Campaigns are instances of ThreatActors pursuing an intent, as observed through sets of Incidents and/or TTP, potentially across organizations.
The Affected_Software field captures the list of platforms and software that are affected by this vulnerability. It is implemented through the CybOX Observables, the suggested CybOX objects to use are the Product Object, the Device Object, the System Object, and the Code Object.
hasStage is used to denote stage/phase of a particular course of action represented as nominals
An attack (noun) is the use of an exploit(s) by an adversary to take advantage of a weakness(s) with the intent of achieving a negative technical impact(s). Source: https://capec.mitre.org/about/glossary.html#Attack From the bove definition, "the use of an exploit(s)" is means, "an adversary" is attacker, and "negative technical impact(s)" is consequence.
An attack (noun) is the use of an exploit(s) by an adversary to take advantage of a weakness(s) with the intent of achieving a negative technical impact(s). Source: https://capec.mitre.org/about/glossary.html#Attack From the bove definition, "the use of an exploit(s)" is means, "an adversary" is attacker, and "to take advantage of... with the intent of achieving a negative technical impact(s)" is consequence.
EquivalentClass: ThreatActor ThreatActors are characterizations of malicious actors (or adversaries) representing a cyber attack threat including presumed intent and historically observed behavior. Source: https://stix.mitre.org/about/documents/STIX_Whitepaper_v1.1.pdf
The details of the CVE class are in another ontology yet to be imported. CVE is not equal to Vulnerability because Vulnerability also refers to OSVDB_ID
Campaigns are instances of ThreatActors pursuing an intent, as observed through sets of Incidents and/or TTP, potentially across organizations. Source: https://stix.mitre.org/about/documents/STIX_Whitepaper_v1.1.pdf
CoursesOfAction are specific measures to be taken to address threat whether they are corrective or preventative to address ExploitTargets, or responsive to counter or mitigate the potential impacts of Incidents. Source: https://stix.mitre.org/about/documents/STIX_Whitepaper_v1.1.pdf
ExploitTargets are vulnerabilities or weaknesses in software, systems, networks or configurations that are targeted for exploitation by the TTP of a ThreatActor. Source: https://stix.mitre.org/about/documents/STIX_Whitepaper_v1.1.pdf
Incidents are discrete instances of Indicators affecting an organization along with information discovered or decided during an incident response investigation. Source: https://stix.mitre.org/about/documents/STIX_Whitepaper_v1.1.pdf
Observables are the “base” construct within the STIX architecture. Observables are stateful properties or measurable events pertinent to the operation of computers and networks. Information about a file (name, hash, size, etc.), a registry key value, a service being started, or an HTTP request being sent are all simple examples of observables. STIX leverages CybOX for its representation of Observables. Source: https://stix.mitre.org/about/documents/STIX_Whitepaper_v1.1.pdf
Tactics, Techniques and Procedures (TTP) are representations of the behavior or modus operandi of cyber adversaries. Source: https://stix.mitre.org/about/documents/STIX_Whitepaper_v1.1.pdf
ThreatActors are characterizations of malicious actors (or adversaries) representing a cyber attack threat including presumed intent and historically observed behavior. Source: https://stix.mitre.org/about/documents/STIX_Whitepaper_v1.1.pdf