Element names and the shared namespace

Classes and enums carry the Attack prefix, so they can be imported beside other vocabularies, and each class extends a lmodel/stix class with the Stix prefix. The slots keep the keys MITRE’s data writes, so data validates unchanged: STIX’s keys come from the stix modules, and ATT&CK’s are x_mitre_*, with tactic_refs, channel, field and related_asset_sectors. Enum values keep MITRE’s spelling, such as Field Controller/RTU/PLC/IED.¹ .linkmllint.yaml leaves permissible values out of the naming rule for that reason.²

A host imports the adapt copy beside LOKF’s schema and other copies, and LinkML merges them into one namespace. No class, enum or type shares a name with LOKF’s or with the released copies of nine neighbours. The copy shares the keys stix’s own copy shares with in-toto, slsa, spdx and oscal, because STIX’s property names stay.³ tests/test_schema_rules.py pins those lists, checks that the copy holds stix’s copy whole, and pins the four ATT&CK keys without the prefix.⁴

Footnotes

Section titled “Footnotes”

1. docs/about.md, the naming paragraph ↩

2. .linkmllint.yaml, the comment ↩

3. README.md, the Knowledge Trust Ladder (KTL) section ↩

4. tests/test_schema_rules.py, SHARED_WITH_NEIGHBOURS and UNPREFIXED_KEYS ↩