Class: StixCyberObservableObject

A STIX Cyber-observable Object (SCO): a fact observed on a network or host, such as a file, an address or a process.

NOTE: this is an abstract class and should not be instantiated directly

 classDiagram
    class StixCyberObservableObject
    click StixCyberObservableObject href "../StixCyberObservableObject/"
      StixObject <|-- StixCyberObservableObject
        click StixObject href "../StixObject/"
      

      StixCyberObservableObject <|-- StixArtifact
        click StixArtifact href "../StixArtifact/"
      StixCyberObservableObject <|-- StixAutonomousSystem
        click StixAutonomousSystem href "../StixAutonomousSystem/"
      StixCyberObservableObject <|-- StixDirectory
        click StixDirectory href "../StixDirectory/"
      StixCyberObservableObject <|-- StixDomainName
        click StixDomainName href "../StixDomainName/"
      StixCyberObservableObject <|-- StixEmailAddress
        click StixEmailAddress href "../StixEmailAddress/"
      StixCyberObservableObject <|-- StixEmailMessage
        click StixEmailMessage href "../StixEmailMessage/"
      StixCyberObservableObject <|-- StixFile
        click StixFile href "../StixFile/"
      StixCyberObservableObject <|-- StixIpv4Address
        click StixIpv4Address href "../StixIpv4Address/"
      StixCyberObservableObject <|-- StixIpv6Address
        click StixIpv6Address href "../StixIpv6Address/"
      StixCyberObservableObject <|-- StixMacAddress
        click StixMacAddress href "../StixMacAddress/"
      StixCyberObservableObject <|-- StixMutex
        click StixMutex href "../StixMutex/"
      StixCyberObservableObject <|-- StixNetworkTraffic
        click StixNetworkTraffic href "../StixNetworkTraffic/"
      StixCyberObservableObject <|-- StixProcess
        click StixProcess href "../StixProcess/"
      StixCyberObservableObject <|-- StixSoftware
        click StixSoftware href "../StixSoftware/"
      StixCyberObservableObject <|-- StixUrl
        click StixUrl href "../StixUrl/"
      StixCyberObservableObject <|-- StixUserAccount
        click StixUserAccount href "../StixUserAccount/"
      StixCyberObservableObject <|-- StixWindowsRegistryKey
        click StixWindowsRegistryKey href "../StixWindowsRegistryKey/"
      StixCyberObservableObject <|-- StixX509Certificate
        click StixX509Certificate href "../StixX509Certificate/"
      

      StixCyberObservableObject : defanged
        
      StixCyberObservableObject : extensions
        
          
    
        
        
        StixCyberObservableObject --> "0..1" StixExtensions : extensions
        click StixExtensions href "../StixExtensions/"
    

        
      StixCyberObservableObject : granular_markings
        
          
    
        
        
        StixCyberObservableObject --> "1..*" StixGranularMarking : granular_markings
        click StixGranularMarking href "../StixGranularMarking/"
    

        
      StixCyberObservableObject : id
        
      StixCyberObservableObject : object_marking_refs
        
          
    
        
        
        StixCyberObservableObject --> "1..*" StixMarkingDefinition : object_marking_refs
        click StixMarkingDefinition href "../StixMarkingDefinition/"
    

        
      StixCyberObservableObject : spec_version
        
          
    
        
        
        StixCyberObservableObject --> "0..1" StixSpecVersion : spec_version
        click StixSpecVersion href "../StixSpecVersion/"
    

        
      StixCyberObservableObject : type

Inheritance

StixObject
- StixCyberObservableObject

Slots

Name	Cardinality and Range	Description	Inheritance
defanged	0..1 Boolean	Defines whether or not the data contained within the object has been defanged	direct
id	1 StixIdentifier	The identifier of the object: its STIX type, two hyphens and a UUID	StixObject
type	1 String	The STIX type name of the object, such as attack-pattern	StixObject
spec_version	0..1 StixSpecVersion	The version of the STIX specification used to represent the object	StixObject
object_marking_refs	1..* StixMarkingDefinition	References to the marking definitions that apply to the object	StixObject
granular_markings	1..* StixGranularMarking	The granular markings that apply to parts of the object	StixObject
extensions	0..1 StixExtensions	The object’s extensions, as a dictionary keyed by extension name	StixObject

