openapi: 3.2.0
info:
  title: CTIA Bundle API
  version: 4178275a824512c2fd3a2acdb0e8277233919054 v2.71.0
  license:
    name: All Rights Reserved
    url: ''
  contact:
    name: 'Cisco Security Business Group -- Advanced Threat '
    url: http://github.com/threatgrid/ctia
    email: cisco-intel-api-support@cisco.com
  description: "A Threat Intelligence API service\n\n  This API provides a mechanism for making Judgements on the Disposition\n  of Observables, which are then distilled into a final Verdict.  A\n  Disposition is a statement regarding the malicious, or otherwise,\n  nature of an Observable.\n\n  The Judgements can be grouped into Indicators, which can be associated\n  with Campaigns, Actors and TTPs.  Feedback can be given on specific\n  Judgements, indicating agreement or disagreement, or clarification.\n\n  When an Observable with a malicious Verdict is seen, it can be recorded as\n  a Sighting, and the Relations that Observable had with other Observables can\n  be recorded as well.\n\n  We support a pre-defined set of Observable Types.  Each Observable Type has a\n  specific form of natural identifier, its ID, which is almost always\n  the default way it is represented when observed in the wild.\n\n  * Ipv4/IPv6  -- 192.168.1.1\n  * Domain/Hostname -- foo.com, www.bar.com\n  * SHA256  -- the sha256 checksum of a file, or other data blob\n  * MD5 -- the md5 checksum of a file, or other data blob\n  * SHA1 -- the sha1 checksum of a file, or other data blob\n  * URL -- A minimal form of the URL\n\n  The Verdict is derived from all of the Judgements on that Observable which\n  have not yet expired.  The highest priority Judgement becomes the\n  active verdict.  If there is more than one Judgement with that\n  priority, than Clean disposition has priority over all others, then\n  Malicious disposition, and so on down to Unknown.\n\n  <a href='/doc/README.md'>CTIA Documentation</a>"
  x-provenance:
    method: harvested
    authored_by: Cisco XDR (CTIA)
    harvested_by: API Evangelist
    harvested_on: '2026-08-19'
    first_party: true
    note: Published by Cisco. Retrieved unmodified except for this x-provenance block.
    provider_published: true
  x-evidence:
  - type: source
    url: https://private.intel.amp.cisco.com/index.html
  - type: raw
    url: https://private.intel.amp.cisco.com/swagger.json
servers:
- url: /
security:
- JWT: []
- oauth2:
  - private-intel
  - private-intel:read
  - private-intel:write
  - casebook
  - casebook:read
  - casebook:write
tags:
- name: Bundle
paths:
  /ctia/bundle/export:
    get:
      tags:
      - Bundle
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NewBundleExport'
            application/x-yaml:
              schema:
                $ref: '#/components/schemas/NewBundleExport'
            application/edn:
              schema:
                $ref: '#/components/schemas/NewBundleExport'
            application/transit+json:
              schema:
                $ref: '#/components/schemas/NewBundleExport'
            application/transit+msgpack:
              schema:
                $ref: '#/components/schemas/NewBundleExport'
      parameters:
      - in: query
        name: ids
        description: ''
        required: true
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
      - in: query
        name: related_to
        description: ''
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
            enum:
            - target_ref
            - source_ref
      - in: query
        name: source_type
        description: ''
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
            enum:
            - feed
            - feedback
            - investigation
            - asset-mapping
            - data-table
            - tool
            - vulnerability
            - judgement
            - target-record
            - weakness
            - note
            - coa
            - attack-pattern
            - incident
            - indicator
            - campaign
            - asset-properties
            - sighting
            - casebook
            - asset
            - identity-assertion
            - malware
            - actor
      - in: query
        name: target_type
        description: ''
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
            enum:
            - feed
            - feedback
            - investigation
            - asset-mapping
            - data-table
            - tool
            - vulnerability
            - judgement
            - target-record
            - weakness
            - note
            - coa
            - attack-pattern
            - incident
            - indicator
            - campaign
            - asset-properties
            - sighting
            - casebook
            - asset
            - identity-assertion
            - malware
            - actor
      - in: query
        name: include_related_entities
        description: ''
        required: false
        schema:
          type: boolean
      summary: Export records with their local relationships. Ids are URIs (with port if specified).
      description: Requires capabilities list-actors, list-asset-mappings, list-asset-properties, list-assets, list-attack-patterns, list-campaigns, list-casebooks, list-coas, list-data-tables, list-feedbacks, list-identity-assertions, list-incidents, list-indicators, list-investigations, list-judgements, list-malwares, list-notes, list-relationships, list-sightings, list-target-records, list-tools, list-verdicts, list-vulnerabilities, list-weaknesses, read-actor, read-asset, read-asset-mapping, read-asset-properties, read-attack-pattern, read-campaign, read-casebook, read-coa, read-data-table, read-feedback, read-identity-assertion, read-incident, read-indicator, read-investigation, read-judgement, read-malware, read-note, read-relationship, read-sighting, read-target-record, read-tool, read-vulnerability, read-weakness.
    post:
      tags:
      - Bundle
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NewBundleExport'
            application/x-yaml:
              schema:
                $ref: '#/components/schemas/NewBundleExport'
            application/edn:
              schema:
                $ref: '#/components/schemas/NewBundleExport'
            application/transit+json:
              schema:
                $ref: '#/components/schemas/NewBundleExport'
            application/transit+msgpack:
              schema:
                $ref: '#/components/schemas/NewBundleExport'
      parameters:
      - in: query
        name: related_to
        description: ''
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
            enum:
            - target_ref
            - source_ref
      - in: query
        name: source_type
        description: ''
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
            enum:
            - feed
            - feedback
            - investigation
            - asset-mapping
            - data-table
            - tool
            - vulnerability
            - judgement
            - target-record
            - weakness
            - note
            - coa
            - attack-pattern
            - incident
            - indicator
            - campaign
            - asset-properties
            - sighting
            - casebook
            - asset
            - identity-assertion
            - malware
            - actor
      - in: query
        name: target_type
        description: ''
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
            enum:
            - feed
            - feedback
            - investigation
            - asset-mapping
            - data-table
            - tool
            - vulnerability
            - judgement
            - target-record
            - weakness
            - note
            - coa
            - attack-pattern
            - incident
            - indicator
            - campaign
            - asset-properties
            - sighting
            - casebook
            - asset
            - identity-assertion
            - malware
            - actor
      - in: query
        name: include_related_entities
        description: ''
        required: false
        schema:
          type: boolean
      summary: Export records with their local relationships. Ids are URIs (with port if specified).
      description: Requires capabilities list-actors, list-asset-mappings, list-asset-properties, list-assets, list-attack-patterns, list-campaigns, list-casebooks, list-coas, list-data-tables, list-feedbacks, list-identity-assertions, list-incidents, list-indicators, list-investigations, list-judgements, list-malwares, list-notes, list-relationships, list-sightings, list-target-records, list-tools, list-verdicts, list-vulnerabilities, list-weaknesses, read-actor, read-asset, read-asset-mapping, read-asset-properties, read-attack-pattern, read-campaign, read-casebook, read-coa, read-data-table, read-feedback, read-identity-assertion, read-incident, read-indicator, read-investigation, read-judgement, read-malware, read-note, read-relationship, read-sighting, read-target-record, read-tool, read-vulnerability, read-weakness.
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BundleExportIds'
          application/x-yaml:
            schema:
              $ref: '#/components/schemas/BundleExportIds'
          application/edn:
            schema:
              $ref: '#/components/schemas/BundleExportIds'
          application/transit+json:
            schema:
              $ref: '#/components/schemas/BundleExportIds'
          application/transit+msgpack:
            schema:
              $ref: '#/components/schemas/BundleExportIds'
        required: true
  /ctia/bundle/import:
    post:
      tags:
      - Bundle
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BundleImportResult'
            application/x-yaml:
              schema:
                $ref: '#/components/schemas/BundleImportResult'
            application/edn:
              schema:
                $ref: '#/components/schemas/BundleImportResult'
            application/transit+json:
              schema:
                $ref: '#/components/schemas/BundleImportResult'
            application/transit+msgpack:
              schema:
                $ref: '#/components/schemas/BundleImportResult'
      parameters:
      - in: query
        name: external-key-prefixes
        description: Comma separated list of external key prefixes
        required: false
        schema:
          type: string
      summary: POST many new entities using a single HTTP call
      description: Requires capabilities create-actor, create-asset, create-asset-mapping, create-asset-properties, create-attack-pattern, create-campaign, create-coa, create-data-table, create-feedback, create-identity-assertion, create-incident, create-indicator, create-judgement, create-malware, create-note, create-relationship, create-sighting, create-tool, create-vulnerability, create-weakness, import-bundle.
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Body116683'
          application/x-yaml:
            schema:
              $ref: '#/components/schemas/Body116683'
          application/edn:
            schema:
              $ref: '#/components/schemas/Body116683'
          application/transit+json:
            schema:
              $ref: '#/components/schemas/Body116683'
          application/transit+msgpack:
            schema:
              $ref: '#/components/schemas/Body116683'
        description: Describes a Bundle of any set of CTIM entities.
        required: true
components:
  schemas:
    NewBundleExportIdentityAssertions:
      example:
        valid_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        identity:
          observables:
          - value: 1.2.3.4
            type: ip
        schema_version: 1.3.30
        revision: 10
        type: identity-assertion
        source: string
        external_ids:
        - string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        source_uri: string
        language: string
        id: string
        tlp: green
        timestamp: '2016-01-01T01:01:01.000Z'
        assertions:
        - name: cisco:ctr:ad:host_domain_name
          value: string
      description: For submitting a new IdentityAssertion.
      type: object
      properties:
        valid_time:
          $ref: '#/components/schemas/NewBundleExportIdentityAssertionsValidTime'
        identity:
          $ref: '#/components/schemas/NewBundleExportIdentityAssertionsIdentity'
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        type:
          example: identity-assertion
          type: string
          enum:
          - identity-assertion
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportIdentityAssertionsExternalReferences'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        assertions:
          example:
          - name: cisco:ctr:ad:host_domain_name
            value: string
          description: Any known context about the identity attributes.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportIdentityAssertionsAssertions'
      additionalProperties: {}
      required:
      - identity
      - assertions
    LibraryLoadType:
      example:
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        process_id: 10
        process_name: string
        process_guid: 10
        process_username: string
        type: LibraryLoadEvent
        dll_library_name: string
        dll_library_path: string
      type: object
      properties:
        time:
          $ref: '#/components/schemas/ObservedTime'
        process_id:
          example: 10
          type: integer
          format: int64
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        type:
          example: LibraryLoadEvent
          type: string
          enum:
          - LibraryLoadEvent
        dll_library_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        dll_library_path:
          example: string
          description: String with at most 2048 characters.
          type: string
      additionalProperties: false
      required:
      - time
      - process_id
      - process_name
      - type
      - dll_library_name
      - dll_library_path
    CompositeIndicatorExpression:
      example:
        operator: and
        indicator_ids:
        - string
      type: object
      properties:
        operator:
          example: and
          type: string
          enum:
          - not
          - or
          - and
        indicator_ids:
          example:
          - string
          type: array
          items:
            type: string
      additionalProperties: false
      required:
      - operator
      - indicator_ids
    NewBundleExportSightingsContextRegistryCreateEvents:
      example:
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        process_id: 10
        process_name: string
        process_guid: 10
        process_username: string
        registry_key: string
        type: RegistryCreateEvent
      type: object
      properties:
        time:
          $ref: '#/components/schemas/NewBundleExportSightingsContextRegistryCreateEventsTime'
        process_id:
          example: 10
          type: integer
          format: int64
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        registry_key:
          example: string
          description: String with at most 1024 characters.
