Skip to content
attack

Class: StixIdentity

An individual, organization or group, such as ACME, Inc., or a class of them.

URI: attack:StixIdentity

 classDiagram
    class StixIdentity
    click StixIdentity href "../StixIdentity/"
      StixDomainObject <|-- StixIdentity
        click StixDomainObject href "../StixDomainObject/"
      

      StixIdentity <|-- AttackIdentity
        click AttackIdentity href "../AttackIdentity/"
      

      StixIdentity : confidence
        
      StixIdentity : contact_information
        
      StixIdentity : created
        
      StixIdentity : created_by_ref
        
          
    
        
        
        StixIdentity --> "0..1" StixIdentity : created_by_ref
        click StixIdentity href "../StixIdentity/"
    

        
      StixIdentity : description
        
      StixIdentity : extensions
        
          
    
        
        
        StixIdentity --> "0..1" StixExtensions : extensions
        click StixExtensions href "../StixExtensions/"
    

        
      StixIdentity : external_references
        
          
    
        
        
        StixIdentity --> "1..*" StixExternalReference : external_references
        click StixExternalReference href "../StixExternalReference/"
    

        
      StixIdentity : granular_markings
        
          
    
        
        
        StixIdentity --> "1..*" StixGranularMarking : granular_markings
        click StixGranularMarking href "../StixGranularMarking/"
    

        
      StixIdentity : id
        
      StixIdentity : identity_class
        
      StixIdentity : labels
        
      StixIdentity : lang
        
      StixIdentity : modified
        
      StixIdentity : name
        
      StixIdentity : object_marking_refs
        
          
    
        
        
        StixIdentity --> "1..*" StixMarkingDefinition : object_marking_refs
        click StixMarkingDefinition href "../StixMarkingDefinition/"
    

        
      StixIdentity : revoked
        
      StixIdentity : roles
        
      StixIdentity : sectors
        
      StixIdentity : spec_version
        
          
    
        
        
        StixIdentity --> "1" StixSpecVersion : spec_version
        click StixSpecVersion href "../StixSpecVersion/"
    

        
      StixIdentity : type

Inheritance

Section titled “Inheritance”

Slots

Section titled “Slots”
Name Cardinality and Range Description Inheritance
roles 1..*
String		 The roles that the identity or threat actor plays direct
name 1
String		 A name that identifies the object direct
description 0..1
String		 A description of the object, which may be long direct
identity_class 0..1
String or 
StixIdentityClass		 The kind of entity the identity describes, such as an individual or an organi… direct
sectors 1..*
String or 
StixIndustrySector		 The industry sectors that the identity belongs to direct
contact_information 0..1
String		 The contact information (e-mail, phone number, etc direct
created_by_ref 0..1
StixIdentity		 A reference to the identity of the object’s creator StixCommonObject
created 1
StixTimestampMillis		 The time at which the object, or its first version, was created StixCommonObject
modified 1
StixTimestampMillis		 The time at which this version of the object was modified StixCommonObject
revoked 0..1
Boolean		 The revoked property indicates whether the object has been revoked StixCommonObject
labels 1..*
String		 The labels property specifies a set of terms used to describe this object StixCommonObject
confidence 0..1
Integer		 Identifies the confidence that the creator has in the correctness of their da… StixCommonObject
lang 0..1
String		 The language of the text content, as an RFC 5646 language code StixCommonObject
external_references 1..*
StixExternalReference		 References to non-STIX information about the object StixCommonObject
id 1
StixIdentifier		 The identifier of the object: its STIX type, two hyphens and a UUID StixObject
type 1
String		 The STIX type name of the object, such as attack-pattern StixObject
spec_version 1
StixSpecVersion		 The version of the STIX specification used to represent the object StixObject
object_marking_refs 1..*
StixMarkingDefinition		 References to the marking definitions that apply to the object StixObject
granular_markings 1..*
StixGranularMarking		 The granular markings that apply to parts of the object StixObject
extensions 0..1
StixExtensions		 The object’s extensions, as a dictionary keyed by extension name StixObject

