relevant physical location.
This field is implemented through the xsi:type extension mechanism. The default type is CIQAddressInstanceType in the http://cybox.mitre.org/extensions/Identity#CIQAddress-1 namespace. This type is defined in the extensions/location/ciq_address_3.0.xsd file or at the URL http://cybox.mitre.org/XMLSchema/extensions/location/ciq_address/1.0/ciq_address_3.0.xsd.
Those who wish to express a simple name may also do so by not specifying an xsi:type and using the Name field.
Diagram
Diagram cybox_common_xsd.tmp#LocationType_id cybox_common_xsd.tmp#LocationType_idref cybox_common_xsd.tmp#LocationType_Name cybox_common_xsd.tmp#LocationType
Type cyboxCommon:LocationType
Children cyboxCommon:Name
Attributes
QName Type Use Annotation
id xs:QName optional
Specifies a unique ID for this Location.
idref xs:QName optional
Specifies a reference to a unique ID defined elsewhere.
Source
<xs:element name="Location" type="cyboxCommon:LocationType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Location field specifies a relevant physical location.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type extension mechanism. The default type is CIQAddressInstanceType in the http://cybox.mitre.org/extensions/Identity#CIQAddress-1 namespace. This type is defined in the extensions/location/ciq_address_3.0.xsd file or at the URL http://cybox.mitre.org/XMLSchema/extensions/location/ciq_address/1.0/ciq_address_3.0.xsd.</xs:documentation>
    <xs:documentation>Those who wish to express a simple name may also do so by not specifying an xsi:type and using the Name field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ActionType / cybox:Discovery_Method
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Discovery_Method field is optional and enables descriptive specification of how this Action was observed (in the case of a Cyber Observable Action instance) or could potentially be observed (in the case of a Cyber Observable Action pattern).
Diagram
Diagram cybox_common_xsd.tmp#MeasureSourceType_class cybox_common_xsd.tmp#MeasureSourceType_source_type cybox_common_xsd.tmp#MeasureSourceType_name cybox_common_xsd.tmp#MeasureSourceType_sighting_count cybox_common_xsd.tmp#MeasureSourceType_Information_Source_Type cybox_common_xsd.tmp#MeasureSourceType_Tool_Type cybox_common_xsd.tmp#MeasureSourceType_Description cybox_common_xsd.tmp#MeasureSourceType_Contributors cybox_common_xsd.tmp#MeasureSourceType_Time cybox_common_xsd.tmp#MeasureSourceType_Observation_Location cybox_common_xsd.tmp#MeasureSourceType_Tools cybox_common_xsd.tmp#MeasureSourceType_Platform cybox_common_xsd.tmp#MeasureSourceType_System cybox_common_xsd.tmp#MeasureSourceType_Instance cybox_common_xsd.tmp#MeasureSourceType_Observable_Location cybox_common_xsd.tmp#MeasureSourceType
Type cyboxCommon:MeasureSourceType
Children cyboxCommon:Contributors, cyboxCommon:Description, cyboxCommon:Information_Source_Type, cyboxCommon:Instance, cyboxCommon:Observable_Location, cyboxCommon:Observation_Location, cyboxCommon:Platform, cyboxCommon:System, cyboxCommon:Time, cyboxCommon:Tool_Type, cyboxCommon:Tools
Attributes
QName Type Use Annotation
class cyboxCommon:SourceClassTypeEnum optional
The class field is optional and enables identification of the high-level class of this cyber observation source.
name xs:string optional
The name field is optional and enables the assignment of a relevant name to this Discovery Method.
sighting_count xs:positiveInteger optional
The sighting_count field specifies how many different identical instances of a given Observable may have been seen/sighted by the observation source.
source_type cyboxCommon:SourceTypeEnum optional
The source_type field is optional and enables identification of the broad type of this cyber observation source.
Source
<xs:element name="Discovery_Method" type="cyboxCommon:MeasureSourceType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Discovery_Method field is optional and enables descriptive specification of how this Action was observed (in the case of a Cyber Observable Action instance) or could potentially be observed (in the case of a Cyber Observable Action pattern).</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ActionType / cybox:Associated_Objects
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Associated_Objects construct is optional and enables the description/specification of cyber Objects relevant (either initiating or affected by) this Action.
Diagram
Diagram cybox_core_xsd.tmp#AssociatedObjectsType_Associated_Object cybox_core_xsd.tmp#AssociatedObjectsType
Type cybox:AssociatedObjectsType
Children cybox:Associated_Object
Source
<xs:element name="Associated_Objects" type="cybox:AssociatedObjectsType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Associated_Objects construct is optional and enables the description/specification of cyber Objects relevant (either initiating or affected by) this Action.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:AssociatedObjectsType / cybox:Associated_Object
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Associated_Object construct enables the description of cyber Objects associated with this Action. This could include Objects that initiated the action, are the target Objects affected by the Action, are utilized by the Action or are the returned result of the Action.
Diagram
Diagram cybox_core_xsd.tmp#ObjectType_id cybox_core_xsd.tmp#ObjectType_idref cybox_core_xsd.tmp#ObjectType_has_changed cybox_core_xsd.tmp#ObjectType_State cybox_core_xsd.tmp#ObjectType_Description cybox_core_xsd.tmp#ObjectType_Properties cybox_core_xsd.tmp#ObjectType_Domain_Specific_Object_Properties cybox_core_xsd.tmp#ObjectType_Location cybox_core_xsd.tmp#ObjectType_Related_Objects cybox_core_xsd.tmp#ObjectType_Defined_Effect cybox_core_xsd.tmp#ObjectType_Discovery_Method cybox_core_xsd.tmp#ObjectType cybox_core_xsd.tmp#AssociatedObjectType_Association_Type cybox_core_xsd.tmp#AssociatedObjectType_Action_Pertinent_Object_Properties cybox_core_xsd.tmp#AssociatedObjectType
Type cybox:AssociatedObjectType
Type hierarchy
Children cybox:Action_Pertinent_Object_Properties, cybox:Association_Type, cybox:Defined_Effect, cybox:Description, cybox:Discovery_Method, cybox:Domain_Specific_Object_Properties, cybox:Location, cybox:Properties, cybox:Related_Objects, cybox:State
Attributes
QName Type Use Annotation
has_changed xs:boolean optional
The has_changed field is optional and conveys a targeted observation pattern of whether the associated object specified has changed in some way without requiring further specific detail. This field would be leveraged within a pattern observable triggering on whether the value of an object specification has changed at all. This field is NOT intended to be used for versioning of CybOX content.
id xs:QName optional
The id field specifies a unique id for this Object.
idref xs:QName optional
The idref field specifies a unique id reference to an Object defined elsewhere.
