Identifies or characterizes a relationship to a threat actor.
The confidence field specifies the level of confidence in the assertion of the relationship between the two components.
The Information_Source field specifies the source of the information about the relationship between the two components.
The relationship field characterizes the type of the relationship between the two components.
This field is implemented through the xsi:type controlled vocabulary extension mechanism. No default vocabulary type has been defined for STIX 1.0. Users may either define their own vocabulary using the type extension mechanism, specify a vocabulary name and reference using the attributes, or simply use this as a free string field.
A reference or representation of the related threat actor.
This field is implemented through the xsi:type extension mechanism. The default and strongly recommended type is ThreatActorType in the http://stix.mitre.org/ThreatActor-1 namespace. This type is defined in the threat_actor.xsd file or at the URL http://stix.mitre.org/XMLSchema/threat_actor/1.1/threat_actor.xsd.