Class: AttackRelationship

name: AttackRelationship
annotations:
  stix_type:
    tag: stix_type
    value: relationship
description: "ATT&CK Relationship objects connect ATT&CK STIX objects using typed\
  \ semantic relationships. ATT&CK restricts STIX relationship semantics to a closed\
  \ set of relationship_type values and enforces valid (source_type, relationship_type,\
  \ target_type) combinations.\nValid relationship combinations:\n  uses:\n    malware\
  \ | tool | intrusion-set | campaign  →  attack-pattern | malware | tool\n    (malware→malware\
  \ and tool→tool combinations are explicitly prohibited)\n  mitigates:\n    course-of-action\
  \  →  attack-pattern\n  subtechnique-of:\n    attack-pattern  →  attack-pattern\
  \  (source=sub-technique, target=parent)\n  detects:\n    x-mitre-data-component\
  \ | x-mitre-detection-strategy  →  attack-pattern\n    (x-mitre-data-component→attack-pattern\
  \ DEPRECATED as of Spec 3.3.0)\n  attributed-to:\n    campaign  →  intrusion-set\n\
  \  targets:\n    attack-pattern  →  x-mitre-asset\n  revoked-by:\n    <any> → <same\
  \ STIX type>  (source and target must be the same type)\n\nATT&CK Relationship objects\
  \ do not carry a 'name' property or 'x_mitre_version'. The x_mitre_modified_by_ref\
  \ is required on all ATT&CK relationships."
comments:
- 'validator_hint: validate-attack-relationship-source-target-type-compatibility'
in_subset:
- attack_sros
from_schema: https://w3id.org/lmodel/attack
is_a: AttackObject
slots:
- x_mitre_modified_by_ref
slot_usage:
  type:
    name: type
    required: true
    pattern: ^relationship$
  id:
    name: id
    required: true
    pattern: ^relationship--
  relationship_type:
    name: relationship_type
    description: The semantic type of this relationship. Must be one of the seven
      ATT&CK relationship types.
    range: AttackRelationshipTypeEnum
    required: true
  source_ref:
    name: source_ref
    description: The STIX ID of the source object. The STIX type prefix must be compatible
      with the relationship_type and target_ref type.
    required: true
  target_ref:
    name: target_ref
    description: The STIX ID of the target object. The STIX type prefix must be compatible
      with the relationship_type and source_ref type.
    required: true
  description:
    name: description
    description: Optional human-readable description providing context about this
      specific relationship instance.
  x_mitre_modified_by_ref:
    name: x_mitre_modified_by_ref
    required: true
  name:
    name: name
    description: Not present on ATT&CK Relationship objects. Inherited from the base
      STIX specification but omitted in ATT&CK's use of relationship objects.
    required: false
  x_mitre_version:
    name: x_mitre_version
    description: Not present on ATT&CK Relationship objects. Version tracking is not
      applied to relationship objects in the ATT&CK Data Model.
    required: false

name: AttackRelationship
annotations:
  stix_type:
    tag: stix_type
    value: relationship
description: "ATT&CK Relationship objects connect ATT&CK STIX objects using typed\
  \ semantic relationships. ATT&CK restricts STIX relationship semantics to a closed\
  \ set of relationship_type values and enforces valid (source_type, relationship_type,\
  \ target_type) combinations.\nValid relationship combinations:\n  uses:\n    malware\
  \ | tool | intrusion-set | campaign  →  attack-pattern | malware | tool\n    (malware→malware\
  \ and tool→tool combinations are explicitly prohibited)\n  mitigates:\n    course-of-action\
  \  →  attack-pattern\n  subtechnique-of:\n    attack-pattern  →  attack-pattern\
  \  (source=sub-technique, target=parent)\n  detects:\n    x-mitre-data-component\
  \ | x-mitre-detection-strategy  →  attack-pattern\n    (x-mitre-data-component→attack-pattern\
  \ DEPRECATED as of Spec 3.3.0)\n  attributed-to:\n    campaign  →  intrusion-set\n\
  \  targets:\n    attack-pattern  →  x-mitre-asset\n  revoked-by:\n    <any> → <same\
  \ STIX type>  (source and target must be the same type)\n\nATT&CK Relationship objects\
  \ do not carry a 'name' property or 'x_mitre_version'. The x_mitre_modified_by_ref\
  \ is required on all ATT&CK relationships."
comments:
- 'validator_hint: validate-attack-relationship-source-target-type-compatibility'
in_subset:
- attack_sros
from_schema: https://w3id.org/lmodel/attack
is_a: AttackObject
slot_usage:
  type:
    name: type
    required: true
    pattern: ^relationship$
  id:
    name: id
    required: true
    pattern: ^relationship--
  relationship_type:
    name: relationship_type
    description: The semantic type of this relationship. Must be one of the seven
      ATT&CK relationship types.