When idref is specified, the id attribute must not be specified, and any instance of this Object should not hold content unless an extension of the Object allows it.
Source
<xs:element name="Associated_Object" type="cybox:AssociatedObjectType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Associated_Object construct enables the description of cyber Objects associated with this Action. This could include Objects that initiated the action, are the target Objects affected by the Action, are utilized by the Action or are the returned result of the Action.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:AssociatedObjectType / cybox:Association_Type
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Association_Type field utilizes a standardized controlled vocabulary to specify the kind of association this Object holds for this Action.
This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is ActionObjectAssociationTypeVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.
Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.
Diagram
Diagram cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#PatternableFieldType cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_name cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_reference cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType
Type cyboxCommon:ControlledVocabularyStringType
Type hierarchy
Attributes
QName Type Default Use Annotation
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional
This field is optional and defines the relevant condition to apply to the value.
delimiter xs:string ##comma## optional
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
is_case_sensitive xs:boolean true optional
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
pattern_type cyboxCommon:PatternTypeEnum optional
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
regex_syntax xs:string optional
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
vocab_name xs:string optional
The vocab_name field specifies the name of the controlled vocabulary.
vocab_reference xs:anyURI optional
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
<xs:element name="Association_Type" type="cyboxCommon:ControlledVocabularyStringType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Association_Type field utilizes a standardized controlled vocabulary to specify the kind of association this Object holds for this Action.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is ActionObjectAssociationTypeVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.</xs:documentation>
    <xs:documentation>Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:AssociatedObjectType / cybox:Action_Pertinent_Object_Properties
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Action_Pertinent_Object_Properties construct is optional and identifies which of the Properties of this Object are specifically pertinent to this Action.
Diagram
Diagram cybox_core_xsd.tmp#ActionPertinentObjectPropertiesType_Property cybox_core_xsd.tmp#ActionPertinentObjectPropertiesType
Type cybox:ActionPertinentObjectPropertiesType
Children cybox:Property
Source
<xs:element name="Action_Pertinent_Object_Properties" type="cybox:ActionPertinentObjectPropertiesType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Action_Pertinent_Object_Properties construct is optional and identifies which of the Properties of this Object are specifically pertinent to this Action.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ActionPertinentObjectPropertiesType / cybox:Property
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Property construct identifies a single Object Property that is specifically pertinent to this Action.
Diagram
Diagram cybox_core_xsd.tmp#ActionPertinentObjectPropertyType_name cybox_core_xsd.tmp#ActionPertinentObjectPropertyType_xpath cybox_core_xsd.tmp#ActionPertinentObjectPropertyType
Type cybox:ActionPertinentObjectPropertyType
Attributes
QName Type Use Annotation
name xs:string optional
The name field specifies the field name for the pertinent Object Property.
xpath xs:string optional
The xpath field specifies the XPath 1.0 expression identifying the pertinent property within the Properties schema for this object type.
Source
<xs:element name="Property" type="cybox:ActionPertinentObjectPropertyType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Property construct identifies a single Object Property that is specifically pertinent to this Action.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ActionType / cybox:Relationships
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Relationships construct is optional and enables description of other cyber observable actions that are related to this Action.
Diagram
Diagram cybox_core_xsd.tmp#ActionRelationshipsType_Relationship cybox_core_xsd.tmp#ActionRelationshipsType
Type cybox:ActionRelationshipsType
Children cybox:Relationship
Source
<xs:element name="Relationships" type="cybox:ActionRelationshipsType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Relationships construct is optional and enables description of other cyber observable actions that are related to this Action.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ActionRelationshipsType / cybox:Relationship
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Relationship construct is required and enables description of a single other cyber observable Action that is related to this Action.
Diagram
Diagram cybox_core_xsd.tmp#ActionRelationshipType_Type cybox_core_xsd.tmp#ActionRelationshipType_Action_Reference cybox_core_xsd.tmp#ActionRelationshipType
Type cybox:ActionRelationshipType
Children cybox:Action_Reference, cybox:Type
Source
<xs:element name="Relationship" type="cybox:ActionRelationshipType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Relationship construct is required and enables description of a single other cyber observable Action that is related to this Action.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ActionRelationshipType / cybox:Type
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Type field utilizes a standardized controlled vocabulary to describe the nature of the relationship between this Action and the related Action.
This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is ActionRelationshipTypeVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.
Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.
Diagram
Diagram cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#PatternableFieldType cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_name cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_reference cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType
Type cyboxCommon:ControlledVocabularyStringType
Type hierarchy
Attributes
QName Type Default Use Annotation
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional
This field is optional and defines the relevant condition to apply to the value.
delimiter xs:string ##comma## optional
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
is_case_sensitive xs:boolean true optional
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
pattern_type cyboxCommon:PatternTypeEnum optional
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
regex_syntax xs:string optional
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
vocab_name xs:string optional
The vocab_name field specifies the name of the controlled vocabulary.
vocab_reference xs:anyURI optional
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
<xs:element name="Type" type="cyboxCommon:ControlledVocabularyStringType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Type field utilizes a standardized controlled vocabulary to describe the nature of the relationship between this Action and the related Action.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is ActionRelationshipTypeVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.</xs:documentation>
    <xs:documentation>Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ActionRelationshipType / cybox:Action_Reference
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Action_Reference construct captures references to other Actions.
Diagram
Diagram cybox_core_xsd.tmp#ActionReferenceType_action_id cybox_core_xsd.tmp#ActionReferenceType
Type cybox:ActionReferenceType
Attributes
QName Type Use Annotation
action_id xs:QName required
The action_id field refers to the id of the action being referenced.
Source
<xs:element name="Action_Reference" type="cybox:ActionReferenceType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Action_Reference construct captures references to other Actions.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ActionType / cybox:Frequency
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Frequency field conveys a targeted observation pattern of the frequency of the associated event or action.
Diagram
Diagram cybox_core_xsd.tmp#FrequencyType_rate cybox_core_xsd.tmp#FrequencyType_units cybox_core_xsd.tmp#FrequencyType_scale cybox_core_xsd.tmp#FrequencyType_trend cybox_core_xsd.tmp#FrequencyType
Type cybox:FrequencyType
Attributes
QName Type Use Annotation
rate xs:float optional
This field specifies the rate for this defined frequency.
scale xs:string optional
This field specifies the time scale for this defined frequency.
trend cybox:TrendEnum optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the frequency of the associated event or action. This field would be leveraged within an event or action pattern observable triggering on the matching of a specified trend in the frequency of an event or action.
units xs:string optional
This field specifies the units for this defined frequency.