          type: string
        type:
          example: RegistryCreateEvent
          type: string
          enum:
          - RegistryCreateEvent
      additionalProperties: {}
      required:
      - time
      - process_id
      - process_name
      - registry_key
      - type
    NewBundleExportSightingsContextFileModifyEventsTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If the observation was made over a period of time, than this field indicates the end of that period.
          type: string
          format: date-time
      additionalProperties: {}
      required:
      - start_time
    NewBundleExportSightingsContextFileMoveEventsTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If the observation was made over a period of time, than this field indicates the end of that period.
          type: string
          format: date-time
      additionalProperties: {}
      required:
      - start_time
    NewBundleExport:
      example:
        description: string
        valid_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        asset_mapping_refs:
        - string
        note_refs:
        - string
        data_table_refs:
        - string
        attack_pattern_refs:
        - string
        sighting_refs:
        - string
        schema_version: 1.3.30
        revision: 10
        assets:
        - description: string
          asset_type: application
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          schema_version: 1.3.30
          revision: 10
          type: asset
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
        weakness_refs:
        - string
        tool_refs:
        - string
        target_record_refs:
        - string
        asset_refs:
        - string
        tools:
        - description: string
          labels:
          - credential-exploitation
          schema_version: 1.3.30
          revision: 10
          type: tool
          x_mitre_aliases:
          - string
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tool_version: string
          tlp: green
          kill_chain_phases:
          - kill_chain_name: string
            phase_name: string
          timestamp: '2016-01-01T01:01:01.000Z'
        indicators:
        - description: string
          tags:
          - string
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          producer: string
          schema_version: 1.3.30
          revision: 10
          type: indicator
          test_mechanisms:
          - string
          source: string
          external_ids:
          - string
          short_description: string
          composite_indicator_expression:
            operator: and
            indicator_ids:
            - string
          title: string
          likely_impact: string
          indicator_type:
          - Anonymization
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          severity: Critical
          tlp: green
          kill_chain_phases:
          - kill_chain_name: string
            phase_name: string
          negate: true
          timestamp: '2016-01-01T01:01:01.000Z'
          confidence: High
          specification:
            type: Judgement
            judgements:
            - string
            required_judgements:
            - confidence: High
              source: string
              relationship: string
              judgement_id: string
        attack_patterns:
        - description: string
          abstraction_level: aggregate
          schema_version: 1.3.30
          revision: 10
          type: attack-pattern
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          x_mitre_platforms:
          - string
          language: string
          id: string
          tlp: green
          x_mitre_data_sources:
          - string
          kill_chain_phases:
          - kill_chain_name: string
            phase_name: string
          x_mitre_contributors:
          - string
          timestamp: '2016-01-01T01:01:01.000Z'
        type: bundle
        weaknesses:
        - description: string
          background_details: string
          paradigms:
          - prevalence: Often
            name: string
          abstraction_level: Base
          architectures:
          - prevalence: Often
            name: string
            class: Embedded
          schema_version: 1.3.30
          revision: 10
          alternate_terms:
          - term: string
            description: string
          likelihood: High
          type: weakness
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          functional_areas:
          - Authentication
          source_uri: string
          modes_of_introduction:
          - phase: Architecture and Design
            note: string
          structure: Chain
          language: string
          id: string
          notes:
          - type: Applicable Platform
            note: string
          common_consequences:
          - scopes:
            - Access Control
            impacts:
            - Alter Execution Logic
            likelihood: High
            note: string
          tlp: green
          detection_methods:
          - method: Architecture or Design Review
            description: string
            effectiveness: High
            effectiveness_notes: string
          operating_systems:
          - prevalence: Often
            name: string
            version: string
            cpe_id: string
            class: Android
          affected_resources:
          - CPU
          languages:
          - prevalence: Often
            name: string
            class: Assembly
          timestamp: '2016-01-01T01:01:01.000Z'
          potential_mitigations:
          - description: string
            phases:
            - Architecture and Design
            strategy: Attack Surface Reduction
            effectiveness: Defense in Depth
            effectiveness_notes: string
          technologies:
          - prevalence: Often
            name: string
        source: string
        external_ids:
        - string
        feedback_refs:
        - string
        asset_properties:
        - properties:
          - name: string
            value: string
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          schema_version: 1.3.30
          revision: 10
          asset_ref: string
          type: asset-properties
          source: string
          external_ids:
          - string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
        short_description: string
        feedbacks:
        - feedback: -1
          schema_version: 1.3.30
          revision: 10
          type: feedback
          source: string
          external_ids:
          - string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          reason: string
          source_uri: string
          language: string
          id: string
          tlp: green
          entity_id: string
          timestamp: '2016-01-01T01:01:01.000Z'
        judgement_refs:
        - string
        title: string
        coa_refs:
        - string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        verdicts:
        - type: verdict
          disposition: 1
          observable:
            value: 1.2.3.4
            type: ip
          judgement_id: string
          disposition_name: Clean
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
        campaigns:
        - description: string
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          schema_version: 1.3.30
          revision: 10
          type: campaign
          campaign_type: string
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          activity:
          - date_time: '2016-01-01T01:01:01.000Z'
            description: string
          source_uri: string
          intended_effect:
          - Account Takeover
          status: Future
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
          confidence: High
          names:
          - string
        source_uri: string
        actors:
        - description: string
          motivation: Ego
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          identity:
            description: string
            related_identities:
            - identity: string
              confidence: High
              information_source: string
              relationship: string
          sophistication: Aspirant
          schema_version: 1.3.30
          revision: 10
          planning_and_operational_support: string
          type: actor
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          intended_effect: Account Takeover
          language: string
          id: string
          tlp: green
          aliases:
          - string
          timestamp: '2016-01-01T01:01:01.000Z'
          confidence: High
          actor_types:
          - Cyber Espionage Operations
        indicator_refs:
        - string
        actor_refs:
        - string
        language: string
        data_tables:
        - description: string
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          schema_version: 1.3.30
          revision: 10
          columns:
          - name: string
            type: integer
            description: string
            required: true
            short_description: string
          type: data-table
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          rows:
          - - anything
          source_uri: string
          language: string
          id: string
          tlp: green
          row_count: 10
          timestamp: '2016-01-01T01:01:01.000Z'
        id: string
        notes:
        - schema_version: 1.3.30
          revision: 10
          content: string
          note_class: keyword
          type: note
          source: string
          external_ids:
          - string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          author: string
          source_uri: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
          related_entities:
          - entity_type: string
            entity_id: string
        identity_assertions:
        - valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          identity:
            observables:
            - value: 1.2.3.4
              type: ip
          schema_version: 1.3.30
          revision: 10
          type: identity-assertion
          source: string
          external_ids:
          - string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
          assertions:
          - name: cisco:ctr:ad:host_domain_name
            value: string
        judgements:
        - valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          schema_version: 1.3.30
          revision: 10
          observable:
            value: 1.2.3.4
            type: ip
          reason_uri: string
          type: judgement
          source: string
          external_ids:
          - string
          disposition: 1
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          reason: string
          source_uri: string
          disposition_name: Clean
          priority: 10
          language: string
          id: string
          severity: Critical
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
          confidence: High
        malwares:
        - description: string
          labels:
          - adware
          abstraction_level: family
          schema_version: 1.3.30
          revision: 10
          type: malware
          x_mitre_aliases:
          - string
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tlp: green
          kill_chain_phases:
          - kill_chain_name: string
            phase_name: string
          timestamp: '2016-01-01T01:01:01.000Z'
        target_records:
        - description: string
          schema_version: 1.3.30
          revision: 10
          type: target-record
          source: string
          external_ids:
          - string
          targets:
          - type: endpoint
            observables:
            - value: 1.2.3.4
              type: ip
            observed_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            os: string
            internal: false
            sensor: string
            source_uri: string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
        asset_mappings:
        - asset_type: application
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          stability: Managed
          schema_version: 1.3.30
          revision: 10
          observable:
            value: 1.2.3.4
            type: ip
          asset_ref: string
          type: asset-mapping
          source: string
          external_ids:
          - string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
          specificity: Low
          confidence: High
        relationship_refs:
        - string
        tlp: green
        incidents:
        - description: string
          assignees:
          - string
          detection_sources:
          - string
          meta:
            keyword: string
          schema_version: 1.3.30
          revision: 10
          type: incident
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          incident_time:
            opened: '2016-01-01T01:01:01.000Z'
            discovered: '2016-01-01T01:01:01.000Z'
            reported: '2016-01-01T01:01:01.000Z'
            remediated: '2016-01-01T01:01:01.000Z'
            closed: '2016-01-01T01:01:01.000Z'
            rejected: '2016-01-01T01:01:01.000Z'
            contained: '2016-01-01T01:01:01.000Z'
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          discovery_method: Agent Disclosure
          source_uri: string
          intended_effect: Account Takeover
          categories:
          - Attrition
          status: Closed
          language: string
          detection_status: active
          id: string
          promotion_method: Automated
          severity: Critical
          tlp: green
          scores:
            asset: 10.0
          techniques:
          - string
          timestamp: '2016-01-01T01:01:01.000Z'
          confidence: High
          short_id: string
          tactics:
          - string
        identity_assertion_refs:
        - string
        sightings:
        - description: string
          schema_version: 1.3.30
          revision: 10
          relations:
          - origin: string
            origin_uri: string
            relation: Allocated
            relation_info:
              keyword: anything
            source:
              value: 1.2.3.4
              type: ip
            related:
              value: 1.2.3.4
              type: ip
          sensor_coordinates:
            type: endpoint
            observables:
            - value: 1.2.3.4
              type: ip
            os: string
          observables:
          - value: 1.2.3.4
            type: ip
          type: sighting
          source: string
          external_ids:
          - string
          targets:
          - type: endpoint
            observables:
            - value: 1.2.3.4
              type: ip
            observed_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            os: string
          short_description: string
          title: string
          resolution: detected
          internal: false
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          detection_interval:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          source_uri: string
          activity_interval:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          language: string
          id: string
          count: 10
          severity: Critical
          tlp: green
          modification_interval:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          context:
            http_events:
            - process_guid: 10
              traffic:
                destination_host_name: string
                protocol: 10
                source_ip: string
                destination_subnet: string
                destination_ip: string
                source_subnet: string
                destination_port: 10
                direction: incoming
                source_port: 10
              method: CONNECT
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              type: HTTPEvent
              host: string
              process_name: string
              process_id: 10
              process_username: string
              query: string
              encrypted: true
              url_port: 10
            process_create_events:
            - parent_process_name: string
              process_guid: 10
              parent_process_guid: 10
              process_disposition: string
              parent_process_size: 10
              process_size: 10
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              parent_process_disposition: string
              type: ProcessCreateEvent
              parent_process_username: string
              parent_process_id: 10
              parent_process_args: string
              process_name: string
              process_hash: string
              process_id: 10
              parent_process_hash: string
              process_username: string
              parent_creation_time: '2016-01-01T01:01:01.000Z'
              process_args: string
            registry_delete_events:
            - time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              process_id: 10
              process_name: string
              process_guid: 10
              process_username: string
              registry_key: string
              type: RegistryDeleteEvent
              registry_value: string
            file_modify_events:
            - file_name: string
              process_guid: 10
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              type: FileModifyEvent
              file_path: string
              process_name: string
              process_id: 10
              process_username: string
              failed: false
            registry_set_events:
            - process_guid: 10
              registry_data: string
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              type: RegistrySetEvent
              registry_data_length: 10
              registry_value: string
              registry_key: string
              process_name: string
              process_id: 10
              process_username: string
            file_create_events:
            - file_name: string
              process_guid: 10
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              type: FileCreateEvent
              file_path: string
              process_name: string
              process_id: 10
              process_username: string
              failed: false
            registry_create_events:
            - time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              process_id: 10
              process_name: string
              process_guid: 10
              process_username: string
              registry_key: string
              type: RegistryCreateEvent
            library_load_events:
            - time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              process_id: 10
              process_name: string
              process_guid: 10
              process_username: string
              type: LibraryLoadEvent
              dll_library_name: string
              dll_library_path: string
            file_move_events:
            - file_name: string
              process_guid: 10
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              type: FileMoveEvent
              old_name: string
              file_path: string
              process_name: string
              process_id: 10
              process_username: string
              new_name: string
            file_delete_events:
            - file_name: string
              process_guid: 10
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              type: FileDeleteEvent
              file_path: string
              process_name: string
              process_id: 10
              process_username: string
              failed: false
            netflow_events:
            - parent_process_name: string
              byte_count_in: 10
              process_guid: 10
              process_path: string
              traffic:
                destination_host_name: string
                protocol: 10
                source_ip: string
