Showing:

Annotations
Attributes
Diagrams
Facets
Source
Used by
Imported schema course_of_action.xsd
Namespace http://stix.mitre.org/CourseOfAction-1
Annotations
 
This schema was originally developed by The MITRE Corporation. The STIX XML Schema implementation is maintained by The MITRE Corporation and developed by the open STIX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the STIX website at http://stix.mitre.org.
Element coa:Course_Of_Action
Namespace http://stix.mitre.org/CourseOfAction-1
Annotations
 
The CourseOfAction field characterizes a Course of Action to be taken in regards to one of more cyber threats. NOTE: This construct is still in its early stages of maturity and will require a good deal of review and refinement.
Diagram
Diagram stix_common_xsd.tmp#CourseOfActionBaseType_id stix_common_xsd.tmp#CourseOfActionBaseType_idref stix_common_xsd.tmp#CourseOfActionBaseType_timestamp stix_common_xsd.tmp#CourseOfActionBaseType course_of_action_xsd.tmp#CourseOfActionType_version course_of_action_xsd.tmp#CourseOfActionType_Title course_of_action_xsd.tmp#CourseOfActionType_Stage course_of_action_xsd.tmp#CourseOfActionType_Type course_of_action_xsd.tmp#CourseOfActionType_Description course_of_action_xsd.tmp#CourseOfActionType_Short_Description course_of_action_xsd.tmp#CourseOfActionType_Objective course_of_action_xsd.tmp#CourseOfActionType_Parameter_Observables course_of_action_xsd.tmp#CourseOfActionType_Structured_COA course_of_action_xsd.tmp#CourseOfActionType_Impact course_of_action_xsd.tmp#CourseOfActionType_Cost course_of_action_xsd.tmp#CourseOfActionType_Efficacy course_of_action_xsd.tmp#CourseOfActionType_Information_Source course_of_action_xsd.tmp#CourseOfActionType_Handling course_of_action_xsd.tmp#CourseOfActionType_Related_COAs course_of_action_xsd.tmp#CourseOfActionType_Related_Packages course_of_action_xsd.tmp#CourseOfActionType
Type coa:CourseOfActionType
Type hierarchy
Children coa:Cost, coa:Description, coa:Efficacy, coa:Handling, coa:Impact, coa:Information_Source, coa:Objective, coa:Parameter_Observables, coa:Related_COAs, coa:Related_Packages, coa:Short_Description, coa:Stage, coa:Structured_COA, coa:Title, coa:Type
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a globally unique identifier for this COA.
idref xs:QName optional 
Specifies a globally unique identifier of a COA specified elsewhere.
 
When idref is specified, the id attribute must not be specified, and any instance of this COA should not hold content.
timestamp xs:dateTime optional 
Specifies a timestamp for the definition of a specific version of a COA. When used in conjunction with the id, this field is specifying the definition time for the specific version of the COA. When used in conjunction with the idref, this field is specifying a reference to a specific version of a COA defined elsewhere. This field has no defined semantic meaning if used in the absence of either the id or idref fields.
version coa:CourseOfActionVersionType optional 
Specifies the relevant STIX-COA schema version for this content.
Source
 
<xs:element name="Course_Of_Action" type="coa:CourseOfActionType">
  <xs:annotation>
    <xs:documentation>The CourseOfAction field characterizes a Course of Action to be taken in regards to one of more cyber threats. NOTE: This construct is still in its early stages of maturity and will require a good deal of review and refinement.</xs:documentation>
  </xs:annotation>
</xs:element>
Element coa:CourseOfActionType / coa:Title
Namespace http://stix.mitre.org/CourseOfAction-1
Annotations
 
The Title field provides a simple title for this CourseOfAction.
Diagram
Diagram
Type xs:string
Source
 
<xs:element name="Title" type="xs:string" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Title field provides a simple title for this CourseOfAction.</xs:documentation>
  </xs:annotation>
</xs:element>
Element coa:CourseOfActionType / coa:Stage
Namespace http://stix.mitre.org/CourseOfAction-1
Annotations
 
The Stage field specifies what stage in the cyber threat management lifecycle this CourseOfAction is relevant to (e.g. Remedy or Response).
 
This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is COAStageVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.
 
Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.
Diagram
Diagram stix_common_xsd.tmp#ControlledVocabularyStringType_vocab_name stix_common_xsd.tmp#ControlledVocabularyStringType_vocab_reference stix_common_xsd.tmp#ControlledVocabularyStringType
Type stixCommon:ControlledVocabularyStringType
Attributes
QName Type Use Annotation
vocab_name xs:string optional 
The vocab_name field specifies the name of the controlled vocabulary.
vocab_reference xs:anyURI optional 
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
 
<xs:element name="Stage" type="stixCommon:ControlledVocabularyStringType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Stage field specifies what stage in the cyber threat management lifecycle this CourseOfAction is relevant to (e.g. Remedy or Response).</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is COAStageVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.</xs:documentation>
    <xs:documentation>Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element coa:CourseOfActionType / coa:Type
Namespace http://stix.mitre.org/CourseOfAction-1
Annotations
 
The Type field specifies the type of this CourseOfAction.
 
