Skip to content
attack

Class: AttackMarkingDefinition

A marking definition for ATT&CK objects, such as MITRE’s copyright statement, which every object of MITRE’s data names.

URI: attack:AttackMarkingDefinition

 classDiagram
    class AttackMarkingDefinition
    click AttackMarkingDefinition href "../AttackMarkingDefinition/"
      StixMarkingDefinition <|-- AttackMarkingDefinition
        click StixMarkingDefinition href "../StixMarkingDefinition/"
      
      AttackMarkingDefinition : created
        
      AttackMarkingDefinition : created_by_ref
        
          
    
        
        
        AttackMarkingDefinition --> "1" StixIdentity : created_by_ref
        click StixIdentity href "../StixIdentity/"
    

        
      AttackMarkingDefinition : definition
        
      AttackMarkingDefinition : definition_type
        
      AttackMarkingDefinition : extensions
        
          
    
        
        
        AttackMarkingDefinition --> "0..1" StixExtensions : extensions
        click StixExtensions href "../StixExtensions/"
    

        
      AttackMarkingDefinition : external_references
        
          
    
        
        
        AttackMarkingDefinition --> "1..*" StixExternalReference : external_references
        click StixExternalReference href "../StixExternalReference/"
    

        
      AttackMarkingDefinition : granular_markings
        
          
    
        
        
        AttackMarkingDefinition --> "1..*" StixGranularMarking : granular_markings
        click StixGranularMarking href "../StixGranularMarking/"
    

        
      AttackMarkingDefinition : id
        
      AttackMarkingDefinition : name
        
      AttackMarkingDefinition : object_marking_refs
        
          
    
        
        
        AttackMarkingDefinition --> "1..*" StixMarkingDefinition : object_marking_refs
        click StixMarkingDefinition href "../StixMarkingDefinition/"
    

        
      AttackMarkingDefinition : spec_version
        
          
    
        
        
        AttackMarkingDefinition --> "1" StixSpecVersion : spec_version
        click StixSpecVersion href "../StixSpecVersion/"
    

        
      AttackMarkingDefinition : type

Inheritance

Section titled “Inheritance”

Slots

Section titled “Slots”
Name Cardinality and Range Description Inheritance
created_by_ref 1
StixIdentity		 A reference to the identity of the object’s creator StixMarkingDefinition
created 1
StixTimestampMillis		 The time at which the object, or its first version, was created StixMarkingDefinition
external_references 1..*
StixExternalReference		 References to non-STIX information about the object StixMarkingDefinition
name 0..1
String		 A name that identifies the object StixMarkingDefinition
definition_type 0..1
String or 
StixMarkingDefinitionType		 The type of the marking definition, such as statement or tlp StixMarkingDefinition
definition 0..1
String or 
StixStatementMarking or 
StixTlpMarking		 The marking itself: a statement, or a Traffic Light Protocol (TLP) level StixMarkingDefinition
id 1
StixIdentifier		 The identifier of the object: its STIX type, two hyphens and a UUID StixObject
type 1
String		 The STIX type name of the object, such as attack-pattern StixObject
spec_version 1
StixSpecVersion		 The version of the STIX specification used to represent the object StixObject
object_marking_refs 1..*
StixMarkingDefinition		 References to the marking definitions that apply to the object StixObject
granular_markings 1..*
StixGranularMarking		 The granular markings that apply to parts of the object StixObject
extensions 0..1
StixExtensions		 The object’s extensions, as a dictionary keyed by extension name StixObject

Identifier and Mapping Information

Section titled “Identifier and Mapping Information”

Annotations

Section titled “Annotations”
property value
stix_type marking-definition

Schema Source

Section titled “Schema Source”

Mappings

Section titled “Mappings”
Mapping Type Mapped Value
self attack:AttackMarkingDefinition
native attack:AttackMarkingDefinition

LinkML Source

Section titled “LinkML Source”

Direct

Section titled “Direct”
name: AttackMarkingDefinition
annotations:
  stix_type:
    tag: stix_type
    value: marking-definition
description: A marking definition for ATT&CK objects, such as MITRE's copyright statement,
  which every object of MITRE's data names.
from_schema: https://w3id.org/lmodel/attack
is_a: StixMarkingDefinition
slot_usage:
  created_by_ref:
    name: created_by_ref
    required: true
  definition_type:
    name: definition_type
    pattern: ^(statement|tlp)$

