Heads up! These docs are for STIX 1.1.1, which is not the latest version (1.2). View the latest!

CompositeIndicatorExpressionTypeIndicator Schema

Type for allowing content creators to create composite indicator expressions using basic boolean logic.

Fields

Field Name Type Description
@operatorrequired OperatorTypeEnum

Specifies the logical composition operator for this composite cyber threat Indicator.
Indicator0..n IndicatorType

The indicator field specifies one cyber threat indicator made up of a pattern identifying certain observable conditions as well as contextual information about the patterns meaning, how and when it should be acted on, etc.