Class: StixMarkingDefinition
A marking definition: a statement, a Traffic Light Protocol (TLP) level or another marking that applies to the objects that reference it.
URI: attack:StixMarkingDefinition
classDiagram
class StixMarkingDefinition
click StixMarkingDefinition href "../StixMarkingDefinition/"
StixObject <|-- StixMarkingDefinition
click StixObject href "../StixObject/"
StixMarkingDefinition <|-- AttackMarkingDefinition
click AttackMarkingDefinition href "../AttackMarkingDefinition/"
StixMarkingDefinition : created
StixMarkingDefinition : created_by_ref
StixMarkingDefinition --> "0..1" StixIdentity : created_by_ref
click StixIdentity href "../StixIdentity/"
StixMarkingDefinition : definition
StixMarkingDefinition : definition_type
StixMarkingDefinition : extensions
StixMarkingDefinition --> "0..1" StixExtensions : extensions
click StixExtensions href "../StixExtensions/"
StixMarkingDefinition : external_references
StixMarkingDefinition --> "1..*" StixExternalReference : external_references
click StixExternalReference href "../StixExternalReference/"
StixMarkingDefinition : granular_markings
StixMarkingDefinition --> "1..*" StixGranularMarking : granular_markings
click StixGranularMarking href "../StixGranularMarking/"
StixMarkingDefinition : id
StixMarkingDefinition : name
StixMarkingDefinition : object_marking_refs
StixMarkingDefinition --> "1..*" StixMarkingDefinition : object_marking_refs
click StixMarkingDefinition href "../StixMarkingDefinition/"
StixMarkingDefinition : spec_version
StixMarkingDefinition --> "1" StixSpecVersion : spec_version
click StixSpecVersion href "../StixSpecVersion/"
StixMarkingDefinition : type
Inheritance
Section titled “Inheritance”- StixObject
- StixMarkingDefinition
| Name | Cardinality and Range | Description | Inheritance |
|---|---|---|---|
| created_by_ref | 0..1 StixIdentity |
A reference to the identity of the object’s creator | direct |
| created | 1 StixTimestampMillis |
The time at which the object, or its first version, was created | direct |
| external_references | 1..* StixExternalReference |
References to non-STIX information about the object | direct |
| name | 0..1 String |
A name that identifies the object | direct |
| definition_type | 0..1 String or StixMarkingDefinitionType |
The type of the marking definition, such as statement or tlp | direct |
| definition | 0..1 String or StixStatementMarking or StixTlpMarking |
The marking itself: a statement, or a Traffic Light Protocol (TLP) level | direct |
| id | 1 StixIdentifier |
The identifier of the object: its STIX type, two hyphens and a UUID | StixObject |
| type | 1 String |
The STIX type name of the object, such as attack-pattern | StixObject |
| spec_version | 1 StixSpecVersion |
The version of the STIX specification used to represent the object | StixObject |
| object_marking_refs | 1..* StixMarkingDefinition |
References to the marking definitions that apply to the object | StixObject |
| granular_markings | 1..* StixGranularMarking |
The granular markings that apply to parts of the object | StixObject |
| extensions | 0..1 StixExtensions |
The object’s extensions, as a dictionary keyed by extension name | StixObject |
Usages
Section titled “Usages”| Rule Applied | Preconditions | Postconditions | Elseconditions |
|---|---|---|---|
| slot_conditions | {'extensions': {'value_presence': 'ABSENT'}} |
{'definition': {'required': True}, 'definition_type': {'required': True}} |
Comments
Section titled “Comments”- created keeps the millisecond precision STIX 2.1 gives every object’s created. OASIS’s JSON schema asks a marking definition for a timestamp of any precision.