Induced

Section titled “Induced”
name: AttackMarkingDefinition
annotations:
  stix_type:
    tag: stix_type
    value: marking-definition
description: A marking definition for ATT&CK objects, such as MITRE's copyright statement,
  which every object of MITRE's data names.
from_schema: https://w3id.org/lmodel/attack
is_a: StixMarkingDefinition
slot_usage:
  created_by_ref:
    name: created_by_ref
    required: true
  definition_type:
    name: definition_type
    pattern: ^(statement|tlp)$
attributes:
  created_by_ref:
    name: created_by_ref
    description: A reference to the identity of the object's creator.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:createdBy
    rank: 1000
    slot_uri: stix:created_by_ref
    owner: AttackMarkingDefinition
    domain_of:
    - StixCommonObject
    - StixMarkingDefinition
    range: StixIdentity
    required: true
    pattern: ^identity--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  created:
    name: created
    description: The time at which the object, or its first version, was created.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:objectCreatedTime
    rank: 1000
    slot_uri: stix:created
    owner: AttackMarkingDefinition
    domain_of:
    - StixCommonObject
    - StixMarkingDefinition
    range: stix_timestamp_millis
    required: true
  external_references:
    name: external_references
    description: References to non-STIX information about the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:externalReference
    rank: 1000
    slot_uri: stix:external_references
    owner: AttackMarkingDefinition
    domain_of:
    - StixCommonObject
    - StixMarkingDefinition
    range: StixExternalReference
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  name:
    name: name
    description: A name that identifies the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:name
    rank: 1000
    slot_uri: stix:name
    owner: AttackMarkingDefinition
    domain_of:
    - AttackTactic
    - AttackMatrix
    - AttackCollection
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackDetectionStrategy
    - AttackAnalytic
    - AttackRelatedAsset
    - AttackLogSource
    - AttackLogSourceReference
    - StixIdentity
    - StixMarkingDefinition
    - StixExtensionDefinition
    - StixAutonomousSystem
    - StixFile
    - StixMutex
    - StixSoftware
    - StixAlternateDataStream
    - StixWindowsPeSection
    - StixWindowsRegistryValue
    - StixAttackPattern
    - StixCampaign
    - StixCourseOfAction
    - StixGrouping
    - StixIncident
    - StixIndicator
    - StixInfrastructure
    - StixIntrusionSet
    - StixLocation
    - StixMalware
    - StixReport
    - StixThreatActor
    - StixTool
    - StixVulnerability
    range: string
  definition_type:
    name: definition_type
    description: The type of the marking definition, such as statement or tlp.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-marking:definitionType
    rank: 1000
    slot_uri: stix:definition_type
    owner: AttackMarkingDefinition
    domain_of:
    - StixMarkingDefinition
    range: string
    pattern: ^(statement|tlp)$
    any_of:
    - range: StixMarkingDefinitionType
    - range: string
  definition:
    name: definition
    description: 'The marking itself: a statement, or a Traffic Light Protocol (TLP)
      level.'
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-marking:definition
    rank: 1000
    slot_uri: stix:definition
    owner: AttackMarkingDefinition
    domain_of:
    - StixMarkingDefinition
    range: string
    inlined: true
    any_of:
    - range: StixStatementMarking
    - range: StixTlpMarking
  id:
    name: id
    description: 'The identifier of the object: its STIX type, two hyphens and a UUID.
      Each class narrows the type.'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:id
    identifier: true
    owner: AttackMarkingDefinition
    domain_of:
    - StixObject
    - StixBundle
    range: stix_identifier
    required: true
    pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    description: The STIX type name of the object, such as attack-pattern. Each class
      pins its own.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:type
    owner: AttackMarkingDefinition
    domain_of:
    - StixObject
    - StixBundle
    range: string
    required: true
    pattern: ^([a-z][a-z0-9]*)+(-[a-z0-9]+)*\-?$
    equals_string: marking-definition
  spec_version:
    name: spec_version
    description: The version of the STIX specification used to represent the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:spec_version
    owner: AttackMarkingDefinition
    domain_of:
    - StixObject
    range: StixSpecVersion
    required: true
  object_marking_refs:
    name: object_marking_refs
    description: References to the marking definitions that apply to the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:objectMarking
    rank: 1000
    slot_uri: stix:object_marking_refs
    owner: AttackMarkingDefinition
    domain_of:
    - StixObject
    range: StixMarkingDefinition
    multivalued: true
    pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  granular_markings:
    name: granular_markings
    description: The granular markings that apply to parts of the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:granular_markings
    owner: AttackMarkingDefinition
    domain_of:
    - StixObject
    range: StixGranularMarking
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  extensions:
    name: extensions
    description: The object's extensions, as a dictionary keyed by extension name.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:extensions
    owner: AttackMarkingDefinition
    domain_of:
    - StixObject
    range: StixExtensions
    inlined: true