                destination_subnet: string
                destination_ip: string
                source_subnet: string
                destination_port: 10
                direction: incoming
                source_port: 10
              flow_time: '2016-01-01T01:01:01.000Z'
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              parent_process_account: string
              type: NetflowEvent
              process_account_type: string
              parent_process_path: string
              parent_process_id: 10
              parent_process_args: string
              process_name: string
              process_account: string
              parent_process_account_type: string
              process_hash: string
              process_id: 10
              parent_process_hash: string
              process_username: string
              byte_count_out: 10
              process_args: string
            registry_rename_events:
            - time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              process_id: 10
              process_name: string
              process_guid: 10
              process_username: string
              registry_key: string
              type: RegistryRenameEvent
              registry_old_key: string
          timestamp: '2016-01-01T01:01:01.000Z'
          confidence: High
          observed_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          sensor: endpoint
          data:
            columns:
            - name: string
              type: integer
              description: string
              required: true
              short_description: string
            rows:
            - - anything
            row_count: 10
        campaign_refs:
        - string
        vulnerability_refs:
        - string
        asset_properties_refs:
        - string
        relationships:
        - description: string
          schema_version: 1.3.30
          revision: 10
          target_ref: string
          type: relationship
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          source_ref: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
          relationship_type: attributed-to
        timestamp: '2016-01-01T01:01:01.000Z'
        verdict_refs:
        - string
        malware_refs:
        - string
        incident_refs:
        - string
        vulnerabilities:
        - description: string
          schema_version: 1.3.30
          revision: 10
          published_date: '2016-01-01T01:01:01.000Z'
          cve:
            cve_data_meta:
              id: string
              assigner: string
          configurations:
            CVE_data_version: string
            nodes:
            - operator: AND
              cpe_match:
              - vulnerable: true
                cpe23Uri: string
                versionStartIncluding: string
                versionEndIncluding: string
                versionStartExcluding: string
                versionEndExcluding: string
              children:
              - operator: AND
                cpe_match:
                - vulnerable: true
                  cpe23Uri: string
                  versionStartIncluding: string
                  versionEndIncluding: string
                  versionStartExcluding: string
                  versionEndExcluding: string
                negate: true
              negate: true
          type: vulnerability
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
          last_modified_date: '2016-01-01T01:01:01.000Z'
          impact:
            cvss_v2:
              integrity_impact: complete
              target_distribution: not_defined
              availability_requirement: not_defined
              exploitability: not_defined
              access_complexity: low
              temporal_vector_string: string
              exploitability_score: 10.0
              impact_score: 10.0
              user_interaction_required: true
              environmental_vector_string: string
              obtain_other_privilege: true
              availability_impact: complete
              access_vector: network
              base_severity: High
              confidentiality_impact: complete
              confidentiality_requirement: not_defined
              report_confidence: not_defined
              authentication: none
              base_score: 10.0
              obtain_user_privilege: true
              obtain_all_privilege: true
              collateral_damage_potential: not_defined
              remediation_level: not_defined
              vector_string: string
              integrity_requirement: not_defined
            cvss_v3:
              integrity_impact: high
              modified_user_interaction: none
              modified_scope: not_defined
              availability_requirement: high
              user_interaction: none
              modified_integrity_impact: not_defined
              privileges_required: high
              exploitability_score: 10.0
              impact_score: 10.0
              environmental_severity: critical
              modified_availability_impact: not_defined
              availability_impact: high
              scope: changed
              exploit_code_maturity: functional
              modified_attack_complexity: not_defined
              base_severity: critical
              confidentiality_impact: high
              temporal_severity: critical
              modified_confidentiality_impact: not_defined
              confidentiality_requirement: high
              report_confidence: confirmed
              temporal_score: 10.0
              modified_privileges_required: not_defined
              modified_attack_vector: not_defined
              base_score: 10.0
              environmental_score: 10.0
              remediation_level: high
              vector_string: string
              integrity_requirement: high
              attack_vector: adjacent_network
              attack_complexity: high
        coas:
        - description: string
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          stage: Containment
          schema_version: 1.3.30
          revision: 10
          efficacy: High
          type: coa
          related_COAs:
          - confidence: High
            source: string
            relationship: string
            COA_id: string
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          coa_type: Diplomatic Actions
          language: string
          id: string
          tlp: green
          objective:
          - string
          cost: High
          timestamp: '2016-01-01T01:01:01.000Z'
          open_c2_coa:
            type: structured_coa
            id: string
            action:
              type: alert
            target:
              type: acudid
              specifiers: string
            actuator:
              type: endpoint
              specifiers:
              - string
            modifiers:
              response: acknowledge
              method:
              - acl
              additional_properties:
                context: string
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              frequency: string
              duration: '2016-01-01T01:01:01.000Z'
              source: string
              search: cve
              option: string
              id: string
              location: internal
              delay: '2016-01-01T01:01:01.000Z'
              destination: copy-to
          structured_coa_type: openc2
          impact: string
      description: Describes a Bundle of any set of CTIM entities.
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        authorized_groups:
          type: array
          items:
            type: string
        valid_time:
          $ref: '#/components/schemas/NewBundleExportValidTime'
        asset_mapping_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        note_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        data_table_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        attack_pattern_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        sighting_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        assets:
          example:
          - description: string
            asset_type: application
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            type: asset
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `NewAsset`s.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportAssets'
          uniqueItems: true
        weakness_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        tool_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        target_record_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        asset_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        tools:
          example:
          - description: string
            labels:
            - credential-exploitation
            schema_version: 1.3.30
            revision: 10
            type: tool
            x_mitre_aliases:
            - string
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tool_version: string
            tlp: green
            kill_chain_phases:
            - kill_chain_name: string
              phase_name: string
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `NewTool`s.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportTools'
          uniqueItems: true
        indicators:
          example:
          - description: string
            tags:
            - string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            producer: string
            schema_version: 1.3.30
            revision: 10
            type: indicator
            test_mechanisms:
            - string
            source: string
            external_ids:
            - string
            short_description: string
            composite_indicator_expression:
              operator: and
              indicator_ids:
              - string
            title: string
            likely_impact: string
            indicator_type:
            - Anonymization
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            severity: Critical
            tlp: green
            kill_chain_phases:
            - kill_chain_name: string
              phase_name: string
            negate: true
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            specification:
              type: Judgement
              judgements:
              - string
              required_judgements:
              - confidence: High
                source: string
                relationship: string
                judgement_id: string
          description: a list of `NewIndicator`s.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportIndicators'
          uniqueItems: true
        authorized_users:
          type: array
          items:
            type: string
        attack_patterns:
          example:
          - description: string
            abstraction_level: aggregate
            schema_version: 1.3.30
            revision: 10
            type: attack-pattern
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            x_mitre_platforms:
            - string
            language: string
            id: string
            tlp: green
            x_mitre_data_sources:
            - string
            kill_chain_phases:
            - kill_chain_name: string
              phase_name: string
            x_mitre_contributors:
            - string
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `NewAttackPattern`s.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportAttackPatterns'
          uniqueItems: true
        type:
          example: bundle
          type: string
          enum:
          - bundle
        created:
          type: string
          format: date-time
        weaknesses:
          example:
          - description: string
            background_details: string
            paradigms:
            - prevalence: Often
              name: string
            abstraction_level: Base
            architectures:
            - prevalence: Often
              name: string
              class: Embedded
            schema_version: 1.3.30
            revision: 10
            alternate_terms:
            - term: string
              description: string
            likelihood: High
            type: weakness
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            functional_areas:
            - Authentication
            source_uri: string
            modes_of_introduction:
            - phase: Architecture and Design
              note: string
            structure: Chain
            language: string
            id: string
            notes:
            - type: Applicable Platform
              note: string
            common_consequences:
            - scopes:
              - Access Control
              impacts:
              - Alter Execution Logic
              likelihood: High
              note: string
            tlp: green
            detection_methods:
            - method: Architecture or Design Review
              description: string
              effectiveness: High
              effectiveness_notes: string
            operating_systems:
            - prevalence: Often
              name: string
              version: string
              cpe_id: string
              class: Android
            affected_resources:
            - CPU
            languages:
            - prevalence: Often
              name: string
              class: Assembly
            timestamp: '2016-01-01T01:01:01.000Z'
            potential_mitigations:
            - description: string
              phases:
              - Architecture and Design
              strategy: Attack Surface Reduction
              effectiveness: Defense in Depth
              effectiveness_notes: string
            technologies:
            - prevalence: Often
              name: string
          description: a list of `NewWeakness`s.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportWeaknesses'
          uniqueItems: true
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        feedback_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        modified:
          type: string
          format: date-time
        asset_properties:
          example:
          - properties:
            - name: string
              value: string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            asset_ref: string
            type: asset-properties
            source: string
            external_ids:
            - string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `NewAssetProperties`s.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportAssetProperties'
          uniqueItems: true
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        feedbacks:
          example:
          - feedback: -1
            schema_version: 1.3.30
            revision: 10
            type: feedback
            source: string
            external_ids:
            - string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            reason: string
            source_uri: string
            language: string
            id: string
            tlp: green
            entity_id: string
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `NewFeedback`s.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportFeedbacks'
          uniqueItems: true
        judgement_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        coa_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportExternalReferences'
        verdicts:
          example:
          - type: verdict
            disposition: 1
            observable:
              value: 1.2.3.4
              type: ip
            judgement_id: string
            disposition_name: Clean
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
          description: a list of `Verdict`s.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportVerdicts'
          uniqueItems: true
        campaigns:
          example:
          - description: string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            type: campaign
            campaign_type: string
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            activity:
            - date_time: '2016-01-01T01:01:01.000Z'
              description: string
            source_uri: string
            intended_effect:
            - Account Takeover
            status: Future
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            names:
            - string
          description: a list of `NewCampaign`s.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportCampaigns'
          uniqueItems: true
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        actors:
          example:
          - description: string
            motivation: Ego
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            identity:
              description: string
              related_identities:
              - identity: string
                confidence: High
                information_source: string
                relationship: string
            sophistication: Aspirant
            schema_version: 1.3.30
            revision: 10
            planning_and_operational_support: string
            type: actor
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            intended_effect: Account Takeover
            language: string
            id: string
            tlp: green
            aliases:
            - string
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            actor_types:
            - Cyber Espionage Operations
          description: a list of `NewActor`s.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportActors'
          uniqueItems: true
        indicator_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        actor_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        data_tables:
          example:
          - description: string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            columns:
            - name: string
              type: integer
              description: string
              required: true
              short_description: string
            type: data-table
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            rows:
            - - anything
            source_uri: string
            language: string
            id: string
            tlp: green
            row_count: 10
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `NewDataTable`s.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportDataTables'
          uniqueItems: true
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        notes:
          example:
          - schema_version: 1.3.30
            revision: 10
            content: string
            note_class: keyword
            type: note
            source: string
            external_ids:
            - string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            author: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            related_entities:
            - entity_type: string
              entity_id: string
          description: a list of `NewNote`s.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportNotes'
          uniqueItems: true
        identity_assertions:
          example:
          - valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            identity:
              observables:
              - value: 1.2.3.4
                type: ip
            schema_version: 1.3.30
            revision: 10
            type: identity-assertion
            source: string
            external_ids:
            - string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            assertions:
            - name: cisco:ctr:ad:host_domain_name
              value: string
          description: a list of `NewIdentityAssertion`s.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportIdentityAssertions'
          uniqueItems: true
        judgements:
          example:
          - valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            observable:
              value: 1.2.3.4
              type: ip
            reason_uri: string
            type: judgement
            source: string
            external_ids:
            - string
            disposition: 1
