Identifies or characterizes a relationship to a threat actor.
| Field Name | Type | Description |
|---|---|---|
| Confidence0..1 | ConfidenceType |
The confidence field specifies the level of confidence in the assertion of the relationship between the two components. |
| Information_Source0..1 | InformationSourceType |
The Information_Source field specifies the source of the information about the relationship between the two components. |
| Relationship0..1 | ControlledVocabularyStringType |
The relationship field characterizes the type of the relationship between the two components. This field is implemented through the xsi:type controlled vocabulary extension mechanism. No default vocabulary type has been defined for STIX 1.0. Users may either define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a free string field. |
| Threat_Actor1..1 | ThreatActorBaseType |
A reference or representation of the related threat actor. This field is implemented through the xsi:type extension mechanism. The default and strongly recommended type is ThreatActorType in the http://stix.mitre.org/ThreatActor-1 namespace. This type is defined in the threat_actor.xsd file or at the URL http://stix.mitre.org/XMLSchema/threat_actor/1.1/threat_actor.xsd. |