Skip to content

Class: ExternalReference

_External references are used to describe pointers to information represented outside of STIX. _

URI: attack:ExternalReference

 classDiagram
    class ExternalReference
    click ExternalReference href "../ExternalReference/"
      CommonSchemaComponent <|-- ExternalReference
        click CommonSchemaComponent href "../CommonSchemaComponent/"

      ExternalReference : description

      ExternalReference : external_id

      ExternalReference : hashes





        ExternalReference --> "0..1" HashesType : hashes
        click HashesType href "../HashesType/"



      ExternalReference : id

      ExternalReference : name

      ExternalReference : source_name

      ExternalReference : type

      ExternalReference : url

Inheritance

Slots

Name Cardinality and Range Description Inheritance
source_name 1
String
Name of the external source direct
description 0..1
String
Human-readable description direct
url 0..1
Uriorcurie
A URL reference to an external resource direct
hashes 0..1
HashesType
Specifies a dictionary of hashes for the file or content direct
external_id 0..1
String
An identifier for the external reference content direct
id 0..1
StixIdentifier
STIX object identifier StixEntity
type 0..1
StixTypeName
STIX object type StixEntity
name 0..1
String
Human-readable name StixEntity

Usages

used by used in type used
AttackObject external_references range ExternalReference
AttackSoftware external_references range ExternalReference
Technique external_references range ExternalReference
Tactic external_references range ExternalReference
Group external_references range ExternalReference
AttackCampaign external_references range ExternalReference
Mitigation external_references range ExternalReference
AttackMalware external_references range ExternalReference
AttackTool external_references range ExternalReference
Asset external_references range ExternalReference
DataSource external_references range ExternalReference
DataComponent external_references range ExternalReference
Matrix external_references range ExternalReference
Collection external_references range ExternalReference
AttackIdentity external_references range ExternalReference
DetectionStrategy external_references range ExternalReference
Analytic external_references range ExternalReference
AttackRelationship external_references range ExternalReference
AttackMarkingDefinition external_references range ExternalReference
StixDomainObject external_references range ExternalReference
StixRelationshipObject external_references range ExternalReference
Core external_references range ExternalReference
ExtensionDefinition external_references range ExternalReference
LanguageContent external_references range ExternalReference
MarkingDefinition external_references range ExternalReference
AttackPattern external_references range ExternalReference
Campaign external_references range ExternalReference
CourseOfAction external_references range ExternalReference
Grouping external_references range ExternalReference
Identity external_references range ExternalReference
Incident external_references range ExternalReference
Indicator external_references range ExternalReference
Infrastructure external_references range ExternalReference
IntrusionSet external_references range ExternalReference
Location external_references range ExternalReference
MalwareAnalysis external_references range ExternalReference
Malware external_references range ExternalReference
Note external_references range ExternalReference
ObservedData external_references range ExternalReference
Opinion external_references range ExternalReference
Report external_references range ExternalReference
ThreatActor external_references range ExternalReference
Tool external_references range ExternalReference
Vulnerability external_references range ExternalReference
Relationship external_references range ExternalReference
Sighting external_references range ExternalReference

In Subsets

Comments

  • jsonschema_rule: oneOf validator_hint: external-reference-branch-validation jsonschema_source: https://github.com/oasis-open/cti-stix2-json-schemas/tree/master/schemas/common/external-reference.json

Notes

  • Upstream JSON Schema uses oneOf branches keyed by source_name; exact branch logic is delegated to validator tooling.

