Skip to content
attack

Class: StixDirectory

The Directory Object represents the properties common to a file system directory.

URI: attack:StixDirectory

 classDiagram
    class StixDirectory
    click StixDirectory href "../StixDirectory/"
      StixCyberObservableObject <|-- StixDirectory
        click StixCyberObservableObject href "../StixCyberObservableObject/"
      
      StixDirectory : atime
        
      StixDirectory : contains_refs
        
          
    
        
        
        StixDirectory --> "1..*" StixCyberObservableObject : contains_refs
        click StixCyberObservableObject href "../StixCyberObservableObject/"
    

        
      StixDirectory : ctime
        
      StixDirectory : defanged
        
      StixDirectory : extensions
        
          
    
        
        
        StixDirectory --> "0..1" StixExtensions : extensions
        click StixExtensions href "../StixExtensions/"
    

        
      StixDirectory : granular_markings
        
          
    
        
        
        StixDirectory --> "1..*" StixGranularMarking : granular_markings
        click StixGranularMarking href "../StixGranularMarking/"
    

        
      StixDirectory : id
        
      StixDirectory : mtime
        
      StixDirectory : object_marking_refs
        
          
    
        
        
        StixDirectory --> "1..*" StixMarkingDefinition : object_marking_refs
        click StixMarkingDefinition href "../StixMarkingDefinition/"
    

        
      StixDirectory : path
        
      StixDirectory : path_enc
        
      StixDirectory : spec_version
        
          
    
        
        
        StixDirectory --> "0..1" StixSpecVersion : spec_version
        click StixSpecVersion href "../StixSpecVersion/"
    

        
      StixDirectory : type

Inheritance

Section titled “Inheritance”

Slots

Section titled “Slots”
Name Cardinality and Range Description Inheritance
path 1
String		 A path, as it was observed direct
path_enc 0..1
String		 Specifies the observed encoding for the path direct
ctime 0..1
StixTimestamp		 The time at which the object was created direct
mtime 0..1
StixTimestamp		 The time at which the object was last written to direct
atime 0..1
StixTimestamp		 The time at which the object was last accessed direct
contains_refs 1..*
StixCyberObservableObject or 
StixFile or 
StixDirectory		 References to other cyber-observable objects that this one contains direct
defanged 0..1
Boolean		 Defines whether or not the data contained within the object has been defanged StixCyberObservableObject
id 1
StixIdentifier		 The identifier of the object: its STIX type, two hyphens and a UUID StixObject
type 1
String		 The STIX type name of the object, such as attack-pattern StixObject
spec_version 0..1
StixSpecVersion		 The version of the STIX specification used to represent the object StixObject
object_marking_refs 1..*
StixMarkingDefinition		 References to the marking definitions that apply to the object StixObject
granular_markings 1..*
StixGranularMarking		 The granular markings that apply to parts of the object StixObject
extensions 0..1
StixExtensions		 The object’s extensions, as a dictionary keyed by extension name StixObject

Usages

Section titled “Usages”
used by used in type used
StixDirectory contains_refs any_of[range] StixDirectory
StixFile parent_directory_ref range StixDirectory
StixArchiveExtension contains_refs any_of[range] StixDirectory

Identifier and Mapping Information

Section titled “Identifier and Mapping Information”

Annotations

Section titled “Annotations”
property value
stix_type directory

Schema Source

Section titled “Schema Source”

Mappings

Section titled “Mappings”
Mapping Type Mapped Value
self attack:StixDirectory
native attack:StixDirectory
close uco-observable:Directory

LinkML Source

Section titled “LinkML Source”

Direct

Section titled “Direct”
name: StixDirectory
annotations:
  stix_type:
    tag: stix_type
    value: directory
description: The Directory Object represents the properties common to a file system
  directory.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:Directory
is_a: StixCyberObservableObject
slots:
- path
- path_enc
- ctime
- mtime
- atime
- contains_refs
slot_usage:
  id:
    name: id
    pattern: ^directory--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    equals_string: directory
  path:
    name: path
    required: true
  contains_refs:
    name: contains_refs
    range: StixCyberObservableObject
    pattern: ^(file|directory)--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    any_of:
    - range: StixFile
    - range: StixDirectory

