Slot: first_seen

The time at which the object was first seen.

URI: stix:first_seen

Applicable Classes

Name	Description	Modifies Slot
StixCampaign	A Campaign is a grouping of adversary behavior that describes a set of malici…	no
StixInfrastructure	Infrastructure objects describe systems, software services, and associated ph…	no
StixIntrusionSet	An Intrusion Set is a grouped set of adversary behavior and resources with co…	no
StixMalware	Malicious code: a program inserted into a system, usually covertly, to compro…	no
StixThreatActor	Threat Actors are actual individuals, groups, or organizations believed to be…	no
StixSighting	The belief that something in cyber threat intelligence, such as an indicator,…	no
AttackGroup	A group: a set of related intrusion activity that the security community trac…	no
AttackCampaign	A campaign: intrusion activity over a stated period against common targets, w…	yes
AttackMalware	Malware: commercial, custom or open-source software an adversary uses for mal…	no

Properties

Type and Range

Property	Value
Range	StixTimestamp
Domain Of	StixCampaign, StixInfrastructure, StixIntrusionSet, StixMalware, StixThreatActor, StixSighting
Slot URI	stix:first_seen

Identifier and Mapping Information

Schema Source

• from schema: https://w3id.org/lmodel/attack

Mappings

Mapping Type	Mapped Value
self	stix:first_seen
native	attack:first_seen

LinkML Source

name: first_seen
description: The time at which the object was first seen.
from_schema: https://w3id.org/lmodel/attack
rank: 1000
slot_uri: stix:first_seen
domain_of:
- StixCampaign
- StixInfrastructure
- StixIntrusionSet
- StixMalware
- StixThreatActor
- StixSighting
range: stix_timestamp