Skip to content

Class: MarkingDefinition

_The marking-definition object represents a specific marking. _

URI: attack:MarkingDefinition

 classDiagram
    class MarkingDefinition
    click MarkingDefinition href "../MarkingDefinition/"
      CommonSchemaComponent <|-- MarkingDefinition
        click CommonSchemaComponent href "../CommonSchemaComponent/"


      MarkingDefinition <|-- AttackMarkingDefinition
        click AttackMarkingDefinition href "../AttackMarkingDefinition/"


      MarkingDefinition : created

      MarkingDefinition : created_by_ref

      MarkingDefinition : definition

      MarkingDefinition : definition_type

      MarkingDefinition : description

      MarkingDefinition : extensions

      MarkingDefinition : external_references





        MarkingDefinition --> "*" ExternalReference : external_references
        click ExternalReference href "../ExternalReference/"



      MarkingDefinition : granular_markings





        MarkingDefinition --> "*" GranularMarking : granular_markings
        click GranularMarking href "../GranularMarking/"



      MarkingDefinition : id

      MarkingDefinition : name

      MarkingDefinition : object_marking_refs

      MarkingDefinition : spec_version





        MarkingDefinition --> "1" SpecVersionEnum : spec_version
        click SpecVersionEnum href "../SpecVersionEnum/"



      MarkingDefinition : statement

      MarkingDefinition : type

Inheritance

Slots

Name Cardinality and Range Description Inheritance
type 1
StixTypeName		 STIX object type direct
spec_version 1
SpecVersionEnum		 STIX specification version direct
id 1
StixIdentifier		 STIX object identifier direct
name 0..1
String		 Human-readable name direct
created_by_ref 0..1
StixIdentifier		 ID of the object that created this object direct
created 1
Datetime		 Creation timestamp direct
external_references *
ExternalReference		 External references to non-STIX information direct
object_marking_refs *
StixIdentifier		 Marking definition references applied to this object direct
granular_markings *
GranularMarking		 Granular markings that apply to selected content direct
extensions *
String		 Open-ended extension payloads direct
definition_type 0..1
String		 Type discriminator for marking definition content direct
definition 0..1
String		 Marking definition payload direct
statement 0..1
String		 A statement (e direct
description 0..1
String		 Human-readable description StixEntity

In Subsets

Comments

  • jsonschema_rule: oneOf+if-then validator_hint: enforce-marking-definition-branches jsonschema_source: https://github.com/oasis-open/cti-stix2-json-schemas/tree/master/schemas/common/marking-definition.json

Notes

  • TLP and statement variants use oneOf/if-then logic in JSON Schema and are represented with validator hints.

Identifier and Mapping Information

Schema Source

  • from schema: https://w3id.org/lmodel/attack

Mappings

Mapping Type Mapped Value
self attack:MarkingDefinition
native attack:MarkingDefinition

LinkML Source

Direct

name: MarkingDefinition
description: 'The marking-definition object represents a specific marking. '
notes:
- TLP and statement variants use oneOf/if-then logic in JSON Schema and are represented
  with validator hints.
comments:
- 'jsonschema_rule: oneOf+if-then validator_hint: enforce-marking-definition-branches
  jsonschema_source: https://github.com/oasis-open/cti-stix2-json-schemas/tree/master/schemas/common/marking-definition.json'
in_subset:
- common
from_schema: https://w3id.org/lmodel/attack
is_a: CommonSchemaComponent
slots:
- type
- spec_version
- id
- name
- created_by_ref
- created
- external_references
- object_marking_refs
- granular_markings
- extensions
- definition_type
- definition
- statement
slot_usage:
  type:
    name: type
    required: true
    pattern: ^marking-definition$
  spec_version:
    name: spec_version
    required: true
  id:
    name: id
    required: true
    pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  created:
    name: created
    required: true
  object_marking_refs:
    name: object_marking_refs
    comments:
    - 'jsonschema_minItems: "1"'
    pattern: ^marking-definition--
  external_references:
    name: external_references
    comments:
    - 'jsonschema_minItems: "1"'
  granular_markings:
    name: granular_markings
    comments:
    - 'jsonschema_minItems: "1"'
  definition_type:
    name: definition_type
    comments:
    - 'jsonschema_conditional_required: "required unless extensions present"'
  definition:
    name: definition
    comments:
    - 'jsonschema_conditional_required: "required unless extensions present"'

