Heads up! These docs are for STIX 1.0, which is not the latest version (1.2). View the latest!

STIXTypeSTIX Core Schema

STIXType defines a bundle of information characterized in the Structured Threat Information eXpression (STIX) language.


Fields

Field Name Type Description
@idoptional QName

Specifies a globally unique identifier for this STIX Package.

@idrefoptional QName

Specifies a globally unique identifier of a STIX Package specified elsewhere.

@versionoptional STIXPackageVersionEnum

Specifies the relevant STIX schema version for this content.

STIX_Header0..1 STIXHeaderType

The STIX_Header field provides information characterizing this package of STIX content.

Observables0..1 ObservablesType

Characterizes one or more cyber observables.

Indicators0..1 IndicatorsType

Characterizes one or more cyber threat Indicators.

TTPs0..1 TTPsType

Characterizes one or more cyber threat adversary Tactics, Techniques or Procedures.

Exploit_Targets0..1 ExploitTargetsType

Characterizes one or more potential targets for exploitation.

Incidents0..1 IncidentsType

Characterizes one or more cyber threat Incidents.

Courses_Of_Action0..1 CoursesOfActionType

Characterizes Courses of Action to be taken in regards to one of more cyber threats.

Campaigns0..1 CampaignsType

Characterizes one or more cyber threat Campaigns.

Threat_Actors0..1 ThreatActorsType

Characterizes one or more cyber Threat Actors.