Skip to content

Class: ExtensionDefinition

_The STIX Extension Definition object allows producers of threat intelligence to extend existing STIX objects or to create entirely new STIX objects in a standardized way. _

URI: attack:ExtensionDefinition

 classDiagram
    class ExtensionDefinition
    click ExtensionDefinition href "../ExtensionDefinition/"
      Core <|-- ExtensionDefinition
        click Core href "../Core/"

      ExtensionDefinition : confidence

      ExtensionDefinition : created

      ExtensionDefinition : created_by_ref

      ExtensionDefinition : description

      ExtensionDefinition : extension_properties

      ExtensionDefinition : extension_types





        ExtensionDefinition --> "1..*" ExtensionTypeEnum : extension_types
        click ExtensionTypeEnum href "../ExtensionTypeEnum/"



      ExtensionDefinition : extensions

      ExtensionDefinition : external_references





        ExtensionDefinition --> "*" ExternalReference : external_references
        click ExternalReference href "../ExternalReference/"



      ExtensionDefinition : granular_markings





        ExtensionDefinition --> "*" GranularMarking : granular_markings
        click GranularMarking href "../GranularMarking/"



      ExtensionDefinition : id

      ExtensionDefinition : labels

      ExtensionDefinition : lang

      ExtensionDefinition : modified

      ExtensionDefinition : name

      ExtensionDefinition : object_marking_refs

      ExtensionDefinition : revoked

      ExtensionDefinition : schema

      ExtensionDefinition : spec_version





        ExtensionDefinition --> "1" SpecVersionEnum : spec_version
        click SpecVersionEnum href "../SpecVersionEnum/"



      ExtensionDefinition : type

      ExtensionDefinition : version

Inheritance

Slots

Name Cardinality and Range Description Inheritance
type 1
StixTypeName		 STIX object type direct
id 1
StixIdentifier		 STIX object identifier direct
name 1
String		 Human-readable name direct
description 0..1
String		 Human-readable description direct
schema 1
String		 Extension schema definition or URL direct
version 1
String		 Version string direct
extension_types 1..*
ExtensionTypeEnum		 Extension-definition type list direct
extension_properties *
String		 Extension-defined property names direct
spec_version 1
SpecVersionEnum		 STIX specification version Core
created 1
Datetime		 Creation timestamp Core
modified 1
Datetime		 Modification timestamp Core
created_by_ref 0..1
StixIdentifier		 ID of the object that created this object Core
labels *
String		 Terms used to describe this object Core
revoked 0..1
Boolean		 Indicates whether this object has been revoked Core
confidence 0..1
Integer		 Confidence that the producer has in this data Core
lang 0..1
String		 Language of textual properties Core
external_references *
ExternalReference		 External references to non-STIX information Core
object_marking_refs *
StixIdentifier		 Marking definition references applied to this object Core
granular_markings *
GranularMarking		 Granular markings that apply to selected content Core
extensions *
String		 Open-ended extension payloads Core

In Subsets

Comments

  • jsonschema_rule: if-then validator_hint: extension-definition-top-level-property-constraint jsonschema_source: https://github.com/oasis-open/cti-stix2-json-schemas/tree/master/schemas/common/extension-definition.json

Identifier and Mapping Information

Schema Source

  • from schema: https://w3id.org/lmodel/attack

Mappings

Mapping Type Mapped Value
self attack:ExtensionDefinition
native attack:ExtensionDefinition

LinkML Source

Direct

name: ExtensionDefinition
description: 'The STIX Extension Definition object allows producers of threat intelligence
  to extend existing STIX objects or to create entirely new STIX objects in a standardized
  way. '
comments:
- 'jsonschema_rule: if-then validator_hint: extension-definition-top-level-property-constraint
  jsonschema_source: https://github.com/oasis-open/cti-stix2-json-schemas/tree/master/schemas/common/extension-definition.json'
in_subset:
- common
from_schema: https://w3id.org/lmodel/attack
is_a: Core
slots:
- type
- id
- name
- description
- schema
- version
- extension_types
- extension_properties
slot_usage:
  type:
    name: type
    pattern: ^extension-definition$
  id:
    name: id
    pattern: ^extension-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  name:
    name: name
    required: true
  schema:
    name: schema
    required: true
  version:
    name: version
    required: true
  extension_types:
    name: extension_types
    comments:
    - 'jsonschema_minItems: "1"'
    required: true
  extension_properties:
    name: extension_properties
    comments:
    - 'jsonschema_minItems: "1" jsonschema_conditional_required: "required when extension_types
      contains toplevel-property-extension"'