Induced

Section titled “Induced”
name: StixDirectory
annotations:
  stix_type:
    tag: stix_type
    value: directory
description: The Directory Object represents the properties common to a file system
  directory.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:Directory
is_a: StixCyberObservableObject
slot_usage:
  id:
    name: id
    pattern: ^directory--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    equals_string: directory
  path:
    name: path
    required: true
  contains_refs:
    name: contains_refs
    range: StixCyberObservableObject
    pattern: ^(file|directory)--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    any_of:
    - range: StixFile
    - range: StixDirectory
attributes:
  path:
    name: path
    description: A path, as it was observed.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:path
    owner: StixDirectory
    domain_of:
    - StixDirectory
    range: string
    required: true
  path_enc:
    name: path_enc
    description: Specifies the observed encoding for the path.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:path_enc
    owner: StixDirectory
    domain_of:
    - StixDirectory
    range: string
    pattern: ^[a-zA-Z0-9/\.+_:-]{2,250}$
  ctime:
    name: ctime
    description: The time at which the object was created.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:ctime
    owner: StixDirectory
    domain_of:
    - StixDirectory
    - StixFile
    range: stix_timestamp
  mtime:
    name: mtime
    description: The time at which the object was last written to.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:mtime
    owner: StixDirectory
    domain_of:
    - StixDirectory
    - StixFile
    range: stix_timestamp
  atime:
    name: atime
    description: The time at which the object was last accessed.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:atime
    owner: StixDirectory
    domain_of:
    - StixDirectory
    - StixFile
    range: stix_timestamp
  contains_refs:
    name: contains_refs
    description: References to other cyber-observable objects that this one contains.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:contains_refs
    owner: StixDirectory
    domain_of:
    - StixDirectory
    - StixFile
    - StixArchiveExtension
    range: StixCyberObservableObject
    multivalued: true
    pattern: ^(file|directory)--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
    any_of:
    - range: StixFile
    - range: StixDirectory
  defanged:
    name: defanged
    description: Defines whether or not the data contained within the object has been
      defanged.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:defanged
    owner: StixDirectory
    domain_of:
    - StixCyberObservableObject
    range: boolean
  id:
    name: id
    description: 'The identifier of the object: its STIX type, two hyphens and a UUID.
      Each class narrows the type.'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:id
    identifier: true
    owner: StixDirectory
    domain_of:
    - StixObject
    - StixBundle
    range: stix_identifier
    required: true
    pattern: ^directory--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    description: The STIX type name of the object, such as attack-pattern. Each class
      pins its own.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:type
    owner: StixDirectory
    domain_of:
    - StixObject
    - StixBundle
    range: string
    required: true
    pattern: ^([a-z][a-z0-9]*)+(-[a-z0-9]+)*\-?$
    equals_string: directory
  spec_version:
    name: spec_version
    description: The version of the STIX specification used to represent the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:spec_version
    owner: StixDirectory
    domain_of:
    - StixObject
    range: StixSpecVersion
  object_marking_refs:
    name: object_marking_refs
    description: References to the marking definitions that apply to the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:objectMarking
    rank: 1000
    slot_uri: stix:object_marking_refs
    owner: StixDirectory
    domain_of:
    - StixObject
    range: StixMarkingDefinition
    multivalued: true
    pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  granular_markings:
    name: granular_markings
    description: The granular markings that apply to parts of the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:granular_markings
    owner: StixDirectory
    domain_of:
    - StixObject
    range: StixGranularMarking
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  extensions:
    name: extensions
    description: The object's extensions, as a dictionary keyed by extension name.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:extensions
    owner: StixDirectory
    domain_of:
    - StixObject
    range: StixExtensions
    inlined: true