This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is CourseOfActionTypeVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.
Diagram
Diagram stix_common_xsd.tmp#ControlledVocabularyStringType_vocab_name stix_common_xsd.tmp#ControlledVocabularyStringType_vocab_reference stix_common_xsd.tmp#ControlledVocabularyStringType
Type stixCommon:ControlledVocabularyStringType
Attributes
QName Type Use Annotation
vocab_name xs:string optional 
The vocab_name field specifies the name of the controlled vocabulary.
vocab_reference xs:anyURI optional 
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
 
<xs:element name="Type" type="stixCommon:ControlledVocabularyStringType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Type field specifies the type of this CourseOfAction.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is CourseOfActionTypeVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.</xs:documentation>
  </xs:annotation>
</xs:element>
Element coa:CourseOfActionType / coa:Description
Namespace http://stix.mitre.org/CourseOfAction-1
Annotations
 
The Description field is optional and provides an unstructured, text description of this CourseOfAction.
Diagram
Diagram stix_common_xsd.tmp#StructuredTextType_id stix_common_xsd.tmp#StructuredTextType_ordinality stix_common_xsd.tmp#StructuredTextType_structuring_format stix_common_xsd.tmp#StructuredTextType
Type stixCommon:StructuredTextType
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a globally unique identifier for this Description.
ordinality xs:positiveInteger optional 
Specifies the intended order position of this construct instance (e.g. Description) within a set of potentially multiple peer construct instances. If only a single construct instance is present its ordinality can be assumed to be 1. If multiple construct instances are present, the ordinality field should be specified with unique values for each instance.
structuring_format xs:string optional 
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interferring with XML validation of the STIX document. If this attribute is absent, the implication is that no markup is being used.
Source
 
<xs:element name="Description" type="stixCommon:StructuredTextType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Description field is optional and provides an unstructured, text description of this CourseOfAction.</xs:documentation>
  </xs:annotation>
</xs:element>
Element coa:CourseOfActionType / coa:Short_Description
Namespace http://stix.mitre.org/CourseOfAction-1
Annotations
 
The Short_Description field is optional and provides a short, unstructured, text description of this CourseOfAction.
Diagram
Diagram stix_common_xsd.tmp#StructuredTextType_id stix_common_xsd.tmp#StructuredTextType_ordinality stix_common_xsd.tmp#StructuredTextType_structuring_format stix_common_xsd.tmp#StructuredTextType
Type stixCommon:StructuredTextType
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a globally unique identifier for this Description.
ordinality xs:positiveInteger optional 
Specifies the intended order position of this construct instance (e.g. Description) within a set of potentially multiple peer construct instances. If only a single construct instance is present its ordinality can be assumed to be 1. If multiple construct instances are present, the ordinality field should be specified with unique values for each instance.
structuring_format xs:string optional 
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interferring with XML validation of the STIX document. If this attribute is absent, the implication is that no markup is being used.
Source
 
<xs:element name="Short_Description" type="stixCommon:StructuredTextType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Short_Description field is optional and provides a short, unstructured, text description of this CourseOfAction.</xs:documentation>
  </xs:annotation>
</xs:element>
Element coa:CourseOfActionType / coa:Objective
Namespace http://stix.mitre.org/CourseOfAction-1
Annotations
 
The Objective field characterizes the objective of this CourseOfAction.
Diagram
Diagram course_of_action_xsd.tmp#ObjectiveType_Description course_of_action_xsd.tmp#ObjectiveType_Short_Description course_of_action_xsd.tmp#ObjectiveType_Applicability_Confidence course_of_action_xsd.tmp#ObjectiveType
Type coa:ObjectiveType
Children coa:Applicability_Confidence, coa:Description, coa:Short_Description
Source
 
<xs:element name="Objective" type="coa:ObjectiveType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Objective field characterizes the objective of this CourseOfAction.</xs:documentation>
  </xs:annotation>
</xs:element>
Element coa:ObjectiveType / coa:Description
Namespace http://stix.mitre.org/CourseOfAction-1
Annotations
 
The Description field is optional and provides an unstructured, text description of the objective of this CourseOfAction.
Diagram
Diagram stix_common_xsd.tmp#StructuredTextType_id stix_common_xsd.tmp#StructuredTextType_ordinality stix_common_xsd.tmp#StructuredTextType_structuring_format stix_common_xsd.tmp#StructuredTextType
Type stixCommon:StructuredTextType
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a globally unique identifier for this Description.
ordinality xs:positiveInteger optional 
Specifies the intended order position of this construct instance (e.g. Description) within a set of potentially multiple peer construct instances. If only a single construct instance is present its ordinality can be assumed to be 1. If multiple construct instances are present, the ordinality field should be specified with unique values for each instance.
structuring_format xs:string optional 
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interferring with XML validation of the STIX document. If this attribute is absent, the implication is that no markup is being used.
Source
 
<xs:element name="Description" type="stixCommon:StructuredTextType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Description field is optional and provides an unstructured, text description of the objective of this CourseOfAction.</xs:documentation>
  </xs:annotation>
</xs:element>
Element coa:ObjectiveType / coa:Short_Description
Namespace http://stix.mitre.org/CourseOfAction-1
Annotations
 
