Skip to content
attack

Class: StixEmailMessage

The Email Message Object represents an instance of an email message.

URI: attack:StixEmailMessage

 classDiagram
    class StixEmailMessage
    click StixEmailMessage href "../StixEmailMessage/"
      StixCyberObservableObject <|-- StixEmailMessage
        click StixCyberObservableObject href "../StixCyberObservableObject/"
      
      StixEmailMessage : additional_header_fields
        
          
    
        
        
        StixEmailMessage --> "0..1" StixDictionary : additional_header_fields
        click StixDictionary href "../StixDictionary/"
    

        
      StixEmailMessage : bcc_refs
        
          
    
        
        
        StixEmailMessage --> "1..*" StixEmailAddress : bcc_refs
        click StixEmailAddress href "../StixEmailAddress/"
    

        
      StixEmailMessage : body
        
      StixEmailMessage : body_multipart
        
          
    
        
        
        StixEmailMessage --> "1..*" StixMimePart : body_multipart
        click StixMimePart href "../StixMimePart/"
    

        
      StixEmailMessage : cc_refs
        
          
    
        
        
        StixEmailMessage --> "1..*" StixEmailAddress : cc_refs
        click StixEmailAddress href "../StixEmailAddress/"
    

        
      StixEmailMessage : content_type
        
      StixEmailMessage : defanged
        
      StixEmailMessage : email_date
        
      StixEmailMessage : extensions
        
          
    
        
        
        StixEmailMessage --> "0..1" StixExtensions : extensions
        click StixExtensions href "../StixExtensions/"
    

        
      StixEmailMessage : from_ref
        
          
    
        
        
        StixEmailMessage --> "0..1" StixEmailAddress : from_ref
        click StixEmailAddress href "../StixEmailAddress/"
    

        
      StixEmailMessage : granular_markings
        
          
    
        
        
        StixEmailMessage --> "1..*" StixGranularMarking : granular_markings
        click StixGranularMarking href "../StixGranularMarking/"
    

        
      StixEmailMessage : id
        
      StixEmailMessage : is_multipart
        
      StixEmailMessage : message_id
        
      StixEmailMessage : object_marking_refs
        
          
    
        
        
        StixEmailMessage --> "1..*" StixMarkingDefinition : object_marking_refs
        click StixMarkingDefinition href "../StixMarkingDefinition/"
    

        
      StixEmailMessage : raw_email_ref
        
          
    
        
        
        StixEmailMessage --> "0..1" StixArtifact : raw_email_ref
        click StixArtifact href "../StixArtifact/"
    

        
      StixEmailMessage : received_lines
        
      StixEmailMessage : sender_ref
        
          
    
        
        
        StixEmailMessage --> "0..1" StixEmailAddress : sender_ref
        click StixEmailAddress href "../StixEmailAddress/"
    

        
      StixEmailMessage : spec_version
        
          
    
        
        
        StixEmailMessage --> "0..1" StixSpecVersion : spec_version
        click StixSpecVersion href "../StixSpecVersion/"
    

        
      StixEmailMessage : subject
        
      StixEmailMessage : to_refs
        
          
    
        
        
        StixEmailMessage --> "1..*" StixEmailAddress : to_refs
        click StixEmailAddress href "../StixEmailAddress/"
    

        
      StixEmailMessage : type

Inheritance

Section titled “Inheritance”

