Skip to content

Common Attack Pattern Enumeration and Classification (CAPEC): LinkML Schema

Common Attack Pattern Enumeration and Classification (CAPEC): A comprehensive dictionary of known patterns of attack employed by adversaries to exploit known weaknesses in cyber-enabled capabilities. CAPEC is a community-developed list maintained by The MITRE Corporation that helps users understand how adversaries exploit weaknesses in applications and other cyber-enabled capabilities. The schema is maintained by The MITRE Corporation and developed in partnership with the public CAPEC Community.

URI: https://w3id.org/lmodel/capec

Name: capec

Classes

Class Description
AlternateTerm Another name or term used to describe an attack pattern
AttackPattern An attack pattern is an abstraction mechanism for helping describe how an att...
AttackPatternCatalog The root element used to hold an enumerated catalog of common attack patterns
AttackStep An individual step in the execution flow of an attack pattern
Category A category in CAPEC is a collection of attack patterns based on some common
Consequence An individual consequence associated with an attack pattern, specifying which
ContentHistory Tracks the original author of a CAPEC entry and any subsequent modifications
Contribution A record of a contribution made to a CAPEC entry, identifying the contributor...
ExcludeRelated Captures the CAPEC identifier of an ancestor for which a given relationship i...
ExternalReference An external reference provides a pointer to where more information and deeper...
HasMember Represents a Has_Member relationship indicating that the parent category or v...
MemberOf Represents a Member_Of relationship indicating that the parent category or vi...
Modification A record of a modification made to a CAPEC entry, identifying the modifier,
Note An additional comment about a CAPEC entry that cannot be captured using the o...
PreviousEntryName A previous name that was used for a CAPEC entry before a substantive name cha...
Reference A link from a CAPEC entry to an external reference defined within the catalog
RelatedAttackPattern A reference to another attack pattern that provides insight to similar items ...
RelatedWeakness A reference to a CWE (Common Weakness Enumeration) weakness associated with a...
Relationships A container for relationships associated with a category or view, showing
Skill A description of the level of skills or specific knowledge needed by an adver...
Stakeholder A target stakeholder or group for whom a CAPEC view is relevant
Submission Information about the original submission of a CAPEC entry, identifying the
TaxonomyMapping A mapping from a CAPEC entry (AttackPattern or Category) to an equivalent or ...
Technique A specific technique used by an adversary during an attack step
View A view in CAPEC represents a perspective with which one might look at the col...

Slots

Slot Description
abstraction The abstraction level for this attack pattern
alternate_terms One or more other names by which this attack pattern may be known
attack_patterns The collection of attack patterns defined in this catalog
audience Reference to the target stakeholders or groups for whom this view is most rel...
authors The author(s) of the referenced material
capec_id Reference to a CAPEC identifier
categories The collection of categories organizing attack patterns in this catalog
consequence_id Internal CAPEC team identifier for consequences that repeat across many indiv...
consequences Individual consequences associated with this attack pattern, specifying the s...
content The content of the note, potentially containing XHTML markup
content_history Tracks the original author of this entry and any subsequent modifications to ...
contribution_comment Comments about the contribution and its significance
contribution_date The date on which this contribution was made
contribution_name The name of the person or team who made this contribution
contribution_organization The organization of the person who made this contribution
contributions Records of contributions made to the entry, identifying contributors and whet...
cwe_id The CWE integer identifier of the related weakness (e
description Textual description or content for this element, potentially containing XHTML...
edition The edition of the material being referenced, in the event that multiple edit...
entry_date Date value associated with this element
entry_id The identifier of the entry in the external taxonomy that this CAPEC entry is...
entry_name The name of the entry in the external taxonomy that this CAPEC entry is being...
example_instances One or more concrete example instances of this attack pattern to help the rea...
exclude_id The CAPEC integer identifier of the ancestor entry for which the relationship...
exclude_related One or more CAPEC identifiers for ancestor entries where a relationship does ...
execution_flow A detailed step-by-step flow of the attack pattern, listing the typical steps...
extended_description Additional details important to this attack pattern beyond what is conveyed i...
external_reference_id The identifier of the external reference entry being linked to (e
external_references The collection of external references shared throughout the catalog entries
filter An XSL query used to identify which attack patterns are members of this view
has_member Has_Member relationships showing that this category or view contains a given ...
id Unique integer identifier for the entry
impact Describes the negative technical impact(s) that arise if an adversary success...
indicators Activities, events, conditions or behaviors that may indicate that an attack ...
level The skill or knowledge level required (High, Medium, Low, or Unknown)
likelihood Identifies how likely this specific consequence is expected to be seen relati...
likelihood_of_attack An overall average likelihood value for attacks that leverage this attack pat...
mapping_fit Identifies how closely the CAPEC entry aligns with the external taxonomy entr...
member_of Member_Of relationships showing that this category or view is a member of a g...
members The members of this view, defined via Member_Of and Has_Member relationships ...
mitigations Actions or approaches to prevent or mitigate the risk of an attack that lever...
modification_comment Comments describing the nature and reason for this modification
modification_date The date on which this modification was made
modification_importance The importance level of this modification
modification_name The name of the person or team who made this modification
modification_organization The organization of the person who made this modification
modifications Records of modifications made to the entry content
name Descriptive title used to give the reader an idea of what the entry represent...
nature The nature of the relationship (ChildOf, ParentOf, CanFollow, CanPrecede, Can...
note Additional commentary about this specific consequence
notes Additional comments and notes about this entry that cannot be captured using ...
objective Describes the perspective from which this view has been constructed and what ...
phase The phase of the attack this step belongs to (Explore, Experiment, or Exploit...
prerequisites The conditions that must exist in order for an attack leveraging this pattern...
previous_entry_names Previous names that were used for this entry
publication The name of the magazine, journal, or other publication that contains the ref...
publication_day The day of publication of the referenced material
publication_month The month of publication of the referenced material
publication_year The year of publication of the referenced material
publisher The name of the publisher of the referenced material
reference_id A globally unique identifier for this external reference (e
references Links to external references for further reading and insight into this entry
related_attack_patterns References to other attack patterns that give insight to similar items at hig...
related_weaknesses References to CWE weaknesses associated with this attack pattern
relationships Relationships of this category with attack patterns, other categories, and vi...
resources_required The resources (e
scope Identifies the security property or properties that are violated when this co...
section A specific section title or page number within the referenced material that i...
skills_required The level of skills or specific knowledge needed by an adversary to execute t...
status The development and usage status level for this entry
step The sequential step number within the execution flow
submission Identifies the original submitter, their organization, the submission date, a...
submission_comment Any comments related to the original submission of this entry
submission_date The date on which this entry was originally submitted
submission_name The name of the person or team who originally submitted this entry
submission_organization The organization of the person who originally submitted this entry
summary A short summary limited to the key points that define this category
taxonomy_mappings Mappings from this entry to equivalent or related entries in taxonomies outsi...
taxonomy_name Identifies the external taxonomy to which this mapping is being made
techniques Specific techniques used by the adversary during this attack step
term The actual alternate term or name for the attack pattern
title The title of the referenced material
type Type or classification for this element
typical_severity An overall average severity value for attacks that leverage this attack patte...
url A URL for the material being referenced, if one exists online
url_date The date when the URL was validated to be accessible and correct
version Version identifier associated with this element
views The collection of views providing perspectives on the attack pattern catalog

