Skip to content
attack

Slot: sighting_of_ref

A reference to the domain object that was sighted.

URI: stix:sighting_of_ref

Applicable Classes

Section titled “Applicable Classes”
Name Description Modifies Slot
StixSighting The belief that something in cyber threat intelligence, such as an indicator,… yes

Properties

Section titled “Properties”

Type and Range

Section titled “Type and Range”
Property Value
Range StixDomainObject
Domain Of StixSighting
Slot URI stix:sighting_of_ref

Value Constraints

Section titled “Value Constraints”
Property Value
Regex Pattern `^(?!(artifact

Comments

Section titled “Comments”
  • The pattern refuses an observable, a relationship and a meta object, as STIX 2.1 does. OASIS’s JSON schema refuses only some of them.

Identifier and Mapping Information

Section titled “Identifier and Mapping Information”

Schema Source

Section titled “Schema Source”

Mappings

Section titled “Mappings”
Mapping Type Mapped Value
self stix:sighting_of_ref
native attack:sighting_of_ref

LinkML Source

Section titled “LinkML Source”
name: sighting_of_ref
description: A reference to the domain object that was sighted.
comments:
- The pattern refuses an observable, a relationship and a meta object, as STIX 2.1
  does. OASIS's JSON schema refuses only some of them.
from_schema: https://w3id.org/lmodel/attack
rank: 1000
slot_uri: stix:sighting_of_ref
domain_of:
- StixSighting
range: StixDomainObject
pattern: ^(?!(artifact|autonomous-system|directory|domain-name|email-addr|email-message|file|ipv4-addr|ipv6-addr|mac-addr|mutex|network-traffic|process|software|url|user-account|windows-registry-key|x509-certificate|relationship|sighting|bundle|marking-definition|language-content|extension-definition)--)[a-z][a-z0-9-]+[a-z0-9]--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$