Source
<xs:element name="Frequency" type="cybox:FrequencyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Frequency field conveys a targeted observation pattern of the frequency of the associated event or action.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:EventType / cybox:Location
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Location field specifies a relevant physical location.
This field is implemented through the xsi:type extension mechanism. The default type is CIQAddressInstanceType in the http://cybox.mitre.org/extensions/Identity#CIQAddress-1 namespace. This type is defined in the extensions/location/ciq_address_3.0.xsd file or at the URL http://cybox.mitre.org/XMLSchema/extensions/location/ciq_address/1.0/ciq_address_3.0.xsd.
Those who wish to express a simple name may also do so by not specifying an xsi:type and using the Name field.
Diagram
Diagram cybox_common_xsd.tmp#LocationType_id cybox_common_xsd.tmp#LocationType_idref cybox_common_xsd.tmp#LocationType_Name cybox_common_xsd.tmp#LocationType
Type cyboxCommon:LocationType
Children cyboxCommon:Name
Attributes
QName Type Use Annotation
id xs:QName optional
Specifies a unique ID for this Location.
idref xs:QName optional
Specifies a reference to a unique ID defined elsewhere.
Source
<xs:element name="Location" type="cyboxCommon:LocationType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Location field specifies a relevant physical location.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type extension mechanism. The default type is CIQAddressInstanceType in the http://cybox.mitre.org/extensions/Identity#CIQAddress-1 namespace. This type is defined in the extensions/location/ciq_address_3.0.xsd file or at the URL http://cybox.mitre.org/XMLSchema/extensions/location/ciq_address/1.0/ciq_address_3.0.xsd.</xs:documentation>
    <xs:documentation>Those who wish to express a simple name may also do so by not specifying an xsi:type and using the Name field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:EventType / cybox:Frequency
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Frequency field conveys a targeted observation pattern of the frequency of the associated event or action.
Diagram
Diagram cybox_core_xsd.tmp#FrequencyType_rate cybox_core_xsd.tmp#FrequencyType_units cybox_core_xsd.tmp#FrequencyType_scale cybox_core_xsd.tmp#FrequencyType_trend cybox_core_xsd.tmp#FrequencyType
Type cybox:FrequencyType
Attributes
QName Type Use Annotation
rate xs:float optional
This field specifies the rate for this defined frequency.
scale xs:string optional
This field specifies the time scale for this defined frequency.
trend cybox:TrendEnum optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the frequency of the associated event or action. This field would be leveraged within an event or action pattern observable triggering on the matching of a specified trend in the frequency of an event or action.
units xs:string optional
This field specifies the units for this defined frequency.
Source
<xs:element name="Frequency" type="cybox:FrequencyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Frequency field conveys a targeted observation pattern of the frequency of the associated event or action.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:EventType / cybox:Event
Namespace http://cybox.mitre.org/cybox-2
Annotations
This Event construct is included recursively to enable description/specification of composite Events.
Diagram
Diagram cybox_core_xsd.tmp#EventType_id cybox_core_xsd.tmp#EventType_idref cybox_core_xsd.tmp#EventType_Type cybox_core_xsd.tmp#EventType_Description cybox_core_xsd.tmp#EventType_Observation_Method cybox_core_xsd.tmp#EventType_Actions cybox_core_xsd.tmp#EventType_Location cybox_core_xsd.tmp#EventType_Frequency cybox_core_xsd.tmp#EventType_Event cybox_core_xsd.tmp#EventType
Type cybox:EventType
Children cybox:Actions, cybox:Description, cybox:Event, cybox:Frequency, cybox:Location, cybox:Observation_Method, cybox:Type
Attributes
QName Type Use Annotation
id xs:QName optional
The id field specifies a unique id for this Event.
idref xs:QName optional
The idref field specifies a unique id reference to an Event defined elsewhere.
When idref is specified, the id attribute must not be specified, and any instance of this Event should not hold content unless an extension of the Event allows it.
Source
<xs:element name="Event" type="cybox:EventType">
  <xs:annotation>
    <xs:documentation>This Event construct is included recursively to enable description/specification of composite Events.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ObservableType / cybox:Observable_Composition
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Observable_Composition construct enables specification of composite observables made up of logical constructions of atomic observables or other composite observables (e.g. Obs5 = (Obs1 OR Obs2) AND (Obs3 OR Obs4)).
Diagram
Diagram cybox_core_xsd.tmp#ObservableCompositionType_operator cybox_core_xsd.tmp#ObservableCompositionType_Observable cybox_core_xsd.tmp#ObservableCompositionType
Type cybox:ObservableCompositionType
Children cybox:Observable
Attributes
QName Type Use Annotation
operator cybox:OperatorTypeEnum required
The operator field enables the specification of complex compositional cyber observables by providing logical operators for defining interrelationships between constituent cyber observables defined utilizing the recursive Observable element.
Source
<xs:element name="Observable_Composition" type="cybox:ObservableCompositionType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Observable_Composition construct enables specification of composite observables made up of logical constructions of atomic observables or other composite observables (e.g. Obs5 = (Obs1 OR Obs2) AND (Obs3 OR Obs4)).</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ObservableCompositionType / cybox:Observable
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Observable construct represents a description of a single cyber observable.
Diagram
Diagram cybox_core_xsd.tmp#ObservableType_id cybox_core_xsd.tmp#ObservableType_idref cybox_core_xsd.tmp#ObservableType_negate cybox_core_xsd.tmp#ObservableType_sighting_count cybox_core_xsd.tmp#ObservableType_Title cybox_core_xsd.tmp#ObservableType_Description cybox_core_xsd.tmp#ObservableType_Keywords cybox_core_xsd.tmp#ObservableType_Observable_Source cybox_core_xsd.tmp#Object cybox_core_xsd.tmp#Event cybox_core_xsd.tmp#ObservableType_Observable_Composition cybox_core_xsd.tmp#ObservableType_Pattern_Fidelity cybox_core_xsd.tmp#ObservableType
Type cybox:ObservableType
Children cybox:Description, cybox:Event, cybox:Keywords, cybox:Object, cybox:Observable_Composition, cybox:Observable_Source, cybox:Pattern_Fidelity, cybox:Title
Attributes
QName Type Default Use Annotation
id xs:QName optional
The id field specifies a unique id for this Observable.
idref xs:QName optional
The idref field specifies a unique id reference to an Observable defined elsewhere.
When idref is specified, the id attribute must not be specified, and any instance of this Observable should not hold content unless an extension of the Observable allows it.
negate xs:boolean false optional
The negate field, when set to true, indicates the absence (rather than the presence) of the given Observable in a CybOX pattern.
sighting_count xs:positiveInteger optional
The sighting_count field specifies how many different identical instances of the Observable may have been seen/sighted.
