Skip to content
attack

Class: StixDomainObject

A STIX Domain Object (SDO): a higher-level concept of cyber threat intelligence, such as an attack pattern, a malware family or a threat actor.

  • NOTE: this is an abstract class and should not be instantiated directly

URI: attack:StixDomainObject

 classDiagram
    class StixDomainObject
    click StixDomainObject href "../StixDomainObject/"
      StixCommonObject <|-- StixDomainObject
        click StixCommonObject href "../StixCommonObject/"
      

      StixDomainObject <|-- AttackTactic
        click AttackTactic href "../AttackTactic/"
      StixDomainObject <|-- AttackMatrix
        click AttackMatrix href "../AttackMatrix/"
      StixDomainObject <|-- AttackCollection
        click AttackCollection href "../AttackCollection/"
      StixDomainObject <|-- AttackAsset
        click AttackAsset href "../AttackAsset/"
      StixDomainObject <|-- AttackDataSource
        click AttackDataSource href "../AttackDataSource/"
      StixDomainObject <|-- AttackDataComponent
        click AttackDataComponent href "../AttackDataComponent/"
      StixDomainObject <|-- AttackDetectionStrategy
        click AttackDetectionStrategy href "../AttackDetectionStrategy/"
      StixDomainObject <|-- AttackAnalytic
        click AttackAnalytic href "../AttackAnalytic/"
      StixDomainObject <|-- StixIdentity
        click StixIdentity href "../StixIdentity/"
      StixDomainObject <|-- StixAttackPattern
        click StixAttackPattern href "../StixAttackPattern/"
      StixDomainObject <|-- StixCampaign
        click StixCampaign href "../StixCampaign/"
      StixDomainObject <|-- StixCourseOfAction
        click StixCourseOfAction href "../StixCourseOfAction/"
      StixDomainObject <|-- StixGrouping
        click StixGrouping href "../StixGrouping/"
      StixDomainObject <|-- StixIncident
        click StixIncident href "../StixIncident/"
      StixDomainObject <|-- StixIndicator
        click StixIndicator href "../StixIndicator/"
      StixDomainObject <|-- StixInfrastructure
        click StixInfrastructure href "../StixInfrastructure/"
      StixDomainObject <|-- StixIntrusionSet
        click StixIntrusionSet href "../StixIntrusionSet/"
      StixDomainObject <|-- StixLocation
        click StixLocation href "../StixLocation/"
      StixDomainObject <|-- StixMalware
        click StixMalware href "../StixMalware/"
      StixDomainObject <|-- StixMalwareAnalysis
        click StixMalwareAnalysis href "../StixMalwareAnalysis/"
      StixDomainObject <|-- StixNote
        click StixNote href "../StixNote/"
      StixDomainObject <|-- StixObservedData
        click StixObservedData href "../StixObservedData/"
      StixDomainObject <|-- StixOpinion
        click StixOpinion href "../StixOpinion/"
      StixDomainObject <|-- StixReport
        click StixReport href "../StixReport/"
      StixDomainObject <|-- StixThreatActor
        click StixThreatActor href "../StixThreatActor/"
      StixDomainObject <|-- StixTool
        click StixTool href "../StixTool/"
      StixDomainObject <|-- StixVulnerability
        click StixVulnerability href "../StixVulnerability/"
      

      StixDomainObject : confidence
        
      StixDomainObject : created
        
      StixDomainObject : created_by_ref
        
          
    
        
        
        StixDomainObject --> "0..1" StixIdentity : created_by_ref
        click StixIdentity href "../StixIdentity/"
    

        
      StixDomainObject : extensions
        
          
    
        
        
        StixDomainObject --> "0..1" StixExtensions : extensions
        click StixExtensions href "../StixExtensions/"
    

        
      StixDomainObject : external_references
        
          
    
        
        
        StixDomainObject --> "1..*" StixExternalReference : external_references
        click StixExternalReference href "../StixExternalReference/"
    

        
      StixDomainObject : granular_markings
        
          
    
        
        
        StixDomainObject --> "1..*" StixGranularMarking : granular_markings
        click StixGranularMarking href "../StixGranularMarking/"
    

        
      StixDomainObject : id
        
      StixDomainObject : labels
        
      StixDomainObject : lang
        
      StixDomainObject : modified
        
      StixDomainObject : object_marking_refs
        
          
    
        
        
        StixDomainObject --> "1..*" StixMarkingDefinition : object_marking_refs
        click StixMarkingDefinition href "../StixMarkingDefinition/"
    

        
      StixDomainObject : revoked
        
      StixDomainObject : spec_version
        
          
    
        
        
        StixDomainObject --> "1" StixSpecVersion : spec_version
        click StixSpecVersion href "../StixSpecVersion/"
    

        
      StixDomainObject : type

Inheritance

Section titled “Inheritance”

Slots

Section titled “Slots”
Name Cardinality and Range Description Inheritance
created_by_ref 0..1
StixIdentity		 A reference to the identity of the object’s creator StixCommonObject
created 1
StixTimestampMillis		 The time at which the object, or its first version, was created StixCommonObject
modified 1
StixTimestampMillis		 The time at which this version of the object was modified StixCommonObject
revoked 0..1
Boolean		 The revoked property indicates whether the object has been revoked StixCommonObject
labels 1..*
String		 The labels property specifies a set of terms used to describe this object StixCommonObject
confidence 0..1
Integer		 Identifies the confidence that the creator has in the correctness of their da… StixCommonObject
lang 0..1
String		 The language of the text content, as an RFC 5646 language code StixCommonObject
external_references 1..*
StixExternalReference		 References to non-STIX information about the object StixCommonObject
id 1
StixIdentifier		 The identifier of the object: its STIX type, two hyphens and a UUID StixObject
type 1
String		 The STIX type name of the object, such as attack-pattern StixObject
spec_version 1
StixSpecVersion		 The version of the STIX specification used to represent the object StixObject
object_marking_refs 1..*
StixMarkingDefinition		 References to the marking definitions that apply to the object StixObject
granular_markings 1..*
StixGranularMarking		 The granular markings that apply to parts of the object StixObject
extensions 0..1
StixExtensions		 The object’s extensions, as a dictionary keyed by extension name StixObject

