Class: StixX509Certificate

The X509 Certificate Object represents the properties of an X.509 certificate.

URI: attack:StixX509Certificate

 classDiagram
    class StixX509Certificate
    click StixX509Certificate href "../StixX509Certificate/"
      StixCyberObservableObject <|-- StixX509Certificate
        click StixCyberObservableObject href "../StixCyberObservableObject/"
      
      StixX509Certificate : defanged
        
      StixX509Certificate : extensions
        
          
    
        
        
        StixX509Certificate --> "0..1" StixExtensions : extensions
        click StixExtensions href "../StixExtensions/"
    

        
      StixX509Certificate : granular_markings
        
          
    
        
        
        StixX509Certificate --> "1..*" StixGranularMarking : granular_markings
        click StixGranularMarking href "../StixGranularMarking/"
    

        
      StixX509Certificate : hashes
        
          
    
        
        
        StixX509Certificate --> "0..1" StixHashes : hashes
        click StixHashes href "../StixHashes/"
    

        
      StixX509Certificate : id
        
      StixX509Certificate : is_self_signed
        
      StixX509Certificate : issuer
        
      StixX509Certificate : object_marking_refs
        
          
    
        
        
        StixX509Certificate --> "1..*" StixMarkingDefinition : object_marking_refs
        click StixMarkingDefinition href "../StixMarkingDefinition/"
    

        
      StixX509Certificate : serial_number
        
      StixX509Certificate : signature_algorithm
        
      StixX509Certificate : spec_version
        
          
    
        
        
        StixX509Certificate --> "0..1" StixSpecVersion : spec_version
        click StixSpecVersion href "../StixSpecVersion/"
    

        
      StixX509Certificate : subject
        
      StixX509Certificate : subject_public_key_algorithm
        
      StixX509Certificate : subject_public_key_exponent
        
      StixX509Certificate : subject_public_key_modulus
        
      StixX509Certificate : type
        
      StixX509Certificate : validity_not_after
        
      StixX509Certificate : validity_not_before
        
      StixX509Certificate : version
        
      StixX509Certificate : x509_v3_extensions
        
          
    
        
        
        StixX509Certificate --> "0..1" StixX509V3Extensions : x509_v3_extensions
        click StixX509V3Extensions href "../StixX509V3Extensions/"
    

        
      

Inheritance

• StixObject
  • StixCyberObservableObject
    • StixX509Certificate

Slots

Name	Cardinality and Range	Description	Inheritance
is_self_signed	0..1 Boolean	Specifies whether the certificate is self-signed, i	direct
hashes	0..1 StixHashes	A dictionary of hashes of the content, keyed by hash algorithm	direct
version	0..1 String	A version, as a string; each class says of what	direct
serial_number	0..1 String	Specifies the unique identifier for the certificate, as issued by a specific …	direct
signature_algorithm	0..1 String	Specifies the name of the algorithm used to sign the certificate	direct
issuer	0..1 String	Specifies the name of the Certificate Authority that issued the certificate	direct
validity_not_before	0..1 StixTimestamp	Specifies the date on which the certificate validity period begins	direct
validity_not_after	0..1 StixTimestamp	Specifies the date on which the certificate validity period ends	direct
subject	0..1 String	A subject, as a string; each class says of what	direct
subject_public_key_algorithm	0..1 String	Specifies the name of the algorithm with which to encrypt data being sent to …	direct
subject_public_key_modulus	0..1 String	Specifies the modulus portion of the subject’s public RSA key	direct
subject_public_key_exponent	0..1 Integer	Specifies the exponent portion of the subject’s public RSA key, as an integer	direct
x509_v3_extensions	0..1 StixX509V3Extensions	Specifies any standard X	direct
defanged	0..1 Boolean	Defines whether or not the data contained within the object has been defanged	StixCyberObservableObject
id	1 StixIdentifier	The identifier of the object: its STIX type, two hyphens and a UUID	StixObject
type	1 String	The STIX type name of the object, such as attack-pattern	StixObject
spec_version	0..1 StixSpecVersion	The version of the STIX specification used to represent the object	StixObject
object_marking_refs	1..* StixMarkingDefinition	References to the marking definitions that apply to the object	StixObject
granular_markings	1..* StixGranularMarking	The granular markings that apply to parts of the object	StixObject
extensions	0..1 StixExtensions	The object’s extensions, as a dictionary keyed by extension name	StixObject

Expressions & Logic

Any Of

The class must satisfy at least one of:

• AnonymousClassExpression({ ‘slot_conditions’: {‘is_self_signed’: SlotDefinition({‘name’: ‘is_self_signed’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘hashes’: SlotDefinition({‘name’: ‘hashes’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘version’: SlotDefinition({‘name’: ‘version’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘serial_number’: SlotDefinition({‘name’: ‘serial_number’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘signature_algorithm’: SlotDefinition({‘name’: ‘signature_algorithm’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘issuer’: SlotDefinition({‘name’: ‘issuer’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘validity_not_before’: SlotDefinition({‘name’: ‘validity_not_before’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘validity_not_after’: SlotDefinition({‘name’: ‘validity_not_after’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘subject’: SlotDefinition({‘name’: ‘subject’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘subject_public_key_algorithm’: SlotDefinition({‘name’: ‘subject_public_key_algorithm’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘subject_public_key_modulus’: SlotDefinition({‘name’: ‘subject_public_key_modulus’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘subject_public_key_exponent’: SlotDefinition({‘name’: ‘subject_public_key_exponent’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘x509_v3_extensions’: SlotDefinition({‘name’: ‘x509_v3_extensions’, ‘required’: True})} })

Identifier and Mapping Information

Annotations

property	value
stix_type	x509-certificate

Schema Source

• from schema: https://w3id.org/lmodel/attack

Mappings

Mapping Type	Mapped Value
self	attack:StixX509Certificate
native	attack:StixX509Certificate
close	uco-observable:X509Certificate

LinkML Source

Direct

name: StixX509Certificate
annotations:
  stix_type:
    tag: stix_type
    value: x509-certificate
description: The X509 Certificate Object represents the properties of an X.509 certificate.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:X509Certificate
is_a: StixCyberObservableObject
slots:
- is_self_signed
- hashes
- version
- serial_number
- signature_algorithm
- issuer
- validity_not_before
- validity_not_after
- subject
- subject_public_key_algorithm
- subject_public_key_modulus
- subject_public_key_exponent
- x509_v3_extensions
slot_usage:
  id:
    name: id
    pattern: ^x509-certificate--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    equals_string: x509-certificate
any_of:
- slot_conditions:
    is_self_signed:
      name: is_self_signed
      required: true
- slot_conditions:
    hashes:
      name: hashes
      required: true
- slot_conditions:
    version:
      name: version
      required: true
- slot_conditions:
    serial_number:
      name: serial_number
      required: true
- slot_conditions:
    signature_algorithm:
      name: signature_algorithm
      required: true
- slot_conditions:
    issuer:
      name: issuer
      required: true
- slot_conditions:
    validity_not_before:
      name: validity_not_before
      required: true
- slot_conditions:
    validity_not_after:
      name: validity_not_after
      required: true
- slot_conditions:
    subject:
      name: subject
      required: true
- slot_conditions:
    subject_public_key_algorithm:
      name: subject_public_key_algorithm
      required: true
- slot_conditions:
    subject_public_key_modulus:
      name: subject_public_key_modulus
      required: true
- slot_conditions:
    subject_public_key_exponent:
      name: subject_public_key_exponent
      required: true
- slot_conditions:
    x509_v3_extensions:
      name: x509_v3_extensions
      required: true