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            reason: string
            source_uri: string
            disposition_name: Clean
            priority: 10
            language: string
            id: string
            severity: Critical
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
          description: a list of `NewJudgement`s.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportJudgements'
          uniqueItems: true
        malwares:
          example:
          - description: string
            labels:
            - adware
            abstraction_level: family
            schema_version: 1.3.30
            revision: 10
            type: malware
            x_mitre_aliases:
            - string
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            kill_chain_phases:
            - kill_chain_name: string
              phase_name: string
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `NewMalware`s.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportMalwares'
          uniqueItems: true
        target_records:
          example:
          - description: string
            schema_version: 1.3.30
            revision: 10
            type: target-record
            source: string
            external_ids:
            - string
            targets:
            - type: endpoint
              observables:
              - value: 1.2.3.4
                type: ip
              observed_time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              os: string
              internal: false
              sensor: string
              source_uri: string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `NewTargetRecord`s.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportTargetRecords'
          uniqueItems: true
        asset_mappings:
          example:
          - asset_type: application
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            stability: Managed
            schema_version: 1.3.30
            revision: 10
            observable:
              value: 1.2.3.4
              type: ip
            asset_ref: string
            type: asset-mapping
            source: string
            external_ids:
            - string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            specificity: Low
            confidence: High
          description: a list of `NewAssetMapping`s.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportAssetMappings'
          uniqueItems: true
        relationship_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        incidents:
          example:
          - description: string
            assignees:
            - string
            detection_sources:
            - string
            meta:
              keyword: string
            schema_version: 1.3.30
            revision: 10
            type: incident
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            incident_time:
              opened: '2016-01-01T01:01:01.000Z'
              discovered: '2016-01-01T01:01:01.000Z'
              reported: '2016-01-01T01:01:01.000Z'
              remediated: '2016-01-01T01:01:01.000Z'
              closed: '2016-01-01T01:01:01.000Z'
              rejected: '2016-01-01T01:01:01.000Z'
              contained: '2016-01-01T01:01:01.000Z'
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            discovery_method: Agent Disclosure
            source_uri: string
            intended_effect: Account Takeover
            categories:
            - Attrition
            status: Closed
            language: string
            detection_status: active
            id: string
            promotion_method: Automated
            severity: Critical
            tlp: green
            scores:
              asset: 10.0
            techniques:
            - string
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            short_id: string
            tactics:
            - string
          description: a list of `NewIncident`s.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportIncidents'
          uniqueItems: true
        client_id:
          type: string
        identity_assertion_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        sightings:
          example:
          - description: string
            schema_version: 1.3.30
            revision: 10
            relations:
            - origin: string
              origin_uri: string
              relation: Allocated
              relation_info:
                keyword: anything
              source:
                value: 1.2.3.4
                type: ip
              related:
                value: 1.2.3.4
                type: ip
            sensor_coordinates:
              type: endpoint
              observables:
              - value: 1.2.3.4
                type: ip
              os: string
            observables:
            - value: 1.2.3.4
              type: ip
            type: sighting
            source: string
            external_ids:
            - string
            targets:
            - type: endpoint
              observables:
              - value: 1.2.3.4
                type: ip
              observed_time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              os: string
            short_description: string
            title: string
            resolution: detected
            internal: false
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            detection_interval:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            source_uri: string
            activity_interval:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            language: string
            id: string
            count: 10
            severity: Critical
            tlp: green
            modification_interval:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            context:
              http_events:
              - process_guid: 10
                traffic:
                  destination_host_name: string
                  protocol: 10
                  source_ip: string
                  destination_subnet: string
                  destination_ip: string
                  source_subnet: string
                  destination_port: 10
                  direction: incoming
                  source_port: 10
                method: CONNECT
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: HTTPEvent
                host: string
                process_name: string
                process_id: 10
                process_username: string
                query: string
                encrypted: true
                url_port: 10
              process_create_events:
              - parent_process_name: string
                process_guid: 10
                parent_process_guid: 10
                process_disposition: string
                parent_process_size: 10
                process_size: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                parent_process_disposition: string
                type: ProcessCreateEvent
                parent_process_username: string
                parent_process_id: 10
                parent_process_args: string
                process_name: string
                process_hash: string
                process_id: 10
                parent_process_hash: string
                process_username: string
                parent_creation_time: '2016-01-01T01:01:01.000Z'
                process_args: string
              registry_delete_events:
              - time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                process_id: 10
                process_name: string
                process_guid: 10
                process_username: string
                registry_key: string
                type: RegistryDeleteEvent
                registry_value: string
              file_modify_events:
              - file_name: string
                process_guid: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: FileModifyEvent
                file_path: string
                process_name: string
                process_id: 10
                process_username: string
                failed: false
              registry_set_events:
              - process_guid: 10
                registry_data: string
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: RegistrySetEvent
                registry_data_length: 10
                registry_value: string
                registry_key: string
                process_name: string
                process_id: 10
                process_username: string
              file_create_events:
              - file_name: string
                process_guid: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: FileCreateEvent
                file_path: string
                process_name: string
                process_id: 10
                process_username: string
                failed: false
              registry_create_events:
              - time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                process_id: 10
                process_name: string
                process_guid: 10
                process_username: string
                registry_key: string
                type: RegistryCreateEvent
              library_load_events:
              - time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                process_id: 10
                process_name: string
                process_guid: 10
                process_username: string
                type: LibraryLoadEvent
                dll_library_name: string
                dll_library_path: string
              file_move_events:
              - file_name: string
                process_guid: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: FileMoveEvent
                old_name: string
                file_path: string
                process_name: string
                process_id: 10
                process_username: string
                new_name: string
              file_delete_events:
              - file_name: string
                process_guid: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: FileDeleteEvent
                file_path: string
                process_name: string
                process_id: 10
                process_username: string
                failed: false
              netflow_events:
              - parent_process_name: string
                byte_count_in: 10
                process_guid: 10
                process_path: string
                traffic:
                  destination_host_name: string
                  protocol: 10
                  source_ip: string
                  destination_subnet: string
                  destination_ip: string
                  source_subnet: string
                  destination_port: 10
                  direction: incoming
                  source_port: 10
                flow_time: '2016-01-01T01:01:01.000Z'
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                parent_process_account: string
                type: NetflowEvent
                process_account_type: string
                parent_process_path: string
                parent_process_id: 10
                parent_process_args: string
                process_name: string
                process_account: string
                parent_process_account_type: string
                process_hash: string
                process_id: 10
                parent_process_hash: string
                process_username: string
                byte_count_out: 10
                process_args: string
              registry_rename_events:
              - time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                process_id: 10
                process_name: string
                process_guid: 10
                process_username: string
                registry_key: string
                type: RegistryRenameEvent
                registry_old_key: string
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            observed_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            sensor: endpoint
            data:
              columns:
              - name: string
                type: integer
                description: string
                required: true
                short_description: string
              rows:
              - - anything
              row_count: 10
          description: a list of `NewSighting`s.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportSightings'
          uniqueItems: true
        campaign_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        vulnerability_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        groups:
          type: array
          items:
            type: string
        asset_properties_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        relationships:
          example:
          - description: string
            schema_version: 1.3.30
            revision: 10
            target_ref: string
            type: relationship
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            source_ref: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            relationship_type: attributed-to
          description: a list of `NewRelationship`s.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportRelationships'
          uniqueItems: true
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        verdict_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        malware_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        owner:
          type: string
        incident_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        vulnerabilities:
          example:
          - description: string
            schema_version: 1.3.30
            revision: 10
            published_date: '2016-01-01T01:01:01.000Z'
            cve:
              cve_data_meta:
                id: string
                assigner: string
            configurations:
              CVE_data_version: string
              nodes:
              - operator: AND
                cpe_match:
                - vulnerable: true
                  cpe23Uri: string
                  versionStartIncluding: string
                  versionEndIncluding: string
                  versionStartExcluding: string
                  versionEndExcluding: string
                children:
                - operator: AND
                  cpe_match:
                  - vulnerable: true
                    cpe23Uri: string
                    versionStartIncluding: string
                    versionEndIncluding: string
                    versionStartExcluding: string
                    versionEndExcluding: string
                  negate: true
                negate: true
            type: vulnerability
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            last_modified_date: '2016-01-01T01:01:01.000Z'
            impact:
              cvss_v2:
                integrity_impact: complete
                target_distribution: not_defined
                availability_requirement: not_defined
                exploitability: not_defined
                access_complexity: low
                temporal_vector_string: string
                exploitability_score: 10.0
                impact_score: 10.0
                user_interaction_required: true
                environmental_vector_string: string
                obtain_other_privilege: true
                availability_impact: complete
                access_vector: network
                base_severity: High
                confidentiality_impact: complete
                confidentiality_requirement: not_defined
                report_confidence: not_defined
                authentication: none
                base_score: 10.0
                obtain_user_privilege: true
                obtain_all_privilege: true
                collateral_damage_potential: not_defined
                remediation_level: not_defined
                vector_string: string
                integrity_requirement: not_defined
              cvss_v3:
                integrity_impact: high
                modified_user_interaction: none
                modified_scope: not_defined
                availability_requirement: high
                user_interaction: none
                modified_integrity_impact: not_defined
                privileges_required: high
                exploitability_score: 10.0
                impact_score: 10.0
                environmental_severity: critical
                modified_availability_impact: not_defined
                availability_impact: high
                scope: changed
                exploit_code_maturity: functional
                modified_attack_complexity: not_defined
                base_severity: critical
                confidentiality_impact: high
                temporal_severity: critical
                modified_confidentiality_impact: not_defined
                confidentiality_requirement: high
                report_confidence: confirmed
                temporal_score: 10.0
                modified_privileges_required: not_defined
                modified_attack_vector: not_defined
                base_score: 10.0
                environmental_score: 10.0
                remediation_level: high
                vector_string: string
                integrity_requirement: high
                attack_vector: adjacent_network
                attack_complexity: high
          description: a list of `NewVulnerability`s.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportVulnerabilities'
          uniqueItems: true
        coas:
          example:
          - description: string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            stage: Containment
            schema_version: 1.3.30
            revision: 10
            efficacy: High
            type: coa
            related_COAs:
            - confidence: High
              source: string
              relationship: string
              COA_id: string
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            coa_type: Diplomatic Actions
            language: string
            id: string
            tlp: green
            objective:
            - string
            cost: High
            timestamp: '2016-01-01T01:01:01.000Z'
            open_c2_coa:
              type: structured_coa
              id: string
              action:
                type: alert
              target:
                type: acudid
                specifiers: string
              actuator:
                type: endpoint
                specifiers:
                - string
              modifiers:
                response: acknowledge
                method:
                - acl
                additional_properties:
                  context: string
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                frequency: string
                duration: '2016-01-01T01:01:01.000Z'
                source: string
                search: cve
                option: string
                id: string
                location: internal
                delay: '2016-01-01T01:01:01.000Z'
                destination: copy-to
            structured_coa_type: openc2
            impact: string
          description: a list of `NewCOA`s.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportCoas'
          uniqueItems: true
      additionalProperties: {}
      required:
      - source
    NewBundleExportWeaknessesExternalReferences:
      example:
        source_name: string
        description: string
        url: string
        hashes:
        - string
        external_id: string
      description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
      type: object
      properties:
        source_name:
          example: string
          description: The source within which the external-reference is defined (system, registry, organization, etc.)
          type: string
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        url:
          example: string
          description: A URL reference to an external resource.
          type: string
        hashes:
          example:
          - string
          description: Specifies a dictionary of hashes for the contents of the url.