Usages

Section titled “Usages”
used by used in type used
AttackRelationship source_ref any_of[range] StixDomainObject
AttackRelationship target_ref any_of[range] StixDomainObject
StixRelationship source_ref any_of[range] StixDomainObject
StixRelationship target_ref any_of[range] StixDomainObject
StixSighting sighting_of_ref range StixDomainObject
StixSighting where_sighted_refs range StixDomainObject

Identifier and Mapping Information

Section titled “Identifier and Mapping Information”

Schema Source

Section titled “Schema Source”

Mappings

Section titled “Mappings”
Mapping Type Mapped Value
self attack:StixDomainObject
native attack:StixDomainObject

LinkML Source

Section titled “LinkML Source”

Direct

Section titled “Direct”
name: StixDomainObject
description: 'A STIX Domain Object (SDO): a higher-level concept of cyber threat intelligence,
  such as an attack pattern, a malware family or a threat actor.'
from_schema: https://w3id.org/lmodel/attack
is_a: StixCommonObject
abstract: true

Induced

Section titled “Induced”
name: StixDomainObject
description: 'A STIX Domain Object (SDO): a higher-level concept of cyber threat intelligence,
  such as an attack pattern, a malware family or a threat actor.'
from_schema: https://w3id.org/lmodel/attack
is_a: StixCommonObject
abstract: true
attributes:
  created_by_ref:
    name: created_by_ref
    description: A reference to the identity of the object's creator.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:createdBy
    rank: 1000
    slot_uri: stix:created_by_ref
    owner: StixDomainObject
    domain_of:
    - StixCommonObject
    - StixMarkingDefinition
    range: StixIdentity
    pattern: ^identity--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  created:
    name: created
    description: The time at which the object, or its first version, was created.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:objectCreatedTime
    rank: 1000
    slot_uri: stix:created
    owner: StixDomainObject
    domain_of:
    - StixCommonObject
    - StixMarkingDefinition
    range: stix_timestamp_millis
    required: true
  modified:
    name: modified
    description: The time at which this version of the object was modified.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:modifiedTime
    rank: 1000
    slot_uri: stix:modified
    owner: StixDomainObject
    domain_of:
    - StixCommonObject
    range: stix_timestamp_millis
    required: true
  revoked:
    name: revoked
    description: The revoked property indicates whether the object has been revoked.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:revoked
    owner: StixDomainObject
    domain_of:
    - StixCommonObject
    range: boolean
  labels:
    name: labels
    description: The labels property specifies a set of terms used to describe this
      object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:tag
    rank: 1000
    slot_uri: stix:labels
    owner: StixDomainObject
    domain_of:
    - StixCommonObject
    range: string
    multivalued: true
    minimum_cardinality: 1
  confidence:
    name: confidence
    description: Identifies the confidence that the creator has in the correctness
      of their data.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:confidence
    rank: 1000
    slot_uri: stix:confidence
    owner: StixDomainObject
    domain_of:
    - StixCommonObject
    range: integer
    minimum_value: 0
    maximum_value: 100
  lang:
    name: lang
    description: The language of the text content, as an RFC 5646 language code.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:lang
    owner: StixDomainObject
    domain_of:
    - StixCommonObject
    - StixGranularMarking
    range: string
  external_references:
    name: external_references
    description: References to non-STIX information about the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:externalReference
    rank: 1000
    slot_uri: stix:external_references
    owner: StixDomainObject
    domain_of:
    - StixCommonObject
    - StixMarkingDefinition
    range: StixExternalReference
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  id:
    name: id
    description: 'The identifier of the object: its STIX type, two hyphens and a UUID.
      Each class narrows the type.'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:id
    identifier: true
    owner: StixDomainObject
    domain_of:
    - StixObject
    - StixBundle
    range: stix_identifier
    required: true
  type:
    name: type
    description: The STIX type name of the object, such as attack-pattern. Each class
      pins its own.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:type
    owner: StixDomainObject
    domain_of:
    - StixObject
    - StixBundle
    range: string
    required: true
    pattern: ^([a-z][a-z0-9]*)+(-[a-z0-9]+)*\-?$
  spec_version:
    name: spec_version
    description: The version of the STIX specification used to represent the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:spec_version
    owner: StixDomainObject
    domain_of:
    - StixObject
    range: StixSpecVersion
    required: true
  object_marking_refs:
    name: object_marking_refs
    description: References to the marking definitions that apply to the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:objectMarking
    rank: 1000
    slot_uri: stix:object_marking_refs
    owner: StixDomainObject
    domain_of:
    - StixObject
    range: StixMarkingDefinition
    multivalued: true
    pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  granular_markings:
    name: granular_markings
    description: The granular markings that apply to parts of the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:granular_markings
    owner: StixDomainObject
    domain_of:
    - StixObject
    range: StixGranularMarking
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  extensions:
    name: extensions
    description: The object's extensions, as a dictionary keyed by extension name.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:extensions
    owner: StixDomainObject
    domain_of:
    - StixObject
    range: StixExtensions
    inlined: true