The Short_Description field is optional and provides a short, unstructured, text description of the objective of this CourseOfAction.
Diagram
Diagram stix_common_xsd.tmp#StructuredTextType_id stix_common_xsd.tmp#StructuredTextType_ordinality stix_common_xsd.tmp#StructuredTextType_structuring_format stix_common_xsd.tmp#StructuredTextType
Type stixCommon:StructuredTextType
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a globally unique identifier for this Description.
ordinality xs:positiveInteger optional 
Specifies the intended order position of this construct instance (e.g. Description) within a set of potentially multiple peer construct instances. If only a single construct instance is present its ordinality can be assumed to be 1. If multiple construct instances are present, the ordinality field should be specified with unique values for each instance.
structuring_format xs:string optional 
Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interferring with XML validation of the STIX document. If this attribute is absent, the implication is that no markup is being used.
Source
 
<xs:element name="Short_Description" type="stixCommon:StructuredTextType" minOccurs="0" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Short_Description field is optional and provides a short, unstructured, text description of the objective of this CourseOfAction.</xs:documentation>
  </xs:annotation>
</xs:element>
Element coa:ObjectiveType / coa:Applicability_Confidence
Namespace http://stix.mitre.org/CourseOfAction-1
Annotations
 
The Applicability_Confidence field characterizes the level of confidence held in the applicability of this suggested COA for its targeted Objective.
Diagram
Diagram stix_common_xsd.tmp#ConfidenceType_timestamp stix_common_xsd.tmp#ConfidenceType_timestamp_precision stix_common_xsd.tmp#ConfidenceType_Value stix_common_xsd.tmp#ConfidenceType_Description stix_common_xsd.tmp#ConfidenceType_Source stix_common_xsd.tmp#ConfidenceType_Confidence_Assertion_Chain stix_common_xsd.tmp#ConfidenceType
Type stixCommon:ConfidenceType
Children stixCommon:Confidence_Assertion_Chain, stixCommon:Description, stixCommon:Source, stixCommon:Value
Attributes
QName Type Default Use Annotation
timestamp xs:dateTime optional 
Specifies the time of this Confidence assertion.
 
In order to avoid ambiguity, it is strongly suggest that all timestamps include a specification of the timezone if it is known.
timestamp_precision stixCommon:DateTimePrecisionEnum second optional 
Represents the precision of the associated timestamp value. If omitted, the default is "second", meaning the timestamp is precise to the full field value. Digits in the timestamp that are required by the xs:dateTime datatype but are beyond the specified precision should be zeroed out.
Source
 
<xs:element name="Applicability_Confidence" type="stixCommon:ConfidenceType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Applicability_Confidence field characterizes the level of confidence held in the applicability of this suggested COA for its targeted Objective.</xs:documentation>
  </xs:annotation>
</xs:element>
Element coa:CourseOfActionType / coa:Parameter_Observables
Namespace http://stix.mitre.org/CourseOfAction-1
Annotations
 
The Parameter_Observables field enables the specification of technical parameters to this Course of Action expressed using the CybOX Language. It is intended that the combination of the Course of Action Type and the Parameter_Observables could be used to define automated courses of action.
Diagram
Diagram cybox_core_xsd.tmp#ObservablesType_cybox_major_version cybox_core_xsd.tmp#ObservablesType_cybox_minor_version cybox_core_xsd.tmp#ObservablesType_cybox_update_version cybox_core_xsd.tmp#ObservablesType_Observable_Package_Source cybox_core_xsd.tmp#Observable cybox_core_xsd.tmp#ObservablesType_Pools cybox_core_xsd.tmp#ObservablesType
Type cybox:ObservablesType
Children cybox:Observable, cybox:Observable_Package_Source, cybox:Pools
Attributes
QName Type Use Annotation
cybox_major_version xs:string required 
The cybox_major_version field specifies the major version of the CybOX language utilized for this set of Observables.
cybox_minor_version xs:string required 
The cybox_minor_version field specifies the minor version of the CybOX language utilized for this set of Observables.
cybox_update_version xs:string optional 
The cybox_update_version field specifies the update version of the CybOX language utilized for this set of Observables. This field MUST be used when using an update version of CybOX.
Source
 
<xs:element name="Parameter_Observables" type="cybox:ObservablesType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Parameter_Observables field enables the specification of technical parameters to this Course of Action expressed using the CybOX Language. It is intended that the combination of the Course of Action Type and the Parameter_Observables could be used to define automated courses of action.</xs:documentation>
  </xs:annotation>
</xs:element>
Element coa:CourseOfActionType / coa:Structured_COA
Namespace http://stix.mitre.org/CourseOfAction-1
Annotations
 
The Structured_COA field enables the specification of an actionable structured representation for the CourseOfAction potentially for automated consumption and implementation.
 
This field is implemented through the xsi:type extension mechanism. While STIX has not defined a default type, it has provided support for passing proprietary or externally defined structured courses of action using the Generic Structured COA extension. The Generic Structured COA extension is captured in the GenericStructuredCOAType in the http://stix.mitre.org/extensions/StructuredCOA#Generic-1 namespace. This type is defined in the extensions/structured_coa/generic_structured_coa.xsd file or at the URL http://stix.mitre.org/XMLSchema/extensions/structured_coa/generic/1.1/generic_structured_coa.xsd.
Diagram
Diagram course_of_action_xsd.tmp#StructuredCOAType_id course_of_action_xsd.tmp#StructuredCOAType_idref course_of_action_xsd.tmp#StructuredCOAType
Type coa:StructuredCOAType
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a unique ID for this StructuredCOA.
idref xs:QName optional 
Specifies a reference to the ID for this StructuredCOA specified elsewhere.
 
