Showing:

Annotations
Attributes
Diagrams
Facets
Source
Used by
Imported schema cybox_common.xsd
Namespace http://cybox.mitre.org/common-2
Annotations
 
This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org.
Element cyboxCommon:TimeType / cyboxCommon:Start_Time
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Start_Time field is optional and describes the starting time for this construct. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
Diagram
Diagram cybox_common_xsd.tmp#DateTimeWithPrecisionType_precision cybox_common_xsd.tmp#DateTimeWithPrecisionType
Type cyboxCommon:DateTimeWithPrecisionType
Attributes
QName Type Default Use Annotation
precision cyboxCommon:DateTimePrecisionEnum second optional 
The precision of the associated dateTime. If omitted, the default is "second", meaning the full field value (including fractional seconds).
Source
 
<xs:element name="Start_Time" type="cyboxCommon:DateTimeWithPrecisionType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Start_Time field is optional and describes the starting time for this construct. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:TimeType / cyboxCommon:End_Time
Namespace http://cybox.mitre.org/common-2
Annotations
 
The End_Time field is optional and describes the ending time for this construct. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
Diagram
Diagram cybox_common_xsd.tmp#DateTimeWithPrecisionType_precision cybox_common_xsd.tmp#DateTimeWithPrecisionType
Type cyboxCommon:DateTimeWithPrecisionType
Attributes
QName Type Default Use Annotation
precision cyboxCommon:DateTimePrecisionEnum second optional 
The precision of the associated dateTime. If omitted, the default is "second", meaning the full field value (including fractional seconds).
Source
 
<xs:element name="End_Time" type="cyboxCommon:DateTimeWithPrecisionType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The End_Time field is optional and describes the ending time for this construct. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:TimeType / cyboxCommon:Produced_Time
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Produced_Time field is optional and describes the time that this construct was produced. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
Diagram
Diagram cybox_common_xsd.tmp#DateTimeWithPrecisionType_precision cybox_common_xsd.tmp#DateTimeWithPrecisionType
Type cyboxCommon:DateTimeWithPrecisionType
Attributes
QName Type Default Use Annotation
precision cyboxCommon:DateTimePrecisionEnum second optional 
The precision of the associated dateTime. If omitted, the default is "second", meaning the full field value (including fractional seconds).
Source
 
<xs:element name="Produced_Time" type="cyboxCommon:DateTimeWithPrecisionType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Produced_Time field is optional and describes the time that this construct was produced. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:TimeType / cyboxCommon:Received_Time
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Received_Time field is optional and describes the time that this construct was received. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
Diagram
Diagram cybox_common_xsd.tmp#DateTimeWithPrecisionType_precision cybox_common_xsd.tmp#DateTimeWithPrecisionType
Type cyboxCommon:DateTimeWithPrecisionType
Attributes
QName Type Default Use Annotation
precision cyboxCommon:DateTimePrecisionEnum second optional 
The precision of the associated dateTime. If omitted, the default is "second", meaning the full field value (including fractional seconds).
Source
 
<xs:element name="Received_Time" type="cyboxCommon:DateTimeWithPrecisionType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Received_Time field is optional and describes the time that this construct was received. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolsInformationType / cyboxCommon:Tool
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Tool field is optional and enables description of a single tool utilized for this cyber observation source.
Diagram
Diagram cybox_common_xsd.tmp#ToolInformationType_id cybox_common_xsd.tmp#ToolInformationType_idref cybox_common_xsd.tmp#ToolInformationType_Name cybox_common_xsd.tmp#ToolInformationType_Type cybox_common_xsd.tmp#ToolInformationType_Description cybox_common_xsd.tmp#ToolInformationType_References cybox_common_xsd.tmp#ToolInformationType_Vendor cybox_common_xsd.tmp#ToolInformationType_Version cybox_common_xsd.tmp#ToolInformationType_Service_Pack cybox_common_xsd.tmp#ToolInformationType_Tool_Specific_Data cybox_common_xsd.tmp#ToolInformationType_Tool_Hashes cybox_common_xsd.tmp#ToolInformationType_Tool_Configuration cybox_common_xsd.tmp#ToolInformationType_Execution_Environment cybox_common_xsd.tmp#ToolInformationType_Errors cybox_common_xsd.tmp#ToolInformationType_Metadata cybox_common_xsd.tmp#ToolInformationType_Compensation_Model cybox_common_xsd.tmp#ToolInformationType
Type cyboxCommon:ToolInformationType
Children cyboxCommon:Compensation_Model, cyboxCommon:Description, cyboxCommon:Errors, cyboxCommon:Execution_Environment, cyboxCommon:Metadata, cyboxCommon:Name, cyboxCommon:References, cyboxCommon:Service_Pack, cyboxCommon:Tool_Configuration, cyboxCommon:Tool_Hashes, cyboxCommon:Tool_Specific_Data, cyboxCommon:Type, cyboxCommon:Vendor, cyboxCommon:Version
Attributes
QName Type Use Annotation
id xs:QName optional 
The id field specifies a unique ID for this Tool.
idref xs:QName optional 
The idref field specifies reference to a unique ID for this Tool.
 
When idref is specified, the id attribute must not be specified, and any instance of this type should not hold content unless an extension of the type allows it.
Source
 
<xs:element name="Tool" type="cyboxCommon:ToolInformationType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Tool field is optional and enables description of a single tool utilized for this cyber observation source.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Name
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the name of the tool leveraged.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Name" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the name of the tool leveraged.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Type
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the type of the tool leveraged.
 
