| StixObject |
Any STIX object: the base of the domain, relationship and cyber-observable ob… |
no |
| StixBundle |
A bundle: a collection of STIX objects grouped together in one container |
yes |
| AttackTechnique |
A technique: how an adversary achieves a tactic’s goal |
no |
| AttackTactic |
A tactic: an adversary’s goal, the reason for a technique |
yes |
| AttackGroup |
A group: a set of related intrusion activity that the security community trac… |
no |
| AttackCampaign |
A campaign: intrusion activity over a stated period against common targets, w… |
no |
| AttackMalware |
Malware: commercial, custom or open-source software an adversary uses for mal… |
no |
| AttackTool |
A tool: software, often legitimate, that an adversary uses, such as a penetra… |
no |
| AttackMitigation |
A mitigation: a security concept or class of technology that can stop a techn… |
no |
| AttackMatrix |
A matrix: the tactics of a domain, in order, under which its techniques are l… |
yes |
| AttackCollection |
A collection: a set of objects, each at one version, published together |
yes |
| AttackAsset |
An asset: a device or system in an industrial control system that techniques … |
yes |
| AttackDataSource |
A data source: a kind of information that can be collected to detect techniqu… |
yes |
| AttackDataComponent |
A data component: a specific kind of data, such as process creation, with the… |
yes |
| AttackDetectionStrategy |
A detection strategy: an approach to detecting a technique, carried out by an… |
yes |
| AttackAnalytic |
An analytic: detection logic for one platform, with the logs it reads and the… |
yes |
| AttackRelationship |
A relationship between two ATT&CK objects, of one of the seven types ATT&CK u… |
no |
| AttackIdentity |
The identity of an organization that creates ATT&CK objects; in MITRE’s data,… |
no |
| AttackMarkingDefinition |
A marking definition for ATT&CK objects, such as MITRE’s copyright statement,… |
no |
| AttackBundle |
A bundle of ATT&CK objects, as MITRE publishes each release of a domain: the … |
no |
| StixCommonObject |
The base of the objects that carry STIX’s common properties: the domain and r… |
no |
| StixDomainObject |
A STIX Domain Object (SDO): a higher-level concept of cyber threat intelligen… |
no |
| StixRelationshipObject |
A STIX Relationship Object (SRO): a relationship or a sighting that links oth… |
no |
| StixCyberObservableObject |
A STIX Cyber-observable Object (SCO): a fact observed on a network or host, s… |
no |
| StixIdentity |
An individual, organization or group, such as ACME, Inc |
yes |
| StixMarkingDefinition |
A marking definition: a statement, a Traffic Light Protocol (TLP) level or an… |
yes |
| StixLanguageContent |
The language-content object represents text content for STIX Objects represen… |
yes |
| StixExtensionDefinition |
The STIX Extension Definition object allows producers of threat intelligence … |
yes |
| StixArtifact |
An array of bytes, carried as base64 in payload_bin, or a link to a file-like… |
yes |
| StixAutonomousSystem |
The AS object represents the properties of an Autonomous Systems (AS) |
yes |
| StixDirectory |
The Directory Object represents the properties common to a file system direct… |
yes |
| StixDomainName |
The Domain Name represents the properties of a network domain name |
yes |
| StixEmailAddress |
The Email Address Object represents a single email address |
yes |
| StixEmailMessage |
The Email Message Object represents an instance of an email message |
yes |
| StixFile |
The File Object represents the properties of a file |
yes |
| StixIpv4Address |
The IPv4 Address Object represents one or more IPv4 addresses expressed using… |
yes |
| StixIpv6Address |
The IPv6 Address Object represents one or more IPv6 addresses expressed using… |
yes |
| StixMacAddress |
The MAC Address Object represents a single Media Access Control (MAC) address |
yes |
| StixMutex |
The Mutex Object represents the properties of a mutual exclusion (mutex) obje… |
yes |
| StixNetworkTraffic |
The Network Traffic Object represents arbitrary network traffic that originat… |
yes |
| StixProcess |
The Process Object represents common properties of an instance of a computer … |
yes |
| StixSoftware |
The Software Object represents high-level properties associated with software… |
yes |
| StixUrl |
The URL Object represents the properties of a uniform resource locator (URL) |
yes |
| StixUserAccount |
The User Account Object represents an instance of any type of user account, i… |
yes |
| StixWindowsRegistryKey |
The Registry Key Object represents the properties of a Windows registry key |
yes |
| StixX509Certificate |
The X509 Certificate Object represents the properties of an X |
yes |
| StixAttackPattern |
Attack Patterns are a type of TTP that describe ways that adversaries attempt… |
yes |
| StixCampaign |
A Campaign is a grouping of adversary behavior that describes a set of malici… |
yes |
| StixCourseOfAction |
A Course of Action is an action taken either to prevent an attack or to respo… |
yes |
| StixGrouping |
A Grouping object explicitly asserts that the referenced STIX Objects have a … |
yes |
| StixIncident |
The Incident object in STIX 2 |
yes |
| StixIndicator |
Indicators contain a pattern that can be used to detect suspicious or malicio… |
yes |
| StixInfrastructure |
Infrastructure objects describe systems, software services, and associated ph… |
yes |
| StixIntrusionSet |
An Intrusion Set is a grouped set of adversary behavior and resources with co… |
yes |
| StixLocation |
A geographic location, given as a region, a civic address, a latitude and lon… |
yes |
| StixMalware |
Malicious code: a program inserted into a system, usually covertly, to compro… |
yes |
| StixMalwareAnalysis |
Malware Analysis captures the metadata and results of a particular analysis p… |
yes |
| StixNote |
A Note is a comment or note containing informative text to help explain the c… |
yes |
| StixObservedData |
Observed data conveys information that was observed on systems and networks, … |
yes |
| StixOpinion |
An Opinion is an assessment of the correctness of the information in a STIX O… |
yes |
| StixReport |
Reports are collections of threat intelligence focused on one or more topics,… |
yes |
| StixThreatActor |
Threat Actors are actual individuals, groups, or organizations believed to be… |
yes |
| StixTool |
Tools are legitimate software that can be used by threat actors to perform at… |
yes |
| StixVulnerability |
A Vulnerability is a mistake in software that can be directly used by a hacke… |
yes |
| StixRelationship |
The Relationship object is used to link together two SDOs in order to describ… |
yes |
| StixSighting |
The belief that something in cyber threat intelligence, such as an indicator,… |
yes |