Source
<xs:element name="Observable" type="cybox:ObservableType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Observable construct represents a description of a single cyber observable.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ObservableType / cybox:Pattern_Fidelity
Namespace http://cybox.mitre.org/cybox-2
Annotations
Pattern_Fidelity contains elements that enable the characterization of the fidelity of this pattern to its purpose.
Diagram
Diagram cybox_core_xsd.tmp#PatternFidelityType_Noisiness cybox_core_xsd.tmp#PatternFidelityType_Ease_of_Evasion cybox_core_xsd.tmp#PatternFidelityType_Evasion_Techniques cybox_core_xsd.tmp#PatternFidelityType
Type cybox:PatternFidelityType
Children cybox:Ease_of_Evasion, cybox:Evasion_Techniques, cybox:Noisiness
Source
<xs:element name="Pattern_Fidelity" type="cybox:PatternFidelityType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>Pattern_Fidelity contains elements that enable the characterization of the fidelity of this pattern to its purpose.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:PatternFidelityType / cybox:Noisiness
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Noisiness field is optional and enables simple characterization of how noisy this Observable typically could be. In other words, how likely is it to generate false positives.
Diagram
Diagram cybox_core_xsd.tmp#NoisinessEnum
Type cybox:NoisinessEnum
Facets
enumeration High
Specifies that this observable has a high level of noisiness meaning a potentially high level of false positives.
enumeration Medium
Specifies that this observable has a medium level of noisiness meaning a potentially medium level of false positives.
enumeration Low
Specifies that this observable has a low level of noisiness meaning a potentially low level of false positives.
Source
<xs:element name="Noisiness" type="cybox:NoisinessEnum" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Noisiness field is optional and enables simple characterization of how noisy this Observable typically could be. In other words, how likely is it to generate false positives.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:PatternFidelityType / cybox:Ease_of_Evasion
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Ease_of_Obfuscation field is optional and enables simple characterization of how easy it would be for an attacker to obfuscate the observability of this Observable.
Diagram
Diagram cybox_core_xsd.tmp#EaseOfObfuscationEnum
Type cybox:EaseOfObfuscationEnum
Facets
enumeration High
Specifies that this observable is very easy to obfuscate and hide.
enumeration Medium
Specifies that this observable is somewhat easy to obfuscate and hide.
enumeration Low
Specifies that this observable is not very easy to obfuscate and hide.
Source
<xs:element name="Ease_of_Evasion" type="cybox:EaseOfObfuscationEnum" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Ease_of_Obfuscation field is optional and enables simple characterization of how easy it would be for an attacker to obfuscate the observability of this Observable.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:PatternFidelityType / cybox:Evasion_Techniques
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Obfuscation_Techniques field is optional and enables the description of potential techniques an attacker could leverage to obfuscate the observability of this Observable.
Diagram
Diagram cybox_core_xsd.tmp#ObfuscationTechniquesType_Obfuscation_Technique cybox_core_xsd.tmp#ObfuscationTechniquesType
Type cybox:ObfuscationTechniquesType
Children cybox:Obfuscation_Technique
Source
<xs:element name="Evasion_Techniques" type="cybox:ObfuscationTechniquesType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Obfuscation_Techniques field is optional and enables the description of potential techniques an attacker could leverage to obfuscate the observability of this Observable.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ObfuscationTechniquesType / cybox:Obfuscation_Technique
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Obfuscation_Technique field is optional and enables the description of a single potential technique an attacker could leverage to obfuscate the observability of this Observable.
Diagram
Diagram cybox_core_xsd.tmp#ObfuscationTechniqueType_Description cybox_core_xsd.tmp#ObfuscationTechniqueType_Observables cybox_core_xsd.tmp#ObfuscationTechniqueType
Type cybox:ObfuscationTechniqueType
Children cybox:Description, cybox:Observables
Source
<xs:element name="Obfuscation_Technique" type="cybox:ObfuscationTechniqueType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Obfuscation_Technique field is optional and enables the description of a single potential technique an attacker could leverage to obfuscate the observability of this Observable.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ObfuscationTechniqueType / cybox:Description
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Description field captures a structured text description of the obfuscation technique.
Diagram
Diagram cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType_structuring_format cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType
Type cyboxCommon:StructuredTextType
Attributes
QName Type Use Annotation
structuring_format xs:string optional
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interfering with XML validation of the CybOX document. If this attribute is absent, the implication is that no markup is being used.
Source
<xs:element name="Description" type="cyboxCommon:StructuredTextType">
  <xs:annotation>
    <xs:documentation>The Description field captures a structured text description of the obfuscation technique.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ObfuscationTechniqueType / cybox:Observables
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Observables construct is optional and enables description of potential cyber observables that could indicate the use of this particular obfuscation technique.
Diagram
Diagram cybox_core_xsd.tmp#ObservablesType_cybox_major_version cybox_core_xsd.tmp#ObservablesType_cybox_minor_version cybox_core_xsd.tmp#ObservablesType_cybox_update_version cybox_core_xsd.tmp#ObservablesType_Observable_Package_Source cybox_core_xsd.tmp#Observable cybox_core_xsd.tmp#ObservablesType_Pools cybox_core_xsd.tmp#ObservablesType
Type cybox:ObservablesType
Children cybox:Observable, cybox:Observable_Package_Source, cybox:Pools
Attributes
QName Type Use Annotation
cybox_major_version xs:string required
The cybox_major_version field specifies the major version of the CybOX language utilized for this set of Observables.
cybox_minor_version xs:string required
The cybox_minor_version field specifies the minor version of the CybOX language utilized for this set of Observables.
cybox_update_version xs:string optional
The cybox_update_version field specifies the update version of the CybOX language utilized for this set of Observables. This field MUST be used when using an update version of CybOX.
Source
<xs:element name="Observables" type="cybox:ObservablesType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Observables construct is optional and enables description of potential cyber observables that could indicate the use of this particular obfuscation technique.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ObservablesType / cybox:Observable_Package_Source
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Observable_Package_Source field is optional and enables descriptive specification of how this package of Observables was identified and specified.