Slots

Section titled “Slots”
Name Cardinality and Range Description Inheritance
email_date 0..1
StixTimestamp		 Specifies the date/time that the email message was sent direct
content_type 0..1
String		 The value of a Content-Type header field direct
from_ref 0..1
StixEmailAddress		 Specifies the value of the ‘From:’ header of the email message direct
sender_ref 0..1
StixEmailAddress		 Specifies the value of the ‘From’ field of the email message direct
to_refs 1..*
StixEmailAddress		 Specifies the mailboxes that are ‘To:’ recipients of the email message direct
cc_refs 1..*
StixEmailAddress		 Specifies the mailboxes that are ‘CC:’ recipients of the email message direct
bcc_refs 1..*
StixEmailAddress		 Specifies the mailboxes that are ‘BCC:’ recipients of the email message direct
message_id 0..1
String		 Specifies the Message-ID field of the email message direct
subject 0..1
String		 A subject, as a string; each class says of what direct
received_lines 1..*
String		 Specifies one or more Received header fields that may be included in the emai… direct
additional_header_fields 0..1
StixDictionary		 Specifies any other header fields found in the email message, as a dictionary direct
raw_email_ref 0..1
StixArtifact		 Specifies the raw binary contents of the email message, including both the he… direct
is_multipart 1
Boolean		 Indicates whether the email body contains multiple MIME parts direct
body 0..1
String		 A body of text direct
body_multipart 1..*
StixMimePart		 The MIME parts that make up a multipart email body direct
defanged 0..1
Boolean		 Defines whether or not the data contained within the object has been defanged StixCyberObservableObject
id 1
StixIdentifier		 The identifier of the object: its STIX type, two hyphens and a UUID StixObject
type 1
String		 The STIX type name of the object, such as attack-pattern StixObject
spec_version 0..1
StixSpecVersion		 The version of the STIX specification used to represent the object StixObject
object_marking_refs 1..*
StixMarkingDefinition		 References to the marking definitions that apply to the object StixObject
granular_markings 1..*
StixGranularMarking		 The granular markings that apply to parts of the object StixObject
extensions 0..1
StixExtensions		 The object’s extensions, as a dictionary keyed by extension name StixObject

Rules

Section titled “Rules”

Rule Applied Preconditions Postconditions Elseconditions
slot_conditions {'body': {'value_presence': 'PRESENT'}} {'body_multipart': {'value_presence': 'ABSENT'}}

Identifier and Mapping Information

Section titled “Identifier and Mapping Information”

Annotations

Section titled “Annotations”
property value
stix_type email-message

Schema Source

Section titled “Schema Source”

Mappings

Section titled “Mappings”
Mapping Type Mapped Value
self attack:StixEmailMessage
native attack:StixEmailMessage
close uco-observable:EmailMessage

LinkML Source

Section titled “LinkML Source”

Direct

Section titled “Direct”
name: StixEmailMessage
annotations:
  stix_type:
    tag: stix_type
    value: email-message
description: The Email Message Object represents an instance of an email message.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:EmailMessage
is_a: StixCyberObservableObject
slots:
- email_date
- content_type
- from_ref
- sender_ref
- to_refs
- cc_refs
- bcc_refs
- message_id
- subject
- received_lines
- additional_header_fields
- raw_email_ref
- is_multipart
- body
- body_multipart
slot_usage:
  id:
    name: id
    pattern: ^email-message--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    equals_string: email-message
  is_multipart:
    name: is_multipart
    required: true
rules:
- preconditions:
    slot_conditions:
      body:
        name: body
        value_presence: PRESENT
  postconditions:
    slot_conditions:
      body_multipart:
        name: body_multipart
        value_presence: ABSENT
  description: body and body_multipart exclude each other.