Usages

used by	used in	type	used
AttackMalware	sample_refs	range	StixCyberObservableObject
AttackRelationship	source_ref	any_of[range]	StixCyberObservableObject
AttackRelationship	target_ref	any_of[range]	StixCyberObservableObject
StixDirectory	contains_refs	range	StixCyberObservableObject
StixDomainName	resolves_to_refs	range	StixCyberObservableObject
StixFile	contains_refs	range	StixCyberObservableObject
StixNetworkTraffic	src_ref	range	StixCyberObservableObject
StixNetworkTraffic	dst_ref	range	StixCyberObservableObject
StixArchiveExtension	contains_refs	range	StixCyberObservableObject
StixMimePart	body_raw_ref	range	StixCyberObservableObject
StixMalware	sample_refs	range	StixCyberObservableObject
StixMalwareAnalysis	analysis_sco_refs	range	StixCyberObservableObject
StixMalwareAnalysis	sample_ref	range	StixCyberObservableObject
StixObservedData	object_refs	any_of[range]	StixCyberObservableObject
StixRelationship	source_ref	any_of[range]	StixCyberObservableObject
StixRelationship	target_ref	any_of[range]	StixCyberObservableObject

Identifier and Mapping Information

Schema Source

from schema: https://w3id.org/lmodel/attack

Mappings

Mapping Type	Mapped Value
self	attack:StixCyberObservableObject
native	attack:StixCyberObservableObject

LinkML Source

Direct

name: StixCyberObservableObject
description: 'A STIX Cyber-observable Object (SCO): a fact observed on a network or
  host, such as a file, an address or a process.'
from_schema: https://w3id.org/lmodel/attack
is_a: StixObject
abstract: true
slots:
- defanged

Induced

name: StixCyberObservableObject
description: 'A STIX Cyber-observable Object (SCO): a fact observed on a network or
  host, such as a file, an address or a process.'
from_schema: https://w3id.org/lmodel/attack
is_a: StixObject
abstract: true
attributes:
  defanged:
    name: defanged
    description: Defines whether or not the data contained within the object has been
      defanged.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:defanged
    owner: StixCyberObservableObject
    domain_of:
    - StixCyberObservableObject
    range: boolean
  id:
    name: id
    description: 'The identifier of the object: its STIX type, two hyphens and a UUID.
      Each class narrows the type.'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:id
    identifier: true
    owner: StixCyberObservableObject
    domain_of:
    - StixObject
    - StixBundle
    range: stix_identifier
    required: true
  type:
    name: type
    description: The STIX type name of the object, such as attack-pattern. Each class
      pins its own.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:type
    owner: StixCyberObservableObject
    domain_of:
    - StixObject
    - StixBundle
    range: string
    required: true
    pattern: ^([a-z][a-z0-9]*)+(-[a-z0-9]+)*\-?$
  spec_version:
    name: spec_version
    description: The version of the STIX specification used to represent the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:spec_version
    owner: StixCyberObservableObject
    domain_of:
    - StixObject
    range: StixSpecVersion
  object_marking_refs:
    name: object_marking_refs
    description: References to the marking definitions that apply to the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:objectMarking
    rank: 1000
    slot_uri: stix:object_marking_refs
    owner: StixCyberObservableObject
    domain_of:
    - StixObject
    range: StixMarkingDefinition
    multivalued: true
    pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  granular_markings:
    name: granular_markings
    description: The granular markings that apply to parts of the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:granular_markings
    owner: StixCyberObservableObject
    domain_of:
    - StixObject
    range: StixGranularMarking
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  extensions:
    name: extensions
    description: The object's extensions, as a dictionary keyed by extension name.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:extensions
    owner: StixCyberObservableObject
    domain_of:
    - StixObject
    range: StixExtensions
    inlined: true