    range: AttackRelationshipTypeEnum
    required: true
  source_ref:
    name: source_ref
    description: The STIX ID of the source object. The STIX type prefix must be compatible
      with the relationship_type and target_ref type.
    required: true
  target_ref:
    name: target_ref
    description: The STIX ID of the target object. The STIX type prefix must be compatible
      with the relationship_type and source_ref type.
    required: true
  description:
    name: description
    description: Optional human-readable description providing context about this
      specific relationship instance.
  x_mitre_modified_by_ref:
    name: x_mitre_modified_by_ref
    required: true
  name:
    name: name
    description: Not present on ATT&CK Relationship objects. Inherited from the base
      STIX specification but omitted in ATT&CK's use of relationship objects.
    required: false
  x_mitre_version:
    name: x_mitre_version
    description: Not present on ATT&CK Relationship objects. Version tracking is not
      applied to relationship objects in the ATT&CK Data Model.
    required: false
attributes:
  x_mitre_modified_by_ref:
    name: x_mitre_modified_by_ref
    description: 'The STIX ID of the identity object that created the current version
      of this object. In practice, always references MITRE''s canonical identity object:
      identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5. May differ from created_by_ref
      if the object was originally created by a third party and subsequently adopted
      or updated by MITRE.'
    comments:
    - 'validator_hint: must-match-mitre-identity-id'
    in_subset:
    - attack_sdos
    - attack_sros
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: x_mitre_modified_by_ref
    owner: AttackRelationship
    domain_of:
    - Technique
    - Tactic
    - Group
    - AttackCampaign
    - Mitigation
    - AttackMalware
    - AttackTool
    - Asset
    - DataSource
    - DataComponent
    - Matrix
    - Collection
    - DetectionStrategy
    - Analytic
    - AttackRelationship
    range: stix_identifier
    required: true
    pattern: ^identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5$
  x_mitre_attack_spec_version:
    name: x_mitre_attack_spec_version
    description: The version of the ATT&CK Data Model specification used to construct
      this object, in MAJOR.MINOR.PATCH (semantic versioning) format. Helps consuming
      software determine whether the data format is supported. Objects lacking this
      property are assumed to conform to ATT&CK spec version 2.0.0. Refer to the ATT&CK
      CHANGELOG for all supported versions.
    comments:
    - 'absent_on: marking-definition, identity (x_mitre_version absent), relationship
      (x_mitre_version absent)'
    in_subset:
    - attack_sdos
    - attack_sros
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: x_mitre_attack_spec_version
    owner: AttackRelationship
    domain_of:
    - AttackObject
    range: semver_string
    required: true
  x_mitre_version:
    name: x_mitre_version
    description: Not present on ATT&CK Relationship objects. Version tracking is not
      applied to relationship objects in the ATT&CK Data Model.
    comments:
    - 'absent_on: relationship, marking-definition'
    in_subset:
    - attack_sdos
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: x_mitre_version
    owner: AttackRelationship
    domain_of:
    - AttackObject
    range: attack_version_string
    required: false
  x_mitre_deprecated:
    name: x_mitre_deprecated
    description: Boolean flag indicating that this ATT&CK object has been deprecated
      and should no longer be used in new analyses or tooling implementations. Deprecated
      objects are retained in the knowledge base for historical reference and legacy
      compatibility, but are not actively maintained with new information.
    comments:
    - 'absent_on: marking-definition'
    in_subset:
    - attack_sdos
    - attack_sros
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: x_mitre_deprecated
    owner: AttackRelationship
    domain_of:
    - AttackObject
    range: boolean
  x_mitre_old_attack_id:
    name: x_mitre_old_attack_id
    description: A legacy ATT&CK ID previously assigned to this object before a knowledge
      base restructuring or domain migration event. Format mirrors the current ATT&CK
      ID format but from the prior numbering scheme (e.g., "MOB-T1001" for a mobile
      technique previously in the pre-unification Mobile ATT&CK dataset).
    in_subset:
    - attack_sdos
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: x_mitre_old_attack_id
    owner: AttackRelationship
    domain_of:
    - AttackObject
    range: string
  type:
    name: type
    description: STIX object type.
    from_schema: https://w3id.org/lmodel/attack
    related_mappings:
    - unified_cyber_ontology:state
    rank: 1000
    alias: type
    owner: AttackRelationship
    domain_of:
    - StixEntity
    - Bundle
    - Core
    - CyberObservableCore
    - ExtensionDefinition
    - LanguageContent
    - MarkingDefinition
    - File
    range: stix_type_name
    required: true
    pattern: ^relationship$
  spec_version:
    name: spec_version
    description: STIX specification version.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:specVersion
    rank: 1000
    alias: spec_version
    owner: AttackRelationship
    domain_of:
    - Core
    - CyberObservableCore
    - MarkingDefinition
    range: SpecVersionEnum
    required: true
  id:
    name: id
    description: STIX object identifier.