When idref is specified, the id attribute must not be specified, and any instance of this StructuredCOA should not hold content.
Source
 
<xs:element name="Structured_COA" type="coa:StructuredCOAType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Structured_COA field enables the specification of an actionable structured representation for the CourseOfAction potentially for automated consumption and implementation.</xs:documentation>
    <xs:documentation>This field is implemented through the xsi:type extension mechanism. While STIX has not defined a default type, it has provided support for passing proprietary or externally defined structured courses of action using the Generic Structured COA extension. The Generic Structured COA extension is captured in the GenericStructuredCOAType in the http://stix.mitre.org/extensions/StructuredCOA#Generic-1 namespace. This type is defined in the extensions/structured_coa/generic_structured_coa.xsd file or at the URL http://stix.mitre.org/XMLSchema/extensions/structured_coa/generic/1.1/generic_structured_coa.xsd.</xs:documentation>
  </xs:annotation>
</xs:element>
Element coa:CourseOfActionType / coa:Impact
Namespace http://stix.mitre.org/CourseOfAction-1
Annotations
 
The Impact field characterizes the estimated impact of applying this CourseOfAction.
 
It is implemented through the StatementType, which allows for the expression of a statement in a vocabulary (Value), a description of the statement (Description), a confidence in the statement (Confidence), and the source of the statement (Source). The default vocabulary type for the Value is HighMediumLowVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.
 
Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.
Diagram
Diagram stix_common_xsd.tmp#StatementType_timestamp stix_common_xsd.tmp#StatementType_timestamp_precision stix_common_xsd.tmp#StatementType_Value stix_common_xsd.tmp#StatementType_Description stix_common_xsd.tmp#StatementType_Source stix_common_xsd.tmp#StatementType_Confidence stix_common_xsd.tmp#StatementType
Type stixCommon:StatementType
Children stixCommon:Confidence, stixCommon:Description, stixCommon:Source, stixCommon:Value
Attributes
QName Type Default Use Annotation
timestamp xs:dateTime optional 
Specifies the time this statement was asserted.
 
In order to avoid ambiguity, it is strongly suggest that all timestamps include a specification of the timezone if it is known.
timestamp_precision stixCommon:DateTimePrecisionEnum second optional 
Represents the precision of the associated timestamp value. If omitted, the default is "second", meaning the timestamp is precise to the full field value. Digits in the timestamp that are required by the xs:dateTime datatype but are beyond the specified precision should be zeroed out.
Source
 
<xs:element name="Impact" type="stixCommon:StatementType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Impact field characterizes the estimated impact of applying this CourseOfAction.</xs:documentation>
    <xs:documentation>It is implemented through the StatementType, which allows for the expression of a statement in a vocabulary (Value), a description of the statement (Description), a confidence in the statement (Confidence), and the source of the statement (Source). The default vocabulary type for the Value is HighMediumLowVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.</xs:documentation>
    <xs:documentation>Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element coa:CourseOfActionType / coa:Cost
Namespace http://stix.mitre.org/CourseOfAction-1
Annotations
 
The Cost field characterizes the estimated cost for applying this CourseOfAction.
 
It is implemented through the StatementType, which allows for the expression of a statement in a vocabulary (Value), a description of the statement (Description), a confidence in the statement (Confidence), and the source of the statement (Source). The default vocabulary type for the Value is HighMediumLowVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.
 
Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.
Diagram
Diagram stix_common_xsd.tmp#StatementType_timestamp stix_common_xsd.tmp#StatementType_timestamp_precision stix_common_xsd.tmp#StatementType_Value stix_common_xsd.tmp#StatementType_Description stix_common_xsd.tmp#StatementType_Source stix_common_xsd.tmp#StatementType_Confidence stix_common_xsd.tmp#StatementType
Type stixCommon:StatementType
Children stixCommon:Confidence, stixCommon:Description, stixCommon:Source, stixCommon:Value
Attributes
QName Type Default Use Annotation
timestamp xs:dateTime optional 
Specifies the time this statement was asserted.
 
In order to avoid ambiguity, it is strongly suggest that all timestamps include a specification of the timezone if it is known.
timestamp_precision stixCommon:DateTimePrecisionEnum second optional 
Represents the precision of the associated timestamp value. If omitted, the default is "second", meaning the timestamp is precise to the full field value. Digits in the timestamp that are required by the xs:dateTime datatype but are beyond the specified precision should be zeroed out.
Source
 
<xs:element name="Cost" type="stixCommon:StatementType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Cost field characterizes the estimated cost for applying this CourseOfAction.</xs:documentation>
    <xs:documentation>It is implemented through the StatementType, which allows for the expression of a statement in a vocabulary (Value), a description of the statement (Description), a confidence in the statement (Confidence), and the source of the statement (Source). The default vocabulary type for the Value is HighMediumLowVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.</xs:documentation>
    <xs:documentation>Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element coa:CourseOfActionType / coa:Efficacy
Namespace http://stix.mitre.org/CourseOfAction-1
Annotations
 
The Efficacy field characterizes the effectiveness of this CourseOfAction in achieving its targeted Objective.
 
It is implemented through the StatementType, which allows for the expression of a statement in a vocabulary (Value), a description of the statement (Description), a confidence in the statement (Confidence), and the source of the statement (Source). The default vocabulary type for the Value is HighMediumLowVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.
 
Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.
Diagram
Diagram stix_common_xsd.tmp#StatementType_timestamp stix_common_xsd.tmp#StatementType_timestamp_precision stix_common_xsd.tmp#StatementType_Value stix_common_xsd.tmp#StatementType_Description stix_common_xsd.tmp#StatementType_Source stix_common_xsd.tmp#StatementType_Confidence stix_common_xsd.tmp#StatementType
Type stixCommon:StatementType
Children stixCommon:Confidence, stixCommon:Description, stixCommon:Source, stixCommon:Value
Attributes
QName Type Default Use Annotation
timestamp xs:dateTime optional 
Specifies the time this statement was asserted.
 
In order to avoid ambiguity, it is strongly suggest that all timestamps include a specification of the timezone if it is known.
timestamp_precision stixCommon:DateTimePrecisionEnum second optional 
Represents the precision of the associated timestamp value. If omitted, the default is "second", meaning the timestamp is precise to the full field value. Digits in the timestamp that are required by the xs:dateTime datatype but are beyond the specified precision should be zeroed out.
Source
 
<xs:element name="Efficacy" type="stixCommon:StatementType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Efficacy field characterizes the effectiveness of this CourseOfAction in achieving its targeted Objective.</xs:documentation>
    <xs:documentation>It is implemented through the StatementType, which allows for the expression of a statement in a vocabulary (Value), a description of the statement (Description), a confidence in the statement (Confidence), and the source of the statement (Source). The default vocabulary type for the Value is HighMediumLowVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.</xs:documentation>
    <xs:documentation>Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element coa:CourseOfActionType / coa:Information_Source
Namespace http://stix.mitre.org/CourseOfAction-1
Annotations
 
The Information_Source field details the source of this entry.
Diagram
Diagram stix_common_xsd.tmp#InformationSourceType_Description stix_common_xsd.tmp#InformationSourceType_Identity stix_common_xsd.tmp#InformationSourceType_Role stix_common_xsd.tmp#InformationSourceType_Contributing_Sources stix_common_xsd.tmp#InformationSourceType_Time stix_common_xsd.tmp#InformationSourceType_Tools stix_common_xsd.tmp#InformationSourceType_References stix_common_xsd.tmp#InformationSourceType
Type stixCommon:InformationSourceType
Children stixCommon:Contributing_Sources, stixCommon:Description, stixCommon:Identity, stixCommon:References, stixCommon:Role, stixCommon:Time, stixCommon:Tools
Source
 
<xs:element name="Information_Source" type="stixCommon:InformationSourceType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Information_Source field details the source of this entry.</xs:documentation>
  </xs:annotation>
</xs:element>
Element coa:CourseOfActionType / coa:Handling
Namespace http://stix.mitre.org/CourseOfAction-1
Annotations
 
The Handling field specifies the appropriate data handling markings for the elements of this COA. The valid marking scope is the nearest CourseOfActionBaseType ancestor of this Handling element and all its descendants.
Diagram
Diagram data_marking_xsd.tmp#MarkingType_Marking data_marking_xsd.tmp#MarkingType
Type marking:MarkingType
Children marking:Marking
Source
 
<xs:element name="Handling" type="marking:MarkingType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Handling field specifies the appropriate data handling markings for the elements of this COA. The valid marking scope is the nearest CourseOfActionBaseType ancestor of this Handling element and all its descendants.</xs:documentation>
  </xs:annotation>
</xs:element>
Element coa:CourseOfActionType / coa:Related_COAs
Namespace http://stix.mitre.org/CourseOfAction-1
Annotations
Diagram
Type coa:RelatedCOAsType
Type hierarchy
Children coa:Related_COA
Attributes
Source
Element coa:RelatedCOAsType / coa:Related_COA
Namespace http://stix.mitre.org/CourseOfAction-1
Annotations
Diagram
Type stixCommon:RelatedCourseOfActionType
Type hierarchy
Children stixCommon:Confidence, stixCommon:Course_Of_Action, stixCommon:Information_Source, stixCommon:Relationship
Source
Element coa:CourseOfActionType / coa:Related_Packages
Namespace http://stix.mitre.org/CourseOfAction-1
Annotations
Diagram
Type stixCommon:RelatedPackageRefsType
Children stixCommon:Package_Reference
Source
Complex Type coa:StructuredCOAType
Namespace http://stix.mitre.org/CourseOfAction-1
Annotations
 
The StructuredCOAType enables the specification of an actionable structured representation for the CourseOfAction potentially for automated consumption and implementation.
 
This type is defined as an abstract type and is intended to be extended using the XML Schema extension mechanism to allow for the expression of a variety of structured COA types. Instance documents representing structured COAs use the xsi:type attribute to specify which implementation of this type they wish to use.
 
STIX has provided one implementation to allow for the passing of proprietary or externally defined structured courses of action in a CDATA block. This implementation is captured in the Generic Structured COA extension, which provides the GenericStructuredCOAType in the http://stix.mitre.org/extensions/StructuredCOA#Generic-1 namespace. The extension is defined in the extensions/structured_coa/generic.xsd file or at the URL http://stix.mitre.org/XMLSchema/extensions/structured_coa/generic/1.1/generic.xsd.
Diagram
Diagram course_of_action_xsd.tmp#StructuredCOAType_id course_of_action_xsd.tmp#StructuredCOAType_idref
Used by
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a unique ID for this StructuredCOA.
idref xs:QName optional 
Specifies a reference to the ID for this StructuredCOA specified elsewhere.
 
