Skip to content
attack

Class: StixSoftware

The Software Object represents high-level properties associated with software, including software products.

URI: attack:StixSoftware

 classDiagram
    class StixSoftware
    click StixSoftware href "../StixSoftware/"
      StixCyberObservableObject <|-- StixSoftware
        click StixCyberObservableObject href "../StixCyberObservableObject/"
      
      StixSoftware : cpe
        
      StixSoftware : defanged
        
      StixSoftware : extensions
        
          
    
        
        
        StixSoftware --> "0..1" StixExtensions : extensions
        click StixExtensions href "../StixExtensions/"
    

        
      StixSoftware : granular_markings
        
          
    
        
        
        StixSoftware --> "1..*" StixGranularMarking : granular_markings
        click StixGranularMarking href "../StixGranularMarking/"
    

        
      StixSoftware : id
        
      StixSoftware : languages
        
      StixSoftware : name
        
      StixSoftware : object_marking_refs
        
          
    
        
        
        StixSoftware --> "1..*" StixMarkingDefinition : object_marking_refs
        click StixMarkingDefinition href "../StixMarkingDefinition/"
    

        
      StixSoftware : spec_version
        
          
    
        
        
        StixSoftware --> "0..1" StixSpecVersion : spec_version
        click StixSpecVersion href "../StixSpecVersion/"
    

        
      StixSoftware : swid
        
      StixSoftware : type
        
      StixSoftware : vendor
        
      StixSoftware : version

Inheritance

Section titled “Inheritance”

Slots

Section titled “Slots”
Name Cardinality and Range Description Inheritance
name 1
String		 A name that identifies the object direct
cpe 0..1
String		 The Common Platform Enumeration (CPE) 2 direct
swid 0..1
String		 Specifies the Software Identification (SWID) Tags entry for the software, if … direct
languages 1..*
String		 The languages the software supports, as RFC 5646 language codes direct
vendor 0..1
String		 Specifies the name of the vendor of the software direct
version 0..1
String		 A version, as a string; each class says of what direct
defanged 0..1
Boolean		 Defines whether or not the data contained within the object has been defanged StixCyberObservableObject
id 1
StixIdentifier		 The identifier of the object: its STIX type, two hyphens and a UUID StixObject
type 1
String		 The STIX type name of the object, such as attack-pattern StixObject
spec_version 0..1
StixSpecVersion		 The version of the STIX specification used to represent the object StixObject
object_marking_refs 1..*
StixMarkingDefinition		 References to the marking definitions that apply to the object StixObject
granular_markings 1..*
StixGranularMarking		 The granular markings that apply to parts of the object StixObject
extensions 0..1
StixExtensions		 The object’s extensions, as a dictionary keyed by extension name StixObject

Usages

Section titled “Usages”
used by used in type used
AttackMalware operating_system_refs range StixSoftware
StixMalware operating_system_refs range StixSoftware
StixMalwareAnalysis host_vm_ref range StixSoftware
StixMalwareAnalysis operating_system_ref range StixSoftware
StixMalwareAnalysis installed_software_refs range StixSoftware

Identifier and Mapping Information

Section titled “Identifier and Mapping Information”

Annotations

Section titled “Annotations”
property value
stix_type software

Schema Source

Section titled “Schema Source”

Mappings

Section titled “Mappings”
Mapping Type Mapped Value
self attack:StixSoftware
native attack:StixSoftware
close uco-observable:Software

LinkML Source

Section titled “LinkML Source”

Direct

Section titled “Direct”
name: StixSoftware
annotations:
  stix_type:
    tag: stix_type
    value: software
description: The Software Object represents high-level properties associated with
  software, including software products.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:Software
is_a: StixCyberObservableObject
slots:
- name
- cpe
- swid
- languages
- vendor
- version
slot_usage:
  id:
    name: id
    pattern: ^software--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    equals_string: software
  name:
    name: name
    required: true

