This type represents the STIX Incident component. It is extended using the XML Schema Extension feature by the STIX Incident type itself. Users of this type who wish to express a full incident using STIX must do so using the xsi:type extension feature. The STIX-defined Incident type is IncidentType in the http://stix.mitre.org/Incident-1 namespace. This type is defined in the incident.xsd file or at the URL http://stix.mitre.org/XMLSchema/incident/1.0/incident.xsd.
Alternatively, uses that require simply specifying an idref as a reference to an incident defined elsewhere can do so without specifying an xsi:type.
| Field Name | Type | Description | 
|---|---|---|
| @idoptional | QName | 
        
           Specifies a globally unique identifier for this cyber threat Incident.  | 
    
| @idrefoptional | QName | 
        
           Specifies a globally unique identifier for a cyber threat Incident specified elsewhere.  |