Slot: where_sighted_refs

A list of ID references to the Identity or Location objects describing the entities or types of entities that saw the sighting.

URI: stix:where_sighted_refs

Applicable Classes

Name	Description	Modifies Slot
StixSighting	The belief that something in cyber threat intelligence, such as an indicator,…	no

Properties

Type and Range

Property	Value
Range	StixDomainObject or  StixIdentity or  StixLocation
Domain Of	StixSighting
Slot URI	stix:where_sighted_refs

Cardinality and Requirements

Property	Value
Multivalued	Yes
Minimum Cardinality	1

Value Constraints

Property	Value
Regex Pattern	`^(identity

Expressions & Logic

Any Of

Value must satisfy at least one of:

• AnonymousSlotExpression({‘range’: ‘StixIdentity’})
• AnonymousSlotExpression({‘range’: ‘StixLocation’})

Identifier and Mapping Information

Schema Source

• from schema: https://w3id.org/lmodel/attack

Mappings

Mapping Type	Mapped Value
self	stix:where_sighted_refs
native	attack:where_sighted_refs

LinkML Source

name: where_sighted_refs
description: A list of ID references to the Identity or Location objects describing
  the entities or types of entities that saw the sighting.
from_schema: https://w3id.org/lmodel/attack
rank: 1000
slot_uri: stix:where_sighted_refs
domain_of:
- StixSighting
range: StixDomainObject
multivalued: true
pattern: ^(identity|location)--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
minimum_cardinality: 1
any_of:
- range: StixIdentity
- range: StixLocation