Skip to content
attack

Class: StixNetworkTraffic

The Network Traffic Object represents arbitrary network traffic that originates from a source and is addressed to a destination.

URI: attack:StixNetworkTraffic

 classDiagram
    class StixNetworkTraffic
    click StixNetworkTraffic href "../StixNetworkTraffic/"
      StixCyberObservableObject <|-- StixNetworkTraffic
        click StixCyberObservableObject href "../StixCyberObservableObject/"
      
      StixNetworkTraffic : defanged
        
      StixNetworkTraffic : dst_byte_count
        
      StixNetworkTraffic : dst_packets
        
      StixNetworkTraffic : dst_payload_ref
        
          
    
        
        
        StixNetworkTraffic --> "0..1" StixArtifact : dst_payload_ref
        click StixArtifact href "../StixArtifact/"
    

        
      StixNetworkTraffic : dst_port
        
      StixNetworkTraffic : dst_ref
        
          
    
        
        
        StixNetworkTraffic --> "0..1" StixCyberObservableObject : dst_ref
        click StixCyberObservableObject href "../StixCyberObservableObject/"
    

        
      StixNetworkTraffic : encapsulated_by_ref
        
          
    
        
        
        StixNetworkTraffic --> "0..1" StixNetworkTraffic : encapsulated_by_ref
        click StixNetworkTraffic href "../StixNetworkTraffic/"
    

        
      StixNetworkTraffic : encapsulates_refs
        
          
    
        
        
        StixNetworkTraffic --> "1..*" StixNetworkTraffic : encapsulates_refs
        click StixNetworkTraffic href "../StixNetworkTraffic/"
    

        
      StixNetworkTraffic : end
        
      StixNetworkTraffic : extensions
        
          
    
        
        
        StixNetworkTraffic --> "0..1" StixNetworkTrafficExtensions : extensions
        click StixNetworkTrafficExtensions href "../StixNetworkTrafficExtensions/"
    

        
      StixNetworkTraffic : granular_markings
        
          
    
        
        
        StixNetworkTraffic --> "1..*" StixGranularMarking : granular_markings
        click StixGranularMarking href "../StixGranularMarking/"
    

        
      StixNetworkTraffic : id
        
      StixNetworkTraffic : ipfix
        
          
    
        
        
        StixNetworkTraffic --> "0..1" StixDictionary : ipfix
        click StixDictionary href "../StixDictionary/"
    

        
      StixNetworkTraffic : is_active
        
      StixNetworkTraffic : object_marking_refs
        
          
    
        
        
        StixNetworkTraffic --> "1..*" StixMarkingDefinition : object_marking_refs
        click StixMarkingDefinition href "../StixMarkingDefinition/"
    

        
      StixNetworkTraffic : protocols
        
      StixNetworkTraffic : spec_version
        
          
    
        
        
        StixNetworkTraffic --> "0..1" StixSpecVersion : spec_version
        click StixSpecVersion href "../StixSpecVersion/"
    

        
      StixNetworkTraffic : src_byte_count
        
      StixNetworkTraffic : src_packets
        
      StixNetworkTraffic : src_payload_ref
        
          
    
        
        
        StixNetworkTraffic --> "0..1" StixArtifact : src_payload_ref
        click StixArtifact href "../StixArtifact/"
    

        
      StixNetworkTraffic : src_port
        
      StixNetworkTraffic : src_ref
        
          
    
        
        
        StixNetworkTraffic --> "0..1" StixCyberObservableObject : src_ref
        click StixCyberObservableObject href "../StixCyberObservableObject/"
    

        
      StixNetworkTraffic : start
        
      StixNetworkTraffic : type

Inheritance

Section titled “Inheritance”