This field is implemented through the xsi:type controlled vocabulary extension mechanism. No default vocabulary type has been defined for CybOX 2.0. Users may either define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a free string field. Additionally, locations where the ToolInformationType is used may define default vocabularies for this field.
Diagram
Diagram cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#PatternableFieldType cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_name cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_reference cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType
Type cyboxCommon:ControlledVocabularyStringType
Type hierarchy
Attributes
QName Type Default Use Annotation
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
vocab_name xs:string optional 
The vocab_name field specifies the name of the controlled vocabulary.
vocab_reference xs:anyURI optional 
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
 
<xs:element name="Type" type="cyboxCommon:ControlledVocabularyStringType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field contains the type of the tool leveraged.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. No default vocabulary type has been defined for CybOX 2.0. Users may either define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a free string field. Additionally, locations where the ToolInformationType is used may define default vocabularies for this field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Description
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains general descriptive information for this tool.
Diagram
Diagram cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType_structuring_format cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType
Type cyboxCommon:StructuredTextType
Attributes
QName Type Use Annotation
structuring_format xs:string optional 
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interfering with XML validation of the CybOX document. If this attribute is absent, the implication is that no markup is being used.
Source
 
<xs:element name="Description" type="cyboxCommon:StructuredTextType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains general descriptive information for this tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:References
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains references to instances or additional information for this tool.
Diagram
Diagram cybox_common_xsd.tmp#ToolReferencesType_Reference cybox_common_xsd.tmp#ToolReferencesType
Type cyboxCommon:ToolReferencesType
Children cyboxCommon:Reference
Source
 
<xs:element name="References" type="cyboxCommon:ToolReferencesType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains references to instances or additional information for this tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolReferencesType / cyboxCommon:Reference
Namespace http://cybox.mitre.org/common-2
Annotations
 
Contains one reference to information or instances of a given tool.
Diagram
Diagram cybox_common_xsd.tmp#ToolReferenceType_reference_type cybox_common_xsd.tmp#ToolReferenceType
Type cyboxCommon:ToolReferenceType
Attributes
QName Type Use Annotation
reference_type cyboxCommon:ToolReferenceTypeEnum optional 
Indicates the nature of the referenced material (documentation, source, executable, etc.).
Source
 
<xs:element name="Reference" type="cyboxCommon:ToolReferenceType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>Contains one reference to information or instances of a given tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Vendor
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains information identifying the vendor organization for this tool.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Vendor" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains information identifying the vendor organization for this tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Version
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains an appropriate version descriptor of this tool.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Version" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains an appropriate version descriptor of this tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Service_Pack
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains an appropriate service pack descriptor for this tool.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Service_Pack" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains an appropriate service pack descriptor for this tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Tool_Specific_Data
Namespace http://cybox.mitre.org/common-2
Annotations
 
This is an abstract type provided to a flexible mechanism for enabling tool-specific data to be included.
Diagram
Diagram cybox_common_xsd.tmp#ToolSpecificDataType
Type cyboxCommon:ToolSpecificDataType
Source
 
<xs:element name="Tool_Specific_Data" type="cyboxCommon:ToolSpecificDataType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This is an abstract type provided to a flexible mechanism for enabling tool-specific data to be included.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Tool_Hashes
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains a hash value computed on the tool file content in order to verify its integrity.
Diagram
Diagram cybox_common_xsd.tmp#HashListType_Hash cybox_common_xsd.tmp#HashListType
Type cyboxCommon:HashListType
Children cyboxCommon:Hash
Source
 
<xs:element name="Tool_Hashes" type="cyboxCommon:HashListType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains a hash value computed on the tool file content in order to verify its integrity.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashListType / cyboxCommon:Hash
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Hash field specifies a single calculated hash value.
Diagram
Diagram cybox_common_xsd.tmp#HashType_Type cybox_common_xsd.tmp#HashType_Simple_Hash_Value cybox_common_xsd.tmp#HashType_Fuzzy_Hash_Value cybox_common_xsd.tmp#HashType_Fuzzy_Hash_Structure cybox_common_xsd.tmp#HashType
Type cyboxCommon:HashType
Children cyboxCommon:Fuzzy_Hash_Structure, cyboxCommon:Fuzzy_Hash_Value, cyboxCommon:Simple_Hash_Value, cyboxCommon:Type
Source
 
<xs:element name="Hash" type="cyboxCommon:HashType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Hash field specifies a single calculated hash value.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashType / cyboxCommon:Type
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Type field utilizes a standardized controlled vocabulary to capture the type of hash used in the Simple_Hash_Value or Fuzzy_Hash_Value elements.
 
This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is HashNameVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.
 
Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.
Diagram
Diagram cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#PatternableFieldType cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_name cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType_vocab_reference cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_ControlledVocabularyStringType
Type cyboxCommon:ControlledVocabularyStringType
Type hierarchy
Attributes
QName Type Default Use Annotation
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
vocab_name xs:string optional 
The vocab_name field specifies the name of the controlled vocabulary.
vocab_reference xs:anyURI optional 
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
 
<xs:element name="Type" type="cyboxCommon:ControlledVocabularyStringType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Type field utilizes a standardized controlled vocabulary to capture the type of hash used in the Simple_Hash_Value or Fuzzy_Hash_Value elements.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is HashNameVocab in the http://cybox.mitre.org/default_vocabularies-2 namespace. This type is defined in the cybox_default_vocabularies.xsd file or at the URL http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd.</xs:documentation>
    <xs:documentation>Users may also define their own vocabulary using the type extension mechanism (by specifying a vocabulary name and/or reference using the vocab_name and vocab_reference attributes, respectively) or simply use this as a string field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashType / cyboxCommon:Simple_Hash_Value
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Simple_Hash_Value field specifies a single result value of a basic cryptograhic hash function outputting a single hexbinary hash value.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#HexBinaryObjectPropertyType_datatype cybox_common_xsd.tmp#HexBinaryObjectPropertyType cybox_common_xsd.tmp#SimpleHashValueType
Type cyboxCommon:SimpleHashValueType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum hexBinary optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Simple_Hash_Value" type="cyboxCommon:SimpleHashValueType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Simple_Hash_Value field specifies a single result value of a basic cryptograhic hash function outputting a single hexbinary hash value.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashType / cyboxCommon:Fuzzy_Hash_Value
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Fuzzy_Hash_Value field specifies a single result value of a cryptograhic fuzzy hash function outputting a single complex string based hash value. (e.g. SSDEEP's Block1hash:Block2hash format).
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype cybox_common_xsd.tmp#StringObjectPropertyType cybox_common_xsd.tmp#FuzzyHashValueType
Type cyboxCommon:FuzzyHashValueType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Fuzzy_Hash_Value" type="cyboxCommon:FuzzyHashValueType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Fuzzy_Hash_Value field specifies a single result value of a cryptograhic fuzzy hash function outputting a single complex string based hash value. (e.g. SSDEEP's Block1hash:Block2hash format).</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashType / cyboxCommon:Fuzzy_Hash_Structure
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Fuzzy_Hash_Structure field is optional and enables the characterization of the key internal components of a fuzzy hash calculation with a given block size.
Diagram
Diagram cybox_common_xsd.tmp#FuzzyHashStructureType_Block_Size cybox_common_xsd.tmp#FuzzyHashStructureType_Block_Hash cybox_common_xsd.tmp#FuzzyHashStructureType
Type cyboxCommon:FuzzyHashStructureType
Children cyboxCommon:Block_Hash, cyboxCommon:Block_Size
Source
 