Diagram
Diagram cybox_common_xsd.tmp#MeasureSourceType_class cybox_common_xsd.tmp#MeasureSourceType_source_type cybox_common_xsd.tmp#MeasureSourceType_name cybox_common_xsd.tmp#MeasureSourceType_sighting_count cybox_common_xsd.tmp#MeasureSourceType_Information_Source_Type cybox_common_xsd.tmp#MeasureSourceType_Tool_Type cybox_common_xsd.tmp#MeasureSourceType_Description cybox_common_xsd.tmp#MeasureSourceType_Contributors cybox_common_xsd.tmp#MeasureSourceType_Time cybox_common_xsd.tmp#MeasureSourceType_Observation_Location cybox_common_xsd.tmp#MeasureSourceType_Tools cybox_common_xsd.tmp#MeasureSourceType_Platform cybox_common_xsd.tmp#MeasureSourceType_System cybox_common_xsd.tmp#MeasureSourceType_Instance cybox_common_xsd.tmp#MeasureSourceType_Observable_Location cybox_common_xsd.tmp#MeasureSourceType
Type cyboxCommon:MeasureSourceType
Children cyboxCommon:Contributors, cyboxCommon:Description, cyboxCommon:Information_Source_Type, cyboxCommon:Instance, cyboxCommon:Observable_Location, cyboxCommon:Observation_Location, cyboxCommon:Platform, cyboxCommon:System, cyboxCommon:Time, cyboxCommon:Tool_Type, cyboxCommon:Tools
Attributes
QName Type Use Annotation
class cyboxCommon:SourceClassTypeEnum optional
The class field is optional and enables identification of the high-level class of this cyber observation source.
name xs:string optional
The name field is optional and enables the assignment of a relevant name to this Discovery Method.
sighting_count xs:positiveInteger optional
The sighting_count field specifies how many different identical instances of a given Observable may have been seen/sighted by the observation source.
source_type cyboxCommon:SourceTypeEnum optional
The source_type field is optional and enables identification of the broad type of this cyber observation source.
Source
<xs:element name="Observable_Package_Source" type="cyboxCommon:MeasureSourceType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Observable_Package_Source field is optional and enables descriptive specification of how this package of Observables was identified and specified.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:Observable
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Observable construct represents a description of a single cyber observable.
Diagram
Diagram cybox_core_xsd.tmp#ObservableType_id cybox_core_xsd.tmp#ObservableType_idref cybox_core_xsd.tmp#ObservableType_negate cybox_core_xsd.tmp#ObservableType_sighting_count cybox_core_xsd.tmp#ObservableType_Title cybox_core_xsd.tmp#ObservableType_Description cybox_core_xsd.tmp#ObservableType_Keywords cybox_core_xsd.tmp#ObservableType_Observable_Source cybox_core_xsd.tmp#Object cybox_core_xsd.tmp#Event cybox_core_xsd.tmp#ObservableType_Observable_Composition cybox_core_xsd.tmp#ObservableType_Pattern_Fidelity cybox_core_xsd.tmp#ObservableType
Type cybox:ObservableType
Used by
Complex Type cybox:ObservablesType
Children cybox:Description, cybox:Event, cybox:Keywords, cybox:Object, cybox:Observable_Composition, cybox:Observable_Source, cybox:Pattern_Fidelity, cybox:Title
Attributes
QName Type Default Use Annotation
id xs:QName optional
The id field specifies a unique id for this Observable.
idref xs:QName optional
The idref field specifies a unique id reference to an Observable defined elsewhere.
When idref is specified, the id attribute must not be specified, and any instance of this Observable should not hold content unless an extension of the Observable allows it.
negate xs:boolean false optional
The negate field, when set to true, indicates the absence (rather than the presence) of the given Observable in a CybOX pattern.
sighting_count xs:positiveInteger optional
The sighting_count field specifies how many different identical instances of the Observable may have been seen/sighted.
Source
<xs:element name="Observable" type="cybox:ObservableType">
  <xs:annotation>
    <xs:documentation>The Observable construct represents a description of a single cyber observable.</xs:documentation>
  </xs:annotation>
  <xs:unique name="unique-observable-id">
    <xs:selector xpath=".//*"/>
    <xs:field xpath="@id"/>
  </xs:unique>
</xs:element>
Element cybox:ObservablesType / cybox:Pools
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Pools construct enables the description of Events, Actions, Objects and Properties in a space-efficient pooled manner with the actual Observable structures defined in the CybOX schema containing references to the pooled elements. This reduces redundancy caused when identical observable elements occur multiple times within a set of defined Observables.
Diagram
Diagram cybox_core_xsd.tmp#PoolsType_Event_Pool cybox_core_xsd.tmp#PoolsType_Action_Pool cybox_core_xsd.tmp#PoolsType_Object_Pool cybox_core_xsd.tmp#PoolsType_Property_Pool cybox_core_xsd.tmp#PoolsType
Type cybox:PoolsType
Children cybox:Action_Pool, cybox:Event_Pool, cybox:Object_Pool, cybox:Property_Pool
Source
<xs:element name="Pools" type="cybox:PoolsType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Pools construct enables the description of Events, Actions, Objects and Properties in a space-efficient pooled manner with the actual Observable structures defined in the CybOX schema containing references to the pooled elements. This reduces redundancy caused when identical observable elements occur multiple times within a set of defined Observables.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:PoolsType / cybox:Event_Pool
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Event_Pool construct enables the description of CybOX Events in a space-efficient pooled manner with the actual Observable structures defined in the CybOX schema containing references to the pooled Event elements. This reduces redundancy caused when identical Events occur multiple times within a set of defined Observables.
Diagram
Diagram cybox_core_xsd.tmp#EventPoolType_Event cybox_core_xsd.tmp#EventPoolType
Type cybox:EventPoolType
Children cybox:Event
Source
<xs:element name="Event_Pool" type="cybox:EventPoolType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Event_Pool construct enables the description of CybOX Events in a space-efficient pooled manner with the actual Observable structures defined in the CybOX schema containing references to the pooled Event elements. This reduces redundancy caused when identical Events occur multiple times within a set of defined Observables.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:EventPoolType / cybox:Event
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Event construct enables specification of a cyber observable event that is dynamic in nature with specific action(s) taken against specific cyber relevant objects (e.g. a file is deleted, a registry key is created or an HTTP Get Request is received).
Diagram
Diagram cybox_core_xsd.tmp#EventType_id cybox_core_xsd.tmp#EventType_idref cybox_core_xsd.tmp#EventType_Type cybox_core_xsd.tmp#EventType_Description cybox_core_xsd.tmp#EventType_Observation_Method cybox_core_xsd.tmp#EventType_Actions cybox_core_xsd.tmp#EventType_Location cybox_core_xsd.tmp#EventType_Frequency cybox_core_xsd.tmp#EventType_Event cybox_core_xsd.tmp#EventType
Type cybox:EventType
Children cybox:Actions, cybox:Description, cybox:Event, cybox:Frequency, cybox:Location, cybox:Observation_Method, cybox:Type
Attributes
QName Type Use Annotation
id xs:QName optional
The id field specifies a unique id for this Event.
idref xs:QName optional
The idref field specifies a unique id reference to an Event defined elsewhere.