When idref is specified, the id attribute must not be specified, and any instance of this StructuredCOA should not hold content.
Source
 
<xs:complexType name="StructuredCOAType" abstract="true">
  <xs:annotation>
    <xs:documentation>The StructuredCOAType enables the specification of an actionable structured representation for the CourseOfAction potentially for automated consumption and implementation.</xs:documentation>
    <xs:documentation>This type is defined as an abstract type and is intended to be extended using the XML Schema extension mechanism to allow for the expression of a variety of structured COA types. Instance documents representing structured COAs use the xsi:type attribute to specify which implementation of this type they wish to use.</xs:documentation>
    <xs:documentation>STIX has provided one implementation to allow for the passing of proprietary or externally defined structured courses of action in a CDATA block. This implementation is captured in the Generic Structured COA extension, which provides the GenericStructuredCOAType in the http://stix.mitre.org/extensions/StructuredCOA#Generic-1 namespace. The extension is defined in the extensions/structured_coa/generic.xsd file or at the URL http://stix.mitre.org/XMLSchema/extensions/structured_coa/generic/1.1/generic.xsd.</xs:documentation>
  </xs:annotation>
  <xs:attribute name="id" type="xs:QName">
    <xs:annotation>
      <xs:documentation>Specifies a unique ID for this StructuredCOA.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
  <xs:attribute name="idref" type="xs:QName">
    <xs:annotation>
      <xs:documentation>Specifies a reference to the ID for this StructuredCOA specified elsewhere.</xs:documentation>
      <xs:documentation>When idref is specified, the id attribute must not be specified, and any instance of this StructuredCOA should not hold content.</xs:documentation>
    </xs:annotation>
  </xs:attribute>
</xs:complexType>
Complex Type coa:CourseOfActionType
Namespace http://stix.mitre.org/CourseOfAction-1
Annotations
 
Represents a single STIX Course of Action.
 
CoursesOfAction are specific measures to be taken to address threat whether they are corrective or preventative to address ExploitTargets, or responsive to counter or mitigate the potential impacts of Incidents. In a structured sense, COA consist of their relevant stage in cyber threat management (e.g., remedy of an ExploitTarget or response to an Incident), type of COA, description of COA, objective of the COA, structured representation of the COA (e.g., IPS rule or automated patch/remediation), the likely impact of the COA, the likely cost of the COA, the estimated efficacy of the COA, observable parameters for the COA, handling guidance, etc.
Diagram
Diagram stix_common_xsd.tmp#CourseOfActionBaseType_id stix_common_xsd.tmp#CourseOfActionBaseType_idref stix_common_xsd.tmp#CourseOfActionBaseType_timestamp stix_common_xsd.tmp#CourseOfActionBaseType course_of_action_xsd.tmp#CourseOfActionType_version course_of_action_xsd.tmp#CourseOfActionType_Title course_of_action_xsd.tmp#CourseOfActionType_Stage course_of_action_xsd.tmp#CourseOfActionType_Type course_of_action_xsd.tmp#CourseOfActionType_Description course_of_action_xsd.tmp#CourseOfActionType_Short_Description course_of_action_xsd.tmp#CourseOfActionType_Objective course_of_action_xsd.tmp#CourseOfActionType_Parameter_Observables course_of_action_xsd.tmp#CourseOfActionType_Structured_COA course_of_action_xsd.tmp#CourseOfActionType_Impact course_of_action_xsd.tmp#CourseOfActionType_Cost course_of_action_xsd.tmp#CourseOfActionType_Efficacy course_of_action_xsd.tmp#CourseOfActionType_Information_Source course_of_action_xsd.tmp#CourseOfActionType_Handling course_of_action_xsd.tmp#CourseOfActionType_Related_COAs course_of_action_xsd.tmp#CourseOfActionType_Related_Packages
Type extension of stixCommon:CourseOfActionBaseType
Type hierarchy
Used by
Children coa:Cost, coa:Description, coa:Efficacy, coa:Handling, coa:Impact, coa:Information_Source, coa:Objective, coa:Parameter_Observables, coa:Related_COAs, coa:Related_Packages, coa:Short_Description, coa:Stage, coa:Structured_COA, coa:Title, coa:Type
Attributes
QName Type Use Annotation
id xs:QName optional 
Specifies a globally unique identifier for this COA.
idref xs:QName optional 
Specifies a globally unique identifier of a COA specified elsewhere.
 