<xs:element name="Fuzzy_Hash_Structure" type="cyboxCommon:FuzzyHashStructureType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Fuzzy_Hash_Structure field is optional and enables the characterization of the key internal components of a fuzzy hash calculation with a given block size.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:FuzzyHashStructureType / cyboxCommon:Block_Size
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Block_Size field is optional and specifies the calculated block size for this fuzzy hash calculation.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#IntegerObjectPropertyType_datatype cybox_common_xsd.tmp#IntegerObjectPropertyType
Type cyboxCommon:IntegerObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum int optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Block_Size" type="cyboxCommon:IntegerObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Block_Size field is optional and specifies the calculated block size for this fuzzy hash calculation.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:FuzzyHashStructureType / cyboxCommon:Block_Hash
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Block_Hash field is optional and enables specification of the elemental components utilized for a fuzzy hash calculation on the hashed object utilizing Block_Size to calculate trigger points.
Diagram
Diagram cybox_common_xsd.tmp#FuzzyHashBlockType_Block_Hash_Value cybox_common_xsd.tmp#FuzzyHashBlockType_Segment_Count cybox_common_xsd.tmp#FuzzyHashBlockType_Segments cybox_common_xsd.tmp#FuzzyHashBlockType
Type cyboxCommon:FuzzyHashBlockType
Children cyboxCommon:Block_Hash_Value, cyboxCommon:Segment_Count, cyboxCommon:Segments
Source
 
<xs:element name="Block_Hash" type="cyboxCommon:FuzzyHashBlockType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Block_Hash field is optional and enables specification of the elemental components utilized for a fuzzy hash calculation on the hashed object utilizing Block_Size to calculate trigger points.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:FuzzyHashBlockType / cyboxCommon:Block_Hash_Value
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Block_Hash_Value field is optional and specifies a fuzzy hash calculation result value for this Block.
Diagram
Diagram cybox_common_xsd.tmp#HashValueType_Simple_Hash_Value cybox_common_xsd.tmp#HashValueType_Fuzzy_Hash_Value cybox_common_xsd.tmp#HashValueType
Type cyboxCommon:HashValueType
Children cyboxCommon:Fuzzy_Hash_Value, cyboxCommon:Simple_Hash_Value
Source
 
<xs:element name="Block_Hash_Value" type="cyboxCommon:HashValueType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Block_Hash_Value field is optional and specifies a fuzzy hash calculation result value for this Block.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashValueType / cyboxCommon:Simple_Hash_Value
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Simple_Hash_Value field specifies a single result value of a basic cryptograhic hash function outputting a single hexbinary hash value.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#HexBinaryObjectPropertyType_datatype cybox_common_xsd.tmp#HexBinaryObjectPropertyType cybox_common_xsd.tmp#SimpleHashValueType
Type cyboxCommon:SimpleHashValueType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum hexBinary optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Simple_Hash_Value" type="cyboxCommon:SimpleHashValueType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Simple_Hash_Value field specifies a single result value of a basic cryptograhic hash function outputting a single hexbinary hash value.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashValueType / cyboxCommon:Fuzzy_Hash_Value
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Fuzzy_Hash_Value field specifies a single result value of a cryptograhic fuzzy hash function outputting a single complex string based hash value. (e.g. SSDEEP's Block1hash:Block2hash format).
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype cybox_common_xsd.tmp#StringObjectPropertyType cybox_common_xsd.tmp#FuzzyHashValueType
Type cyboxCommon:FuzzyHashValueType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Fuzzy_Hash_Value" type="cyboxCommon:FuzzyHashValueType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Fuzzy_Hash_Value field specifies a single result value of a cryptograhic fuzzy hash function outputting a single complex string based hash value. (e.g. SSDEEP's Block1hash:Block2hash format).</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:FuzzyHashBlockType / cyboxCommon:Segment_Count
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Segment_Count field is optional and specifies the number of segments identified and utilized within this fuzzy hash calculation.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#IntegerObjectPropertyType_datatype cybox_common_xsd.tmp#IntegerObjectPropertyType
Type cyboxCommon:IntegerObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum int optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Segment_Count" type="cyboxCommon:IntegerObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Segment_Count field is optional and specifies the number of segments identified and utilized within this fuzzy hash calculation.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:FuzzyHashBlockType / cyboxCommon:Segments
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Segments field is optional and specifies the set of segments identified and utilized within this fuzzy hash calculation.
Diagram
Diagram cybox_common_xsd.tmp#HashSegmentsType_Segment cybox_common_xsd.tmp#HashSegmentsType
Type cyboxCommon:HashSegmentsType
Children cyboxCommon:Segment
Source
 
<xs:element name="Segments" type="cyboxCommon:HashSegmentsType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Segments field is optional and specifies the set of segments identified and utilized within this fuzzy hash calculation.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashSegmentsType / cyboxCommon:Segment
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Segment field is optional and specifies a single segment identified and utilized within this fuzzy hash calculation.
Diagram
Diagram cybox_common_xsd.tmp#HashSegmentType_Trigger_Point cybox_common_xsd.tmp#HashSegmentType_Segment_Hash cybox_common_xsd.tmp#HashSegmentType_Raw_Segment_Content cybox_common_xsd.tmp#HashSegmentType
Type cyboxCommon:HashSegmentType
Children cyboxCommon:Raw_Segment_Content, cyboxCommon:Segment_Hash, cyboxCommon:Trigger_Point
Source
 