Slots

Section titled “Slots”
Name Cardinality and Range Description Inheritance
start 0..1
StixTimestamp		 Specifies the date/time the network traffic was initiated, if known direct
end 0..1
StixTimestamp		 Specifies the date/time the network traffic ended, if known direct
src_ref 0..1
StixCyberObservableObject or 
StixIpv4Address or 
StixIpv6Address or 
StixMacAddress or 
StixDomainName		 Specifies the source of the network traffic, as a reference to an Observable … direct
dst_ref 0..1
StixCyberObservableObject or 
StixIpv4Address or 
StixIpv6Address or 
StixMacAddress or 
StixDomainName		 Specifies the destination of the network traffic, as a reference to an Observ… direct
src_port 0..1
Integer		 The source port of the traffic direct
dst_port 0..1
Integer		 The destination port of the traffic direct
protocols 1..*
String		 Specifies the protocols observed in the network traffic, along with their cor… direct
src_byte_count 0..1
Integer		 Specifies the number of bytes sent from the source to the destination direct
dst_byte_count 0..1
Integer		 Specifies the number of bytes sent from the destination to the source direct
src_packets 0..1
Integer		 Specifies the number of packets sent from the source to the destination direct
dst_packets 0..1
Integer		 Specifies the number of packets sent destination to the source direct
ipfix 0..1
StixDictionary		 Specifies any IP Flow Information Export (IPFIX) data for the traffic direct
src_payload_ref 0..1
StixArtifact		 Specifies the bytes sent from the source to the destination direct
dst_payload_ref 0..1
StixArtifact		 Specifies the bytes sent from the source to the destination direct
encapsulates_refs 1..*
StixNetworkTraffic		 Links to other network-traffic objects encapsulated by a network-traffic direct
encapsulated_by_ref 0..1
StixNetworkTraffic		 Links to another network-traffic object which encapsulates this object direct
is_active 0..1
Boolean		 Indicates whether the network traffic is still ongoing direct
defanged 0..1
Boolean		 Defines whether or not the data contained within the object has been defanged StixCyberObservableObject
id 1
StixIdentifier		 The identifier of the object: its STIX type, two hyphens and a UUID StixObject
type 1
String		 The STIX type name of the object, such as attack-pattern StixObject
spec_version 0..1
StixSpecVersion		 The version of the STIX specification used to represent the object StixObject
object_marking_refs 1..*
StixMarkingDefinition		 References to the marking definitions that apply to the object StixObject
granular_markings 1..*
StixGranularMarking		 The granular markings that apply to parts of the object StixObject
extensions 0..1
StixNetworkTrafficExtensions		 The object’s extensions, as a dictionary keyed by extension name StixObject
Expressions & Logic

Any Of

Section titled “Any Of”

The class must satisfy at least one of:

  • AnonymousClassExpression({ ‘slot_conditions’: {‘src_ref’: SlotDefinition({‘name’: ‘src_ref’, ‘required’: True})} })
  • AnonymousClassExpression({ ‘slot_conditions’: {‘dst_ref’: SlotDefinition({‘name’: ‘dst_ref’, ‘required’: True})} })

Usages

Section titled “Usages”
used by used in type used
StixNetworkTraffic encapsulates_refs range StixNetworkTraffic
StixNetworkTraffic encapsulated_by_ref range StixNetworkTraffic
StixProcess opened_connection_refs range StixNetworkTraffic
StixMalwareAnalysis sample_ref any_of[range] StixNetworkTraffic

Identifier and Mapping Information

Section titled “Identifier and Mapping Information”

Annotations

Section titled “Annotations”
property value
stix_type network-traffic

Schema Source

Section titled “Schema Source”

Mappings

Section titled “Mappings”
Mapping Type Mapped Value
self attack:StixNetworkTraffic
native attack:StixNetworkTraffic

LinkML Source

Section titled “LinkML Source”