Identifier and Mapping Information

Schema Source

  • from schema: https://w3id.org/lmodel/attack

Mappings

Mapping Type Mapped Value
self attack:ExternalReference
native attack:ExternalReference
exact unified_cyber_ontology:ExternalReference

LinkML Source

Direct

name: ExternalReference
description: 'External references are used to describe pointers to information represented
  outside of STIX. '
notes:
- Upstream JSON Schema uses oneOf branches keyed by source_name; exact branch logic
  is delegated to validator tooling.
comments:
- 'jsonschema_rule: oneOf validator_hint: external-reference-branch-validation jsonschema_source:
  https://github.com/oasis-open/cti-stix2-json-schemas/tree/master/schemas/common/external-reference.json'
in_subset:
- common
from_schema: https://w3id.org/lmodel/attack
exact_mappings:
- unified_cyber_ontology:ExternalReference
is_a: CommonSchemaComponent
slots:
- source_name
- description
- url
- hashes
- external_id
slot_usage:
  source_name:
    name: source_name
    required: true
  url:
    name: url
    pattern: '^\w+:'

Induced

name: ExternalReference
description: 'External references are used to describe pointers to information represented
  outside of STIX. '
notes:
- Upstream JSON Schema uses oneOf branches keyed by source_name; exact branch logic
  is delegated to validator tooling.
comments:
- 'jsonschema_rule: oneOf validator_hint: external-reference-branch-validation jsonschema_source:
  https://github.com/oasis-open/cti-stix2-json-schemas/tree/master/schemas/common/external-reference.json'
in_subset:
- common
from_schema: https://w3id.org/lmodel/attack
exact_mappings:
- unified_cyber_ontology:ExternalReference
is_a: CommonSchemaComponent
slot_usage:
  source_name:
    name: source_name
    required: true
  url:
    name: url
    pattern: '^\w+:'
attributes:
  source_name:
    name: source_name
    description: Name of the external source.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:name
    rank: 1000
    alias: source_name
    owner: ExternalReference
    domain_of:
    - ExternalReference
    range: string
    required: true
  description:
    name: description
    description: Human-readable description.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:description
    rank: 1000
    alias: description
    owner: ExternalReference
    domain_of:
    - RelatedAsset
    - MutableElement
    - StixEntity
    - ExtensionDefinition
    - ExternalReference
    range: string
  url:
    name: url
    description: A URL reference to an external resource.
    from_schema: https://w3id.org/lmodel/attack
    related_mappings:
    - unified_cyber_ontology:URL
    rank: 1000
    alias: url
    owner: ExternalReference
    domain_of:
    - ExternalReference
    - Artifact
    range: uriorcurie
    pattern: '^\w+:'
  hashes:
    name: hashes
    description: Specifies a dictionary of hashes for the file or content.
    from_schema: https://w3id.org/lmodel/attack
    exact_mappings:
    - unified_cyber_ontology:hashes
    rank: 1000
    alias: hashes
    owner: ExternalReference
    domain_of:
    - ExternalReference
    - Artifact
    - File
    - X509Certificate
    range: HashesType
  external_id:
    name: external_id
    description: An identifier for the external reference content.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: external_id
    owner: ExternalReference
    domain_of:
    - ExternalReference
    range: string
  id:
    name: id
    description: STIX object identifier.
    from_schema: https://w3id.org/lmodel/attack
    related_mappings:
    - unified_cyber_ontology:externalReference
    rank: 1000
    alias: id
    owner: ExternalReference
    domain_of:
    - StixEntity
    - Bundle
    - Core
    - CyberObservableCore
    - ExtensionDefinition
    - LanguageContent
    - MarkingDefinition
    - File
    range: stix_identifier
  type:
    name: type
    description: STIX object type.
    from_schema: https://w3id.org/lmodel/attack
    related_mappings:
    - unified_cyber_ontology:state
    rank: 1000
    alias: type
    owner: ExternalReference
    domain_of:
    - StixEntity
    - Bundle
    - Core
    - CyberObservableCore
    - ExtensionDefinition
    - LanguageContent
    - MarkingDefinition
    - File
    range: stix_type_name
  name:
    name: name
    description: Human-readable name.
    from_schema: https://w3id.org/lmodel/attack
    exact_mappings:
    - unified_cyber_ontology:name
    rank: 1000
    alias: name
    owner: ExternalReference
    domain_of:
    - RelatedAsset
    - StixEntity
    - ExtensionDefinition
    - MarkingDefinition
    - AutonomousSystem
    - File
    range: string