<xs:element name="Segment" type="cyboxCommon:HashSegmentType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Segment field is optional and specifies a single segment identified and utilized within this fuzzy hash calculation.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashSegmentType / cyboxCommon:Trigger_Point
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Trigger_point field is optional and specifies the offset within the hashed object of the trigger point for this segment.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#HexBinaryObjectPropertyType_datatype cybox_common_xsd.tmp#HexBinaryObjectPropertyType
Type cyboxCommon:HexBinaryObjectPropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum hexBinary optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Trigger_Point" type="cyboxCommon:HexBinaryObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Trigger_point field is optional and specifies the offset within the hashed object of the trigger point for this segment.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashSegmentType / cyboxCommon:Segment_Hash
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Segment_Hash field is optional and specifies a calculated hash value for this segment.
Diagram
Diagram cybox_common_xsd.tmp#HashValueType_Simple_Hash_Value cybox_common_xsd.tmp#HashValueType_Fuzzy_Hash_Value cybox_common_xsd.tmp#HashValueType
Type cyboxCommon:HashValueType
Children cyboxCommon:Fuzzy_Hash_Value, cyboxCommon:Simple_Hash_Value
Source
 
<xs:element name="Segment_Hash" type="cyboxCommon:HashValueType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Segment_Hash field is optional and specifies a calculated hash value for this segment.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:HashSegmentType / cyboxCommon:Raw_Segment_Content
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Raw_Segment_Content field is optional and contains the raw content of this segment of the hashed object.
Diagram
Diagram
Source
 
<xs:element name="Raw_Segment_Content" type="xs:anyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Raw_Segment_Content field is optional and contains the raw content of this segment of the hashed object.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Tool_Configuration
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains information describing the configuration and usage of the tool.
Diagram
Diagram cybox_common_xsd.tmp#ToolConfigurationType_Configuration_Settings cybox_common_xsd.tmp#ToolConfigurationType_Dependencies cybox_common_xsd.tmp#ToolConfigurationType_Usage_Context_Assumptions cybox_common_xsd.tmp#ToolConfigurationType_Internationalization_Settings cybox_common_xsd.tmp#ToolConfigurationType_Build_Information cybox_common_xsd.tmp#ToolConfigurationType
Type cyboxCommon:ToolConfigurationType
Children cyboxCommon:Build_Information, cyboxCommon:Configuration_Settings, cyboxCommon:Dependencies, cyboxCommon:Internationalization_Settings, cyboxCommon:Usage_Context_Assumptions
Source
 
<xs:element name="Tool_Configuration" type="cyboxCommon:ToolConfigurationType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains information describing the configuration and usage of the tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolConfigurationType / cyboxCommon:Configuration_Settings
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field describes the configuration settings of this tool instance.
Diagram
Diagram cybox_common_xsd.tmp#ConfigurationSettingsType_Configuration_Setting cybox_common_xsd.tmp#ConfigurationSettingsType
Type cyboxCommon:ConfigurationSettingsType
Children cyboxCommon:Configuration_Setting
Source
 
<xs:element name="Configuration_Settings" type="cyboxCommon:ConfigurationSettingsType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field describes the configuration settings of this tool instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ConfigurationSettingsType / cyboxCommon:Configuration_Setting
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains a single configuration setting instance.
Diagram
Diagram cybox_common_xsd.tmp#ConfigurationSettingType_Item_Name cybox_common_xsd.tmp#ConfigurationSettingType_Item_Value cybox_common_xsd.tmp#ConfigurationSettingType_Item_Type cybox_common_xsd.tmp#ConfigurationSettingType_Item_Description cybox_common_xsd.tmp#ConfigurationSettingType
Type cyboxCommon:ConfigurationSettingType
Children cyboxCommon:Item_Description, cyboxCommon:Item_Name, cyboxCommon:Item_Type, cyboxCommon:Item_Value
Source
 
<xs:element name="Configuration_Setting" type="cyboxCommon:ConfigurationSettingType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field contains a single configuration setting instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ConfigurationSettingType / cyboxCommon:Item_Name
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the name of the configuration item referenced by this configuration setting instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Item_Name" type="xs:string">
  <xs:annotation>
    <xs:documentation>This field contains the name of the configuration item referenced by this configuration setting instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ConfigurationSettingType / cyboxCommon:Item_Value
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the value of this configuration setting instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Item_Value" type="xs:string">
  <xs:annotation>
    <xs:documentation>This field contains the value of this configuration setting instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ConfigurationSettingType / cyboxCommon:Item_Type
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the type of the configuration item referenced in this configuration setting instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Item_Type" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the type of the configuration item referenced in this configuration setting instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ConfigurationSettingType / cyboxCommon:Item_Description
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains a description of the configuration item referenced in this configuration setting instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Item_Description" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains a description of the configuration item referenced in this configuration setting instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolConfigurationType / cyboxCommon:Dependencies
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains information describing the relevant dependencies for this tool.
Diagram
Diagram cybox_common_xsd.tmp#DependenciesType_Dependency cybox_common_xsd.tmp#DependenciesType
Type cyboxCommon:DependenciesType
Children cyboxCommon:Dependency
Source
 
<xs:element name="Dependencies" type="cyboxCommon:DependenciesType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains information describing the relevant dependencies for this tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:DependenciesType / cyboxCommon:Dependency
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains information describing a single dependency for this tool.
Diagram
Diagram cybox_common_xsd.tmp#DependencyType_Dependency_Type cybox_common_xsd.tmp#DependencyType_Dependency_Description cybox_common_xsd.tmp#DependencyType
Type cyboxCommon:DependencyType
Children cyboxCommon:Dependency_Description, cyboxCommon:Dependency_Type
Source
 
