Skip to content

Slot: source_ref

The ID of the source (from) object.

URI: stix:source_ref

Name Description Modifies Slot
StixRelationship The Relationship object is used to link together two SDOs in order to describ… yes
AttackRelationship A relationship between two ATT&CK objects, of one of the seven types ATT&CK u… no
Property Value
Range StixObject or 
StixDomainObject or 
StixCyberObservableObject
Domain Of StixRelationship
Slot URI stix:source_ref
Property Value
Regex Pattern `^(?!(relationship
Expressions & Logic

Value must satisfy at least one of:

  • AnonymousSlotExpression({‘range’: ‘StixDomainObject’})
  • AnonymousSlotExpression({‘range’: ‘StixCyberObservableObject’})
Mapping Type Mapped Value
self stix:source_ref
native attack:source_ref
close uco-core:source
name: source_ref
description: The ID of the source (from) object.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-core:source
rank: 1000
slot_uri: stix:source_ref
domain_of:
- StixRelationship
range: StixObject
pattern: ^(?!(relationship|sighting|bundle|marking-definition|language-content)--)[a-z][a-z0-9-]+[a-z0-9]--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
any_of:
- range: StixDomainObject
- range: StixCyberObservableObject