When idref is specified, the id attribute must not be specified, and any instance of this Event should not hold content unless an extension of the Event allows it.
Source
<xs:element name="Event" type="cybox:EventType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Event construct enables specification of a cyber observable event that is dynamic in nature with specific action(s) taken against specific cyber relevant objects (e.g. a file is deleted, a registry key is created or an HTTP Get Request is received).</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:PoolsType / cybox:Action_Pool
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Action_Pool construct enables the description of CybOX Actions in a space-efficient pooled manner with the actual Observable structures defined in the CybOX schema containing references to the pooled Action elements. This reduces redundancy caused when identical Actions occur multiple times within a set of defined Observables.
Diagram
Diagram cybox_core_xsd.tmp#ActionPoolType_Action cybox_core_xsd.tmp#ActionPoolType
Type cybox:ActionPoolType
Children cybox:Action
Source
<xs:element name="Action_Pool" type="cybox:ActionPoolType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Action_Pool construct enables the description of CybOX Actions in a space-efficient pooled manner with the actual Observable structures defined in the CybOX schema containing references to the pooled Action elements. This reduces redundancy caused when identical Actions occur multiple times within a set of defined Observables.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ActionPoolType / cybox:Action
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Action construct enables description/specification of a single cyber observable action.
Diagram
Diagram cybox_core_xsd.tmp#ActionType_id cybox_core_xsd.tmp#ActionType_idref cybox_core_xsd.tmp#ActionType_ordinal_position cybox_core_xsd.tmp#ActionType_action_status cybox_core_xsd.tmp#ActionType_context cybox_core_xsd.tmp#ActionType_timestamp cybox_core_xsd.tmp#ActionType_timestamp_precision cybox_core_xsd.tmp#ActionType_Type cybox_core_xsd.tmp#ActionType_Name cybox_core_xsd.tmp#ActionType_Description cybox_core_xsd.tmp#ActionType_Action_Aliases cybox_core_xsd.tmp#ActionType_Action_Arguments cybox_core_xsd.tmp#ActionType_Location cybox_core_xsd.tmp#ActionType_Discovery_Method cybox_core_xsd.tmp#ActionType_Associated_Objects cybox_core_xsd.tmp#ActionType_Relationships cybox_core_xsd.tmp#ActionType_Frequency cybox_core_xsd.tmp#ActionType
Type cybox:ActionType
Children cybox:Action_Aliases, cybox:Action_Arguments, cybox:Associated_Objects, cybox:Description, cybox:Discovery_Method, cybox:Frequency, cybox:Location, cybox:Name, cybox:Relationships, cybox:Type
Attributes
QName Type Default Use Annotation
action_status cybox:ActionStatusTypeEnum optional
The action_status field enables description of the status of the action being described.
context cybox:ActionContextTypeEnum optional
The context field is optional and enables simple characterization of the broad operational context in which the Action is relevant.
id xs:QName optional
The id field specifies a unique id for this Action.
idref xs:QName optional
The idref field specifies a unique id reference to an Action defined elsewhere.
When idref is specified, the id attribute must not be specified, and any instance of this Action should not hold content unless an extension of the Action allows it.
ordinal_position xs:positiveInteger optional
The ordinal_position field is intended to reference the ordinal position of the action with within a series of actions.
timestamp xs:dateTime optional
The timestamp field represents the local or relative time at which the action occurred or was observed. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
timestamp_precision cyboxCommon:DateTimePrecisionEnum second optional
Represents the precision of the associated timestamp value. If omitted, the default is "second", meaning the timestamp is precise to the full field value. Digits in the timestamp that are required by the xs:dateTime datatype but are beyond the specified precision should be zeroed out.
Source
<xs:element name="Action" type="cybox:ActionType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Action construct enables description/specification of a single cyber observable action.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:PoolsType / cybox:Object_Pool
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Object_Pool construct enables the description of CybOX Objects in a space-efficient pooled manner with the actual Observable structures defined in the CybOX schema containing references to the pooled Object elements. This reduces redundancy caused when identical Objects occur multiple times within a set of defined Observables.
Diagram
Diagram cybox_core_xsd.tmp#ObjectPoolType_Object cybox_core_xsd.tmp#ObjectPoolType
Type cybox:ObjectPoolType
Children cybox:Object
Source
<xs:element name="Object_Pool" type="cybox:ObjectPoolType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Object_Pool construct enables the description of CybOX Objects in a space-efficient pooled manner with the actual Observable structures defined in the CybOX schema containing references to the pooled Object elements. This reduces redundancy caused when identical Objects occur multiple times within a set of defined Observables.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ObjectPoolType / cybox:Object
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Object construct identifies and specifies the characteristics of a specific cyber-relevant object (e.g. a file, a registry key or a process).
Diagram
Diagram cybox_core_xsd.tmp#ObjectType_id cybox_core_xsd.tmp#ObjectType_idref cybox_core_xsd.tmp#ObjectType_has_changed cybox_core_xsd.tmp#ObjectType_State cybox_core_xsd.tmp#ObjectType_Description cybox_core_xsd.tmp#ObjectType_Properties cybox_core_xsd.tmp#ObjectType_Domain_Specific_Object_Properties cybox_core_xsd.tmp#ObjectType_Location cybox_core_xsd.tmp#ObjectType_Related_Objects cybox_core_xsd.tmp#ObjectType_Defined_Effect cybox_core_xsd.tmp#ObjectType_Discovery_Method cybox_core_xsd.tmp#ObjectType
Type cybox:ObjectType
Children cybox:Defined_Effect, cybox:Description, cybox:Discovery_Method, cybox:Domain_Specific_Object_Properties, cybox:Location, cybox:Properties, cybox:Related_Objects, cybox:State
Attributes
QName Type Use Annotation
has_changed xs:boolean optional
The has_changed field is optional and conveys a targeted observation pattern of whether the associated object specified has changed in some way without requiring further specific detail. This field would be leveraged within a pattern observable triggering on whether the value of an object specification has changed at all. This field is NOT intended to be used for versioning of CybOX content.
id xs:QName optional
The id field specifies a unique id for this Object.
idref xs:QName optional
The idref field specifies a unique id reference to an Object defined elsewhere.
When idref is specified, the id attribute must not be specified, and any instance of this Object should not hold content unless an extension of the Object allows it.