<xs:element name="Dependency" type="cyboxCommon:DependencyType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field contains information describing a single dependency for this tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:DependencyType / cyboxCommon:Dependency_Type
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field describes the type of this dependency instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Dependency_Type" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field describes the type of this dependency instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:DependencyType / cyboxCommon:Dependency_Description
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains a description of this dependency instance.
Diagram
Diagram cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType_structuring_format cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType
Type cyboxCommon:StructuredTextType
Attributes
QName Type Use Annotation
structuring_format xs:string optional 
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interfering with XML validation of the CybOX document. If this attribute is absent, the implication is that no markup is being used.
Source
 
<xs:element name="Dependency_Description" type="cyboxCommon:StructuredTextType">
  <xs:annotation>
    <xs:documentation>This field contains a description of this dependency instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolConfigurationType / cyboxCommon:Usage_Context_Assumptions
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains descriptions of the various relevant usage context assumptions for this tool .
Diagram
Diagram cybox_common_xsd.tmp#UsageContextAssumptionsType_Usage_Context_Assumption cybox_common_xsd.tmp#UsageContextAssumptionsType
Type cyboxCommon:UsageContextAssumptionsType
Children cyboxCommon:Usage_Context_Assumption
Source
 
<xs:element name="Usage_Context_Assumptions" type="cyboxCommon:UsageContextAssumptionsType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains descriptions of the various relevant usage context assumptions for this tool .</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:UsageContextAssumptionsType / cyboxCommon:Usage_Context_Assumption
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains a single usage context assumption for this tool.
Diagram
Diagram cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType_structuring_format cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType
Type cyboxCommon:StructuredTextType
Attributes
QName Type Use Annotation
structuring_format xs:string optional 
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interfering with XML validation of the CybOX document. If this attribute is absent, the implication is that no markup is being used.
Source
 
<xs:element name="Usage_Context_Assumption" type="cyboxCommon:StructuredTextType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field contains a single usage context assumption for this tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolConfigurationType / cyboxCommon:Internationalization_Settings
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains information describing relevant internationalization setting for this tool .
Diagram
Diagram cybox_common_xsd.tmp#InternationalizationSettingsType_Internal_Strings cybox_common_xsd.tmp#InternationalizationSettingsType
Type cyboxCommon:InternationalizationSettingsType
Children cyboxCommon:Internal_Strings
Source
 
<xs:element name="Internationalization_Settings" type="cyboxCommon:InternationalizationSettingsType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains information describing relevant internationalization setting for this tool .</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:InternationalizationSettingsType / cyboxCommon:Internal_Strings
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains a single internal string instance for this internationalization setting instance.
Diagram
Diagram cybox_common_xsd.tmp#InternalStringsType_Key cybox_common_xsd.tmp#InternalStringsType_Content cybox_common_xsd.tmp#InternalStringsType
Type cyboxCommon:InternalStringsType
Children cyboxCommon:Content, cyboxCommon:Key
Source
 
<xs:element name="Internal_Strings" type="cyboxCommon:InternalStringsType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field contains a single internal string instance for this internationalization setting instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:InternalStringsType / cyboxCommon:Key
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the actual key of this internal string instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Key" type="xs:string">
  <xs:annotation>
    <xs:documentation>This field contains the actual key of this internal string instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:InternalStringsType / cyboxCommon:Content
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the actual content of this internal string instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Content" type="xs:string">
  <xs:annotation>
    <xs:documentation>This field contains the actual content of this internal string instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolConfigurationType / cyboxCommon:Build_Information
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains information describing how this tool was built.
Diagram
Diagram cybox_common_xsd.tmp#BuildInformationType_Build_ID cybox_common_xsd.tmp#BuildInformationType_Build_Project cybox_common_xsd.tmp#BuildInformationType_Build_Utility cybox_common_xsd.tmp#BuildInformationType_Build_Version cybox_common_xsd.tmp#BuildInformationType_Build_Label cybox_common_xsd.tmp#BuildInformationType_Compilers cybox_common_xsd.tmp#BuildInformationType_Compilation_Date cybox_common_xsd.tmp#BuildInformationType_Build_Configuration cybox_common_xsd.tmp#BuildInformationType_Build_Script cybox_common_xsd.tmp#BuildInformationType_Libraries cybox_common_xsd.tmp#BuildInformationType_Build_Output_Log cybox_common_xsd.tmp#BuildInformationType
Type cyboxCommon:BuildInformationType
Children cyboxCommon:Build_Configuration, cyboxCommon:Build_ID, cyboxCommon:Build_Label, cyboxCommon:Build_Output_Log, cyboxCommon:Build_Project, cyboxCommon:Build_Script, cyboxCommon:Build_Utility, cyboxCommon:Build_Version, cyboxCommon:Compilation_Date, cyboxCommon:Compilers, cyboxCommon:Libraries
Source
 
<xs:element name="Build_Information" type="cyboxCommon:BuildInformationType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains information describing how this tool was built.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildInformationType / cyboxCommon:Build_ID
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains an externally defined unique identifier of this build of this application instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Build_ID" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains an externally defined unique identifier of this build of this application instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildInformationType / cyboxCommon:Build_Project
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the project name of this build of this application instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Build_Project" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the project name of this build of this application instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildInformationType / cyboxCommon:Build_Utility
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains information identifying the utility used to build this application.
Diagram
Diagram cybox_common_xsd.tmp#BuildUtilityType_Build_Utility_Name cybox_common_xsd.tmp#BuildUtilityType_Build_Utility_Platform_Specification cybox_common_xsd.tmp#BuildUtilityType
Type cyboxCommon:BuildUtilityType
Children cyboxCommon:Build_Utility_Name, cyboxCommon:Build_Utility_Platform_Specification
Source
 