    from_schema: https://w3id.org/lmodel/attack
    related_mappings:
    - unified_cyber_ontology:externalReference
    rank: 1000
    alias: id
    owner: AttackRelationship
    domain_of:
    - StixEntity
    - Bundle
    - Core
    - CyberObservableCore
    - ExtensionDefinition
    - LanguageContent
    - MarkingDefinition
    - File
    range: stix_identifier
    required: true
    pattern: ^relationship--
  created:
    name: created
    description: Creation timestamp.
    notes:
    - STIX core timestamps require millisecond precision.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:objectCreatedTime
    rank: 1000
    alias: created
    owner: AttackRelationship
    domain_of:
    - Core
    - MarkingDefinition
    range: datetime
    required: true
    pattern: T\d{2}:\d{2}:\d{2}\.\d{3,}Z$
  modified:
    name: modified
    description: Modification timestamp.
    notes:
    - STIX core timestamps require millisecond precision.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:modifiedTime
    rank: 1000
    alias: modified
    owner: AttackRelationship
    domain_of:
    - Core
    range: datetime
    required: true
    pattern: T\d{2}:\d{2}:\d{2}\.\d{3,}Z$
  created_by_ref:
    name: created_by_ref
    description: The STIX ID of the identity object that first created this ATT&CK
      object. Typically references MITRE's identity (identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5).
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:createdBy
    rank: 1000
    alias: created_by_ref
    owner: AttackRelationship
    domain_of:
    - Core
    - MarkingDefinition
    range: stix_identifier
  labels:
    name: labels
    description: Terms used to describe this object.
    comments:
    - 'jsonschema_minItems: "1"'
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:tag
    rank: 1000
    alias: labels
    owner: AttackRelationship
    domain_of:
    - Core
    range: string
    multivalued: true
  revoked:
    name: revoked
    description: Indicates whether this object has been revoked.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: revoked
    owner: AttackRelationship
    domain_of:
    - Core
    range: boolean
  confidence:
    name: confidence
    description: Confidence that the producer has in this data.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: confidence
    owner: AttackRelationship
    domain_of:
    - Core
    range: integer
    minimum_value: 0
    maximum_value: 100
  lang:
    name: lang
    description: Language of textual properties.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: lang
    owner: AttackRelationship
    domain_of:
    - Core
    - GranularMarking
    range: string
  external_references:
    name: external_references
    description: External references to non-STIX information.
    comments:
    - 'jsonschema_minItems: "1"'
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:externalReference
    rank: 1000
    alias: external_references
    owner: AttackRelationship
    domain_of:
    - Core
    - MarkingDefinition
    range: ExternalReference
    multivalued: true
  object_marking_refs:
    name: object_marking_refs
    description: Marking definition references applied to this object.
    comments:
    - 'jsonschema_minItems: "1"'
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:objectMarking
    rank: 1000
    alias: object_marking_refs
    owner: AttackRelationship
    domain_of:
    - Core
    - CyberObservableCore
    - MarkingDefinition
    range: stix_identifier
    multivalued: true
  granular_markings:
    name: granular_markings
    description: Granular markings that apply to selected content.
    comments:
    - 'jsonschema_minItems: "1"'
    from_schema: https://w3id.org/lmodel/attack
    narrow_mappings:
    - unified_cyber_ontology:objectMarking
    rank: 1000
    alias: granular_markings
    owner: AttackRelationship
    domain_of:
    - Core
    - CyberObservableCore
    - MarkingDefinition
    range: GranularMarking
    multivalued: true
  extensions:
    name: extensions
    description: Open-ended extension payloads.
    notes:
    - JSON Schema uses patternProperties for extension keys; exact key validation
      is delegated to validator tooling.
    comments:
    - 'jsonschema_rule: patternProperties validator_hint: validate-extension-keys-and-values'
    from_schema: https://w3id.org/lmodel/attack
    related_mappings:
    - unified_cyber_ontology:hasFacet
    rank: 1000
    alias: extensions
    owner: AttackRelationship
    domain_of:
    - Core
    - CyberObservableCore
    - MarkingDefinition
    - File
    range: string
    multivalued: true
  name:
    name: name
    description: Not present on ATT&CK Relationship objects. Inherited from the base
      STIX specification but omitted in ATT&CK's use of relationship objects.
    from_schema: https://w3id.org/lmodel/attack
    exact_mappings:
    - unified_cyber_ontology:name
    rank: 1000
    alias: name
    owner: AttackRelationship
    domain_of:
    - RelatedAsset
    - StixEntity
    - ExtensionDefinition
    - MarkingDefinition
    - AutonomousSystem
    - File
    range: string
    required: false
  description:
    name: description
    description: Optional human-readable description providing context about this
      specific relationship instance.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:description
    rank: 1000
    alias: description
    owner: AttackRelationship
    domain_of:
    - RelatedAsset
    - MutableElement
    - StixEntity
    - ExtensionDefinition
    - ExternalReference
    range: string