Source
<xs:element name="Object" type="cybox:ObjectType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Object construct identifies and specifies the characteristics of a specific cyber-relevant object (e.g. a file, a registry key or a process).</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:PoolsType / cybox:Property_Pool
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Property_Pool construct enables the description of CybOX Properties in a space-efficient pooled manner with the actual Observable structures defined in the CybOX schema containing references to the pooled Properties elements. This reduces redundancy caused when identical Properties occur multiple times within a set of defined Observables.
Diagram
Diagram cybox_core_xsd.tmp#PropertyPoolType_Property cybox_core_xsd.tmp#PropertyPoolType
Type cybox:PropertyPoolType
Children cybox:Property
Source
<xs:element name="Property_Pool" type="cybox:PropertyPoolType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Property_Pool construct enables the description of CybOX Properties in a space-efficient pooled manner with the actual Observable structures defined in the CybOX schema containing references to the pooled Properties elements. This reduces redundancy caused when identical Properties occur multiple times within a set of defined Observables.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:PropertyPoolType / cybox:Property
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Property construct enables the specification of a single Object Property.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#PropertyType_name cybox_common_xsd.tmp#PropertyType_description cybox_common_xsd.tmp#PropertyType
Type cyboxCommon:PropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional
This attribute is optional and specifies the expected type for the value of the specified property.
defanging_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
description xs:string optional
A description of what this property represents.
has_changed xs:boolean optional
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional
The id field specifies a unique ID for this Object Property.
idref xs:QName optional
The idref field specifies a unique ID reference for this Object Property.
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional
This field is optional and conveys whether the associated Object property has been obfuscated.
name xs:string optional
The name field specifies a name for this property.
obfuscation_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
<xs:element name="Property" type="cyboxCommon:PropertyType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Property construct enables the specification of a single Object Property.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:Observables
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Observables construct represents a collection of cyber observables.
Diagram
Diagram cybox_core_xsd.tmp#ObservablesType_cybox_major_version cybox_core_xsd.tmp#ObservablesType_cybox_minor_version cybox_core_xsd.tmp#ObservablesType_cybox_update_version cybox_core_xsd.tmp#ObservablesType_Observable_Package_Source cybox_core_xsd.tmp#Observable cybox_core_xsd.tmp#ObservablesType_Pools cybox_core_xsd.tmp#ObservablesType
Type cybox:ObservablesType
Children cybox:Observable, cybox:Observable_Package_Source, cybox:Pools
Attributes
QName Type Use Annotation
cybox_major_version xs:string required
The cybox_major_version field specifies the major version of the CybOX language utilized for this set of Observables.
cybox_minor_version xs:string required
The cybox_minor_version field specifies the minor version of the CybOX language utilized for this set of Observables.
cybox_update_version xs:string optional
The cybox_update_version field specifies the update version of the CybOX language utilized for this set of Observables. This field MUST be used when using an update version of CybOX.
Source
<xs:element name="Observables" type="cybox:ObservablesType">
  <xs:annotation>
    <xs:documentation>The Observables construct represents a collection of cyber observables.</xs:documentation>
  </xs:annotation>
  <xs:unique name="unique-observables-id">
    <xs:selector xpath=".//*"/>
    <xs:field xpath="@id"/>
  </xs:unique>
</xs:element>
Element cybox:StateChangeEffectType / cybox:Old_Object
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Old_Object construct specifies the object and its properties as they were before the state change effect occurred.
Diagram
Diagram cybox_core_xsd.tmp#ObjectType_id cybox_core_xsd.tmp#ObjectType_idref cybox_core_xsd.tmp#ObjectType_has_changed cybox_core_xsd.tmp#ObjectType_State cybox_core_xsd.tmp#ObjectType_Description cybox_core_xsd.tmp#ObjectType_Properties cybox_core_xsd.tmp#ObjectType_Domain_Specific_Object_Properties cybox_core_xsd.tmp#ObjectType_Location cybox_core_xsd.tmp#ObjectType_Related_Objects cybox_core_xsd.tmp#ObjectType_Defined_Effect cybox_core_xsd.tmp#ObjectType_Discovery_Method cybox_core_xsd.tmp#ObjectType
Type cybox:ObjectType
Children cybox:Defined_Effect, cybox:Description, cybox:Discovery_Method, cybox:Domain_Specific_Object_Properties, cybox:Location, cybox:Properties, cybox:Related_Objects, cybox:State
Attributes
QName Type Use Annotation
has_changed xs:boolean optional
The has_changed field is optional and conveys a targeted observation pattern of whether the associated object specified has changed in some way without requiring further specific detail. This field would be leveraged within a pattern observable triggering on whether the value of an object specification has changed at all. This field is NOT intended to be used for versioning of CybOX content.
id xs:QName optional
The id field specifies a unique id for this Object.
idref xs:QName optional
The idref field specifies a unique id reference to an Object defined elsewhere.
When idref is specified, the id attribute must not be specified, and any instance of this Object should not hold content unless an extension of the Object allows it.
Source
<xs:element name="Old_Object" type="cybox:ObjectType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Old_Object construct specifies the object and its properties as they were before the state change effect occurred.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:StateChangeEffectType / cybox:New_Object
Namespace http://cybox.mitre.org/cybox-2
Annotations
The New_Object construct specifies the object and its properties as they are after the state change effect occurred.
Diagram
Diagram cybox_core_xsd.tmp#ObjectType_id cybox_core_xsd.tmp#ObjectType_idref cybox_core_xsd.tmp#ObjectType_has_changed cybox_core_xsd.tmp#ObjectType_State cybox_core_xsd.tmp#ObjectType_Description cybox_core_xsd.tmp#ObjectType_Properties cybox_core_xsd.tmp#ObjectType_Domain_Specific_Object_Properties cybox_core_xsd.tmp#ObjectType_Location cybox_core_xsd.tmp#ObjectType_Related_Objects cybox_core_xsd.tmp#ObjectType_Defined_Effect cybox_core_xsd.tmp#ObjectType_Discovery_Method cybox_core_xsd.tmp#ObjectType
Type cybox:ObjectType
Children cybox:Defined_Effect, cybox:Description, cybox:Discovery_Method, cybox:Domain_Specific_Object_Properties, cybox:Location, cybox:Properties, cybox:Related_Objects, cybox:State
Attributes
QName Type Use Annotation
has_changed xs:boolean optional
The has_changed field is optional and conveys a targeted observation pattern of whether the associated object specified has changed in some way without requiring further specific detail. This field would be leveraged within a pattern observable triggering on whether the value of an object specification has changed at all. This field is NOT intended to be used for versioning of CybOX content.
id xs:QName optional
The id field specifies a unique id for this Object.
idref xs:QName optional
The idref field specifies a unique id reference to an Object defined elsewhere.
