| StixCommonObject |
The base of the objects that carry STIX’s common properties: the domain and r… |
no |
| StixMarkingDefinition |
A marking definition: a statement, a Traffic Light Protocol (TLP) level or an… |
no |
| AttackTechnique |
A technique: how an adversary achieves a tactic’s goal |
yes |
| AttackTactic |
A tactic: an adversary’s goal, the reason for a technique |
yes |
| AttackGroup |
A group: a set of related intrusion activity that the security community trac… |
yes |
| AttackCampaign |
A campaign: intrusion activity over a stated period against common targets, w… |
yes |
| AttackMalware |
Malware: commercial, custom or open-source software an adversary uses for mal… |
yes |
| AttackTool |
A tool: software, often legitimate, that an adversary uses, such as a penetra… |
yes |
| AttackMitigation |
A mitigation: a security concept or class of technology that can stop a techn… |
yes |
| AttackMatrix |
A matrix: the tactics of a domain, in order, under which its techniques are l… |
yes |
| AttackCollection |
A collection: a set of objects, each at one version, published together |
no |
| AttackAsset |
An asset: a device or system in an industrial control system that techniques … |
yes |
| AttackDataSource |
A data source: a kind of information that can be collected to detect techniqu… |
yes |
| AttackDataComponent |
A data component: a specific kind of data, such as process creation, with the… |
no |
| AttackDetectionStrategy |
A detection strategy: an approach to detecting a technique, carried out by an… |
yes |
| AttackAnalytic |
An analytic: detection logic for one platform, with the logs it reads and the… |
yes |
| AttackRelationship |
A relationship between two ATT&CK objects, of one of the seven types ATT&CK u… |
no |
| AttackIdentity |
The identity of an organization that creates ATT&CK objects; in MITRE’s data,… |
no |
| AttackMarkingDefinition |
A marking definition for ATT&CK objects, such as MITRE’s copyright statement,… |
no |
| StixDomainObject |
A STIX Domain Object (SDO): a higher-level concept of cyber threat intelligen… |
no |
| StixRelationshipObject |
A STIX Relationship Object (SRO): a relationship or a sighting that links oth… |
no |
| StixIdentity |
An individual, organization or group, such as ACME, Inc |
no |
| StixLanguageContent |
The language-content object represents text content for STIX Objects represen… |
no |
| StixExtensionDefinition |
The STIX Extension Definition object allows producers of threat intelligence … |
no |
| StixAttackPattern |
Attack Patterns are a type of TTP that describe ways that adversaries attempt… |
no |
| StixCampaign |
A Campaign is a grouping of adversary behavior that describes a set of malici… |
no |
| StixCourseOfAction |
A Course of Action is an action taken either to prevent an attack or to respo… |
no |
| StixGrouping |
A Grouping object explicitly asserts that the referenced STIX Objects have a … |
no |
| StixIncident |
The Incident object in STIX 2 |
no |
| StixIndicator |
Indicators contain a pattern that can be used to detect suspicious or malicio… |
no |
| StixInfrastructure |
Infrastructure objects describe systems, software services, and associated ph… |
no |
| StixIntrusionSet |
An Intrusion Set is a grouped set of adversary behavior and resources with co… |
no |
| StixLocation |
A geographic location, given as a region, a civic address, a latitude and lon… |
no |
| StixMalware |
Malicious code: a program inserted into a system, usually covertly, to compro… |
no |
| StixMalwareAnalysis |
Malware Analysis captures the metadata and results of a particular analysis p… |
no |
| StixNote |
A Note is a comment or note containing informative text to help explain the c… |
no |
| StixObservedData |
Observed data conveys information that was observed on systems and networks, … |
no |
| StixOpinion |
An Opinion is an assessment of the correctness of the information in a STIX O… |
no |
| StixReport |
Reports are collections of threat intelligence focused on one or more topics,… |
no |
| StixThreatActor |
Threat Actors are actual individuals, groups, or organizations believed to be… |
no |
| StixTool |
Tools are legitimate software that can be used by threat actors to perform at… |
no |
| StixVulnerability |
A Vulnerability is a mistake in software that can be directly used by a hacke… |
no |
| StixRelationship |
The Relationship object is used to link together two SDOs in order to describ… |
no |
| StixSighting |
The belief that something in cyber threat intelligence, such as an indicator,… |
no |