<xs:element name="Build_Utility" type="cyboxCommon:BuildUtilityType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains information identifying the utility used to build this application.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildUtilityType / cyboxCommon:Build_Utility_Name
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the informally defined name of the utility used to build this application instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Build_Utility_Name" type="xs:string">
  <xs:annotation>
    <xs:documentation>This field contains the informally defined name of the utility used to build this application instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildUtilityType / cyboxCommon:Build_Utility_Platform_Specification
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field identifies the build utility used to build this application.
Diagram
Diagram cybox_common_xsd.tmp#PlatformSpecificationType_Description cybox_common_xsd.tmp#PlatformSpecificationType_Identifier cybox_common_xsd.tmp#PlatformSpecificationType
Type cyboxCommon:PlatformSpecificationType
Children cyboxCommon:Description, cyboxCommon:Identifier
Source
 
<xs:element name="Build_Utility_Platform_Specification" type="cyboxCommon:PlatformSpecificationType">
  <xs:annotation>
    <xs:documentation>This field identifies the build utility used to build this application.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:PlatformSpecificationType / cyboxCommon:Description
Namespace http://cybox.mitre.org/common-2
Annotations
 
A prose description of the indicated platform.
Diagram
Diagram cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType_structuring_format cybox_common_xsd.tmp#http___cybox.mitre.org_common-2_StructuredTextType
Type cyboxCommon:StructuredTextType
Attributes
QName Type Use Annotation
structuring_format xs:string optional 
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interfering with XML validation of the CybOX document. If this attribute is absent, the implication is that no markup is being used.
Source
 
<xs:element name="Description" type="cyboxCommon:StructuredTextType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>A prose description of the indicated platform.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:PlatformSpecificationType / cyboxCommon:Identifier
Namespace http://cybox.mitre.org/common-2
Annotations
 
Indicates a pre-defined name for the given platform using some naming scheme. For example, one could provide a CPE (Common Platform Enumeration) name using the CPE naming format.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype cybox_common_xsd.tmp#StringObjectPropertyType cybox_common_xsd.tmp#PlatformIdentifierType_system cybox_common_xsd.tmp#PlatformIdentifierType_system-ref cybox_common_xsd.tmp#PlatformIdentifierType
Type cyboxCommon:PlatformIdentifierType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
system xs:string optional 
Indicates the naming system from which the indicated name was drawn.
system-ref xs:anyURI optional 
A reference to information about the naming system from which the indicated name was drawn.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Identifier" type="cyboxCommon:PlatformIdentifierType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>Indicates a pre-defined name for the given platform using some naming scheme. For example, one could provide a CPE (Common Platform Enumeration) name using the CPE naming format.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildInformationType / cyboxCommon:Build_Version
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the appropriate version descriptor of this build of this application instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Build_Version" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the appropriate version descriptor of this build of this application instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildInformationType / cyboxCommon:Build_Label
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains any relevant label for this build of this application instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Build_Label" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains any relevant label for this build of this application instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildInformationType / cyboxCommon:Compilers
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field describes the compilers utilized during this build of this application.
Diagram
Diagram cybox_common_xsd.tmp#CompilersType_Compiler cybox_common_xsd.tmp#CompilersType
Type cyboxCommon:CompilersType
Children cyboxCommon:Compiler
Source
 
<xs:element name="Compilers" type="cyboxCommon:CompilersType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field describes the compilers utilized during this build of this application.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:CompilersType / cyboxCommon:Compiler
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field describes a single compiler utilized during this build of this application.
Diagram
Diagram cybox_common_xsd.tmp#CompilerType_Compiler_Informal_Description cybox_common_xsd.tmp#CompilerType_Compiler_Platform_Specification cybox_common_xsd.tmp#CompilerType
Type cyboxCommon:CompilerType
Children cyboxCommon:Compiler_Informal_Description, cyboxCommon:Compiler_Platform_Specification
Source
 
<xs:element name="Compiler" type="cyboxCommon:CompilerType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field describes a single compiler utilized during this build of this application.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:CompilerType / cyboxCommon:Compiler_Informal_Description
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the informal description of this compiler instance.
Diagram
Diagram cybox_common_xsd.tmp#CompilerInformalDescriptionType_Compiler_Name cybox_common_xsd.tmp#CompilerInformalDescriptionType_Compiler_Version cybox_common_xsd.tmp#CompilerInformalDescriptionType
Type cyboxCommon:CompilerInformalDescriptionType
Children cyboxCommon:Compiler_Name, cyboxCommon:Compiler_Version
Source
 
<xs:element name="Compiler_Informal_Description" type="cyboxCommon:CompilerInformalDescriptionType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the informal description of this compiler instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:CompilerInformalDescriptionType / cyboxCommon:Compiler_Name
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the name of the compiler.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Compiler_Name" type="xs:string">
  <xs:annotation>
    <xs:documentation>This field contains the name of the compiler.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:CompilerInformalDescriptionType / cyboxCommon:Compiler_Version
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the version of the compiler.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Compiler_Version" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the version of the compiler.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:CompilerType / cyboxCommon:Compiler_Platform_Specification
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field identifies this compiler instance.
Diagram
Diagram cybox_common_xsd.tmp#PlatformSpecificationType_Description cybox_common_xsd.tmp#PlatformSpecificationType_Identifier cybox_common_xsd.tmp#PlatformSpecificationType
Type cyboxCommon:PlatformSpecificationType
Children cyboxCommon:Description, cyboxCommon:Identifier
Source
 
<xs:element name="Compiler_Platform_Specification" type="cyboxCommon:PlatformSpecificationType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field identifies this compiler instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildInformationType / cyboxCommon:Compilation_Date
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field identifies the compilation date for the build of the tool. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
Diagram
Diagram cybox_common_xsd.tmp#DateTimeWithPrecisionType_precision cybox_common_xsd.tmp#DateTimeWithPrecisionType
Type cyboxCommon:DateTimeWithPrecisionType
Attributes
QName Type Default Use Annotation
precision cyboxCommon:DateTimePrecisionEnum second optional 
The precision of the associated dateTime. If omitted, the default is "second", meaning the full field value (including fractional seconds).
Source
 
