Skip to content
attack

Slot: observed_data_refs

A list of ID references to the Observed Data objects that contain the raw cyber data for this Sighting.

URI: stix:observed_data_refs

Applicable Classes

Section titled “Applicable Classes”
Name Description Modifies Slot
StixSighting The belief that something in cyber threat intelligence, such as an indicator,… no

Properties

Section titled “Properties”

Type and Range

Section titled “Type and Range”
Property Value
Range StixObservedData
Domain Of StixSighting
Slot URI stix:observed_data_refs

Cardinality and Requirements

Section titled “Cardinality and Requirements”
Property Value
Multivalued Yes
Minimum Cardinality 1

Value Constraints

Section titled “Value Constraints”
Property Value
Regex Pattern ^observed-data--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$

Identifier and Mapping Information

Section titled “Identifier and Mapping Information”

Schema Source

Section titled “Schema Source”

Mappings

Section titled “Mappings”
Mapping Type Mapped Value
self stix:observed_data_refs
native attack:observed_data_refs

LinkML Source

Section titled “LinkML Source”
name: observed_data_refs
description: A list of ID references to the Observed Data objects that contain the
  raw cyber data for this Sighting.
from_schema: https://w3id.org/lmodel/attack
rank: 1000
slot_uri: stix:observed_data_refs
domain_of:
- StixSighting
range: StixObservedData
multivalued: true
pattern: ^observed-data--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
minimum_cardinality: 1