string
comment: Campaigns are instances of ThreatActors pursuing an intent, as observed through sets of Incidents and/or TTP, potentially across organizations.

ucohasAffectedSoftware
type: ObjectProperty
equivalent property: ucohasObservable
comment: The Affected_Software field captures the list of platforms and software that are affected by this vulnerability. It is implemented through the CybOX Observables, the suggested CybOX objects to use are the Product Object, the Device Object, the System Object, and the Code Object.

ucohasStage
type: ObjectProperty
domain: ucoCourseofAction
range: Class
  one of: ucoRemedy
  one of: ucoResponse
comment: hasStage is used to denote stage/phase of a particular course of action represented as nominals

ucoAttack
type: Class
equivalent class: ucoIncident
equivalent class: Restriction
  on property: ucohasConsequence
  min qualified cardinality: 1
  on class: ucoConsequence
equivalent class: Restriction
  on property: ucohasMeans
  min qualified cardinality: 1
  on class: ucoMeans
subclass of: ucoUCOThing
comment: An attack (noun) is the use of an exploit(s) by an adversary to take advantage of a weakness(s) with the intent of achieving a negative technical impact(s). Source: https://capec.mitre.org/about/glossary.html#Attack From the bove definition, "the use of an exploit(s)" is means, "an adversary" is attacker, and "negative technical impact(s)" is consequence.

Axiom
annotated source: ucoAttack
annotated property: comment
annotated target: An attack (noun) is the use of an exploit(s) by an adversary to take advantage of a weakness(s) with the intent of achieving a negative technical impact(s). Source: https://capec.mitre.org/about/glossary.html#Attack From the bove definition, "the use of an exploit(s)" is means, "an adversary" is attacker, and "negative technical impact(s)" is consequence.
comment: An attack (noun) is the use of an exploit(s) by an adversary to take advantage of a weakness(s) with the intent of achieving a negative technical impact(s). Source: https://capec.mitre.org/about/glossary.html#Attack From the bove definition, "the use of an exploit(s)" is means, "an adversary" is attacker, and "to take advantage of... with the intent of achieving a negative technical impact(s)" is consequence.

ucoAttacker
type: Class
equivalent class: ucoThreatActor
subclass of: ucoUCOThing
comment: EquivalentClass: ThreatActor ThreatActors are characterizations of malicious actors (or adversaries) representing a cyber attack threat including presumed intent and historically observed behavior. Source: https://stix.mitre.org/about/documents/STIX_Whitepaper_v1.1.pdf

ucoCVE
type: Class
subclass of: ucoUCOThing
comment: The details of the CVE class are in another ontology yet to be imported. CVE is not equal to Vulnerability because Vulnerability also refers to OSVDB_ID

ucoCampaign
type: Class
subclass of: ucoUCOThing
subclass of: Restriction
  on property: ucousesAttacks
  min qualified cardinality: 1
  on class: ucoAttack
comment: Campaigns are instances of ThreatActors pursuing an intent, as observed through sets of Incidents and/or TTP, potentially across organizations. Source: https://stix.mitre.org/about/documents/STIX_Whitepaper_v1.1.pdf

ucoCourseofAction
type: Class
subclass of: ucoUCOThing
comment: CoursesOfAction are specific measures to be taken to address threat whether they are corrective or preventative to address ExploitTargets, or responsive to counter or mitigate the potential impacts of Incidents. Source: https://stix.mitre.org/about/documents/STIX_Whitepaper_v1.1.pdf

ucoExploitTarget
type: Class
subclass of: ucoUCOThing
comment: ExploitTargets are vulnerabilities or weaknesses in software, systems, networks or configurations that are targeted for exploitation by the TTP of a ThreatActor. Source: https://stix.mitre.org/about/documents/STIX_Whitepaper_v1.1.pdf

ucoFile
type: Class
subclass of: ucoUCOThing
comment: A computer file is a resource for storing information, which is available to a computer program and is usually based on some kind of durable storage. A file is "durable" in the sense that it remains available for other programs to use after the program that created it has finished executing. Computer files can be considered as the modern counterpart of paper documents which traditionally are kept in office and library files, and this is the source of the term. http://dbpedia.org/page/Computer_file

ucoIncident
type: Class
subclass of: ucoUCOThing
comment: Incidents are discrete instances of Indicators affecting an organization along with information discovered or decided during an incident response investigation. Source: https://stix.mitre.org/about/documents/STIX_Whitepaper_v1.1.pdf

ucoObservable
type: Class
subclass of: ucoUCOThing
comment: Observables are the “base” construct within the STIX architecture. Observables are stateful properties or measurable events pertinent to the operation of computers and networks. Information about a file (name, hash, size, etc.), a registry key value, a service being started, or an HTTP request being sent are all simple examples of observables. STIX leverages CybOX for its representation of Observables. Source: https://stix.mitre.org/about/documents/STIX_Whitepaper_v1.1.pdf

ucoTTP
type: Class
subclass of: ucoUCOThing
comment: Tactics, Techniques and Procedures (TTP) are representations of the behavior or modus operandi of cyber adversaries. Source: https://stix.mitre.org/about/documents/STIX_Whitepaper_v1.1.pdf

ucoThreatActor
type: Class
subclass of: ucoUCOThing
comment: ThreatActors are characterizations of malicious actors (or adversaries) representing a cyber attack threat including presumed intent and historically observed behavior. Source: https://stix.mitre.org/about/documents/STIX_Whitepaper_v1.1.pdf