Heads up! These docs are for STIX 1.1.1, which is not the latest version (1.2). View the latest!

AffectedAssetTypeIncident Schema


Fields

Field Name Type Description
Type0..1 AssetTypeType

The Type field is optional and specifies the type of the asset impacted by the incident (a security attribute was negatively affected).

Description0..1 StructuredTextType

The Description field is optional and provides an unstructured, text description of the asset.

Business_Function_Or_Role0..1 StructuredTextType

The Business_Function_Or_Role field is optional and provides a brief description of the asset's role, mission, and importance within the organization.

Ownership_Class0..1 ControlledVocabularyStringType

The Ownership_Class field is optional and gives a high-level characterization of who owns (or controls) this asset (e.g. Internally-owned, Employee-owned, Partner-owned, Customer-owned).

This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is OwnershipClassVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.1.1/stix_default_vocabularies.xsd.

Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.

Management_Class0..1 ControlledVocabularyStringType

The Management_Class field is optional and gives a high-level characterization of who is responsible for the day-to-day management and administration of this asset (e.g. Managed Internally, Managed by External Party, Co-managed).

This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is ManagementClassVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.1.1/stix_default_vocabularies.xsd.

Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.

Location_Class0..1 ControlledVocabularyStringType

The Location_Class field is optional and gives a high-level characterization of where this asset is physically located (e.g. Internal location, External location, Co-located, Mobile).

This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is LocationClassVocab-1.0 in the http://stix.mitre.org/default_vocabularies-1 namespace. This type is defined in the stix_default_vocabularies.xsd file or at the URL http://stix.mitre.org/XMLSchema/default_vocabularies/1.1.1/stix_default_vocabularies.xsd.

Users may also define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a string field.

Location0..1 AddressAbstractType

The Location field specifies the physical location of the affected asset.

This field is implemented through the xsi:type extension mechanism. The default type is CIQAddressInstanceType in the http://stix.mitre.org/extensions/Identity#CIQAddress-1 namespace. This type is defined in the extensions/address/ciq_3.0_address.xsd file or at the URL http://stix.mitre.org/XMLSchema/extensions/address/ciq/1.1/ciq_3.0_address.xsd.

Those who wish to express a simple name may also do so by not specifying an xsi:type and using the Name field.

Nature_Of_Security_Effect0..1 NatureOfSecurityEffectType

The Nature_Of_Security_Effect field is optional and characterizes how the security properties of the Asset were affected.

Structured_Description0..1 ObservablesType

The Structured_Description field is optional and provides a structured description of the asset.