Slot: description

A description of the object, which may be long.

Applicable Classes

Name	Description	Modifies Slot
AttackTactic	A tactic: an adversary’s goal, the reason for a technique	yes
AttackMatrix	A matrix: the tactics of a domain, in order, under which its techniques are l…	yes
AttackCollection	A collection: a set of objects, each at one version, published together	yes
AttackAsset	An asset: a device or system in an industrial control system that techniques …	no
AttackDataSource	A data source: a kind of information that can be collected to detect techniqu…	yes
AttackDataComponent	A data component: a specific kind of data, such as process creation, with the…	yes
AttackAnalytic	An analytic: detection logic for one platform, with the logs it reads and the…	yes
AttackRelatedAsset	A name a sector gives to devices like an asset, and how such a device relates…	yes
AttackMutableElement	A part of an analytic a defender may tune, and why it can vary	yes
StixIdentity	An individual, organization or group, such as ACME, Inc	no
StixExtensionDefinition	The STIX Extension Definition object allows producers of threat intelligence …	no
StixExternalReference	External references are used to describe pointers to information represented …	no
StixAttackPattern	Attack Patterns are a type of TTP that describe ways that adversaries attempt…	no
StixCampaign	A Campaign is a grouping of adversary behavior that describes a set of malici…	no
StixCourseOfAction	A Course of Action is an action taken either to prevent an attack or to respo…	no
StixGrouping	A Grouping object explicitly asserts that the referenced STIX Objects have a …	no
StixIncident	The Incident object in STIX 2	no
StixIndicator	Indicators contain a pattern that can be used to detect suspicious or malicio…	no
StixInfrastructure	Infrastructure objects describe systems, software services, and associated ph…	no
StixIntrusionSet	An Intrusion Set is a grouped set of adversary behavior and resources with co…	no
StixLocation	A geographic location, given as a region, a civic address, a latitude and lon…	no
StixMalware	Malicious code: a program inserted into a system, usually covertly, to compro…	no
StixReport	Reports are collections of threat intelligence focused on one or more topics,…	no
StixThreatActor	Threat Actors are actual individuals, groups, or organizations believed to be…	no
StixTool	Tools are legitimate software that can be used by threat actors to perform at…	no
StixVulnerability	A Vulnerability is a mistake in software that can be directly used by a hacke…	no
StixRelationship	The Relationship object is used to link together two SDOs in order to describ…	no
StixSighting	The belief that something in cyber threat intelligence, such as an indicator,…	no
AttackTechnique	A technique: how an adversary achieves a tactic’s goal	no
AttackGroup	A group: a set of related intrusion activity that the security community trac…	no
AttackCampaign	A campaign: intrusion activity over a stated period against common targets, w…	yes
AttackMalware	Malware: commercial, custom or open-source software an adversary uses for mal…	yes
AttackTool	A tool: software, often legitimate, that an adversary uses, such as a penetra…	yes
AttackMitigation	A mitigation: a security concept or class of technology that can stop a techn…	yes
AttackRelationship	A relationship between two ATT&CK objects, of one of the seven types ATT&CK u…	no
AttackIdentity	The identity of an organization that creates ATT&CK objects; in MITRE’s data,…	no

Properties

Type and Range

Property	Value
Range	String
Domain Of	AttackTactic, AttackMatrix, AttackCollection, AttackAsset, AttackDataSource, AttackDataComponent, AttackAnalytic, AttackRelatedAsset, AttackMutableElement, StixIdentity, StixExtensionDefinition, StixExternalReference, StixAttackPattern, StixCampaign, StixCourseOfAction, StixGrouping, StixIncident, StixIndicator, StixInfrastructure, StixIntrusionSet, StixLocation, StixMalware, StixReport, StixThreatActor, StixTool, StixVulnerability, StixRelationship, StixSighting
Slot URI	stix:description

Identifier and Mapping Information

Schema Source

from schema: https://w3id.org/lmodel/attack

Mappings

Mapping Type	Mapped Value
self	stix:description
native	attack:description
close	uco-core:description

LinkML Source

name: description
description: A description of the object, which may be long.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-core:description
rank: 1000
slot_uri: stix:description
domain_of:
- AttackTactic
- AttackMatrix
- AttackCollection
- AttackAsset
- AttackDataSource
- AttackDataComponent
- AttackAnalytic
- AttackRelatedAsset
- AttackMutableElement
- StixIdentity
- StixExtensionDefinition
- StixExternalReference
- StixAttackPattern
- StixCampaign
- StixCourseOfAction
- StixGrouping
- StixIncident
- StixIndicator
- StixInfrastructure
- StixIntrusionSet
- StixLocation
- StixMalware
- StixReport
- StixThreatActor
- StixTool
- StixVulnerability
- StixRelationship
- StixSighting
range: string