          type: array
          items:
            type: string
        external_id:
          example: string
          description: An identifier for the external reference content.
          type: string
      additionalProperties: {}
      required:
      - source_name
    NewBundleExportSightingsTargetsObservables:
      example:
        value: 1.2.3.4
        type: ip
      description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature.  This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains.  These do not exist as objects within the CTIA storage model, so you never create an observable.
      type: object
      properties:
        value:
          example: 1.2.3.4
          description: The value of the observable.
          type: string
        type:
          example: ip
          description: The type of observable.
          type: string
          enum:
          - file_path
          - mac_address
          - trend_micro_id
          - cybereason_id
          - process_args
          - s1_agent_id
          - device
          - hostname
          - certificate_common_name
          - serial_number
          - meraki_network_id
          - url
          - jamf_management_id
          - certificate_serial
          - intune_id
          - meraki_org_id
          - cisco_cm_id
          - registry_key
          - process_path
          - darktrace_id
          - process_username
          - cortex_agent_id
          - orbital_node_id
          - process_uid
          - ngfw_name
          - user
          - certificate_issuer
          - ipv6
          - email
          - cisco_uc_id
          - cvm_id
          - sha256
          - crowdstrike_id
          - google_cloud_id
          - google_chromebook_id
          - acudid
          - sha1
          - registry_name
          - md5
          - service_now_id
          - ip
          - domain
          - email_subject
          - imei
          - ngfw_id
          - amp_computer_guid
          - ms_machine_id
          - secure_access_id
          - mutex
          - processor_id
          - swc_device_id
          - registry_path
          - odns_identity
          - odns_identity_label
          - cisco_mid
          - process_name
          - pki_serial
          - meraki_node_sn
          - email_messageid
          - imsi
          - user_agent
          - process_hash
          - file_name
      additionalProperties: {}
      required:
      - value
      - type
    NewMalware:
      description: a new Malware
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        labels:
          example:
          - adware
          description: The type of malware being described.
          type: array
          items:
            type: string
        authorized_groups:
          type: array
          items:
            type: string
        abstraction_level:
          example: family
          description: Malware abstraction level.
          type: string
          enum:
          - family
          - version
          - variant
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        authorized_users:
          type: array
          items:
            type: string
        type:
          example: malware
          type: string
          enum:
          - malware
        created:
          type: string
          format: date-time
        x_mitre_aliases:
          example:
          - string
          description: ATT&CK Software.aliases.
          type: array
          items:
            type: string
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        kill_chain_phases:
          example:
          - kill_chain_name: string
            phase_name: string
          description: The list of Kill Chain Phases for which this Malware can be used.
          type: array
          items:
            $ref: '#/components/schemas/KillChainPhase'
        client_id:
          type: string
        groups:
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        owner:
          type: string
      additionalProperties: false
      required:
      - description
      - labels
      - short_description
      - title
    Target:
      example:
        type: endpoint
        observables:
        - value: 1.2.3.4
          type: ip
        observed_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        os: string
        internal: false
        sensor: string
        source_uri: string
      description: Schema for TargetRecord Targets
      type: object
      properties:
        type:
          example: endpoint
          description: The sensor/actuator name that best fits a device.
          type: string
        observables:
          example:
          - value: 1.2.3.4
            type: ip
          type: array
          items:
            $ref: '#/components/schemas/Observable'
        observed_time:
          $ref: '#/components/schemas/ObservedTime'
        os:
          example: string
          type: string
        internal:
          example: false
          description: Is it internal to our network?
          type: boolean
        sensor:
          example: string
          description: 'The OpenC2 Actuator name that best fits the device that is creating this TargetRecord (e.g.: network.firewall, etc.)'
          type: string
        source_uri:
          example: string
          description: A URI
          type: string
      additionalProperties: false
      required:
      - type
      - observables
      - observed_time
    NewBundleExportIndicatorsExternalReferences:
      example:
        source_name: string
        description: string
        url: string
        hashes:
        - string
        external_id: string
      description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
      type: object
      properties:
        source_name:
          example: string
          description: The source within which the external-reference is defined (system, registry, organization, etc.)
          type: string
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        url:
          example: string
          description: A URL reference to an external resource.
          type: string
        hashes:
          example:
          - string
          description: Specifies a dictionary of hashes for the contents of the url.
          type: array
          items:
            type: string
        external_id:
          example: string
          description: An identifier for the external reference content.
          type: string
      additionalProperties: {}
      required:
      - source_name
    NewBundleExportIncidentsExternalReferences:
      example:
        source_name: string
        description: string
        url: string
        hashes:
        - string
        external_id: string
      description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
      type: object
      properties:
        source_name:
          example: string
          description: The source within which the external-reference is defined (system, registry, organization, etc.)
          type: string
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        url:
          example: string
          description: A URL reference to an external resource.
          type: string
        hashes:
          example:
          - string
          description: Specifies a dictionary of hashes for the contents of the url.
          type: array
          items:
            type: string
        external_id:
          example: string
          description: An identifier for the external reference content.
          type: string
      additionalProperties: {}
      required:
      - source_name
    NewBundleExportSightingsContextLibraryLoadEventsTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If the observation was made over a period of time, than this field indicates the end of that period.
          type: string
          format: date-time
      additionalProperties: {}
      required:
      - start_time
    NewBundleExportSightingsContextRegistrySetEvents:
      example:
        process_guid: 10
        registry_data: string
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        type: RegistrySetEvent
        registry_data_length: 10
        registry_value: string
        registry_key: string
        process_name: string
        process_id: 10
        process_username: string
      type: object
      properties:
        process_guid:
          example: 10
          type: integer
          format: int64
        registry_data:
          example: string
          description: String with at most 5000 characters.
          type: string
        time:
          $ref: '#/components/schemas/NewBundleExportSightingsContextRegistrySetEventsTime'
        type:
          example: RegistrySetEvent
          type: string
          enum:
          - RegistrySetEvent
        registry_data_length:
          example: 10
          type: integer
          format: int64
        registry_value:
          example: string
          description: String with at most 2048 characters.
          type: string
        registry_key:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
      additionalProperties: {}
      required:
      - time
      - type
      - registry_value
      - registry_key
      - process_name
      - process_id
    NetflowType:
      example:
        parent_process_name: string
        byte_count_in: 10
        process_guid: 10
        process_path: string
        traffic:
          destination_host_name: string
          protocol: 10
          source_ip: string
          destination_subnet: string
          destination_ip: string
          source_subnet: string
          destination_port: 10
          direction: incoming
          source_port: 10
        flow_time: '2016-01-01T01:01:01.000Z'
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        parent_process_account: string
        type: NetflowEvent
        process_account_type: string
        parent_process_path: string
        parent_process_id: 10
        parent_process_args: string
        process_name: string
        process_account: string
        parent_process_account_type: string
        process_hash: string
        process_id: 10
        parent_process_hash: string
        process_username: string
        byte_count_out: 10
        process_args: string
      type: object
      properties:
        parent_process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        byte_count_in:
          example: 10
          type: integer
          format: int64
        process_guid:
          example: 10
          type: integer
          format: int64
        process_path:
          example: string
          description: String with at most 1024 characters.
          type: string
        traffic:
          $ref: '#/components/schemas/Traffic'
        flow_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Schema definition for all date or timestamp values.  Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
          type: string
          format: date-time
        time:
          $ref: '#/components/schemas/ObservedTime'
        parent_process_account:
          example: string
          description: String with at most 1024 characters.
          type: string
        type:
          example: NetflowEvent
          type: string
          enum:
          - NetflowEvent
        process_account_type:
          example: string
          description: String with at most 1024 characters.
          type: string
        parent_process_path:
          example: string
          description: String with at most 1024 characters.
          type: string
        parent_process_id:
          example: 10
          type: integer
          format: int64
        parent_process_args:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_account:
          example: string
          description: String with at most 1024 characters.
          type: string
        parent_process_account_type:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_hash:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        parent_process_hash:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        byte_count_out:
          example: 10
          type: integer
          format: int64
        process_args:
          example: string
          description: String with at most 1024 characters.
          type: string
      additionalProperties: false
      required:
      - traffic
      - time
      - type
      - process_name
      - process_id
    NewBundleExportCoasValidTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid.
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If not present, the valid time position of the indicator does not have an upper bound.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If end_time is not present, then the valid time position of the object does not have an upper bound.
          type: string
          format: date-time
      additionalProperties: {}
    ObservedTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If the observation was made over a period of time, than this field indicates the end of that period.
          type: string
          format: date-time
      additionalProperties: false
      required:
      - start_time
    NewBundleExportWeaknessesPotentialMitigations:
      example:
        description: string
        phases:
        - Architecture and Design
        strategy: Attack Surface Reduction
        effectiveness: Defense in Depth
        effectiveness_notes: string
      type: object
      properties:
        description:
          example: string
          description: A description of this individual mitigation including any strengths and shortcomings of this mitigation for the weakness.
          type: string
        phases:
          example:
          - Architecture and Design
          description: Indicates the development life cycle phase during which this particular mitigation may be applied.
          type: array
          items:
            type: string
        strategy:
          example: Attack Surface Reduction
          description: A general strategy for protecting a system to which this mitigation contributes.
          type: string
        effectiveness:
          example: Defense in Depth
          description: Summarizes how effective the mitigation may be in preventing the weakness.
          type: string
        effectiveness_notes:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
      additionalProperties: {}
      required:
      - description
    ActionType:
      example:
        type: alert
      type: object
      properties:
        type:
          example: alert
          type: string
          enum:
          - stop
          - save
          - delete
          - remediate
          - redirect
          - alert
          - query
          - augment
          - snapshot
          - update
          - allow
          - scan
          - investigate
          - modify
          - sync
          - start
          - pause
          - deny
          - substitute
          - distill
          - move
          - restart
          - other
          - detonate
          - response
          - set
          - notify
          - report
          - restore
          - get
          - throttle
          - mitigate
          - resume
          - locate
          - contain
      additionalProperties: false
      required:
      - type
    NewBundleExportSightingsTargets:
      example:
        type: endpoint
        observables:
        - value: 1.2.3.4
          type: ip
        observed_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        os: string
      description: Describes the target of the sighting and contains identifying observables for the target.
      type: object
      properties:
        type:
          example: endpoint
          description: The sensor/actuator name that best fits a device.
          type: string
        observables:
          example:
          - value: 1.2.3.4
            type: ip
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportSightingsTargetsObservables'
        observed_time:
          $ref: '#/components/schemas/NewBundleExportSightingsTargetsObservedTime'
        os:
          example: string
          type: string
      additionalProperties: {}
      required:
      - type
      - observables
      - observed_time
    NewBundleExportIndicatorsValidTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid.