<xs:element name="Compilation_Date" type="cyboxCommon:DateTimeWithPrecisionType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field identifies the compilation date for the build of the tool. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildInformationType / cyboxCommon:Build_Configuration
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field describes how the build utility was configured for this build of this application.
Diagram
Diagram cybox_common_xsd.tmp#BuildConfigurationType_Configuration_Setting_Description cybox_common_xsd.tmp#BuildConfigurationType_Configuration_Settings cybox_common_xsd.tmp#BuildConfigurationType
Type cyboxCommon:BuildConfigurationType
Children cyboxCommon:Configuration_Setting_Description, cyboxCommon:Configuration_Settings
Source
 
<xs:element name="Build_Configuration" type="cyboxCommon:BuildConfigurationType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field describes how the build utility was configured for this build of this application.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildConfigurationType / cyboxCommon:Configuration_Setting_Description
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the description of the configuration settings for this build of this application instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Configuration_Setting_Description" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the description of the configuration settings for this build of this application instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildConfigurationType / cyboxCommon:Configuration_Settings
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the configuration settings for this build of this application instance.
Diagram
Diagram cybox_common_xsd.tmp#ConfigurationSettingsType_Configuration_Setting cybox_common_xsd.tmp#ConfigurationSettingsType
Type cyboxCommon:ConfigurationSettingsType
Children cyboxCommon:Configuration_Setting
Source
 
<xs:element name="Configuration_Settings" type="cyboxCommon:ConfigurationSettingsType">
  <xs:annotation>
    <xs:documentation>This field contains the configuration settings for this build of this application instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildInformationType / cyboxCommon:Build_Script
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the actual build script for this build of this application instance.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Build_Script" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains the actual build script for this build of this application instance.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildInformationType / cyboxCommon:Libraries
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field identifies the libraries incorporated into the build of the tool.
Diagram
Diagram cybox_common_xsd.tmp#LibrariesType_Library cybox_common_xsd.tmp#LibrariesType
Type cyboxCommon:LibrariesType
Children cyboxCommon:Library
Source
 
<xs:element name="Libraries" type="cyboxCommon:LibrariesType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field identifies the libraries incorporated into the build of the tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:LibrariesType / cyboxCommon:Library
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field identifies a library incorporated into the build of the tool.
Diagram
Diagram cybox_common_xsd.tmp#LibraryType_name cybox_common_xsd.tmp#LibraryType_version cybox_common_xsd.tmp#LibraryType
Type cyboxCommon:LibraryType
Attributes
QName Type Use Annotation
name xs:string optional 
This field identifies the name of the library.
version xs:string optional 
This field identifies the version of the library.
Source
 
<xs:element name="Library" type="cyboxCommon:LibraryType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field identifies a library incorporated into the build of the tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:BuildInformationType / cyboxCommon:Build_Output_Log
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains a capture of the output log of the build process.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Build_Output_Log" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains a capture of the output log of the build process.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Execution_Environment
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains information describing the execution environment of the tool.
Diagram
Diagram cybox_common_xsd.tmp#ExecutionEnvironmentType_System cybox_common_xsd.tmp#ExecutionEnvironmentType_User_Account_Info cybox_common_xsd.tmp#ExecutionEnvironmentType_Command_Line cybox_common_xsd.tmp#ExecutionEnvironmentType_Start_Time cybox_common_xsd.tmp#ExecutionEnvironmentType
Type cyboxCommon:ExecutionEnvironmentType
Children cyboxCommon:Command_Line, cyboxCommon:Start_Time, cyboxCommon:System, cyboxCommon:User_Account_Info
Source
 
<xs:element name="Execution_Environment" type="cyboxCommon:ExecutionEnvironmentType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains information describing the execution environment of the tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ExecutionEnvironmentType / cyboxCommon:System
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains information describing the system on which the tool was executed. System should be of type SystemObj:SystemObjectType.
Diagram
Diagram cybox_common_xsd.tmp#ObjectPropertiesType_object_reference cybox_common_xsd.tmp#ObjectPropertiesType_Custom_Properties cybox_common_xsd.tmp#ObjectPropertiesType
Type cyboxCommon:ObjectPropertiesType
Children cyboxCommon:Custom_Properties
Attributes
QName Type Use Annotation
object_reference xs:QName optional 
The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
Source
 
<xs:element name="System" type="cyboxCommon:ObjectPropertiesType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains information describing the system on which the tool was executed. System should be of type SystemObj:SystemObjectType.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ObjectPropertiesType / cyboxCommon:Custom_Properties
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Custom_Properties construct is optional and enables the specification of a set of custom Object Properties that may not be defined in existing Properties schemas.
Diagram
Diagram cybox_common_xsd.tmp#CustomPropertiesType_Property cybox_common_xsd.tmp#CustomPropertiesType
Type cyboxCommon:CustomPropertiesType
Children cyboxCommon:Property
Source
 
<xs:element name="Custom_Properties" type="cyboxCommon:CustomPropertiesType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Custom_Properties construct is optional and enables the specification of a set of custom Object Properties that may not be defined in existing Properties schemas.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:CustomPropertiesType / cyboxCommon:Property
Namespace http://cybox.mitre.org/common-2
Annotations
 
The Property construct enables the specification of a single Object Property.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#PropertyType_name cybox_common_xsd.tmp#PropertyType_description cybox_common_xsd.tmp#PropertyType
Type cyboxCommon:PropertyType
Type hierarchy
Attributes
QName Type Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional 
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional 
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional 
This attribute is optional and specifies the expected type for the value of the specified property.
defanging_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
delimiter xs:string ##comma## optional 
The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
description xs:string optional 
A description of what this property represents.
has_changed xs:boolean optional 
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional 
The id field specifies a unique ID for this Object Property.
idref xs:QName optional 
The idref field specifies a unique ID reference for this Object Property.
 