Induced

name: MarkingDefinition
description: 'The marking-definition object represents a specific marking. '
notes:
- TLP and statement variants use oneOf/if-then logic in JSON Schema and are represented
  with validator hints.
comments:
- 'jsonschema_rule: oneOf+if-then validator_hint: enforce-marking-definition-branches
  jsonschema_source: https://github.com/oasis-open/cti-stix2-json-schemas/tree/master/schemas/common/marking-definition.json'
in_subset:
- common
from_schema: https://w3id.org/lmodel/attack
is_a: CommonSchemaComponent
slot_usage:
  type:
    name: type
    required: true
    pattern: ^marking-definition$
  spec_version:
    name: spec_version
    required: true
  id:
    name: id
    required: true
    pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  created:
    name: created
    required: true
  object_marking_refs:
    name: object_marking_refs
    comments:
    - 'jsonschema_minItems: "1"'
    pattern: ^marking-definition--
  external_references:
    name: external_references
    comments:
    - 'jsonschema_minItems: "1"'
  granular_markings:
    name: granular_markings
    comments:
    - 'jsonschema_minItems: "1"'
  definition_type:
    name: definition_type
    comments:
    - 'jsonschema_conditional_required: "required unless extensions present"'
  definition:
    name: definition
    comments:
    - 'jsonschema_conditional_required: "required unless extensions present"'
attributes:
  type:
    name: type
    description: STIX object type.
    from_schema: https://w3id.org/lmodel/attack
    related_mappings:
    - unified_cyber_ontology:state
    rank: 1000
    alias: type
    owner: MarkingDefinition
    domain_of:
    - StixEntity
    - Bundle
    - Core
    - CyberObservableCore
    - ExtensionDefinition
    - LanguageContent
    - MarkingDefinition
    - File
    range: stix_type_name
    required: true
    pattern: ^marking-definition$
  spec_version:
    name: spec_version
    description: STIX specification version.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:specVersion
    rank: 1000
    alias: spec_version
    owner: MarkingDefinition
    domain_of:
    - Core
    - CyberObservableCore
    - MarkingDefinition
    range: SpecVersionEnum
    required: true
  id:
    name: id
    description: STIX object identifier.
    from_schema: https://w3id.org/lmodel/attack
    related_mappings:
    - unified_cyber_ontology:externalReference
    rank: 1000
    alias: id
    owner: MarkingDefinition
    domain_of:
    - StixEntity
    - Bundle
    - Core
    - CyberObservableCore
    - ExtensionDefinition
    - LanguageContent
    - MarkingDefinition
    - File
    range: stix_identifier
    required: true
    pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  name:
    name: name
    description: Human-readable name.
    from_schema: https://w3id.org/lmodel/attack
    exact_mappings:
    - unified_cyber_ontology:name
    rank: 1000
    alias: name
    owner: MarkingDefinition
    domain_of:
    - RelatedAsset
    - StixEntity
    - ExtensionDefinition
    - MarkingDefinition
    - AutonomousSystem
    - File
    range: string
  created_by_ref:
    name: created_by_ref
    description: ID of the object that created this object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:createdBy
    rank: 1000
    alias: created_by_ref
    owner: MarkingDefinition
    domain_of:
    - Core
    - MarkingDefinition
    range: stix_identifier
  created:
    name: created
    description: Creation timestamp.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:objectCreatedTime
    rank: 1000
    alias: created
    owner: MarkingDefinition
    domain_of:
    - Core
    - MarkingDefinition
    range: datetime
    required: true
  external_references:
    name: external_references
    description: External references to non-STIX information.
    comments:
    - 'jsonschema_minItems: "1"'
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:externalReference
    rank: 1000
    alias: external_references
    owner: MarkingDefinition
    domain_of:
    - Core
    - MarkingDefinition
    range: ExternalReference
    multivalued: true
  object_marking_refs:
    name: object_marking_refs
    description: Marking definition references applied to this object.
    comments:
    - 'jsonschema_minItems: "1"'
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:objectMarking
    rank: 1000
    alias: object_marking_refs
    owner: MarkingDefinition
    domain_of:
    - Core
    - CyberObservableCore
    - MarkingDefinition
    range: stix_identifier
    multivalued: true
    pattern: ^marking-definition--
  granular_markings:
    name: granular_markings
    description: Granular markings that apply to selected content.
    comments:
    - 'jsonschema_minItems: "1"'
    from_schema: https://w3id.org/lmodel/attack
    narrow_mappings:
    - unified_cyber_ontology:objectMarking
    rank: 1000
    alias: granular_markings
    owner: MarkingDefinition
    domain_of:
    - Core
    - CyberObservableCore
    - MarkingDefinition
    range: GranularMarking
    multivalued: true
  extensions:
    name: extensions
    description: Open-ended extension payloads.
    notes:
    - JSON Schema uses patternProperties for extension keys; exact key validation
      is delegated to validator tooling.
    comments:
    - 'jsonschema_rule: patternProperties validator_hint: validate-extension-keys-and-values'
    from_schema: https://w3id.org/lmodel/attack
    related_mappings:
    - unified_cyber_ontology:hasFacet
    rank: 1000
    alias: extensions
    owner: MarkingDefinition
    domain_of:
    - Core
    - CyberObservableCore
    - MarkingDefinition
    - File
    range: string
    multivalued: true
  definition_type:
    name: definition_type
    description: Type discriminator for marking definition content.
    comments:
    - 'jsonschema_conditional_required: "required unless extensions present"'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: definition_type
    owner: MarkingDefinition
    domain_of:
    - MarkingDefinition
    range: string
  definition:
    name: definition
    description: Marking definition payload.
    comments:
    - 'jsonschema_conditional_required: "required unless extensions present"'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: definition
    owner: MarkingDefinition
    domain_of:
    - MarkingDefinition
    range: string
  statement:
    name: statement
    description: A statement (e.g., copyright, terms of use) applied to the content
      marked by this marking definition.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: statement
    owner: MarkingDefinition
    domain_of:
    - StatementMarkingObject
    - MarkingDefinition
    range: string
  description:
    name: description
    description: Human-readable description.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:description
    rank: 1000
    alias: description
    owner: MarkingDefinition
    domain_of:
    - RelatedAsset
    - MutableElement
    - StixEntity
    - ExtensionDefinition
    - ExternalReference
    range: string