When idref is specified, the id attribute must not be specified, and any instance of this Object should not hold content unless an extension of the Object allows it.
Source
<xs:element name="New_Object" type="cybox:ObjectType">
  <xs:annotation>
    <xs:documentation>The New_Object construct specifies the object and its properties as they are after the state change effect occurred.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:DataReadEffectType / cybox:Data
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Data field specifies the data that was read from the object by the action.
Diagram
Diagram cybox_common_xsd.tmp#DataSegmentType_id cybox_common_xsd.tmp#DataSegmentType_Data_Format cybox_common_xsd.tmp#DataSegmentType_Data_Size cybox_common_xsd.tmp#DataSegmentType_Byte_Order cybox_common_xsd.tmp#DataSegmentType_Data_Segment cybox_common_xsd.tmp#DataSegmentType_Offset cybox_common_xsd.tmp#DataSegmentType_Search_Distance cybox_common_xsd.tmp#DataSegmentType_Search_Within cybox_common_xsd.tmp#DataSegmentType
Type cyboxCommon:DataSegmentType
Children cyboxCommon:Byte_Order, cyboxCommon:Data_Format, cyboxCommon:Data_Segment, cyboxCommon:Data_Size, cyboxCommon:Offset, cyboxCommon:Search_Distance, cyboxCommon:Search_Within
Attributes
QName Type Use Annotation
id xs:QName optional
The id field specifies a unique id for this data segment.
Source
<xs:element name="Data" type="cyboxCommon:DataSegmentType">
  <xs:annotation>
    <xs:documentation>The Data field specifies the data that was read from the object by the action.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:DataWrittenEffectType / cybox:Data
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Data field specifies the data that was written to the object by the action.
Diagram
Diagram cybox_common_xsd.tmp#DataSegmentType_id cybox_common_xsd.tmp#DataSegmentType_Data_Format cybox_common_xsd.tmp#DataSegmentType_Data_Size cybox_common_xsd.tmp#DataSegmentType_Byte_Order cybox_common_xsd.tmp#DataSegmentType_Data_Segment cybox_common_xsd.tmp#DataSegmentType_Offset cybox_common_xsd.tmp#DataSegmentType_Search_Distance cybox_common_xsd.tmp#DataSegmentType_Search_Within cybox_common_xsd.tmp#DataSegmentType
Type cyboxCommon:DataSegmentType
Children cyboxCommon:Byte_Order, cyboxCommon:Data_Format, cyboxCommon:Data_Segment, cyboxCommon:Data_Size, cyboxCommon:Offset, cyboxCommon:Search_Distance, cyboxCommon:Search_Within
Attributes
QName Type Use Annotation
id xs:QName optional
The id field specifies a unique id for this data segment.
Source
<xs:element name="Data" type="cyboxCommon:DataSegmentType">
  <xs:annotation>
    <xs:documentation>The Data field specifies the data that was written to the object by the action.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:DataSentEffectType / cybox:Data
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Data field specifies the data that was sent on the object, or from the object, by the action.
Diagram
Diagram cybox_common_xsd.tmp#DataSegmentType_id cybox_common_xsd.tmp#DataSegmentType_Data_Format cybox_common_xsd.tmp#DataSegmentType_Data_Size cybox_common_xsd.tmp#DataSegmentType_Byte_Order cybox_common_xsd.tmp#DataSegmentType_Data_Segment cybox_common_xsd.tmp#DataSegmentType_Offset cybox_common_xsd.tmp#DataSegmentType_Search_Distance cybox_common_xsd.tmp#DataSegmentType_Search_Within cybox_common_xsd.tmp#DataSegmentType
Type cyboxCommon:DataSegmentType
Children cyboxCommon:Byte_Order, cyboxCommon:Data_Format, cyboxCommon:Data_Segment, cyboxCommon:Data_Size, cyboxCommon:Offset, cyboxCommon:Search_Distance, cyboxCommon:Search_Within
Attributes
QName Type Use Annotation
id xs:QName optional
The id field specifies a unique id for this data segment.
Source
<xs:element name="Data" type="cyboxCommon:DataSegmentType">
  <xs:annotation>
    <xs:documentation>The Data field specifies the data that was sent on the object, or from the object, by the action.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:DataReceivedEffectType / cybox:Data
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Data field specifies the data that was received on the object, or from the object, by the action.
Diagram
Diagram cybox_common_xsd.tmp#DataSegmentType_id cybox_common_xsd.tmp#DataSegmentType_Data_Format cybox_common_xsd.tmp#DataSegmentType_Data_Size cybox_common_xsd.tmp#DataSegmentType_Byte_Order cybox_common_xsd.tmp#DataSegmentType_Data_Segment cybox_common_xsd.tmp#DataSegmentType_Offset cybox_common_xsd.tmp#DataSegmentType_Search_Distance cybox_common_xsd.tmp#DataSegmentType_Search_Within cybox_common_xsd.tmp#DataSegmentType
Type cyboxCommon:DataSegmentType
Children cyboxCommon:Byte_Order, cyboxCommon:Data_Format, cyboxCommon:Data_Segment, cyboxCommon:Data_Size, cyboxCommon:Offset, cyboxCommon:Search_Distance, cyboxCommon:Search_Within
Attributes
QName Type Use Annotation
id xs:QName optional
The id field specifies a unique id for this data segment.
Source
<xs:element name="Data" type="cyboxCommon:DataSegmentType">
  <xs:annotation>
    <xs:documentation>The Data field specifies the data that was received on the object, or from the object, by the action.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:PropertyReadEffectType / cybox:Name
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Name field specifies the Name of the property being read.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Name" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Name field specifies the Name of the property being read.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:PropertyReadEffectType / cybox:Value
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Value field specifies the value of the property being read.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Value" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Value field specifies the value of the property being read.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:PropertiesEnumeratedEffectType / cybox:Properties
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Properties field specifies the properties that were enumerated as a result of the action on the object.
Diagram
Diagram cybox_core_xsd.tmp#PropertiesType_Property cybox_core_xsd.tmp#PropertiesType
Type cybox:PropertiesType
Children cybox:Property
Source
<xs:element name="Properties" type="cybox:PropertiesType">
  <xs:annotation>
    <xs:documentation>The Properties field specifies the properties that were enumerated as a result of the action on the object.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:PropertiesType / cybox:Property
Namespace http://cybox.mitre.org/cybox-2
Annotations
The Property element specifies a single property that was enumerated as a result of the action on the object.
Diagram
Diagram
Type xs:string
Source
<xs:element name="Property" type="xs:string" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Property element specifies a single property that was enumerated as a result of the action on the object.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cybox:ValuesEnumeratedEffectType / cybox:Values