Induced

Section titled “Induced”
name: StixSoftware
annotations:
  stix_type:
    tag: stix_type
    value: software
description: The Software Object represents high-level properties associated with
  software, including software products.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:Software
is_a: StixCyberObservableObject
slot_usage:
  id:
    name: id
    pattern: ^software--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    equals_string: software
  name:
    name: name
    required: true
attributes:
  name:
    name: name
    description: A name that identifies the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:name
    rank: 1000
    slot_uri: stix:name
    owner: StixSoftware
    domain_of:
    - AttackTactic
    - AttackMatrix
    - AttackCollection
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackDetectionStrategy
    - AttackAnalytic
    - AttackRelatedAsset
    - AttackLogSource
    - AttackLogSourceReference
    - StixIdentity
    - StixMarkingDefinition
    - StixExtensionDefinition
    - StixAutonomousSystem
    - StixFile
    - StixMutex
    - StixSoftware
    - StixAlternateDataStream
    - StixWindowsPeSection
    - StixWindowsRegistryValue
    - StixAttackPattern
    - StixCampaign
    - StixCourseOfAction
    - StixGrouping
    - StixIncident
    - StixIndicator
    - StixInfrastructure
    - StixIntrusionSet
    - StixLocation
    - StixMalware
    - StixReport
    - StixThreatActor
    - StixTool
    - StixVulnerability
    range: string
    required: true
  cpe:
    name: cpe
    description: The Common Platform Enumeration (CPE) 2.3 name of the software, if
      it has one.
    comments:
    - STIX asks for an entry of the NVD CPE Dictionary.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:cpe
    owner: StixSoftware
    domain_of:
    - StixSoftware
    range: string
    pattern: cpe:2\.3:[aho\*\-](:(((\?*|\*?)([a-zA-Z0-9\-\._]|(\\[\\\*\?!\x22#$$%&\x27\(\)\+,/:;<=>@\[\]\^`\{\|}~]))+(\?*|\*?))|[\*\-])){5}(:(([a-zA-Z]{2,3}(-([a-zA-Z]{2}|[0-9]{3}))?)|[\*\-]))(:(((\?*|\*?)([a-zA-Z0-9\-\._]|(\\[\\\*\?!\x22#$$%&\x27\(\)\+,/:;<=>@\[\]\^`\{\|}~]))+(\?*|\*?))|[\*\-])){4}
  swid:
    name: swid
    description: Specifies the Software Identification (SWID) Tags entry for the software,
      if available.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:swid
    owner: StixSoftware
    domain_of:
    - StixSoftware
    range: string
  languages:
    name: languages
    description: The languages the software supports, as RFC 5646 language codes.
    comments:
    - ISO 639-2 codes are accepted too, for backward compatibility.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:languages
    owner: StixSoftware
    domain_of:
    - StixSoftware
    range: string
    multivalued: true
    pattern: ^([a-z]{2}(-[A-Z]{2})?(-[a-z]{4})?(-[A-Z]{2}|[0-9]{3})?(-[a-z0-9]{5,8}|[0-9][a-z0-9]{3})*(-[a-z0-9]{1,8})*|[a-z]{3})$
    minimum_cardinality: 1
  vendor:
    name: vendor
    description: Specifies the name of the vendor of the software.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:vendor
    owner: StixSoftware
    domain_of:
    - StixSoftware
    range: string
  version:
    name: version
    description: A version, as a string; each class says of what.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:version
    owner: StixSoftware
    domain_of:
    - StixExtensionDefinition
    - StixSoftware
    - StixX509Certificate
    - StixPdfExtension
    - StixMalwareAnalysis
    range: string
  defanged:
    name: defanged
    description: Defines whether or not the data contained within the object has been
      defanged.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:defanged
    owner: StixSoftware
    domain_of:
    - StixCyberObservableObject
    range: boolean
  id:
    name: id
    description: 'The identifier of the object: its STIX type, two hyphens and a UUID.
      Each class narrows the type.'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:id
    identifier: true
    owner: StixSoftware
    domain_of:
    - StixObject
    - StixBundle
    range: stix_identifier
    required: true
    pattern: ^software--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    description: The STIX type name of the object, such as attack-pattern. Each class
      pins its own.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:type
    owner: StixSoftware
    domain_of:
    - StixObject
    - StixBundle
    range: string
    required: true
    pattern: ^([a-z][a-z0-9]*)+(-[a-z0-9]+)*\-?$
    equals_string: software
  spec_version:
    name: spec_version
    description: The version of the STIX specification used to represent the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:spec_version
    owner: StixSoftware
    domain_of:
    - StixObject
    range: StixSpecVersion
  object_marking_refs:
    name: object_marking_refs
    description: References to the marking definitions that apply to the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:objectMarking
    rank: 1000
    slot_uri: stix:object_marking_refs
    owner: StixSoftware
    domain_of:
    - StixObject
    range: StixMarkingDefinition
    multivalued: true
    pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  granular_markings:
    name: granular_markings
    description: The granular markings that apply to parts of the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:granular_markings
    owner: StixSoftware
    domain_of:
    - StixObject
    range: StixGranularMarking
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  extensions:
    name: extensions
    description: The object's extensions, as a dictionary keyed by extension name.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:extensions
    owner: StixSoftware
    domain_of:
    - StixObject
    range: StixExtensions
    inlined: true