Induced

name: ExtensionDefinition
description: 'The STIX Extension Definition object allows producers of threat intelligence
  to extend existing STIX objects or to create entirely new STIX objects in a standardized
  way. '
comments:
- 'jsonschema_rule: if-then validator_hint: extension-definition-top-level-property-constraint
  jsonschema_source: https://github.com/oasis-open/cti-stix2-json-schemas/tree/master/schemas/common/extension-definition.json'
in_subset:
- common
from_schema: https://w3id.org/lmodel/attack
is_a: Core
slot_usage:
  type:
    name: type
    pattern: ^extension-definition$
  id:
    name: id
    pattern: ^extension-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  name:
    name: name
    required: true
  schema:
    name: schema
    required: true
  version:
    name: version
    required: true
  extension_types:
    name: extension_types
    comments:
    - 'jsonschema_minItems: "1"'
    required: true
  extension_properties:
    name: extension_properties
    comments:
    - 'jsonschema_minItems: "1" jsonschema_conditional_required: "required when extension_types
      contains toplevel-property-extension"'
attributes:
  type:
    name: type
    description: STIX object type.
    from_schema: https://w3id.org/lmodel/attack
    related_mappings:
    - unified_cyber_ontology:state
    rank: 1000
    alias: type
    owner: ExtensionDefinition
    domain_of:
    - StixEntity
    - Bundle
    - Core
    - CyberObservableCore
    - ExtensionDefinition
    - LanguageContent
    - MarkingDefinition
    - File
    range: stix_type_name
    required: true
    pattern: ^extension-definition$
  id:
    name: id
    description: STIX object identifier.
    from_schema: https://w3id.org/lmodel/attack
    related_mappings:
    - unified_cyber_ontology:externalReference
    rank: 1000
    alias: id
    owner: ExtensionDefinition
    domain_of:
    - StixEntity
    - Bundle
    - Core
    - CyberObservableCore
    - ExtensionDefinition
    - LanguageContent
    - MarkingDefinition
    - File
    range: stix_identifier
    required: true
    pattern: ^extension-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  name:
    name: name
    description: Human-readable name.
    from_schema: https://w3id.org/lmodel/attack
    exact_mappings:
    - unified_cyber_ontology:name
    rank: 1000
    alias: name
    owner: ExtensionDefinition
    domain_of:
    - RelatedAsset
    - StixEntity
    - ExtensionDefinition
    - MarkingDefinition
    - AutonomousSystem
    - File
    range: string
    required: true
  description:
    name: description
    description: Human-readable description.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:description
    rank: 1000
    alias: description
    owner: ExtensionDefinition
    domain_of:
    - RelatedAsset
    - MutableElement
    - StixEntity
    - ExtensionDefinition
    - ExternalReference
    range: string
  schema:
    name: schema
    description: Extension schema definition or URL.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: schema
    owner: ExtensionDefinition
    domain_of:
    - ExtensionDefinition
    range: string
    required: true
  version:
    name: version
    description: Version string.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: version
    owner: ExtensionDefinition
    domain_of:
    - ExtensionDefinition
    - Software
    - PdfExt
    - X509Certificate
    - MalwareAnalysis
    range: string
    required: true
  extension_types:
    name: extension_types
    description: Extension-definition type list.
    comments:
    - 'jsonschema_minItems: "1"'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: extension_types
    owner: ExtensionDefinition
    domain_of:
    - ExtensionDefinition
    range: ExtensionTypeEnum
    required: true
    multivalued: true
  extension_properties:
    name: extension_properties
    description: Extension-defined property names.
    comments:
    - 'jsonschema_minItems: "1" jsonschema_conditional_required: "required when extension_types
      contains toplevel-property-extension"'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: extension_properties
    owner: ExtensionDefinition
    domain_of:
    - ExtensionDefinition
    range: string
    multivalued: true
  spec_version:
    name: spec_version