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If not present, the valid time position of the indicator does not have an upper bound.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If end_time is not present, then the valid time position of the object does not have an upper bound.
          type: string
          format: date-time
      additionalProperties: {}
    NewBundleExportMalwaresExternalReferences:
      example:
        source_name: string
        description: string
        url: string
        hashes:
        - string
        external_id: string
      description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
      type: object
      properties:
        source_name:
          example: string
          description: The source within which the external-reference is defined (system, registry, organization, etc.)
          type: string
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        url:
          example: string
          description: A URL reference to an external resource.
          type: string
        hashes:
          example:
          - string
          description: Specifies a dictionary of hashes for the contents of the url.
          type: array
          items:
            type: string
        external_id:
          example: string
          description: An identifier for the external reference content.
          type: string
      additionalProperties: {}
      required:
      - source_name
    CVSSv2:
      example:
        integrity_impact: complete
        target_distribution: not_defined
        availability_requirement: not_defined
        exploitability: not_defined
        access_complexity: low
        temporal_vector_string: string
        exploitability_score: 10.0
        impact_score: 10.0
        user_interaction_required: true
        environmental_vector_string: string
        obtain_other_privilege: true
        availability_impact: complete
        access_vector: network
        base_severity: High
        confidentiality_impact: complete
        confidentiality_requirement: not_defined
        report_confidence: not_defined
        authentication: none
        base_score: 10.0
        obtain_user_privilege: true
        obtain_all_privilege: true
        collateral_damage_potential: not_defined
        remediation_level: not_defined
        vector_string: string
        integrity_requirement: not_defined
      type: object
      properties:
        integrity_impact:
          example: complete
          description: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and guaranteed veracity of information. Increased integrity impact increases the vulnerability score.
          type: string
          enum:
          - partial
          - none
          - complete
        target_distribution:
          example: not_defined
          description: This metric measures the proportion of vulnerable systems. It is meant as an environment-specific indicator in order to approximate the percentage of systems that could be affected by the vulnerability. The greater the proportion of vulnerable systems, the higher the score.
          type: string
          enum:
          - low
          - none
          - high
          - medium
          - not_defined
        availability_requirement:
          example: not_defined
          description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
          type: string
          enum:
          - low
          - high
          - medium
          - not_defined
        exploitability:
          example: not_defined
          description: This metric measures the current state of exploit techniques or code availability. Public availability of easy-to-use exploit code increases the number of potential attackers by including those who are unskilled thereby increasing the severity of the vulnerability.
          type: string
          enum:
          - high
          - unproven
          - functional
          - proof_of_concept
          - not_defined
        access_complexity:
          example: low
          description: 'This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system. For example, consider a buffer overflow in an Internet service: once the target system is located, the attacker can launch an exploit at will.'
          type: string
          enum:
          - low
          - high
          - medium
        temporal_vector_string:
          example: string
          description: A text representation of a set of CVSSv2 temporal metrics. Temporal metrics allow analysists to calculate threat severity based on temporal factors such as reliability of vulnerability reports, availability of mitigations, and the ease or difficulty of conducting the exploit. It is commonly used to record or transfer CVSSv2 metric information in a concise form
          type: string
        exploitability_score:
          example: 10.0
          description: a Score number from 0 to 10
          type: number
          format: double
        impact_score:
          example: 10.0
          description: a Score number from 0 to 10
          type: number
          format: double
        user_interaction_required:
          example: true
          type: boolean
        environmental_vector_string:
          example: string
          description: A text representation of a set of CVSSv2 environmental metrics. Environmental metrics allow analysists to calculate threat scores in relation to environmental security requirements, collateral damage potential, and target availability. It is commonly used to record or transfer CVSSv2 metric information in a concise form
          type: string
        obtain_other_privilege:
          example: true
          type: boolean
        availability_impact:
          example: complete
          description: This metric measures the impact to availability of a successfully exploited vulnerability. Availability refers to the accessibility of information resources. Attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system. Increased availability impact increases the vulnerability score.
          type: string
          enum:
          - partial
          - none
          - complete
        access_vector:
          example: network
          description: This metric reflects how the vulnerability is exploited.The more remote an attacker can be to attack a host, the greater the vulnerability score.
          type: string
          enum:
          - network
          - adjacent network
          - local
        base_severity:
          example: High
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        confidentiality_impact:
          example: complete
          description: This metric measures the impact on confidentiality of a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. Increasedconfidentiality impact increases the vulnerability score.
          type: string
          enum:
          - partial
          - none
          - complete
        confidentiality_requirement:
          example: not_defined
          description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
          type: string
          enum:
          - low
          - high
          - medium
          - not_defined
        report_confidence:
          example: not_defined
          description: This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details. Sometimes, only the existence of vulnerabilities are publicized, but without specific details. The vulnerability may later be corroborated and then confirmed through acknowledgement by the author or vendor of the affected technology. The urgency of a vulnerability is higher when a vulnerability is known to exist with certainty. This metric also suggests the level of technical knowledge available to would-be attackers. The more a vulnerability is validated by the vendor or other reputable sources, the higher the score.
          type: string
          enum:
          - uncorroborated
          - unconfirmed
          - confirmed
          - not_defined
        authentication:
          example: none
          description: This metric measures the number of times an attacker must authenticate to a target in order to exploit a vulnerability. This metric does not gauge the strength or complexity of the authentication process, only that an attacker is required to provide credentials before an exploit may occur. The fewer authentication instances that are required, the higher the vulnerability score.
          type: string
          enum:
          - none
          - single
          - multiple
        base_score:
          example: 10.0
          description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v2/guide'
          type: number
          format: double
        obtain_user_privilege:
          example: true
          type: boolean
        obtain_all_privilege:
          example: true
          type: boolean
        collateral_damage_potential:
          example: not_defined
          description: This metric measures the potential for loss of life or physical assets through damage or theft of property or equipment.  The metric may also measure economic loss of productivity or revenue. Naturally, the greater the damage potential, the higher the vulnerability score.
          type: string
          enum:
          - low
          - none
          - high
          - medium_high
          - low_medium
          - not_defined
        remediation_level:
          example: not_defined
          description: The remediation level of a vulnerability is an important factor for prioritization. The typical vulnerability is unpatched when initially published. Workarounds or hotfixes may offer interim remediation until an official patch or upgrade is issued. Each of these respective stages adjusts the temporal score downwards, reflecting the decreasing urgency as remediation becomes final. The less official and permanent a fix, the higher the vulnerability score is.
          type: string
          enum:
          - temporary_fix
          - workaround
          - official_fix
          - unavailable
          - not_defined
        vector_string:
          example: string
          description: a text representation of a set of CVSSv2 metrics. It is commonly used to record or transfer CVSSv2 metric information in a concise form
          type: string
        integrity_requirement:
          example: not_defined
          description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
          type: string
          enum:
          - low
          - high
          - medium
          - not_defined
      additionalProperties: false
      required:
      - base_severity
      - base_score
      - vector_string
    NewBundleExportSightingsRelationsRelationInfo:
      example:
        keyword: anything
      type: object
      additionalProperties:
        example: anything
    RegistryDeleteType:
      example:
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        process_id: 10
        process_name: string
        process_guid: 10
        process_username: string
        registry_key: string
        type: RegistryDeleteEvent
        registry_value: string
      type: object
      properties:
        time:
          $ref: '#/components/schemas/ObservedTime'
        process_id:
          example: 10
          type: integer
          format: int64
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        registry_key:
          example: string
          description: String with at most 1024 characters.
          type: string
        type:
          example: RegistryDeleteEvent
          type: string
          enum:
          - RegistryDeleteEvent
        registry_value:
          example: string
          description: String with at most 2048 characters.
          type: string
      additionalProperties: false
      required:
      - time
      - process_id
      - process_name
      - registry_key
      - type
    MetaData:
      example:
        keyword: anything
      description: metadata associated to the incident.
      type: object
      additionalProperties:
        example: anything
        description: custom field relevant to attach meta data to.
    NewBundleExportAssetMappingsValidTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: For each asset, we allow for the assertion of time bound properties.This gives us both a record of the current state of the asset,as well as history.
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If not present, the valid time position of the indicator does not have an upper bound.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If end_time is not present, then the valid time position of the object does not have an upper bound.
          type: string
          format: date-time
      additionalProperties: {}
    NewTargetRecord:
      description: a new Target-record
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        authorized_groups:
          type: array
          items:
            type: string
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        authorized_users:
          type: array
          items:
            type: string
        type:
          example: target-record
          type: string
          enum:
          - target-record
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        targets:
          example:
          - type: endpoint
            observables:
            - value: 1.2.3.4
              type: ip
            observed_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            os: string
            internal: false
            sensor: string
            source_uri: string
          type: array
          items:
            $ref: '#/components/schemas/Target'
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        client_id:
          type: string
        groups:
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        owner:
          type: string
      additionalProperties: false
      required:
      - source
      - targets
    NewBundleExportIndicatorsSpecification:
      example:
        type: Judgement
        judgements:
        - string
        required_judgements:
        - confidence: High
          source: string
          relationship: string
          judgement_id: string
      description: An indicator based on a list of judgements.  If any of the Observables in it's judgements are encountered, than it may be matches against.  If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
      type: object
      properties:
        type:
          example: Judgement
          type: string
          enum:
          - Judgement
        judgements:
          example:
          - string
          type: array
          items:
            type: string
        required_judgements:
          example:
          - confidence: High
            source: string
            relationship: string
            judgement_id: string
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportIndicatorsSpecificationRequiredJudgements'
      additionalProperties: {}
      required:
      - type
      - judgements
      - required_judgements
    NewBundleExportJudgementsObservable:
      example:
        value: 1.2.3.4
        type: ip
      description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature.  This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains.  These do not exist as objects within the CTIA storage model, so you never create an observable.
      type: object
      properties:
        value:
          example: 1.2.3.4
          description: The value of the observable.
          type: string
        type:
          example: ip
          description: The type of observable.
          type: string
          enum:
          - file_path
          - mac_address
          - trend_micro_id
          - cybereason_id
          - process_args
          - s1_agent_id
          - device
          - hostname
          - certificate_common_name
          - serial_number
          - meraki_network_id
          - url
          - jamf_management_id
          - certificate_serial
          - intune_id
          - meraki_org_id
          - cisco_cm_id
          - registry_key
          - process_path
          - darktrace_id
          - process_username
          - cortex_agent_id
          - orbital_node_id
          - process_uid
          - ngfw_name
          - user
          - certificate_issuer
          - ipv6
          - email
          - cisco_uc_id
          - cvm_id
          - sha256
          - crowdstrike_id
          - google_cloud_id
          - google_chromebook_id
          - acudid
          - sha1
          - registry_name
          - md5
          - service_now_id
          - ip
          - domain
          - email_subject
          - imei
          - ngfw_id
          - amp_computer_guid
          - ms_machine_id
          - secure_access_id
          - mutex
          - processor_id
          - swc_device_id
          - registry_path
          - odns_identity
          - odns_identity_label
          - cisco_mid
          - process_name
          - pki_serial
          - meraki_node_sn
          - email_messageid
          - imsi
          - user_agent
          - process_hash
          - file_name
      additionalProperties: {}
      required:
      - value
      - type
    NewBundleExportSightingsRelations:
      example:
        origin: string
        origin_uri: string
        relation: Allocated
        relation_info:
          keyword: anything
        source:
          value: 1.2.3.4
          type: ip
        related:
          value: 1.2.3.4
          type: ip
      description: A relation inside a Sighting.
      type: object
      properties:
        origin:
          example: string
          type: string
        origin_uri:
          example: string
          description: A URI
          type: string
        relation:
          example: Allocated
          type: string
        relation_info:
          $ref: '#/components/schemas/NewBundleExportSightingsRelationsRelationInfo'
        source:
          $ref: '#/components/schemas/NewBundleExportSightingsRelationsSource'
        related:
          $ref: '#/components/schemas/NewBundleExportSightingsRelationsRelated'
      additionalProperties: {}
      required:
      - origin
      - relation
      - source
      - related
    NewBundleExportSightingsContextRegistryRenameEventsTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If the observation was made over a period of time, than this field indicates the end of that period.
          type: string
          format: date-time
      additionalProperties: {}
      required:
      - start_time
    NewBundleExportAssetMappings:
      example:
        asset_type: application
        valid_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        stability: Managed
        schema_version: 1.3.30
        revision: 10
        observable:
          value: 1.2.3.4
          type: ip
        asset_ref: string
        type: asset-mapping
        source: string
        external_ids:
        - string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        source_uri: string
        language: string
        id: string
        tlp: green
        timestamp: '2016-01-01T01:01:01.000Z'
        specificity: Low
        confidence: High
      description: Schema for submitting new AssetMapping.
      type: object
      properties:
        asset_type:
          example: application
          description: 'Type of the mapped Asset: Device, Person, Application, etc.'
          type: string
          enum:
          - device
          - network
          - application
          - person
          - data
        valid_time:
          $ref: '#/components/schemas/NewBundleExportAssetMappingsValidTime'
        stability:
          example: Managed
          description: Do we manage when it changes, or is it always a time bound assignment?
          type: string
          enum:
          - Physical
          - Managed
          - Temporary
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        observable:
          $ref: '#/components/schemas/NewBundleExportAssetMappingsObservable'
        asset_ref:
          example: string
          description: URI that points to the mapped Asset.
          type: string
        type:
          example: asset-mapping
          type: string
          enum:
          - asset-mapping
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportAssetMappingsExternalReferences'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        specificity:
          example: Low
          description: Denotes the level of how many assets potentially could have this same identifier.
          type: string
          enum:
          - Medium
          - Unique
          - Low
        confidence:
          example: High
          description: 'Level of confidence held in the characterization of this AssetMapping e.g.: is it susceptible to manipulation or translation?'
