Class: KillChainPhase

The Kill Chain Phase object represents a single phase of a cyber attack,

including the initial reconnaissance and planning stages up to the final

objective of the attacker. It provides a detailed description of each phase and

its associated activities within the broader context of a cyber attack. See <a

target='_blank'

href='https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html'>Cyber

Kill Chain®.

 classDiagram
    class KillChainPhase
    click KillChainPhase href "../KillChainPhase/"
      Object <|-- KillChainPhase
        click Object href "../Object/"

      KillChainPhase : phase

      KillChainPhase : phase_id





        KillChainPhase --> "1" PhaseIdEnum : phase_id
        click PhaseIdEnum href "../PhaseIdEnum/"

Inheritance

OcsfObject
- Object
  - KillChainPhase

Slots

Name	Cardinality and Range	Description	Inheritance
phase	0..1 recommended String	The cyber kill chain phase	direct
phase_id	1 PhaseIdEnum	The cyber kill chain phase identifier	direct

Usages

used by	used in	type	used
Osint	kill_chain	range	KillChainPhase
RelatedEvent	kill_chain	range	KillChainPhase
FindingInfo	kill_chain	range	KillChainPhase
SecurityFinding	kill_chain	range	KillChainPhase

In Subsets

objects_subset

Aliases

Kill Chain Phase

Identifier and Mapping Information

Schema Source

from schema: https://w3id.org/lmodel/ocsf

Mappings

Mapping Type	Mapped Value
self	ocsf:KillChainPhase
native	ocsf:KillChainPhase
close	attack:KillChainPhase

LinkML Source

Direct

name: KillChainPhase
description: 'The Kill Chain Phase object represents a single phase of a cyber attack,

  including the initial reconnaissance and planning stages up to the final

  objective of the attacker. It provides a detailed description of each phase and

  its associated activities within the broader context of a cyber attack. See <a

  target=''_blank''

  href=''https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html''>Cyber

  Kill Chain®</a>.'
in_subset:
- objects_subset
from_schema: https://w3id.org/lmodel/ocsf
aliases:
- Kill Chain Phase
close_mappings:
- attack:KillChainPhase
is_a: Object
slots:
- phase
- phase_id
slot_usage:
  phase:
    name: phase
    recommended: true
  phase_id:
    name: phase_id
    required: true

Induced

name: KillChainPhase
description: 'The Kill Chain Phase object represents a single phase of a cyber attack,

  including the initial reconnaissance and planning stages up to the final

  objective of the attacker. It provides a detailed description of each phase and

  its associated activities within the broader context of a cyber attack. See <a

  target=''_blank''

  href=''https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html''>Cyber

  Kill Chain®</a>.'
in_subset:
- objects_subset
from_schema: https://w3id.org/lmodel/ocsf
aliases:
- Kill Chain Phase
close_mappings:
- attack:KillChainPhase
is_a: Object
slot_usage:
  phase:
    name: phase
    recommended: true
  phase_id:
    name: phase_id
    required: true
attributes:
  phase:
    name: phase
    description: The cyber kill chain phase.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Kill Chain Phase
    rank: 1000
    alias: phase
    owner: KillChainPhase
    domain_of:
    - KillChainPhase
    range: string
    recommended: true
  phase_id:
    name: phase_id
    annotations:
      sibling:
        tag: sibling
        value: phase
    description: The cyber kill chain phase identifier.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Kill Chain Phase ID
    rank: 1000
    alias: phase_id
    owner: KillChainPhase
    domain_of:
    - KillChainPhase
    range: PhaseIdEnum
    required: true