Skip to content
attack

Slot: contains_refs

References to other cyber-observable objects that this one contains.

URI: stix:contains_refs

Applicable Classes

Section titled “Applicable Classes”
Name Description Modifies Slot
StixDirectory The Directory Object represents the properties common to a file system direct… yes
StixFile The File Object represents the properties of a file no
StixArchiveExtension The Archive File extension specifies a default extension for capturing proper… yes

Properties

Section titled “Properties”

Type and Range

Section titled “Type and Range”
Property Value
Range StixCyberObservableObject
Domain Of StixDirectory, StixFile, StixArchiveExtension
Slot URI stix:contains_refs

Cardinality and Requirements

Section titled “Cardinality and Requirements”
Property Value
Multivalued Yes
Minimum Cardinality 1

Value Constraints

Section titled “Value Constraints”
Property Value
Regex Pattern `^(?!(attack-pattern

Identifier and Mapping Information

Section titled “Identifier and Mapping Information”

Schema Source

Section titled “Schema Source”

Mappings

Section titled “Mappings”
Mapping Type Mapped Value
self stix:contains_refs
native attack:contains_refs

LinkML Source

Section titled “LinkML Source”
name: contains_refs
description: References to other cyber-observable objects that this one contains.
from_schema: https://w3id.org/lmodel/attack
rank: 1000
slot_uri: stix:contains_refs
domain_of:
- StixDirectory
- StixFile
- StixArchiveExtension
range: StixCyberObservableObject
multivalued: true
pattern: ^(?!(attack-pattern|campaign|course-of-action|grouping|identity|incident|indicator|infrastructure|intrusion-set|location|malware|malware-analysis|note|observed-data|opinion|report|threat-actor|tool|vulnerability|relationship|sighting|bundle|marking-definition|language-content|extension-definition)--)[a-z][a-z0-9-]+[a-z0-9]--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
minimum_cardinality: 1