Skip to content

Class: CyberObservableObject

  • NOTE: this is an abstract class and should not be instantiated directly

URI: attack:CyberObservableObject

 classDiagram
    class CyberObservableObject
    click CyberObservableObject href "../CyberObservableObject/"
      CyberObservableCore <|-- CyberObservableObject
        click CyberObservableCore href "../CyberObservableCore/"


      CyberObservableObject <|-- Artifact
        click Artifact href "../Artifact/"
      CyberObservableObject <|-- AutonomousSystem
        click AutonomousSystem href "../AutonomousSystem/"
      CyberObservableObject <|-- Directory
        click Directory href "../Directory/"
      CyberObservableObject <|-- DomainName
        click DomainName href "../DomainName/"
      CyberObservableObject <|-- EmailAddr
        click EmailAddr href "../EmailAddr/"
      CyberObservableObject <|-- EmailMessage
        click EmailMessage href "../EmailMessage/"
      CyberObservableObject <|-- File
        click File href "../File/"
      CyberObservableObject <|-- Ipv4Addr
        click Ipv4Addr href "../Ipv4Addr/"
      CyberObservableObject <|-- Ipv6Addr
        click Ipv6Addr href "../Ipv6Addr/"
      CyberObservableObject <|-- MacAddr
        click MacAddr href "../MacAddr/"
      CyberObservableObject <|-- Mutex
        click Mutex href "../Mutex/"
      CyberObservableObject <|-- NetworkTraffic
        click NetworkTraffic href "../NetworkTraffic/"
      CyberObservableObject <|-- Process
        click Process href "../Process/"
      CyberObservableObject <|-- Software
        click Software href "../Software/"
      CyberObservableObject <|-- Url
        click Url href "../Url/"
      CyberObservableObject <|-- UserAccount
        click UserAccount href "../UserAccount/"
      CyberObservableObject <|-- WindowsRegistryKey
        click WindowsRegistryKey href "../WindowsRegistryKey/"
      CyberObservableObject <|-- X509Certificate
        click X509Certificate href "../X509Certificate/"


      CyberObservableObject : defanged

      CyberObservableObject : description

      CyberObservableObject : extensions

      CyberObservableObject : granular_markings





        CyberObservableObject --> "*" GranularMarking : granular_markings
        click GranularMarking href "../GranularMarking/"



      CyberObservableObject : id

      CyberObservableObject : name

      CyberObservableObject : object_marking_refs

      CyberObservableObject : spec_version





        CyberObservableObject --> "0..1" SpecVersionEnum : spec_version
        click SpecVersionEnum href "../SpecVersionEnum/"



      CyberObservableObject : type

Inheritance

Slots

Name Cardinality and Range Description Inheritance
type 1
StixTypeName		 STIX object type StixEntity, CyberObservableCore
spec_version 0..1
SpecVersionEnum		 STIX specification version CyberObservableCore
id 1
StixIdentifier		 STIX object identifier StixEntity, CyberObservableCore
object_marking_refs *
StixIdentifier		 Marking definition references applied to this object CyberObservableCore
granular_markings *
GranularMarking		 Granular markings that apply to selected content CyberObservableCore
defanged 0..1
Boolean		 Defines whether or not the data contained within the object has been defanged CyberObservableCore
extensions *
String		 Open-ended extension payloads CyberObservableCore
name 0..1
String		 Human-readable name StixEntity
description 0..1
String		 Human-readable description StixEntity

Usages

used by used in type used
ObservedData objects range CyberObservableObject

Identifier and Mapping Information

Schema Source

  • from schema: https://w3id.org/lmodel/attack

Mappings

Mapping Type Mapped Value
self attack:CyberObservableObject
native attack:CyberObservableObject

LinkML Source

Direct

name: CyberObservableObject
from_schema: https://w3id.org/lmodel/attack
is_a: CyberObservableCore
abstract: true

Induced

name: CyberObservableObject
from_schema: https://w3id.org/lmodel/attack
is_a: CyberObservableCore
abstract: true
attributes:
  type:
    name: type
    description: STIX object type.
    from_schema: https://w3id.org/lmodel/attack
    related_mappings:
    - unified_cyber_ontology:state
    rank: 1000
    alias: type
    owner: CyberObservableObject
    domain_of:
    - StixEntity
    - Bundle
    - Core
    - CyberObservableCore
    - ExtensionDefinition
    - LanguageContent
    - MarkingDefinition
    - File
    range: stix_type_name
    required: true
  spec_version:
    name: spec_version
    description: STIX specification version.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:specVersion
    rank: 1000
    alias: spec_version
    owner: CyberObservableObject
    domain_of:
    - Core
    - CyberObservableCore
    - MarkingDefinition
    range: SpecVersionEnum
  id:
    name: id
    description: STIX object identifier.
    from_schema: https://w3id.org/lmodel/attack
    related_mappings:
    - unified_cyber_ontology:externalReference
    rank: 1000
    alias: id
    owner: CyberObservableObject
    domain_of:
    - StixEntity
    - Bundle
    - Core
    - CyberObservableCore
    - ExtensionDefinition
    - LanguageContent
    - MarkingDefinition
    - File
    range: stix_identifier
    required: true
  object_marking_refs:
    name: object_marking_refs
    description: Marking definition references applied to this object.
    comments:
    - 'jsonschema_minItems: "1"'
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:objectMarking
    rank: 1000
    alias: object_marking_refs
    owner: CyberObservableObject
    domain_of:
    - Core
    - CyberObservableCore
    - MarkingDefinition
    range: stix_identifier
    multivalued: true
  granular_markings:
    name: granular_markings
    description: Granular markings that apply to selected content.
    comments:
    - 'jsonschema_minItems: "1"'
    from_schema: https://w3id.org/lmodel/attack
    narrow_mappings:
    - unified_cyber_ontology:objectMarking
    rank: 1000
    alias: granular_markings
    owner: CyberObservableObject
    domain_of:
    - Core
    - CyberObservableCore
    - MarkingDefinition
    range: GranularMarking
    multivalued: true
  defanged:
    name: defanged
    description: Defines whether or not the data contained within the object has been
      defanged.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: defanged
    owner: CyberObservableObject
    domain_of:
    - CyberObservableCore
    range: boolean
  extensions:
    name: extensions
    description: Open-ended extension payloads.
    notes:
    - JSON Schema uses patternProperties for extension keys; exact key validation
      is delegated to validator tooling.
    comments:
    - 'jsonschema_rule: patternProperties validator_hint: validate-extension-keys-and-values'
    from_schema: https://w3id.org/lmodel/attack
    related_mappings:
    - unified_cyber_ontology:hasFacet
    rank: 1000
    alias: extensions
    owner: CyberObservableObject
    domain_of:
    - Core
    - CyberObservableCore
    - MarkingDefinition
    - File
    range: string
    multivalued: true
  name:
    name: name
    description: Human-readable name.
    from_schema: https://w3id.org/lmodel/attack
    exact_mappings:
    - unified_cyber_ontology:name
    rank: 1000
    alias: name
    owner: CyberObservableObject
    domain_of:
    - RelatedAsset
    - StixEntity
    - ExtensionDefinition
    - MarkingDefinition
    - AutonomousSystem
    - File
    range: string
  description:
    name: description
    description: Human-readable description.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:description
    rank: 1000
    alias: description
    owner: CyberObservableObject
    domain_of:
    - RelatedAsset
    - MutableElement
    - StixEntity
    - ExtensionDefinition
    - ExternalReference
    range: string