Class: StixIpv6Address

The IPv6 Address Object represents one or more IPv6 addresses expressed using CIDR notation.

URI: attack:StixIpv6Address

 classDiagram
    class StixIpv6Address
    click StixIpv6Address href "../StixIpv6Address/"
      StixCyberObservableObject <|-- StixIpv6Address
        click StixCyberObservableObject href "../StixCyberObservableObject/"
      
      StixIpv6Address : belongs_to_refs
        
          
    
        
        
        StixIpv6Address --> "1..*" StixAutonomousSystem : belongs_to_refs
        click StixAutonomousSystem href "../StixAutonomousSystem/"
    

        
      StixIpv6Address : defanged
        
      StixIpv6Address : extensions
        
          
    
        
        
        StixIpv6Address --> "0..1" StixExtensions : extensions
        click StixExtensions href "../StixExtensions/"
    

        
      StixIpv6Address : granular_markings
        
          
    
        
        
        StixIpv6Address --> "1..*" StixGranularMarking : granular_markings
        click StixGranularMarking href "../StixGranularMarking/"
    

        
      StixIpv6Address : id
        
      StixIpv6Address : object_marking_refs
        
          
    
        
        
        StixIpv6Address --> "1..*" StixMarkingDefinition : object_marking_refs
        click StixMarkingDefinition href "../StixMarkingDefinition/"
    

        
      StixIpv6Address : resolves_to_refs
        
          
    
        
        
        StixIpv6Address --> "1..*" StixMacAddress : resolves_to_refs
        click StixMacAddress href "../StixMacAddress/"
    

        
      StixIpv6Address : spec_version
        
          
    
        
        
        StixIpv6Address --> "0..1" StixSpecVersion : spec_version
        click StixSpecVersion href "../StixSpecVersion/"
    

        
      StixIpv6Address : type
        
      StixIpv6Address : value
        
      

Inheritance

• StixObject
  • StixCyberObservableObject
    • StixIpv6Address

Slots

Name	Cardinality and Range	Description	Inheritance
value	1 String	The value of the observable, in the form each class states	direct
resolves_to_refs	1..* StixMacAddress	References to the cyber-observable objects that this one resolves to	direct
belongs_to_refs	1..* StixAutonomousSystem	References to the autonomous systems that this address belongs to	direct
defanged	0..1 Boolean	Defines whether or not the data contained within the object has been defanged	StixCyberObservableObject
id	1 StixIdentifier	The identifier of the object: its STIX type, two hyphens and a UUID	StixObject
type	1 String	The STIX type name of the object, such as attack-pattern	StixObject
spec_version	0..1 StixSpecVersion	The version of the STIX specification used to represent the object	StixObject
object_marking_refs	1..* StixMarkingDefinition	References to the marking definitions that apply to the object	StixObject
granular_markings	1..* StixGranularMarking	The granular markings that apply to parts of the object	StixObject
extensions	0..1 StixExtensions	The object’s extensions, as a dictionary keyed by extension name	StixObject

Usages

used by	used in	type	used
StixDomainName	resolves_to_refs	any_of[range]	StixIpv6Address
StixNetworkTraffic	src_ref	any_of[range]	StixIpv6Address
StixNetworkTraffic	dst_ref	any_of[range]	StixIpv6Address

Identifier and Mapping Information

Annotations

property	value
stix_type	ipv6-addr

Schema Source

• from schema: https://w3id.org/lmodel/attack

Mappings

Mapping Type	Mapped Value
self	attack:StixIpv6Address
native	attack:StixIpv6Address
close	uco-observable:IPv6Address

LinkML Source

Direct

name: StixIpv6Address
annotations:
  stix_type:
    tag: stix_type
    value: ipv6-addr
description: The IPv6 Address Object represents one or more IPv6 addresses expressed
  using CIDR notation.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:IPv6Address
is_a: StixCyberObservableObject
slots:
- value
- resolves_to_refs
- belongs_to_refs
slot_usage:
  id:
    name: id
    pattern: ^ipv6-addr--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    equals_string: ipv6-addr
  value:
    name: value
    required: true
    pattern: ^\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?\s*(\/(12[0-8]|1[0-1][0-9]|[1-9][0-9]|[0-9]))?$
  resolves_to_refs:
    name: resolves_to_refs
    range: StixMacAddress
    pattern: ^mac-addr--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$