When idref is specified, the id attribute must not be specified, and any instance of this COA should not hold content.
timestamp xs:dateTime optional 
Specifies a timestamp for the definition of a specific version of a COA. When used in conjunction with the id, this field is specifying the definition time for the specific version of the COA. When used in conjunction with the idref, this field is specifying a reference to a specific version of a COA defined elsewhere. This field has no defined semantic meaning if used in the absence of either the id or idref fields.
version coa:CourseOfActionVersionType optional 
Specifies the relevant STIX-COA schema version for this content.
Source
 
<xs:complexType name="CourseOfActionType">
  <xs:annotation>
    <xs:documentation>Represents a single STIX Course of Action.</xs:documentation>
    <xs:documentation>CoursesOfAction are specific measures to be taken to address threat whether they are corrective or preventative to address ExploitTargets, or responsive to counter or mitigate the potential impacts of Incidents. In a structured sense, COA consist of their relevant stage in cyber threat management (e.g., remedy of an ExploitTarget or response to an Incident), type of COA, description of COA, objective of the COA, structured representation of the COA (e.g., IPS rule or automated patch/remediation), the likely impact of the COA, the likely cost of the COA, the estimated efficacy of the COA, observable parameters for the COA, handling guidance, etc.</xs:documentation>
  </xs:annotation>
  <xs:complexContent>
    <xs:extension base="stixCommon:CourseOfActionBaseType">
      <xs:sequence>
        <xs:element name="Title" type="xs:string" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Title field provides a simple title for this CourseOfAction.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Stage" type="stixCommon:ControlledVocabularyStringType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Stage field specifies what stage in the cyber threat management lifecycle this CourseOfAction is relevant to (e.g. Remedy or Response).</xs:documentation>
            <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is COAStageVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.</xs:documentation>
            <xs:documentation>Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Type" type="stixCommon:ControlledVocabularyStringType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Type field specifies the type of this CourseOfAction.</xs:documentation>
            <xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is CourseOfActionTypeVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Description" type="stixCommon:StructuredTextType" minOccurs="0" maxOccurs="unbounded">
          <xs:annotation>
            <xs:documentation>The Description field is optional and provides an unstructured, text description of this CourseOfAction.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Short_Description" type="stixCommon:StructuredTextType" minOccurs="0" maxOccurs="unbounded">
          <xs:annotation>
            <xs:documentation>The Short_Description field is optional and provides a short, unstructured, text description of this CourseOfAction.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Objective" type="coa:ObjectiveType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Objective field characterizes the objective of this CourseOfAction.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Parameter_Observables" type="cybox:ObservablesType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Parameter_Observables field enables the specification of technical parameters to this Course of Action expressed using the CybOX Language. It is intended that the combination of the Course of Action Type and the Parameter_Observables could be used to define automated courses of action.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Structured_COA" type="coa:StructuredCOAType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Structured_COA field enables the specification of an actionable structured representation for the CourseOfAction potentially for automated consumption and implementation.</xs:documentation>
            <xs:documentation>This field is implemented through the xsi:type extension mechanism. While STIX has not defined a default type, it has provided support for passing proprietary or externally defined structured courses of action using the Generic Structured COA extension. The Generic Structured COA extension is captured in the GenericStructuredCOAType in the http://stix.mitre.org/extensions/StructuredCOA#Generic-1 namespace. This type is defined in the extensions/structured_coa/generic_structured_coa.xsd file or at the URL http://stix.mitre.org/XMLSchema/extensions/structured_coa/generic/1.1/generic_structured_coa.xsd.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Impact" type="stixCommon:StatementType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Impact field characterizes the estimated impact of applying this CourseOfAction.</xs:documentation>
            <xs:documentation>It is implemented through the StatementType, which allows for the expression of a statement in a vocabulary (Value), a description of the statement (Description), a confidence in the statement (Confidence), and the source of the statement (Source). The default vocabulary type for the Value is HighMediumLowVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.</xs:documentation>
            <xs:documentation>Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Cost" type="stixCommon:StatementType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Cost field characterizes the estimated cost for applying this CourseOfAction.</xs:documentation>
            <xs:documentation>It is implemented through the StatementType, which allows for the expression of a statement in a vocabulary (Value), a description of the statement (Description), a confidence in the statement (Confidence), and the source of the statement (Source). The default vocabulary type for the Value is HighMediumLowVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.</xs:documentation>
            <xs:documentation>Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Efficacy" type="stixCommon:StatementType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Efficacy field characterizes the effectiveness of this CourseOfAction in achieving its targeted Objective.</xs:documentation>
            <xs:documentation>It is implemented through the StatementType, which allows for the expression of a statement in a vocabulary (Value), a description of the statement (Description), a confidence in the statement (Confidence), and the source of the statement (Source). The default vocabulary type for the Value is HighMediumLowVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd.</xs:documentation>
            <xs:documentation>Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Information_Source" type="stixCommon:InformationSourceType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Information_Source field details the source of this entry.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Handling" type="marking:MarkingType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Handling field specifies the appropriate data handling markings for the elements of this COA. The valid marking scope is the nearest CourseOfActionBaseType ancestor of this Handling element and all its descendants.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Related_COAs" type="coa:RelatedCOAsType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Related_COAs field identifies or characterizes relationships to one or more related courses of action.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Related_Packages" type="stixCommon:RelatedPackageRefsType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Related_Packages field identifies or characterizes relationships to set of related Packages.</xs:documentation>
            <xs:documentation>DEPRECATED: This field is deprecated and will be removed in the next major version of STIX. Its use is strongly discouraged except for legacy applications.</xs:documentation>
            <xs:appinfo>
              <deprecated>true</deprecated>
            </xs:appinfo>
          </xs:annotation>
        </xs:element>
      </xs:sequence>
      <xs:attribute name="version" type="coa:CourseOfActionVersionType">
        <xs:annotation>
          <xs:documentation>Specifies the relevant STIX-COA schema version for this content.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:extension>
  </xs:complexContent>
</xs:complexType>
Complex Type coa:ObjectiveType
Namespace http://stix.mitre.org/CourseOfAction-1
Annotations
 
