Heads up! These docs are for STIX 1.1.1, which is not the latest version (1.2). View the latest!

KillChainPhaseTypeSTIX Common Schema

The KillChainPhaseType characterizes an individual phase within a kill chain definition.


Fields

Field Name Type Description
@phase_idoptional QName

A globally unique identifier for this kill chain phase.

When used directly within a kill chain definition, this attribute must be globally unique and serves to identify the kill chain phase being defined. When used within a kill chain reference, this attribute must reference an existing kill chain phase phase_id and serves as a reference (similar to @idref elsewhere in STIX).

@nameoptional string

This field specifies the descriptive name of the relevant kill chain phase.

When used within a kill chain reference, this attribute should be omitted or, if it is present, must match the name used in the kill chain phase definition that this field references.

@ordinalityoptional int

This field specifies the ordinality (e.g. 1, 2 or 3) of this phase within this kill chain definition.

When used within a kill chain reference, this attribute should be omitted or, if it is present, must match the ordinality used in the kill chain phase definition that this field references.