Induced

name: StixIpv6Address
annotations:
  stix_type:
    tag: stix_type
    value: ipv6-addr
description: The IPv6 Address Object represents one or more IPv6 addresses expressed
  using CIDR notation.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:IPv6Address
is_a: StixCyberObservableObject
slot_usage:
  id:
    name: id
    pattern: ^ipv6-addr--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    equals_string: ipv6-addr
  value:
    name: value
    required: true
    pattern: ^\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?\s*(\/(12[0-8]|1[0-1][0-9]|[1-9][0-9]|[0-9]))?$
  resolves_to_refs:
    name: resolves_to_refs
    range: StixMacAddress
    pattern: ^mac-addr--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
attributes:
  value:
    name: value
    description: The value of the observable, in the form each class states.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:value
    owner: StixIpv6Address
    domain_of:
    - StixDomainName
    - StixEmailAddress
    - StixIpv4Address
    - StixIpv6Address
    - StixMacAddress
    - StixUrl
    range: string
    required: true
    pattern: ^\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?\s*(\/(12[0-8]|1[0-1][0-9]|[1-9][0-9]|[0-9]))?$
  resolves_to_refs:
    name: resolves_to_refs
    description: References to the cyber-observable objects that this one resolves
      to.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:resolves_to_refs
    owner: StixIpv6Address
    domain_of:
    - StixDomainName
    - StixIpv4Address
    - StixIpv6Address
    range: StixMacAddress
    multivalued: true
    pattern: ^mac-addr--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  belongs_to_refs:
    name: belongs_to_refs
    description: References to the autonomous systems that this address belongs to.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:belongs_to_refs
    owner: StixIpv6Address
    domain_of:
    - StixIpv4Address
    - StixIpv6Address
    range: StixAutonomousSystem
    multivalued: true
    pattern: ^autonomous-system--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  defanged:
    name: defanged
    description: Defines whether or not the data contained within the object has been
      defanged.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:defanged
    owner: StixIpv6Address
    domain_of:
    - StixCyberObservableObject
    range: boolean
  id:
    name: id
    description: 'The identifier of the object: its STIX type, two hyphens and a UUID.
      Each class narrows the type.'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:id
    identifier: true
    owner: StixIpv6Address
    domain_of:
    - StixObject
    - StixBundle
    range: stix_identifier
    required: true
    pattern: ^ipv6-addr--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    description: The STIX type name of the object, such as attack-pattern. Each class
      pins its own.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:type
    owner: StixIpv6Address
    domain_of:
    - StixObject
    - StixBundle
    range: string
    required: true
    pattern: ^([a-z][a-z0-9]*)+(-[a-z0-9]+)*\-?$
    equals_string: ipv6-addr
  spec_version:
    name: spec_version
    description: The version of the STIX specification used to represent the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:spec_version
    owner: StixIpv6Address
    domain_of:
    - StixObject
    range: StixSpecVersion
  object_marking_refs:
    name: object_marking_refs
    description: References to the marking definitions that apply to the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:objectMarking
    rank: 1000
    slot_uri: stix:object_marking_refs
    owner: StixIpv6Address
    domain_of:
    - StixObject
    range: StixMarkingDefinition
    multivalued: true
    pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  granular_markings:
    name: granular_markings
    description: The granular markings that apply to parts of the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:granular_markings
    owner: StixIpv6Address
    domain_of:
    - StixObject
    range: StixGranularMarking
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  extensions:
    name: extensions
    description: The object's extensions, as a dictionary keyed by extension name.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:extensions
    owner: StixIpv6Address
    domain_of:
    - StixObject
    range: StixExtensions
    inlined: true