Class: AttackLogSourceReference

A log an analytic reads: a data component and one of its logs and channels.

URI: attack:AttackLogSourceReference

 classDiagram
    class AttackLogSourceReference
    click AttackLogSourceReference href "../AttackLogSourceReference/"
      AttackLogSourceReference : channel
        
      AttackLogSourceReference : name
        
      AttackLogSourceReference : x_mitre_data_component_ref
        
          
    
        
        
        AttackLogSourceReference --> "1" AttackDataComponent : x_mitre_data_component_ref
        click AttackDataComponent href "../AttackDataComponent/"
    

        
      

Slots

Name	Cardinality and Range	Description	Inheritance
x_mitre_data_component_ref	1 AttackDataComponent	The data component whose log the reference names	direct
name	1 String	A name that identifies the object	direct
channel	1 String	A channel or event type within a log, such as 1 for process creation in Sysmo…	direct

Usages

used by	used in	type	used
AttackAnalytic	x_mitre_log_source_references	range	AttackLogSourceReference

Identifier and Mapping Information

Schema Source

• from schema: https://w3id.org/lmodel/attack

Mappings

Mapping Type	Mapped Value
self	attack:AttackLogSourceReference
native	attack:AttackLogSourceReference

LinkML Source

Direct

name: AttackLogSourceReference
description: 'A log an analytic reads: a data component and one of its logs and channels.'
from_schema: https://w3id.org/lmodel/attack
slots:
- x_mitre_data_component_ref
- name
- channel
slot_usage:
  x_mitre_data_component_ref:
    name: x_mitre_data_component_ref
    required: true
  name:
    name: name
    required: true
  channel:
    name: channel
    required: true

Induced

name: AttackLogSourceReference
description: 'A log an analytic reads: a data component and one of its logs and channels.'
from_schema: https://w3id.org/lmodel/attack
slot_usage:
  x_mitre_data_component_ref:
    name: x_mitre_data_component_ref
    required: true
  name:
    name: name
    required: true
  channel:
    name: channel
    required: true
attributes:
  x_mitre_data_component_ref:
    name: x_mitre_data_component_ref
    description: The data component whose log the reference names.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_data_component_ref
    owner: AttackLogSourceReference
    domain_of:
    - AttackLogSourceReference
    range: AttackDataComponent
    required: true
    pattern: ^x-mitre-data-component--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  name:
    name: name
    description: A name that identifies the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:name
    rank: 1000
    slot_uri: stix:name
    owner: AttackLogSourceReference
    domain_of:
    - AttackTactic
    - AttackMatrix
    - AttackCollection
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackDetectionStrategy
    - AttackAnalytic
    - AttackRelatedAsset
    - AttackLogSource
    - AttackLogSourceReference
    - StixIdentity
    - StixMarkingDefinition
    - StixExtensionDefinition
    - StixAutonomousSystem
    - StixFile
    - StixMutex
    - StixSoftware
    - StixAlternateDataStream
    - StixWindowsPeSection
    - StixWindowsRegistryValue
    - StixAttackPattern
    - StixCampaign
    - StixCourseOfAction
    - StixGrouping
    - StixIncident
    - StixIndicator
    - StixInfrastructure
    - StixIntrusionSet
    - StixLocation
    - StixMalware
    - StixReport
    - StixThreatActor
    - StixTool
    - StixVulnerability
    range: string
    required: true
  channel:
    name: channel
    description: A channel or event type within a log, such as 1 for process creation
      in Sysmon.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:channel
    owner: AttackLogSourceReference
    domain_of:
    - AttackLogSource
    - AttackLogSourceReference
    range: string
    required: true
    pattern: \S