Class: StixExternalReference
External references are used to describe pointers to information represented outside of STIX.
URI: attack:StixExternalReference
classDiagram
class StixExternalReference
click StixExternalReference href "../StixExternalReference/"
StixExternalReference : description
StixExternalReference : external_id
StixExternalReference : hashes
StixExternalReference --> "0..1" StixHashes : hashes
click StixHashes href "../StixHashes/"
StixExternalReference : source_name
StixExternalReference : url
| Name | Cardinality and Range | Description | Inheritance |
|---|---|---|---|
| source_name | 1 String |
The source, such as a system, registry or organization, that defines the refe… | direct |
| description | 0..1 String |
A description of the object, which may be long | direct |
| url | 0..1 Uri |
A URL | direct |
| hashes | 0..1 StixHashes |
A dictionary of hashes of the content, keyed by hash algorithm | direct |
| external_id | 0..1 String |
An identifier of the external content in its source, such as CVE-2016-1234 | direct |
Expressions & Logic
Any Of
Section titled “Any Of”The class must satisfy at least one of:
- AnonymousClassExpression({ ‘slot_conditions’: {‘external_id’: SlotDefinition({‘name’: ‘external_id’, ‘required’: True})} })
- AnonymousClassExpression({ ‘slot_conditions’: {‘description’: SlotDefinition({‘name’: ‘description’, ‘required’: True})} })
- AnonymousClassExpression({‘slot_conditions’: {‘url’: SlotDefinition({‘name’: ‘url’, ‘required’: True})}})
Usages
Section titled “Usages”| Rule Applied | Preconditions | Postconditions | Elseconditions |
|---|---|---|---|
| slot_conditions | {'source_name': {'equals_string': 'cve'}} |
```{‘external_id’: {‘required’: True, ‘pattern’: ’^CVE-\d{4}-(0\d{3} | [1-9]\d{3,})$’}}``` |
| Rule Applied | Preconditions | Postconditions | Elseconditions |
|---|---|---|---|
| slot_conditions | {'source_name': {'equals_string': 'capec'}} |
{'external_id': {'required': True, 'pattern': '^CAPEC-\\d+$'}} |
Identifier and Mapping Information
Section titled “Identifier and Mapping Information”Schema Source
Section titled “Schema Source”- from schema: https://w3id.org/lmodel/attack
Mappings
Section titled “Mappings”| Mapping Type | Mapped Value |
|---|---|
| self | attack:StixExternalReference |
| native | attack:StixExternalReference |
| close | uco-core:ExternalReference |
LinkML Source
Section titled “LinkML Source”Direct
Section titled “Direct”name: StixExternalReferencedescription: External references are used to describe pointers to information represented outside of STIX.from_schema: https://w3id.org/lmodel/attackclose_mappings:- uco-core:ExternalReferenceslots:- source_name- description- url- hashes- external_idslot_usage: source_name: name: source_name required: truerules:- preconditions: slot_conditions: source_name: name: source_name equals_string: cve postconditions: slot_conditions: external_id: name: external_id required: true pattern: ^CVE-\d{4}-(0\d{3}|[1-9]\d{3,})$ description: A reference to the CVE list names a CVE identifier.- preconditions: slot_conditions: source_name: name: source_name equals_string: capec postconditions: slot_conditions: external_id: name: external_id required: true pattern: ^CAPEC-\d+$ description: A reference to CAPEC names a CAPEC identifier.any_of:- slot_conditions: external_id: name: external_id required: true- slot_conditions: description: name: description required: true- slot_conditions: url: name: url required: trueInduced
Section titled “Induced”name: StixExternalReferencedescription: External references are used to describe pointers to information represented outside of STIX.from_schema: https://w3id.org/lmodel/attackclose_mappings:- uco-core:ExternalReferenceslot_usage: source_name: name: source_name required: trueattributes: source_name: name: source_name description: The source, such as a system, registry or organization, that defines the reference. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:source_name owner: StixExternalReference domain_of: - StixExternalReference range: string required: true description: name: description description: A description of the object, which may be long. from_schema: https://w3id.org/lmodel/attack close_mappings: - uco-core:description rank: 1000 slot_uri: stix:description owner: StixExternalReference domain_of: - AttackTactic - AttackMatrix - AttackCollection - AttackAsset - AttackDataSource - AttackDataComponent - AttackAnalytic - AttackRelatedAsset - AttackMutableElement - StixIdentity - StixExtensionDefinition - StixExternalReference - StixAttackPattern - StixCampaign - StixCourseOfAction - StixGrouping - StixIncident - StixIndicator - StixInfrastructure - StixIntrusionSet - StixLocation - StixMalware - StixReport - StixThreatActor - StixTool - StixVulnerability - StixRelationship - StixSighting range: string url: name: url description: A URL. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:url owner: StixExternalReference domain_of: - StixExternalReference - StixArtifact range: uri hashes: name: hashes description: A dictionary of hashes of the content, keyed by hash algorithm. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:hashes owner: StixExternalReference domain_of: - StixExternalReference - StixArtifact - StixFile - StixX509Certificate - StixAlternateDataStream - StixWindowsPeSection - StixWindowsPeOptionalHeader range: StixHashes inlined: true external_id: name: external_id description: An identifier of the external content in its source, such as CVE-2016-1234. from_schema: https://w3id.org/lmodel/attack close_mappings: - uco-core:externalIdentifier rank: 1000 slot_uri: stix:external_id owner: StixExternalReference domain_of: - StixExternalReference range: stringrules:- preconditions: slot_conditions: source_name: name: source_name equals_string: cve postconditions: slot_conditions: external_id: name: external_id required: true pattern: ^CVE-\d{4}-(0\d{3}|[1-9]\d{3,})$ description: A reference to the CVE list names a CVE identifier.- preconditions: slot_conditions: source_name: name: source_name equals_string: capec postconditions: slot_conditions: external_id: name: external_id required: true pattern: ^CAPEC-\d+$ description: A reference to CAPEC names a CAPEC identifier.any_of:- slot_conditions: external_id: name: external_id required: true- slot_conditions: description: name: description required: true- slot_conditions: url: name: url required: true