Induced

name: StixX509Certificate
annotations:
  stix_type:
    tag: stix_type
    value: x509-certificate
description: The X509 Certificate Object represents the properties of an X.509 certificate.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:X509Certificate
is_a: StixCyberObservableObject
slot_usage:
  id:
    name: id
    pattern: ^x509-certificate--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    equals_string: x509-certificate
attributes:
  is_self_signed:
    name: is_self_signed
    description: Specifies whether the certificate is self-signed, i.e., whether it
      is signed by the same entity whose identity it certifies.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:is_self_signed
    owner: StixX509Certificate
    domain_of:
    - StixX509Certificate
    range: boolean
  hashes:
    name: hashes
    description: A dictionary of hashes of the content, keyed by hash algorithm.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:hashes
    owner: StixX509Certificate
    domain_of:
    - StixExternalReference
    - StixArtifact
    - StixFile
    - StixX509Certificate
    - StixAlternateDataStream
    - StixWindowsPeSection
    - StixWindowsPeOptionalHeader
    range: StixHashes
    inlined: true
  version:
    name: version
    description: A version, as a string; each class says of what.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:version
    owner: StixX509Certificate
    domain_of:
    - StixExtensionDefinition
    - StixSoftware
    - StixX509Certificate
    - StixPdfExtension
    - StixMalwareAnalysis
    range: string
  serial_number:
    name: serial_number
    description: Specifies the unique identifier for the certificate, as issued by
      a specific Certificate Authority.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:serial_number
    owner: StixX509Certificate
    domain_of:
    - StixX509Certificate
    range: string
  signature_algorithm:
    name: signature_algorithm
    description: Specifies the name of the algorithm used to sign the certificate.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:signature_algorithm
    owner: StixX509Certificate
    domain_of:
    - StixX509Certificate
    range: string
  issuer:
    name: issuer
    description: Specifies the name of the Certificate Authority that issued the certificate.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:issuer
    owner: StixX509Certificate
    domain_of:
    - StixX509Certificate
    range: string
  validity_not_before:
    name: validity_not_before
    description: Specifies the date on which the certificate validity period begins.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:validity_not_before
    owner: StixX509Certificate
    domain_of:
    - StixX509Certificate
    range: stix_timestamp
  validity_not_after:
    name: validity_not_after
    description: Specifies the date on which the certificate validity period ends.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:validity_not_after
    owner: StixX509Certificate
    domain_of:
    - StixX509Certificate
    range: stix_timestamp
  subject:
    name: subject
    description: A subject, as a string; each class says of what.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:subject
    owner: StixX509Certificate
    domain_of:
    - StixEmailMessage
    - StixX509Certificate
    range: string
  subject_public_key_algorithm:
    name: subject_public_key_algorithm
    description: Specifies the name of the algorithm with which to encrypt data being
      sent to the subject.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:subject_public_key_algorithm
    owner: StixX509Certificate
    domain_of:
    - StixX509Certificate
    range: string
  subject_public_key_modulus:
    name: subject_public_key_modulus
    description: Specifies the modulus portion of the subject's public RSA key.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:subject_public_key_modulus
    owner: StixX509Certificate
    domain_of:
    - StixX509Certificate
    range: string
  subject_public_key_exponent:
    name: subject_public_key_exponent
    description: Specifies the exponent portion of the subject's public RSA key, as
      an integer.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:subject_public_key_exponent
    owner: StixX509Certificate
    domain_of:
    - StixX509Certificate
    range: integer
  x509_v3_extensions:
    name: x509_v3_extensions
    description: Specifies any standard X.509 v3 extensions that may be used in the
      certificate.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:x509_v3_extensions
    owner: StixX509Certificate
    domain_of:
    - StixX509Certificate
    range: StixX509V3Extensions
    inlined: true
  defanged:
    name: defanged
    description: Defines whether or not the data contained within the object has been
      defanged.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:defanged
    owner: StixX509Certificate
    domain_of:
    - StixCyberObservableObject
    range: boolean
  id:
    name: id
    description: 'The identifier of the object: its STIX type, two hyphens and a UUID.
      Each class narrows the type.'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:id
    identifier: true
    owner: StixX509Certificate
    domain_of:
    - StixObject
    - StixBundle
    range: stix_identifier
    required: true
    pattern: ^x509-certificate--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    description: The STIX type name of the object, such as attack-pattern. Each class
      pins its own.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:type
    owner: StixX509Certificate
    domain_of:
    - StixObject
    - StixBundle
    range: string
    required: true
    pattern: ^([a-z][a-z0-9]*)+(-[a-z0-9]+)*\-?$
    equals_string: x509-certificate
  spec_version:
    name: spec_version
    description: The version of the STIX specification used to represent the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:spec_version
    owner: StixX509Certificate
    domain_of:
    - StixObject
    range: StixSpecVersion
  object_marking_refs:
    name: object_marking_refs
    description: References to the marking definitions that apply to the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:objectMarking
    rank: 1000
    slot_uri: stix:object_marking_refs
    owner: StixX509Certificate
    domain_of:
    - StixObject
    range: StixMarkingDefinition
    multivalued: true
    pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  granular_markings:
    name: granular_markings
    description: The granular markings that apply to parts of the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:granular_markings
    owner: StixX509Certificate
    domain_of:
    - StixObject
    range: StixGranularMarking
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  extensions:
    name: extensions
    description: The object's extensions, as a dictionary keyed by extension name.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:extensions
    owner: StixX509Certificate
    domain_of:
    - StixObject
    range: StixExtensions
    inlined: true
any_of:
- slot_conditions:
    is_self_signed:
      name: is_self_signed
      required: true
- slot_conditions:
    hashes:
      name: hashes
      required: true
- slot_conditions:
    version:
      name: version
      required: true
- slot_conditions:
    serial_number:
      name: serial_number
      required: true
- slot_conditions:
    signature_algorithm:
      name: signature_algorithm
      required: true
- slot_conditions:
    issuer:
      name: issuer
      required: true
- slot_conditions:
    validity_not_before:
      name: validity_not_before
      required: true
- slot_conditions:
    validity_not_after:
      name: validity_not_after
      required: true
- slot_conditions:
    subject:
      name: subject
      required: true
- slot_conditions:
    subject_public_key_algorithm:
      name: subject_public_key_algorithm
      required: true
- slot_conditions:
    subject_public_key_modulus:
      name: subject_public_key_modulus
      required: true
- slot_conditions:
    subject_public_key_exponent:
      name: subject_public_key_exponent
      required: true
- slot_conditions:
    x509_v3_extensions:
      name: x509_v3_extensions
      required: true