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
is_case_sensitive xs:boolean true optional 
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
is_defanged xs:boolean optional 
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional 
This field is optional and conveys whether the associated Object property has been obfuscated.
name xs:string optional 
The name field specifies a name for this property.
obfuscation_algorithm_ref xs:anyURI optional 
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
observed_encoding xs:string optional 
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
 
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
 
This field is intended to be applicable only to fields which contain string values.
pattern_type cyboxCommon:PatternTypeEnum optional 
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional 
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional 
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional 
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
 
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
 
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional 
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
 
<xs:element name="Property" type="cyboxCommon:PropertyType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Property construct enables the specification of a single Object Property.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ExecutionEnvironmentType / cyboxCommon:User_Account_Info
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains information describing the user account that executed the tool. User_Account_Info should be of type UserAccountObj:UserAccountObjectType.
Diagram
Diagram cybox_common_xsd.tmp#ObjectPropertiesType_object_reference cybox_common_xsd.tmp#ObjectPropertiesType_Custom_Properties cybox_common_xsd.tmp#ObjectPropertiesType
Type cyboxCommon:ObjectPropertiesType
Children cyboxCommon:Custom_Properties
Attributes
QName Type Use Annotation
object_reference xs:QName optional 
The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
Source
 
<xs:element name="User_Account_Info" type="cyboxCommon:ObjectPropertiesType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field contains information describing the user account that executed the tool. User_Account_Info should be of type UserAccountObj:UserAccountObjectType.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ExecutionEnvironmentType / cyboxCommon:Command_Line
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field specifies the command line string used to run the tool.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Command_Line" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field specifies the command line string used to run the tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ExecutionEnvironmentType / cyboxCommon:Start_Time
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field specifies when the tool was run. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
Diagram
Diagram cybox_common_xsd.tmp#DateTimeWithPrecisionType_precision cybox_common_xsd.tmp#DateTimeWithPrecisionType
Type cyboxCommon:DateTimeWithPrecisionType
Attributes
QName Type Default Use Annotation
precision cyboxCommon:DateTimePrecisionEnum second optional 
The precision of the associated dateTime. If omitted, the default is "second", meaning the full field value (including fractional seconds).
Source
 
<xs:element name="Start_Time" type="cyboxCommon:DateTimeWithPrecisionType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field specifies when the tool was run. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Errors
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field captures any errors generated during the run of the tool.
Diagram
Diagram cybox_common_xsd.tmp#ErrorsType_Error cybox_common_xsd.tmp#ErrorsType
Type cyboxCommon:ErrorsType
Children cyboxCommon:Error
Source
 
<xs:element name="Errors" type="cyboxCommon:ErrorsType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field captures any errors generated during the run of the tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ErrorsType / cyboxCommon:Error
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field captures a single type of error generated during the run of the tool.
Diagram
Diagram cybox_common_xsd.tmp#ErrorType_Error_Type cybox_common_xsd.tmp#ErrorType_Error_Count cybox_common_xsd.tmp#ErrorType_Error_Instances cybox_common_xsd.tmp#ErrorType
Type cyboxCommon:ErrorType
Children cyboxCommon:Error_Count, cyboxCommon:Error_Instances, cyboxCommon:Error_Type
Source
 
<xs:element name="Error" type="cyboxCommon:ErrorType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field captures a single type of error generated during the run of the tool.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ErrorType / cyboxCommon:Error_Type
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field specifies the type for this tool run error.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Error_Type" type="xs:string">
  <xs:annotation>
    <xs:documentation>This field specifies the type for this tool run error.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ErrorType / cyboxCommon:Error_Count
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field specifies the count of instances for this error in the tool run.
Diagram
Diagram
Type xs:integer
Source
 
<xs:element name="Error_Count" type="xs:integer" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field specifies the count of instances for this error in the tool run.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ErrorType / cyboxCommon:Error_Instances
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field captures the actual error output for each instance of this type of error.
Diagram
Diagram cybox_common_xsd.tmp#ErrorInstancesType_Error_Instance cybox_common_xsd.tmp#ErrorInstancesType
Type cyboxCommon:ErrorInstancesType
Children cyboxCommon:Error_Instance
Source
 
<xs:element name="Error_Instances" type="cyboxCommon:ErrorInstancesType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field captures the actual error output for each instance of this type of error.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ErrorInstancesType / cyboxCommon:Error_Instance
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field captures the actual error output for a single instance of this type of error.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Error_Instance" type="xs:string" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field captures the actual error output for a single instance of this type of error.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Metadata
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field captures other relevant metadata including tool-specific fields.
Diagram
Diagram cybox_common_xsd.tmp#MetadataType_type cybox_common_xsd.tmp#MetadataType_Value cybox_common_xsd.tmp#MetadataType_SubDatum cybox_common_xsd.tmp#MetadataType
Type cyboxCommon:MetadataType
Children cyboxCommon:SubDatum, cyboxCommon:Value
Attributes
QName Type Use Annotation
type xs:string optional 
This field specifies the type of name of a single metadata field.
Source
 
<xs:element name="Metadata" type="cyboxCommon:MetadataType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field captures other relevant metadata including tool-specific fields.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:MetadataType / cyboxCommon:Value
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field specifies the value of name of a single metadata field.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Value" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>This field specifies the value of name of a single metadata field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:MetadataType / cyboxCommon:SubDatum
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field uses recursion of the MetadataType specify subdatum structures for this metadata field.
Diagram
Diagram cybox_common_xsd.tmp#MetadataType_type cybox_common_xsd.tmp#MetadataType_Value cybox_common_xsd.tmp#MetadataType_SubDatum cybox_common_xsd.tmp#MetadataType
Type cyboxCommon:MetadataType
Children cyboxCommon:SubDatum, cyboxCommon:Value
Attributes
QName Type Use Annotation
type xs:string optional 
This field specifies the type of name of a single metadata field.
Source
 
<xs:element name="SubDatum" type="cyboxCommon:MetadataType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>This field uses recursion of the MetadataType specify subdatum structures for this metadata field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element cyboxCommon:ToolInformationType / cyboxCommon:Compensation_Model
Namespace http://cybox.mitre.org/common-2
Annotations
 
This field contains the name of the compensation model used for the tool.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#CompensationModelType_datatype cybox_common_xsd.tmp#CompensationModelType
Type cyboxCommon:CompensationModelType
Type hierarchy
Attributes
QName Type Fixed Default Use Annotation
appears_random xs:boolean optional 
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional 
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.