The XPath specified in a data marking controlled structure field must select all fields (elements and attributes) that the marking will be applied to. It is not sufficient to select only the root element using the / character. Instead, you should use the node() function to select relevant nodes. For example, to select the entire document you should use //node() while to select a parent construct (Indicator, for example), you could use ancestor-or-self::stix:Indicator//node().
As noted in the annotations, prefixes are valid if they are declared in scope of the Controlled_Structure element.
| Field Name | Type | Description |
|---|---|---|
| @idoptional | QName |
Specifies a unique ID for this Marking. |
| @idrefoptional | QName |
Specifies a reference to the ID of a Marking defined elsewhere. When idref is specified, the id attribute must not be specified, and any instance of this Marking should not hold content. |
| @versionoptional | string |
Specifies the relevant Data_Marking schema version for this content. |
| Controlled_Structure0..1 | string |
This field utilizes XPath 1.0 to specify the structures for which the Marking is to be applied. The XPath expression is NOT recursive and the marking structure does NOT apply to child nodes of the selected node. Instead, the expression must explicitly select all nodes that the marking is to be applied to including elements, attributes, and text nodes. The context root of the XPath statement is this Controlled_Structure element. Any namespace prefix declarations that are available to this Controlled_Structure element are available to the XPath. Note that all Controlled_Structure elements have a scope within the document for which their XPath is valid to reference. Usages of MarkingType may specify a "marking scope". The marking scope is always recursive and specifies the set of nodes that may be selected by the XPath expression (and therefore that may have the markings applied to them). If no marking scope is specified in the schema documentation or specification where the MarkingType is used, it should be assumed that the document itself and all nodes are within scope. |
| Marking_Structure0..n | MarkingStructureType |
This field contains the marking information to be applied to the portions of XML content specified in the ControlledStructure field. This field is defined as MarkingStructureType which is an abstract type the enables the flexibility to utilize any variety of marking structures. |
| Information_Source0..1 | InformationSourceType |
The Information_Source field details the source of this entry. |
