Skip to content

Slot: created_by_ref

ID of the object that created this object.

URI: stix:created_by_ref Alias: created_by_ref

Applicable Classes

Name Description Modifies Slot
CourseOfAction A Course of Action is an action taken either to prevent an attack or to respo... no
Core Common properties and behavior across all STIX Domain Objects and STIX Relati... no
Relationship The Relationship object is used to link together two SDOs in order to describ... no
Incident The Incident object in STIX 2 no
MalwareAnalysis Malware Analysis captures the metadata and results of a particular analysis p... no
Identity Identities can represent actual individuals, organizations, or groups (e no
Grouping A Grouping object explicitly asserts that the referenced STIX Objects have a ... no
IntrusionSet An Intrusion Set is a grouped set of adversary behavior and resources with co... no
Malware Malware is a type of TTP that is also known as malicious code and malicious s... no
ExtensionDefinition The STIX Extension Definition object allows producers of threat intelligence ... no
MarkingDefinition The marking-definition object represents a specific marking no
Sighting A Sighting denotes the belief that something in CTI (e no
StixRelationshipObject no
LanguageContent The language-content object represents text content for STIX Objects represen... no
ObservedData Observed data conveys information that was observed on systems and networks, ... no
StixDomainObject no
Tool Tools are legitimate software that can be used by threat actors to perform at... no
Campaign A Campaign is a grouping of adversary behavior that describes a set of malici... no
Indicator Indicators contain a pattern that can be used to detect suspicious or malicio... no
Opinion An Opinion is an assessment of the correctness of the information in a STIX O... no
Report Reports are collections of threat intelligence focused on one or more topics,... no
ThreatActor Threat Actors are actual individuals, groups, or organizations believed to be... no
Vulnerability A Vulnerability is a mistake in software that can be directly used by a hacke... no
Note A Note is a comment or note containing informative text to help explain the c... no
Location A Location represents a geographic location no
AttackPattern Attack Patterns are a type of TTP that describe ways that adversaries attempt... no
Infrastructure Infrastructure objects describe systems, software services, and associated ph... no

Properties

Type and Range

Property Value
Range StixIdentifier
Domain Of Core, MarkingDefinition

Cardinality and Requirements

Property Value

Identifier and Mapping Information

Schema Source

  • from schema: https://w3id.org/lmodel/stix

Mappings

Mapping Type Mapped Value
self stix:created_by_ref
native stix:created_by_ref
close unified_cyber_ontology:createdBy

LinkML Source

name: created_by_ref
description: ID of the object that created this object.
from_schema: https://w3id.org/lmodel/stix
close_mappings:
- unified_cyber_ontology:createdBy
rank: 1000
alias: created_by_ref
domain_of:
- Core
- MarkingDefinition
range: stix_identifier