    description: STIX specification version.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:specVersion
    rank: 1000
    alias: spec_version
    owner: ExtensionDefinition
    domain_of:
    - Core
    - CyberObservableCore
    - MarkingDefinition
    range: SpecVersionEnum
    required: true
  created:
    name: created
    description: Creation timestamp.
    notes:
    - STIX core timestamps require millisecond precision.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:objectCreatedTime
    rank: 1000
    alias: created
    owner: ExtensionDefinition
    domain_of:
    - Core
    - MarkingDefinition
    range: datetime
    required: true
    pattern: T\d{2}:\d{2}:\d{2}\.\d{3,}Z$
  modified:
    name: modified
    description: Modification timestamp.
    notes:
    - STIX core timestamps require millisecond precision.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:modifiedTime
    rank: 1000
    alias: modified
    owner: ExtensionDefinition
    domain_of:
    - Core
    range: datetime
    required: true
    pattern: T\d{2}:\d{2}:\d{2}\.\d{3,}Z$
  created_by_ref:
    name: created_by_ref
    description: ID of the object that created this object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:createdBy
    rank: 1000
    alias: created_by_ref
    owner: ExtensionDefinition
    domain_of:
    - Core
    - MarkingDefinition
    range: stix_identifier
  labels:
    name: labels
    description: Terms used to describe this object.
    comments:
    - 'jsonschema_minItems: "1"'
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:tag
    rank: 1000
    alias: labels
    owner: ExtensionDefinition
    domain_of:
    - Core
    range: string
    multivalued: true
  revoked:
    name: revoked
    description: Indicates whether this object has been revoked.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: revoked
    owner: ExtensionDefinition
    domain_of:
    - Core
    range: boolean
  confidence:
    name: confidence
    description: Confidence that the producer has in this data.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: confidence
    owner: ExtensionDefinition
    domain_of:
    - Core
    range: integer
    minimum_value: 0
    maximum_value: 100
  lang:
    name: lang
    description: Language of textual properties.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: lang
    owner: ExtensionDefinition
    domain_of:
    - Core
    - GranularMarking
    range: string
  external_references:
    name: external_references
    description: External references to non-STIX information.
    comments:
    - 'jsonschema_minItems: "1"'
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:externalReference
    rank: 1000
    alias: external_references
    owner: ExtensionDefinition
    domain_of:
    - Core
    - MarkingDefinition
    range: ExternalReference
    multivalued: true
  object_marking_refs:
    name: object_marking_refs
    description: Marking definition references applied to this object.
    comments:
    - 'jsonschema_minItems: "1"'
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:objectMarking
    rank: 1000
    alias: object_marking_refs
    owner: ExtensionDefinition
    domain_of:
    - Core
    - CyberObservableCore
    - MarkingDefinition
    range: stix_identifier
    multivalued: true
  granular_markings:
    name: granular_markings
    description: Granular markings that apply to selected content.
    comments:
    - 'jsonschema_minItems: "1"'
    from_schema: https://w3id.org/lmodel/attack
    narrow_mappings:
    - unified_cyber_ontology:objectMarking
    rank: 1000
    alias: granular_markings
    owner: ExtensionDefinition
    domain_of:
    - Core
    - CyberObservableCore
    - MarkingDefinition
    range: GranularMarking
    multivalued: true
  extensions:
    name: extensions
    description: Open-ended extension payloads.
    notes:
    - JSON Schema uses patternProperties for extension keys; exact key validation
      is delegated to validator tooling.
    comments:
    - 'jsonschema_rule: patternProperties validator_hint: validate-extension-keys-and-values'
    from_schema: https://w3id.org/lmodel/attack
    related_mappings:
    - unified_cyber_ontology:hasFacet
    rank: 1000
    alias: extensions
    owner: ExtensionDefinition
    domain_of:
    - Core
    - CyberObservableCore
    - MarkingDefinition
    - File
    range: string
    multivalued: true