Class: StixMimePart

One MIME part of a multipart email body.

URI: attack:StixMimePart

 classDiagram
    class StixMimePart
    click StixMimePart href "../StixMimePart/"
      StixMimePart : body
        
      StixMimePart : body_raw_ref
        
          
    
        
        
        StixMimePart --> "0..1" StixCyberObservableObject : body_raw_ref
        click StixCyberObservableObject href "../StixCyberObservableObject/"
    

        
      StixMimePart : content_disposition
        
      StixMimePart : content_type
        
      

Slots

Name	Cardinality and Range	Description	Inheritance
body	0..1 String	A body of text	direct
body_raw_ref	0..1 StixCyberObservableObject or  StixArtifact or  StixFile	Specifies the contents of non-textual MIME parts, that is those whose content…	direct
content_type	0..1 String	The value of a Content-Type header field	direct
content_disposition	0..1 String	Specifies the value of the ‘Content-Disposition’ header field of the MIME par…	direct

Expressions & Logic

Any Of

The class must satisfy at least one of:

• AnonymousClassExpression({‘slot_conditions’: {‘body’: SlotDefinition({‘name’: ‘body’, ‘required’: True})}})
• AnonymousClassExpression({ ‘slot_conditions’: {‘body_raw_ref’: SlotDefinition({‘name’: ‘body_raw_ref’, ‘required’: True})} })

Usages

used by	used in	type	used
StixEmailMessage	body_multipart	range	StixMimePart

Rules

Rule Applied	Preconditions	Postconditions	Elseconditions
slot_conditions	{'body': {'value_presence': 'PRESENT'}}	{'body_raw_ref': {'value_presence': 'ABSENT'}}

Identifier and Mapping Information

Schema Source

• from schema: https://w3id.org/lmodel/attack

Mappings

Mapping Type	Mapped Value
self	attack:StixMimePart
native	attack:StixMimePart
close	uco-observable:MimePartType

LinkML Source

Direct

name: StixMimePart
description: One MIME part of a multipart email body.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:MimePartType
slots:
- body
- body_raw_ref
- content_type
- content_disposition
rules:
- preconditions:
    slot_conditions:
      body:
        name: body
        value_presence: PRESENT
  postconditions:
    slot_conditions:
      body_raw_ref:
        name: body_raw_ref
        value_presence: ABSENT
  description: body and body_raw_ref exclude each other.
any_of:
- slot_conditions:
    body:
      name: body
      required: true
- slot_conditions:
    body_raw_ref:
      name: body_raw_ref
      required: true

Induced

name: StixMimePart
description: One MIME part of a multipart email body.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:MimePartType
attributes:
  body:
    name: body
    description: A body of text.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:body
    owner: StixMimePart
    domain_of:
    - StixEmailMessage
    - StixMimePart
    range: string
  body_raw_ref:
    name: body_raw_ref
    description: Specifies the contents of non-textual MIME parts, that is those whose
      content_type does not start with text/, as a reference to an Artifact Object
      or File Object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:body_raw_ref
    owner: StixMimePart
    domain_of:
    - StixMimePart
    range: StixCyberObservableObject
    pattern: ^(artifact|file)--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    any_of:
    - range: StixArtifact
    - range: StixFile
  content_type:
    name: content_type
    description: The value of a Content-Type header field.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:content_type
    owner: StixMimePart
    domain_of:
    - StixEmailMessage
    - StixMimePart
    range: string
  content_disposition:
    name: content_disposition
    description: Specifies the value of the 'Content-Disposition' header field of
      the MIME part.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:content_disposition
    owner: StixMimePart
    domain_of:
    - StixMimePart
    range: string
rules:
- preconditions:
    slot_conditions:
      body:
        name: body
        value_presence: PRESENT
  postconditions:
    slot_conditions:
      body_raw_ref:
        name: body_raw_ref
        value_presence: ABSENT
  description: body and body_raw_ref exclude each other.
any_of:
- slot_conditions:
    body:
      name: body
      required: true
- slot_conditions:
    body_raw_ref:
      name: body_raw_ref
      required: true