Enumerations

Enumeration Description
AbstractionEnum The different abstraction levels that apply to an attack pattern
AttackStepPhaseEnum The different phases of an individual attack step within the execution flow
ContributionTypeEnum The type of contribution made to a CAPEC entry
ImportanceEnum Different values for the importance of a modification to CAPEC content
LikelihoodEnum Values corresponding to different likelihoods
NoteTypeEnum The different types of notes that can be associated with an attack pattern
RelatedNatureEnum The different values that can be used to define the nature of a related attac...
ScopeEnum The different areas of software security that can be affected by exploiting a...
SeverityEnum Values corresponding to different severities of attack impact
SkillLevelEnum Values corresponding to different knowledge levels required to perform an att...
StakeholderEnum The different types of users and stakeholder groups within the CAPEC communit...
StatusEnum The different status values that an entity (view, category, or attack pattern...
TaxonomyMappingFitEnum The different values used to describe how closely a mapping between CAPEC and...
TaxonomyNameEnum The different known taxonomies to which CAPEC entries can be mapped
TechnicalImpactEnum The different negative technical impacts that can result from a successful at...
ViewTypeEnum The different types of views that can be found within CAPEC

Types

Type Description
Boolean A binary (true or false) value
Curie a compact URI
Date a date (year, month and day) in an idealized calendar
DateOrDatetime Either a date or a datetime
Datetime The combination of a date and time
Decimal A real number with arbitrary precision that conforms to the xsd:decimal speci...
Double A real number that conforms to the xsd:double specification
Float A real number that conforms to the xsd:float specification
Integer An integer
Jsonpath A string encoding a JSON Path
Jsonpointer A string encoding a JSON Pointer
Ncname Prefix part of CURIE
Nodeidentifier A URI, CURIE or BNODE that represents a node in a model
Objectidentifier A URI or CURIE that represents an object in the model
Sparqlpath A string encoding a SPARQL Property Path
String A character string
StructuredText Mixed content type allowing XHTML content embedded within standard string dat...
Time A time object represents a (local) time of day, independent of any particular...
Uri URI value represented as a string
Uri a complete URI
Uriorcurie a URI or a CURIE

Subsets

Subset Description
AttackPatternContent Supporting types used within attack pattern content descriptions, including c...
AudienceTypes Types for describing target stakeholder audiences relevant to CAPEC views
CatalogEntries Top-level CAPEC catalog entry types (AttackPattern, Category, View, ExternalR...
ContentHistoryTypes Types for tracking authorship and modification history of CAPEC entries, incl...
ExecutionFlowTypes Types for describing the detailed step-by-step execution flow of attack patte...
RelationshipTypes Types representing relationships between CAPEC entries, including related att...
TaxonomyTypes Types for mapping CAPEC entries to entries in external security taxonomies su...