Induced

Section titled “Induced”
name: StixEmailMessage
annotations:
  stix_type:
    tag: stix_type
    value: email-message
description: The Email Message Object represents an instance of an email message.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:EmailMessage
is_a: StixCyberObservableObject
slot_usage:
  id:
    name: id
    pattern: ^email-message--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    equals_string: email-message
  is_multipart:
    name: is_multipart
    required: true
attributes:
  email_date:
    name: email_date
    description: Specifies the date/time that the email message was sent.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:date
    alias: date
    owner: StixEmailMessage
    domain_of:
    - StixEmailMessage
    range: stix_timestamp
  content_type:
    name: content_type
    description: The value of a Content-Type header field.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:content_type
    owner: StixEmailMessage
    domain_of:
    - StixEmailMessage
    - StixMimePart
    range: string
  from_ref:
    name: from_ref
    description: Specifies the value of the 'From:' header of the email message.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:from_ref
    owner: StixEmailMessage
    domain_of:
    - StixEmailMessage
    range: StixEmailAddress
    pattern: ^email-addr--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  sender_ref:
    name: sender_ref
    description: Specifies the value of the 'From' field of the email message.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:sender_ref
    owner: StixEmailMessage
    domain_of:
    - StixEmailMessage
    range: StixEmailAddress
    pattern: ^email-addr--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  to_refs:
    name: to_refs
    description: Specifies the mailboxes that are 'To:' recipients of the email message.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:to_refs
    owner: StixEmailMessage
    domain_of:
    - StixEmailMessage
    range: StixEmailAddress
    multivalued: true
    pattern: ^email-addr--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  cc_refs:
    name: cc_refs
    description: Specifies the mailboxes that are 'CC:' recipients of the email message.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:cc_refs
    owner: StixEmailMessage
    domain_of:
    - StixEmailMessage
    range: StixEmailAddress
    multivalued: true
    pattern: ^email-addr--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  bcc_refs:
    name: bcc_refs
    description: Specifies the mailboxes that are 'BCC:' recipients of the email message.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:bcc_refs
    owner: StixEmailMessage
    domain_of:
    - StixEmailMessage
    range: StixEmailAddress
    multivalued: true
    pattern: ^email-addr--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  message_id:
    name: message_id
    description: Specifies the Message-ID field of the email message.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:message_id
    owner: StixEmailMessage
    domain_of:
    - StixEmailMessage
    range: string
  subject:
    name: subject
    description: A subject, as a string; each class says of what.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:subject
    owner: StixEmailMessage
    domain_of:
    - StixEmailMessage
    - StixX509Certificate
    range: string
  received_lines:
    name: received_lines
    description: Specifies one or more Received header fields that may be included
      in the email headers.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:received_lines
    owner: StixEmailMessage
    domain_of:
    - StixEmailMessage
    range: string
    multivalued: true
    minimum_cardinality: 1
  additional_header_fields:
    name: additional_header_fields
    description: Specifies any other header fields found in the email message, as
      a dictionary.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:additional_header_fields
    owner: StixEmailMessage
    domain_of:
    - StixEmailMessage
    range: StixDictionary
    inlined: true
  raw_email_ref:
    name: raw_email_ref
    description: Specifies the raw binary contents of the email message, including
      both the headers and body, as a reference to an Artifact Object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:raw_email_ref
    owner: StixEmailMessage
    domain_of:
    - StixEmailMessage
    range: StixArtifact
    pattern: ^artifact--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  is_multipart:
    name: is_multipart
    description: Indicates whether the email body contains multiple MIME parts.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:is_multipart
    owner: StixEmailMessage
    domain_of:
    - StixEmailMessage
    range: boolean
    required: true
  body:
    name: body
    description: A body of text.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:body
    owner: StixEmailMessage
    domain_of:
    - StixEmailMessage
    - StixMimePart
    range: string
  body_multipart:
    name: body_multipart
    description: The MIME parts that make up a multipart email body.
    comments:
    - Present only when is_multipart is true.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:body_multipart
    owner: StixEmailMessage
    domain_of:
    - StixEmailMessage
    range: StixMimePart
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  defanged:
    name: defanged
    description: Defines whether or not the data contained within the object has been
      defanged.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:defanged
    owner: StixEmailMessage
    domain_of:
    - StixCyberObservableObject
    range: boolean
  id:
    name: id
    description: 'The identifier of the object: its STIX type, two hyphens and a UUID.
      Each class narrows the type.'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:id
    identifier: true
    owner: StixEmailMessage
    domain_of:
    - StixObject
    - StixBundle
    range: stix_identifier
    required: true
    pattern: ^email-message--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    description: The STIX type name of the object, such as attack-pattern. Each class
      pins its own.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:type
    owner: StixEmailMessage
    domain_of:
    - StixObject
    - StixBundle
    range: string
    required: true
    pattern: ^([a-z][a-z0-9]*)+(-[a-z0-9]+)*\-?$
    equals_string: email-message
  spec_version:
    name: spec_version
    description: The version of the STIX specification used to represent the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:spec_version
    owner: StixEmailMessage
    domain_of:
    - StixObject
    range: StixSpecVersion
  object_marking_refs:
    name: object_marking_refs
    description: References to the marking definitions that apply to the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:objectMarking
    rank: 1000
    slot_uri: stix:object_marking_refs
    owner: StixEmailMessage
    domain_of:
    - StixObject
    range: StixMarkingDefinition
    multivalued: true
    pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  granular_markings:
    name: granular_markings
    description: The granular markings that apply to parts of the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:granular_markings
    owner: StixEmailMessage
    domain_of:
    - StixObject
    range: StixGranularMarking
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  extensions:
    name: extensions
    description: The object's extensions, as a dictionary keyed by extension name.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:extensions
    owner: StixEmailMessage
    domain_of:
    - StixObject
    range: StixExtensions
    inlined: true
rules:
- preconditions:
    slot_conditions:
      body:
        name: body
        value_presence: PRESENT
  postconditions:
    slot_conditions:
      body_multipart:
        name: body_multipart
        value_presence: ABSENT
  description: body and body_multipart exclude each other.