Direct

Section titled “Direct”
name: StixNetworkTraffic
annotations:
  stix_type:
    tag: stix_type
    value: network-traffic
description: The Network Traffic Object represents arbitrary network traffic that
  originates from a source and is addressed to a destination.
from_schema: https://w3id.org/lmodel/attack
is_a: StixCyberObservableObject
slots:
- start
- end
- src_ref
- dst_ref
- src_port
- dst_port
- protocols
- src_byte_count
- dst_byte_count
- src_packets
- dst_packets
- ipfix
- src_payload_ref
- dst_payload_ref
- encapsulates_refs
- encapsulated_by_ref
- is_active
slot_usage:
  id:
    name: id
    pattern: ^network-traffic--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    equals_string: network-traffic
  protocols:
    name: protocols
    required: true
  extensions:
    name: extensions
    range: StixNetworkTrafficExtensions
any_of:
- slot_conditions:
    src_ref:
      name: src_ref
      required: true
- slot_conditions:
    dst_ref:
      name: dst_ref
      required: true

Induced

Section titled “Induced”
name: StixNetworkTraffic
annotations:
  stix_type:
    tag: stix_type
    value: network-traffic
description: The Network Traffic Object represents arbitrary network traffic that
  originates from a source and is addressed to a destination.
from_schema: https://w3id.org/lmodel/attack
is_a: StixCyberObservableObject
slot_usage:
  id:
    name: id
    pattern: ^network-traffic--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    equals_string: network-traffic
  protocols:
    name: protocols
    required: true
  extensions:
    name: extensions
    range: StixNetworkTrafficExtensions
attributes:
  start:
    name: start
    description: Specifies the date/time the network traffic was initiated, if known.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:start
    owner: StixNetworkTraffic
    domain_of:
    - StixNetworkTraffic
    range: stix_timestamp
  end:
    name: end
    description: Specifies the date/time the network traffic ended, if known.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:end
    owner: StixNetworkTraffic
    domain_of:
    - StixNetworkTraffic
    range: stix_timestamp
  src_ref:
    name: src_ref
    description: Specifies the source of the network traffic, as a reference to an
      Observable Object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:src_ref
    owner: StixNetworkTraffic
    domain_of:
    - StixNetworkTraffic
    range: StixCyberObservableObject
    pattern: ^(ipv4-addr|ipv6-addr|mac-addr|domain-name)--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    any_of:
    - range: StixIpv4Address
    - range: StixIpv6Address
    - range: StixMacAddress
    - range: StixDomainName
  dst_ref:
    name: dst_ref
    description: Specifies the destination of the network traffic, as a reference
      to an Observable Object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:dst_ref
    owner: StixNetworkTraffic
    domain_of:
    - StixNetworkTraffic
    range: StixCyberObservableObject
    pattern: ^(ipv4-addr|ipv6-addr|mac-addr|domain-name)--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    any_of:
    - range: StixIpv4Address
    - range: StixIpv6Address
    - range: StixMacAddress
    - range: StixDomainName
  src_port:
    name: src_port
    description: The source port of the traffic.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:src_port
    owner: StixNetworkTraffic
    domain_of:
    - StixNetworkTraffic
    range: integer
    minimum_value: 0
    maximum_value: 65535
  dst_port:
    name: dst_port
    description: The destination port of the traffic.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:dst_port
    owner: StixNetworkTraffic
    domain_of:
    - StixNetworkTraffic
    range: integer
    minimum_value: 0
    maximum_value: 65535
  protocols:
    name: protocols
    description: Specifies the protocols observed in the network traffic, along with
      their corresponding state.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:protocols
    owner: StixNetworkTraffic
    domain_of:
    - StixNetworkTraffic
    range: string
    required: true
    multivalued: true
    minimum_cardinality: 1
  src_byte_count:
    name: src_byte_count
    description: Specifies the number of bytes sent from the source to the destination.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:src_byte_count
    owner: StixNetworkTraffic
    domain_of:
    - StixNetworkTraffic
    range: integer
  dst_byte_count:
    name: dst_byte_count
    description: Specifies the number of bytes sent from the destination to the source.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:dst_byte_count
    owner: StixNetworkTraffic
    domain_of:
    - StixNetworkTraffic
    range: integer
  src_packets:
    name: src_packets
    description: Specifies the number of packets sent from the source to the destination.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:src_packets
    owner: StixNetworkTraffic