Identifier and Mapping Information
Section titled “Identifier and Mapping Information”Annotations
Section titled “Annotations”| property | value |
|---|---|
| stix_type | marking-definition |
Schema Source
Section titled “Schema Source”- from schema: https://w3id.org/lmodel/attack
Mappings
Section titled “Mappings”| Mapping Type | Mapped Value |
|---|---|
| self | attack:StixMarkingDefinition |
| native | attack:StixMarkingDefinition |
| close | uco-marking:MarkingDefinition |
LinkML Source
Section titled “LinkML Source”Direct
Section titled “Direct”name: StixMarkingDefinitionannotations: stix_type: tag: stix_type value: marking-definitiondescription: 'A marking definition: a statement, a Traffic Light Protocol (TLP) level or another marking that applies to the objects that reference it.'comments:- created keeps the millisecond precision STIX 2.1 gives every object's created. OASIS's JSON schema asks a marking definition for a timestamp of any precision.from_schema: https://w3id.org/lmodel/attackclose_mappings:- uco-marking:MarkingDefinitionis_a: StixObjectslots:- created_by_ref- created- external_references- name- definition_type- definitionslot_usage: id: name: id pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ type: name: type equals_string: marking-definition spec_version: name: spec_version required: true created: name: created required: truerules:- preconditions: slot_conditions: extensions: name: extensions value_presence: ABSENT postconditions: slot_conditions: definition: name: definition required: true definition_type: name: definition_type required: true description: Without extensions, a marking definition states its definition and definition type.Induced
Section titled “Induced”name: StixMarkingDefinitionannotations: stix_type: tag: stix_type value: marking-definitiondescription: 'A marking definition: a statement, a Traffic Light Protocol (TLP) level or another marking that applies to the objects that reference it.'comments:- created keeps the millisecond precision STIX 2.1 gives every object's created. OASIS's JSON schema asks a marking definition for a timestamp of any precision.from_schema: https://w3id.org/lmodel/attackclose_mappings:- uco-marking:MarkingDefinitionis_a: StixObjectslot_usage: id: name: id pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ type: name: type equals_string: marking-definition spec_version: name: spec_version required: true created: name: created required: trueattributes: created_by_ref: name: created_by_ref description: A reference to the identity of the object's creator. from_schema: https://w3id.org/lmodel/attack close_mappings: - uco-core:createdBy rank: 1000 slot_uri: stix:created_by_ref owner: StixMarkingDefinition domain_of: - StixCommonObject - StixMarkingDefinition range: StixIdentity pattern: ^identity--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ created: name: created description: The time at which the object, or its first version, was created. from_schema: https://w3id.org/lmodel/attack close_mappings: - uco-core:objectCreatedTime rank: 1000 slot_uri: stix:created owner: StixMarkingDefinition domain_of: - StixCommonObject - StixMarkingDefinition range: stix_timestamp_millis required: true external_references: name: external_references description: References to non-STIX information about the object. from_schema: https://w3id.org/lmodel/attack close_mappings: - uco-core:externalReference rank: 1000 slot_uri: stix:external_references owner: StixMarkingDefinition domain_of: - StixCommonObject - StixMarkingDefinition range: StixExternalReference multivalued: true inlined: true inlined_as_list: true minimum_cardinality: 1 name: name: name description: A name that identifies the object. from_schema: https://w3id.org/lmodel/attack close_mappings: - uco-core:name rank: 1000 slot_uri: stix:name owner: StixMarkingDefinition domain_of: - AttackTactic - AttackMatrix - AttackCollection - AttackAsset - AttackDataSource - AttackDataComponent - AttackDetectionStrategy - AttackAnalytic - AttackRelatedAsset - AttackLogSource - AttackLogSourceReference - StixIdentity - StixMarkingDefinition - StixExtensionDefinition - StixAutonomousSystem - StixFile - StixMutex - StixSoftware - StixAlternateDataStream - StixWindowsPeSection - StixWindowsRegistryValue - StixAttackPattern - StixCampaign - StixCourseOfAction - StixGrouping - StixIncident - StixIndicator - StixInfrastructure - StixIntrusionSet - StixLocation - StixMalware - StixReport - StixThreatActor - StixTool - StixVulnerability range: string definition_type: name: definition_type description: The type of the marking definition, such as statement or tlp. from_schema: https://w3id.org/lmodel/attack close_mappings: - uco-marking:definitionType rank: 1000 slot_uri: stix:definition_type owner: StixMarkingDefinition domain_of: - StixMarkingDefinition range: string any_of: - range: StixMarkingDefinitionType - range: string definition: name: definition description: 'The marking itself: a statement, or a Traffic Light Protocol (TLP) level.' from_schema: https://w3id.org/lmodel/attack close_mappings: - uco-marking:definition rank: 1000 slot_uri: stix:definition owner: StixMarkingDefinition domain_of: - StixMarkingDefinition range: string inlined: true any_of: - range: StixStatementMarking - range: StixTlpMarking id: name: id description: 'The identifier of the object: its STIX type, two hyphens and a UUID. Each class narrows the type.' from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:id identifier: true owner: StixMarkingDefinition domain_of: - StixObject - StixBundle range: stix_identifier required: true pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ type: name: type description: The STIX type name of the object, such as attack-pattern. Each class pins its own. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:type owner: StixMarkingDefinition domain_of: - StixObject - StixBundle range: string required: true pattern: ^([a-z][a-z0-9]*)+(-[a-z0-9]+)*\-?$ equals_string: marking-definition spec_version: name: spec_version description: The version of the STIX specification used to represent the object. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:spec_version owner: StixMarkingDefinition domain_of: - StixObject range: StixSpecVersion required: true object_marking_refs: name: object_marking_refs description: References to the marking definitions that apply to the object. from_schema: https://w3id.org/lmodel/attack close_mappings: - uco-core:objectMarking rank: 1000 slot_uri: stix:object_marking_refs owner: StixMarkingDefinition domain_of: - StixObject range: StixMarkingDefinition multivalued: true pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ minimum_cardinality: 1 granular_markings: name: granular_markings description: The granular markings that apply to parts of the object. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:granular_markings owner: StixMarkingDefinition domain_of: - StixObject range: StixGranularMarking multivalued: true inlined: true inlined_as_list: true minimum_cardinality: 1 extensions: name: extensions description: The object's extensions, as a dictionary keyed by extension name. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:extensions owner: StixMarkingDefinition domain_of: - StixObject range: StixExtensions inlined: truerules:- preconditions: slot_conditions: extensions: name: extensions value_presence: ABSENT postconditions: slot_conditions: definition: name: definition required: true definition_type: name: definition_type required: true description: Without extensions, a marking definition states its definition and definition type.