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
      additionalProperties: {}
      required:
      - asset_type
      - valid_time
      - stability
      - observable
      - asset_ref
      - source
      - specificity
      - confidence
    NewIncident:
      description: a new Incident
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        authorized_groups:
          type: array
          items:
            type: string
        assignees:
          example:
          - string
          description: A set of owners assigned to this incident.
          type: array
          items:
            type: string
        detection_sources:
          example:
          - string
          description: A set of sources that contributed threat detections to the incident.
          type: array
          items:
            type: string
        meta:
          $ref: '#/components/schemas/MetaData'
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        authorized_users:
          type: array
          items:
            type: string
        type:
          example: incident
          type: string
          enum:
          - incident
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        incident_time:
          $ref: '#/components/schemas/IncidentTime'
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        discovery_method:
          example: Agent Disclosure
          description: Identifies how the incident was discovered.
          type: string
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        intended_effect:
          example: Account Takeover
          description: Specifies the suspected intended effect of this incident
          type: string
        categories:
          example:
          - Attrition
          description: A set of categories for this incident.
          type: array
          items:
            type: string
        status:
          example: Closed
          description: The `status` field represents the current state of an incident within the incident management process. Its values help in tracking and reporting the progress of the incident from its discovery to its resolution.
          type: string
          enum:
          - New
          - Closed
          - 'Open: Recovered'
          - 'Closed: Other'
          - 'Hold: Internal'
          - 'Hold: Legal'
          - 'Closed: Under Review'
          - Rejected
          - Open
          - 'Closed: Merged'
          - Restoration Achieved
          - Incident Reported
          - 'Closed: Suspected'
          - Stalled
          - 'Open: Contained'
          - 'Closed: Near-Miss'
          - 'Hold: External'
          - Containment Achieved
          - 'New: Processing'
          - 'Closed: Confirmed Threat'
          - 'Closed: False Positive'
          - 'Open: Reported'
          - 'Open: Investigating'
          - Hold
          - 'New: Presented'
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        detection_status:
          example: active
          description: Represents the state of an incident within the incident generation process, indicating whether the incident is actively receiving updates or is no longer being updated.
          type: string
          enum:
          - inactive_oversized
          - inactive_user_closed
          - active
          - inactive_merged
          - inactive_expired
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        promotion_method:
          example: Automated
          description: Describes method for promoting an Incident, whether manually or automatically. An Incident may be created manually by a SOAR analyst or SOC operator, or through an automated correlation or aggregation rule or engine that matches a specific set of events or alerts, and promotes them to Incident(s).
          type: string
          enum:
          - Automated
          - Manual
        severity:
          example: Critical
          description: "Represents the potential impact of an incident on an organization's security posture and business operations. It helps organizations prioritize and allocate resources for incident response based on the severity level of the incident \nIt helps analysts and incident handlers prioritize incidents by indicating the level of risk and potential impact associated with the incident. This enables organizations to allocate resources efficiently and address the most critical incidents first.\nCan also be used to generate reports and metrics for measuring the effectiveness of the incident response process and to identify trends and patterns in the threat landscape.\nIt is important to note that the `severity` field is subjective and can be interpreted differently by different organizations or analysts. Therefore, it should be used in conjunction with other intelligence attributes, such as the `confidence` field, to provide a more comprehensive view of the incident."
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Critical
          - Low
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        scores:
          $ref: '#/components/schemas/NewIncidentScores'
        client_id:
          type: string
        techniques:
          example:
          - string
          description: Represents the specific methods or actions used by an attacker to carry out an offensive maneuver or achieve their goals.
          type: array
          items:
            type: string
        groups:
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        confidence:
          example: High
          description: 'Represents the level of certainty or trustworthiness associated with the incident. It denotes the reliability of the intelligence associated with the incident.

            The `confidence` field can take on several values, including:

            - `info`: Indicates that the incident information is based on sources with no previous track record or there is no track record for the source reporting the incident.

            - `low`: Indicates that the incident information is based on sources with a questionable track record or there is limited information about the accuracy of the source.

            - `medium`: Indicates that the incident information is based on sources with a mixed track record or of uncertain reliability.

            - `high`: Indicates that the incident information is based on sources with a proven track record and high degree of reliability.

            The `confidence` field can be used to indicate the level of trust and confidence that can be attributed to the incident, and it may impact how the incident is prioritized, analyzed and addressed. It can also help in the decision-making process associated with the incident response activities.

            It is important to note that the `confidence` field is subjective and can be interpreted differently by different organizations or analysts. As such, it is often used in conjunction with other intelligence attributes, such as the `severity` field, to provide a more complete picture of the incident.'
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        owner:
          type: string
        short_id:
          example: string
          description: A human-readable, short identifier for the incident, unique within an organization.
          type: string
        tactics:
          example:
          - string
          description: Represents the offensive techniques, approaches, or procedures that an adversary may use to achieve their objectives during an attack. It helps in understanding the intent and capabilities of the adversary and can be used to identify indicators of attack (IoAs) or indicators of compromise (IoCs) that are associated with the adversary's tactics.
          type: array
          items:
            type: string
      additionalProperties: false
      required:
      - incident_time
      - status
      - confidence
    NewBundleExportActorsExternalReferences:
      example:
        source_name: string
        description: string
        url: string
        hashes:
        - string
        external_id: string
      description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
      type: object
      properties:
        source_name:
          example: string
          description: The source within which the external-reference is defined (system, registry, organization, etc.)
          type: string
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        url:
          example: string
          description: A URL reference to an external resource.
          type: string
        hashes:
          example:
          - string
          description: Specifies a dictionary of hashes for the contents of the url.
          type: array
          items:
            type: string
        external_id:
          example: string
          description: An identifier for the external reference content.
          type: string
      additionalProperties: {}
      required:
      - source_name
    Context:
      example:
        http_events:
        - process_guid: 10
          traffic:
            destination_host_name: string
            protocol: 10
            source_ip: string
            destination_subnet: string
            destination_ip: string
            source_subnet: string
            destination_port: 10
            direction: incoming
            source_port: 10
          method: CONNECT
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: HTTPEvent
          host: string
          process_name: string
          process_id: 10
          process_username: string
          query: string
          encrypted: true
          url_port: 10
        process_create_events:
        - parent_process_name: string
          process_guid: 10
          parent_process_guid: 10
          process_disposition: string
          parent_process_size: 10
          process_size: 10
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          parent_process_disposition: string
          type: ProcessCreateEvent
          parent_process_username: string
          parent_process_id: 10
          parent_process_args: string
          process_name: string
          process_hash: string
          process_id: 10
          parent_process_hash: string
          process_username: string
          parent_creation_time: '2016-01-01T01:01:01.000Z'
          process_args: string
        registry_delete_events:
        - time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          process_id: 10
          process_name: string
          process_guid: 10
          process_username: string
          registry_key: string
          type: RegistryDeleteEvent
          registry_value: string
        file_modify_events:
        - file_name: string
          process_guid: 10
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: FileModifyEvent
          file_path: string
          process_name: string
          process_id: 10
          process_username: string
          failed: false
        registry_set_events:
        - process_guid: 10
          registry_data: string
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: RegistrySetEvent
          registry_data_length: 10
          registry_value: string
          registry_key: string
          process_name: string
          process_id: 10
          process_username: string
        file_create_events:
        - file_name: string
          process_guid: 10
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: FileCreateEvent
          file_path: string
          process_name: string
          process_id: 10
          process_username: string
          failed: false
        registry_create_events:
        - time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          process_id: 10
          process_name: string
          process_guid: 10
          process_username: string
          registry_key: string
          type: RegistryCreateEvent
        library_load_events:
        - time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          process_id: 10
          process_name: string
          process_guid: 10
          process_username: string
          type: LibraryLoadEvent
          dll_library_name: string
          dll_library_path: string
        file_move_events:
        - file_name: string
          process_guid: 10
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: FileMoveEvent
          old_name: string
          file_path: string
          process_name: string
          process_id: 10
          process_username: string
          new_name: string
        file_delete_events:
        - file_name: string
          process_guid: 10
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: FileDeleteEvent
          file_path: string
          process_name: string
          process_id: 10
          process_username: string
          failed: false
        netflow_events:
        - parent_process_name: string
          byte_count_in: 10
          process_guid: 10
          process_path: string
          traffic:
            destination_host_name: string
            protocol: 10
            source_ip: string
            destination_subnet: string
            destination_ip: string
            source_subnet: string
            destination_port: 10
            direction: incoming
            source_port: 10
          flow_time: '2016-01-01T01:01:01.000Z'
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          parent_process_account: string
          type: NetflowEvent
          process_account_type: string
          parent_process_path: string
          parent_process_id: 10
          parent_process_args: string
          process_name: string
          process_account: string
          parent_process_account_type: string
          process_hash: string
          process_id: 10
          parent_process_hash: string
          process_username: string
          byte_count_out: 10
          process_args: string
        registry_rename_events:
        - time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          process_id: 10
          process_name: string
          process_guid: 10
          process_username: string
          registry_key: string
          type: RegistryRenameEvent
          registry_old_key: string
      description: Context including the event type that best fits the type of the sighting.