Usages

Section titled “Usages”
used by used in type used
AttackTechnique x_mitre_modified_by_ref range StixIdentity
AttackTechnique created_by_ref range StixIdentity
AttackTactic x_mitre_modified_by_ref range StixIdentity
AttackTactic created_by_ref range StixIdentity
AttackGroup x_mitre_modified_by_ref range StixIdentity
AttackGroup created_by_ref range StixIdentity
AttackCampaign x_mitre_modified_by_ref range StixIdentity
AttackCampaign created_by_ref range StixIdentity
AttackMalware x_mitre_modified_by_ref range StixIdentity
AttackMalware created_by_ref range StixIdentity
AttackTool x_mitre_modified_by_ref range StixIdentity
AttackTool created_by_ref range StixIdentity
AttackMitigation x_mitre_modified_by_ref range StixIdentity
AttackMitigation created_by_ref range StixIdentity
AttackMatrix x_mitre_modified_by_ref range StixIdentity
AttackMatrix created_by_ref range StixIdentity
AttackCollection x_mitre_modified_by_ref range StixIdentity
AttackCollection created_by_ref range StixIdentity
AttackAsset x_mitre_modified_by_ref range StixIdentity
AttackAsset created_by_ref range StixIdentity
AttackDataSource x_mitre_modified_by_ref range StixIdentity
AttackDataSource created_by_ref range StixIdentity
AttackDataComponent x_mitre_modified_by_ref range StixIdentity
AttackDataComponent created_by_ref range StixIdentity
AttackDetectionStrategy x_mitre_modified_by_ref range StixIdentity
AttackDetectionStrategy created_by_ref range StixIdentity
AttackAnalytic x_mitre_modified_by_ref range StixIdentity
AttackAnalytic created_by_ref range StixIdentity
AttackRelationship x_mitre_modified_by_ref range StixIdentity
AttackRelationship created_by_ref range StixIdentity
AttackIdentity created_by_ref range StixIdentity
AttackMarkingDefinition created_by_ref range StixIdentity
StixCommonObject created_by_ref range StixIdentity
StixDomainObject created_by_ref range StixIdentity
StixRelationshipObject created_by_ref range StixIdentity
StixIdentity created_by_ref range StixIdentity
StixMarkingDefinition created_by_ref range StixIdentity
StixLanguageContent created_by_ref range StixIdentity
StixExtensionDefinition created_by_ref range StixIdentity
StixAttackPattern created_by_ref range StixIdentity
StixCampaign created_by_ref range StixIdentity
StixCourseOfAction created_by_ref range StixIdentity
StixGrouping created_by_ref range StixIdentity
StixIncident created_by_ref range StixIdentity
StixIndicator created_by_ref range StixIdentity
StixInfrastructure created_by_ref range StixIdentity
StixIntrusionSet created_by_ref range StixIdentity
StixLocation created_by_ref range StixIdentity
StixMalware created_by_ref range StixIdentity
StixMalwareAnalysis created_by_ref range StixIdentity
StixNote created_by_ref range StixIdentity
StixObservedData created_by_ref range StixIdentity
StixOpinion created_by_ref range StixIdentity
StixReport created_by_ref range StixIdentity
StixThreatActor created_by_ref range StixIdentity
StixTool created_by_ref range StixIdentity
StixVulnerability created_by_ref range StixIdentity
StixRelationship created_by_ref range StixIdentity
StixSighting where_sighted_refs any_of[range] StixIdentity
StixSighting created_by_ref range StixIdentity

Identifier and Mapping Information

Section titled “Identifier and Mapping Information”

Annotations

Section titled “Annotations”
property value
stix_type identity

Schema Source

Section titled “Schema Source”

Mappings

Section titled “Mappings”
Mapping Type Mapped Value
self attack:StixIdentity
native attack:StixIdentity
close uco-identity:Identity

LinkML Source

Section titled “LinkML Source”

Direct

Section titled “Direct”
name: StixIdentity
annotations:
  stix_type:
    tag: stix_type
    value: identity
description: An individual, organization or group, such as ACME, Inc., or a class
  of them.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-identity:Identity
is_a: StixDomainObject
slots:
- roles
- name
- description
- identity_class
- sectors
- contact_information
slot_usage:
  id:
    name: id
    pattern: ^identity--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    equals_string: identity
  name:
    name: name
    required: true