    domain_of:
    - StixNetworkTraffic
    range: integer
  dst_packets:
    name: dst_packets
    description: Specifies the number of packets sent destination to the source.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:dst_packets
    owner: StixNetworkTraffic
    domain_of:
    - StixNetworkTraffic
    range: integer
  ipfix:
    name: ipfix
    description: Specifies any IP Flow Information Export (IPFIX) data for the traffic.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:ipfix
    owner: StixNetworkTraffic
    domain_of:
    - StixNetworkTraffic
    range: StixDictionary
    inlined: true
  src_payload_ref:
    name: src_payload_ref
    description: Specifies the bytes sent from the source to the destination.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:src_payload_ref
    owner: StixNetworkTraffic
    domain_of:
    - StixNetworkTraffic
    range: StixArtifact
    pattern: ^artifact--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  dst_payload_ref:
    name: dst_payload_ref
    description: Specifies the bytes sent from the source to the destination.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:dst_payload_ref
    owner: StixNetworkTraffic
    domain_of:
    - StixNetworkTraffic
    range: StixArtifact
    pattern: ^artifact--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  encapsulates_refs:
    name: encapsulates_refs
    description: Links to other network-traffic objects encapsulated by a network-traffic.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:encapsulates_refs
    owner: StixNetworkTraffic
    domain_of:
    - StixNetworkTraffic
    range: StixNetworkTraffic
    multivalued: true
    pattern: ^network-traffic--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  encapsulated_by_ref:
    name: encapsulated_by_ref
    description: Links to another network-traffic object which encapsulates this object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:encapsulated_by_ref
    owner: StixNetworkTraffic
    domain_of:
    - StixNetworkTraffic
    range: StixNetworkTraffic
    pattern: ^network-traffic--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  is_active:
    name: is_active
    description: Indicates whether the network traffic is still ongoing.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:is_active
    owner: StixNetworkTraffic
    domain_of:
    - StixNetworkTraffic
    range: boolean
  defanged:
    name: defanged
    description: Defines whether or not the data contained within the object has been
      defanged.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:defanged
    owner: StixNetworkTraffic
    domain_of:
    - StixCyberObservableObject
    range: boolean
  id:
    name: id
    description: 'The identifier of the object: its STIX type, two hyphens and a UUID.
      Each class narrows the type.'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:id
    identifier: true
    owner: StixNetworkTraffic
    domain_of:
    - StixObject
    - StixBundle
    range: stix_identifier
    required: true
    pattern: ^network-traffic--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    description: The STIX type name of the object, such as attack-pattern. Each class
      pins its own.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:type
    owner: StixNetworkTraffic
    domain_of:
    - StixObject
    - StixBundle
    range: string
    required: true
    pattern: ^([a-z][a-z0-9]*)+(-[a-z0-9]+)*\-?$
    equals_string: network-traffic
  spec_version:
    name: spec_version
    description: The version of the STIX specification used to represent the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:spec_version
    owner: StixNetworkTraffic
    domain_of:
    - StixObject
    range: StixSpecVersion
  object_marking_refs:
    name: object_marking_refs
    description: References to the marking definitions that apply to the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:objectMarking
    rank: 1000
    slot_uri: stix:object_marking_refs
    owner: StixNetworkTraffic
    domain_of:
    - StixObject
    range: StixMarkingDefinition
    multivalued: true
    pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  granular_markings:
    name: granular_markings
    description: The granular markings that apply to parts of the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:granular_markings
    owner: StixNetworkTraffic
    domain_of:
    - StixObject
    range: StixGranularMarking
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  extensions:
    name: extensions
    description: The object's extensions, as a dictionary keyed by extension name.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:extensions
    owner: StixNetworkTraffic
    domain_of:
    - StixObject
    range: StixNetworkTrafficExtensions
    inlined: true
any_of:
- slot_conditions:
    src_ref:
      name: src_ref
      required: true
- slot_conditions:
    dst_ref:
      name: dst_ref
      required: true