The ObjectiveType characterizes the objective of this CourseOfAction.
Diagram
Diagram course_of_action_xsd.tmp#ObjectiveType_Description course_of_action_xsd.tmp#ObjectiveType_Short_Description course_of_action_xsd.tmp#ObjectiveType_Applicability_Confidence
Used by
Children coa:Applicability_Confidence, coa:Description, coa:Short_Description
Source
 
<xs:complexType name="ObjectiveType">
  <xs:annotation>
    <xs:documentation>The ObjectiveType characterizes the objective of this CourseOfAction.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Description" type="stixCommon:StructuredTextType" minOccurs="0" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Description field is optional and provides an unstructured, text description of the objective of this CourseOfAction.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Short_Description" type="stixCommon:StructuredTextType" minOccurs="0" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Short_Description field is optional and provides a short, unstructured, text description of the objective of this CourseOfAction.</xs:documentation>
      </xs:annotation>
    </xs:element>
    <xs:element name="Applicability_Confidence" type="stixCommon:ConfidenceType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Applicability_Confidence field characterizes the level of confidence held in the applicability of this suggested COA for its targeted Objective.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type coa:RelatedCOAsType
Namespace http://stix.mitre.org/CourseOfAction-1
Diagram
Diagram stix_common_xsd.tmp#GenericRelationshipListType_scope stix_common_xsd.tmp#GenericRelationshipListType course_of_action_xsd.tmp#RelatedCOAsType_Related_COA
Type extension of stixCommon:GenericRelationshipListType
Type hierarchy
Used by
Children coa:Related_COA
Attributes
QName Type Default Use Annotation
scope stixCommon:RelationshipScopeEnum exclusive optional 
Indicates how multiple related items should be interpreted in this relationship. If "inclusive" is specified, then a single conceptual relationship is being defined between the subject and the collection of objects indicated by the related items (i.e. the relationship is not necessarily relevant for any one particular object being referenced, but for the aggregated collection of objects referenced). If "exclusive" is specified, then multiple relationships are being defined between the specific subject and each object individually.
Source
 
<xs:complexType name="RelatedCOAsType">
  <xs:complexContent>
    <xs:extension base="stixCommon:GenericRelationshipListType">
      <xs:sequence>
        <xs:element name="Related_COA" type="stixCommon:RelatedCourseOfActionType" maxOccurs="unbounded">
          <xs:annotation>
            <xs:documentation>The Related_COA field specifies a single other course of action related to this course of action.</xs:documentation>
          </xs:annotation>
        </xs:element>
      </xs:sequence>
    </xs:extension>
  </xs:complexContent>
</xs:complexType>
Simple Type coa:CourseOfActionVersionType
Namespace http://stix.mitre.org/CourseOfAction-1
Annotations
 
An enumeration of all versions of the Course of Action type valid in the current release of STIX.
Diagram
Diagram
Type restriction of xs:string
Facets
enumeration 1.0
enumeration 1.0.1
enumeration 1.1
enumeration 1.1.1
enumeration 1.2
Used by
Source
 
<xs:simpleType name="CourseOfActionVersionType">
  <xs:annotation>
    <xs:documentation>An enumeration of all versions of the Course of Action type valid in the current release of STIX.</xs:documentation>
  </xs:annotation>
  <xs:restriction base="xs:string">
    <xs:enumeration value="1.0"/>
    <xs:enumeration value="1.0.1"/>
    <xs:enumeration value="1.1"/>
    <xs:enumeration value="1.1.1"/>
    <xs:enumeration value="1.2"/>
  </xs:restriction>
</xs:simpleType>
Attribute coa:StructuredCOAType / @id
Namespace No namespace
Annotations
 
Specifies a unique ID for this StructuredCOA.
Type xs:QName
Used by
Complex Type coa:StructuredCOAType
Source
 
<xs:attribute name="id" type="xs:QName">
  <xs:annotation>
    <xs:documentation>Specifies a unique ID for this StructuredCOA.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute coa:StructuredCOAType / @idref
Namespace No namespace
Annotations
 
Specifies a reference to the ID for this StructuredCOA specified elsewhere.
 
When idref is specified, the id attribute must not be specified, and any instance of this StructuredCOA should not hold content.
Type xs:QName
Used by
Complex Type coa:StructuredCOAType
Source
 
<xs:attribute name="idref" type="xs:QName">
  <xs:annotation>
    <xs:documentation>Specifies a reference to the ID for this StructuredCOA specified elsewhere.</xs:documentation>
    <xs:documentation>When idref is specified, the id attribute must not be specified, and any instance of this StructuredCOA should not hold content.</xs:documentation>
  </xs:annotation>
</xs:attribute>
Attribute coa:CourseOfActionType / @version
Namespace No namespace
Annotations
 
Specifies the relevant STIX-COA schema version for this content.
Type coa:CourseOfActionVersionType
Facets
enumeration 1.0
enumeration 1.0.1
enumeration 1.1
enumeration 1.1.1
enumeration 1.2
Used by
Complex Type coa:CourseOfActionType
Source
 
<xs:attribute name="version" type="coa:CourseOfActionVersionType">
  <xs:annotation>
    <xs:documentation>Specifies the relevant STIX-COA schema version for this content.</xs:documentation>
  </xs:annotation>
</xs:attribute>
XML Schema documentation generated by ® XML Editor.