Induced

Section titled “Induced”
name: StixIdentity
annotations:
  stix_type:
    tag: stix_type
    value: identity
description: An individual, organization or group, such as ACME, Inc., or a class
  of them.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-identity:Identity
is_a: StixDomainObject
slot_usage:
  id:
    name: id
    pattern: ^identity--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    equals_string: identity
  name:
    name: name
    required: true
attributes:
  roles:
    name: roles
    description: The roles that the identity or threat actor plays.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:roles
    owner: StixIdentity
    domain_of:
    - StixIdentity
    - StixThreatActor
    range: string
    multivalued: true
    minimum_cardinality: 1
  name:
    name: name
    description: A name that identifies the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:name
    rank: 1000
    slot_uri: stix:name
    owner: StixIdentity
    domain_of:
    - AttackTactic
    - AttackMatrix
    - AttackCollection
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackDetectionStrategy
    - AttackAnalytic
    - AttackRelatedAsset
    - AttackLogSource
    - AttackLogSourceReference
    - StixIdentity
    - StixMarkingDefinition
    - StixExtensionDefinition
    - StixAutonomousSystem
    - StixFile
    - StixMutex
    - StixSoftware
    - StixAlternateDataStream
    - StixWindowsPeSection
    - StixWindowsRegistryValue
    - StixAttackPattern
    - StixCampaign
    - StixCourseOfAction
    - StixGrouping
    - StixIncident
    - StixIndicator
    - StixInfrastructure
    - StixIntrusionSet
    - StixLocation
    - StixMalware
    - StixReport
    - StixThreatActor
    - StixTool
    - StixVulnerability
    range: string
    required: true
  description:
    name: description
    description: A description of the object, which may be long.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:description
    rank: 1000
    slot_uri: stix:description
    owner: StixIdentity
    domain_of:
    - AttackTactic
    - AttackMatrix
    - AttackCollection
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackAnalytic
    - AttackRelatedAsset
    - AttackMutableElement
    - StixIdentity
    - StixExtensionDefinition
    - StixExternalReference
    - StixAttackPattern
    - StixCampaign
    - StixCourseOfAction
    - StixGrouping
    - StixIncident
    - StixIndicator
    - StixInfrastructure
    - StixIntrusionSet
    - StixLocation
    - StixMalware
    - StixReport
    - StixThreatActor
    - StixTool
    - StixVulnerability
    - StixRelationship
    - StixSighting
    range: string
  identity_class:
    name: identity_class
    description: The kind of entity the identity describes, such as an individual
      or an organization.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:identity_class
    owner: StixIdentity
    domain_of:
    - StixIdentity
    range: string
    any_of:
    - range: StixIdentityClass
    - range: string
  sectors:
    name: sectors
    description: The industry sectors that the identity belongs to.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:sectors
    owner: StixIdentity
    domain_of:
    - StixIdentity
    range: string
    multivalued: true
    minimum_cardinality: 1
    any_of:
    - range: StixIndustrySector
    - range: string
  contact_information:
    name: contact_information
    description: The contact information (e-mail, phone number, etc.) for this Identity.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:contact_information
    owner: StixIdentity
    domain_of:
    - StixIdentity
    range: string
  created_by_ref:
    name: created_by_ref
    description: A reference to the identity of the object's creator.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:createdBy
    rank: 1000
    slot_uri: stix:created_by_ref
    owner: StixIdentity
    domain_of:
    - StixCommonObject
    - StixMarkingDefinition
    range: StixIdentity
    pattern: ^identity--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  created:
    name: created
    description: The time at which the object, or its first version, was created.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:objectCreatedTime
    rank: 1000
    slot_uri: stix:created
    owner: StixIdentity
    domain_of:
    - StixCommonObject
    - StixMarkingDefinition
    range: stix_timestamp_millis
    required: true
  modified:
    name: modified
    description: The time at which this version of the object was modified.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:modifiedTime
    rank: 1000
    slot_uri: stix:modified
    owner: StixIdentity
    domain_of:
    - StixCommonObject
    range: stix_timestamp_millis
    required: true
  revoked:
    name: revoked
    description: The revoked property indicates whether the object has been revoked.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:revoked
    owner: StixIdentity
    domain_of:
    - StixCommonObject
    range: boolean
  labels:
    name: labels
    description: The labels property specifies a set of terms used to describe this
      object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:tag
    rank: 1000
    slot_uri: stix:labels
    owner: StixIdentity
    domain_of:
    - StixCommonObject
    range: string
    multivalued: true
    minimum_cardinality: 1
  confidence:
    name: confidence
    description: Identifies the confidence that the creator has in the correctness
      of their data.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:confidence
    rank: 1000
    slot_uri: stix:confidence
    owner: StixIdentity
    domain_of:
    - StixCommonObject
    range: integer
    minimum_value: 0
    maximum_value: 100
  lang:
    name: lang
    description: The language of the text content, as an RFC 5646 language code.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:lang
    owner: StixIdentity
    domain_of:
    - StixCommonObject
    - StixGranularMarking
    range: string
  external_references:
    name: external_references
    description: References to non-STIX information about the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:externalReference
    rank: 1000
    slot_uri: stix:external_references
    owner: StixIdentity
    domain_of:
    - StixCommonObject
    - StixMarkingDefinition
    range: StixExternalReference
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  id:
    name: id
    description: 'The identifier of the object: its STIX type, two hyphens and a UUID.
      Each class narrows the type.'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:id
    identifier: true
    owner: StixIdentity
    domain_of:
    - StixObject
    - StixBundle
    range: stix_identifier
    required: true
    pattern: ^identity--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    description: The STIX type name of the object, such as attack-pattern. Each class
      pins its own.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:type
    owner: StixIdentity
    domain_of:
    - StixObject
    - StixBundle
    range: string
    required: true
    pattern: ^([a-z][a-z0-9]*)+(-[a-z0-9]+)*\-?$
    equals_string: identity
  spec_version:
    name: spec_version
    description: The version of the STIX specification used to represent the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:spec_version
    owner: StixIdentity
    domain_of:
    - StixObject
    range: StixSpecVersion
    required: true
  object_marking_refs:
    name: object_marking_refs
    description: References to the marking definitions that apply to the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:objectMarking
    rank: 1000
    slot_uri: stix:object_marking_refs
    owner: StixIdentity
    domain_of:
    - StixObject
    range: StixMarkingDefinition
    multivalued: true
    pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  granular_markings:
    name: granular_markings
    description: The granular markings that apply to parts of the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:granular_markings
    owner: StixIdentity
    domain_of:
    - StixObject
    range: StixGranularMarking
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  extensions:
    name: extensions
    description: The object's extensions, as a dictionary keyed by extension name.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:extensions
    owner: StixIdentity
    domain_of:
    - StixObject
    range: StixExtensions
    inlined: true