      type: object
      properties:
        http_events:
          example:
          - process_guid: 10
            traffic:
              destination_host_name: string
              protocol: 10
              source_ip: string
              destination_subnet: string
              destination_ip: string
              source_subnet: string
              destination_port: 10
              direction: incoming
              source_port: 10
            method: CONNECT
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: HTTPEvent
            host: string
            process_name: string
            process_id: 10
            process_username: string
            query: string
            encrypted: true
            url_port: 10
          description: a list of `HTTPType`
          type: array
          items:
            $ref: '#/components/schemas/HTTPType'
        process_create_events:
          example:
          - parent_process_name: string
            process_guid: 10
            parent_process_guid: 10
            process_disposition: string
            parent_process_size: 10
            process_size: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            parent_process_disposition: string
            type: ProcessCreateEvent
            parent_process_username: string
            parent_process_id: 10
            parent_process_args: string
            process_name: string
            process_hash: string
            process_id: 10
            parent_process_hash: string
            process_username: string
            parent_creation_time: '2016-01-01T01:01:01.000Z'
            process_args: string
          description: a list of `ProcessCreate`
          type: array
          items:
            $ref: '#/components/schemas/ProcessCreateType'
        registry_delete_events:
          example:
          - time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            process_id: 10
            process_name: string
            process_guid: 10
            process_username: string
            registry_key: string
            type: RegistryDeleteEvent
            registry_value: string
          description: a list of `RegistryDeleteType`
          type: array
          items:
            $ref: '#/components/schemas/RegistryDeleteType'
        file_modify_events:
          example:
          - file_name: string
            process_guid: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: FileModifyEvent
            file_path: string
            process_name: string
            process_id: 10
            process_username: string
            failed: false
          description: a list of `FileModifyType`
          type: array
          items:
            $ref: '#/components/schemas/FileModifyType'
        registry_set_events:
          example:
          - process_guid: 10
            registry_data: string
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: RegistrySetEvent
            registry_data_length: 10
            registry_value: string
            registry_key: string
            process_name: string
            process_id: 10
            process_username: string
          description: a list of `RegistrySetType`
          type: array
          items:
            $ref: '#/components/schemas/RegistrySetType'
        file_create_events:
          example:
          - file_name: string
            process_guid: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: FileCreateEvent
            file_path: string
            process_name: string
            process_id: 10
            process_username: string
            failed: false
          description: a list of `FileCreateType`
          type: array
          items:
            $ref: '#/components/schemas/FileCreateType'
        registry_create_events:
          example:
          - time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            process_id: 10
            process_name: string
            process_guid: 10
            process_username: string
            registry_key: string
            type: RegistryCreateEvent
          description: a list of `RegistryCreateType`
          type: array
          items:
            $ref: '#/components/schemas/RegistryCreateType'
        library_load_events:
          example:
          - time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            process_id: 10
            process_name: string
            process_guid: 10
            process_username: string
            type: LibraryLoadEvent
            dll_library_name: string
            dll_library_path: string
          description: a list of `LibraryLoadType`
          type: array
          items:
            $ref: '#/components/schemas/LibraryLoadType'
        file_move_events:
          example:
          - file_name: string
            process_guid: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: FileMoveEvent
            old_name: string
            file_path: string
            process_name: string
            process_id: 10
            process_username: string
            new_name: string
          description: a list of `FileMoveType`
          type: array
          items:
            $ref: '#/components/schemas/FileMoveType'
        file_delete_events:
          example:
          - file_name: string
            process_guid: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: FileDeleteEvent
            file_path: string
            process_name: string
            process_id: 10
            process_username: string
            failed: false
          description: a list of `FileDeleteType`
          type: array
          items:
            $ref: '#/components/schemas/FileDeleteType'
        netflow_events:
          example:
          - parent_process_name: string
            byte_count_in: 10
            process_guid: 10
            process_path: string
            traffic:
              destination_host_name: string
              protocol: 10
              source_ip: string
              destination_subnet: string
              destination_ip: string
              source_subnet: string
              destination_port: 10
              direction: incoming
              source_port: 10
            flow_time: '2016-01-01T01:01:01.000Z'
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            parent_process_account: string
            type: NetflowEvent
            process_account_type: string
            parent_process_path: string
            parent_process_id: 10
            parent_process_args: string
            process_name: string
            process_account: string
            parent_process_account_type: string
            process_hash: string
            process_id: 10
            parent_process_hash: string
            process_username: string
            byte_count_out: 10
            process_args: string
          description: a list of `NetflowType`
          type: array
          items:
            $ref: '#/components/schemas/NetflowType'
        registry_rename_events:
          example:
          - time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            process_id: 10
            process_name: string
            process_guid: 10
            process_username: string
            registry_key: string
            type: RegistryRenameEvent
            registry_old_key: string
          description: a list of `RegistryRenameType`
          type: array
          items:
            $ref: '#/components/schemas/RegistryRenameType'
      additionalProperties: false
    NewBundleExportSightingsContextRegistryDeleteEvents:
      example:
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        process_id: 10
        process_name: string
        process_guid: 10
        process_username: string
        registry_key: string
        type: RegistryDeleteEvent
        registry_value: string
      type: object
      properties:
        process_guid:
          example: 10
          type: integer
          format: int64
        time:
          $ref: '#/components/schemas/NewBundleExportSightingsContextRegistryDeleteEventsTime'
        type:
          example: RegistryDeleteEvent
          type: string
          enum:
          - RegistryDeleteEvent
        registry_value:
          example: string
          description: String with at most 2048 characters.
          type: string
        registry_key:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
      additionalProperties: {}
      required:
      - time
      - type
      - registry_key
      - process_name
      - process_id
    NewBundleExportSightingsContextLibraryLoadEvents:
      example:
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        process_id: 10
        process_name: string
        process_guid: 10
        process_username: string
        type: LibraryLoadEvent
        dll_library_name: string
        dll_library_path: string
      type: object
      properties:
        dll_library_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        time:
          $ref: '#/components/schemas/NewBundleExportSightingsContextLibraryLoadEventsTime'
        type:
          example: LibraryLoadEvent
          type: string
          enum:
          - LibraryLoadEvent
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        dll_library_path:
          example: string
          description: String with at most 2048 characters.
          type: string
      additionalProperties: {}
      required:
      - dll_library_name
      - time
      - type
      - process_name
      - process_id
      - dll_library_path
    NewBundleExportDataTablesColumns:
      example:
        name: string
        type: integer
        description: string
        required: true
        short_description: string
      type: object
      properties:
        name:
          example: string
          type: string
        type:
          example: integer
          type: string
          enum:
          - url
          - string
          - observable
          - number
          - integer
          - markdown
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        required:
          example: true
          description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`.
          type: boolean
        short_description:
          example: string
          type: string
      additionalProperties: {}
      required:
      - name
      - type
    NewBundleExportMalwares:
      example:
        description: string
        labels:
        - adware
        abstraction_level: family
        schema_version: 1.3.30
        revision: 10
        type: malware
        x_mitre_aliases:
        - string
        source: string
        external_ids:
        - string
        short_description: string
        title: string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        source_uri: string
        language: string
        id: string
        tlp: green
        kill_chain_phases:
        - kill_chain_name: string
          phase_name: string
        timestamp: '2016-01-01T01:01:01.000Z'
      description: For submitting a new Malware.
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        labels:
          example:
          - adware
          description: The type of malware being described.
          type: array
          items:
            type: string
        abstraction_level:
          example: family
          description: Malware abstraction level.
          type: string
          enum:
          - family
          - version
          - variant
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        type:
          example: malware
          type: string
          enum:
          - malware
        x_mitre_aliases:
          example:
          - string
          description: ATT&CK Software.aliases.
          type: array
          items:
            type: string
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportMalwaresExternalReferences'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        kill_chain_phases:
          example:
          - kill_chain_name: string
            phase_name: string
          description: The list of Kill Chain Phases for which this Malware can be used.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportMalwaresKillChainPhases'
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
      additionalProperties: {}
      required:
      - description
      - labels
      - short_description
      - title
    NewBundleExportSightingsRelationsRelated:
      example:
        value: 1.2.3.4
        type: ip
      description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature.  This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains.  These do not exist as objects within the CTIA storage model, so you never create an observable.
      type: object
      properties:
        value:
          example: 1.2.3.4
          description: The value of the observable.
          type: string
        type:
          example: ip
          description: The type of observable.
          type: string
          enum:
          - file_path
          - mac_address
          - trend_micro_id
          - cybereason_id
          - process_args
          - s1_agent_id
          - device
          - hostname
          - certificate_common_name
          - serial_number
          - meraki_network_id
          - url
          - jamf_management_id
          - certificate_serial
          - intune_id
          - meraki_org_id
          - cisco_cm_id
          - registry_key
          - process_path
          - darktrace_id
          - process_username
          - cortex_agent_id
          - orbital_node_id
          - process_uid
          - ngfw_name
          - user
          - certificate_issuer
          - ipv6
          - email
          - cisco_uc_id
          - cvm_id
          - sha256
          - crowdstrike_id
          - google_cloud_id
          - google_chromebook_id
          - acudid
          - sha1
          - registry_name
          - md5
          - service_now_id
          - ip
          - domain
          - email_subject
          - imei
          - ngfw_id
          - amp_computer_guid
          - ms_machine_id
          - secure_access_id
          - mutex
          - processor_id
          - swc_device_id
          - registry_path
          - odns_identity
          - odns_identity_label
          - cisco_mid
          - process_name
          - pki_serial
          - meraki_node_sn
          - email_messageid
          - imsi
          - user_agent
          - process_hash
          - file_name
      additionalProperties: {}
      required:
      - value
      - type
    NewBundleExportVulnerabilitiesConfigurationsNodesChildrenCpeMatch:
      example:
        vulnerable: true
        cpe23Uri: string
        versionStartIncluding: string
        versionEndIncluding: string
        versionStartExcluding: string
        versionEndExcluding: string
      type: object
      properties:
        vulnerable:
          example: true
          type: boolean
        cpe23Uri:
          example: string
          description: A text representation of a software or hardware platform.
          type: string
        versionStartIncluding:
          example: string
          description: A string representing the lower bound(inclusive) of version in the CPE.
          type: string
        versionEndIncluding:
          example: string
          description: A string representing the upper bound(inclusive) of version in the CPE.
          type: string
        versionStartExcluding:
          example: string
          description: A string representing the lower bound(exclusive) of version in the CPE.
          type: string
        versionEndExcluding:
          example: string
          description: A string representing the upper bound(exclusive) of version in the CPE.
          type: string
      additionalProperties: {}
      required:
      - vulnerable
      - cpe23Uri
    NewActor:
      description: a new Actor
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        authorized_groups:
          type: array
          items:
            type: string
        motivation:
          example: Ego
          description: The reason or purpose behind the malicious activity attributed to this Actor. By understanding a threat actor's motivation, analysts can better predict the attacker's behavior and anticipate future malicious actions.
          type: string
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        identity:
          $ref: '#/components/schemas/Identity'
        sophistication:
          example: Aspirant
          description: "Represents the level of expertise and skill that the threat actor has displayed in their malicious activities. Can help security analysts assess the potential impact of an attacker's TTPs and determine the potential attack surface. \n\nFor example, a threat actor with a low sophistication level may primarily rely on off-the-shelf malware and attack tools, while an attacker with high sophistication may use custom tools with advanced evasion techniques, zero-day exploits, and sophisticated methods for command and control of their malware. \n\nThe sophistication level of an attacker can also be inferred based on several factors such as the complexity of attacks, the attacker's knowledge of the targeted organization's systems, and the attacker's ability to remain undetected.\n\nIf an attacker shows a high level of sophistication in reconnaissances, social engineering, and phishing, then the attacker may have a good knowledge of the targeted organization and its employees. This means that the attacker may be more successful in infiltrating the organization's network and compromising its systems."
          type: string
          enum:
          - Aspirant
          - Innovator
          - Practitioner
          - Novice
          - Expert
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        planning_and_operational_support:
          example: string
          description: "Provides information about the resources and capabilities of the attacker that could be used to assist in planning and operations related to the threat.\n\n It can be used to describe Infrastructure, Tools, Techniques, and Capabilities used by the threat actor."
          type: string
        authorized_users:
          type: array
          items:
            type: string
        type:
          example: actor
          type: string
          enum:
          - actor
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        intended_effect:
          example: Account Takeover
          description: "Represents the desired outcome or impact the threat actor is trying to achieve through their malicious activities. \n\n Helps security analysts to understand the attacker's goals beyond the immediate impact of the attack. By understanding the intended effect, analysts can draw connections between seemingly unrelated attacks and build a more complete understanding of an attacker's long-term goals and motivations."
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        client_id:
          type: string
        aliases:
          example:
          - string
          description: A list of other names that this Threat Actor is believed to use.
          type: array
          items:
            type: string
        groups:
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        confidence:
          example: High
          description: 'This field can help analysts decide how much trust they can put in the information provided by the threat intelligence sources.


            For example, an Actor entity can have high confidence if the organization''s security researchers have been tracking it for a long time and have gathered a significant amount of intelligence about it through various sources, such as analysis of malware, network traffic, and human intelligence. In contrast, low confidence may indicate the organization has only seen limited or circumstantial evidence.'
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        owner:
          type: string
        actor_types:
          example:
          - Cyber Espionage Operations
          type: array
          items:
            type: string
      additionalProperties: false
      required:
      - description
      - source
      - short_description
      - title
    NewBundleExportAssetsValidTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: 'Specifies the time range during which the asset is considered valid or accurate.

        For example, if an asset entity represents a device, the `valid_time` field could be used to indicate the period during which the device''s configuration information is deemed accurate.'
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If not present, the valid time position of the indicator does not have an upper bound.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If end_time is not present, then the valid time position of the object does not have an upper bound.
          type: string
          format: date-time
      additionalProperties: {}
    FileCreateType:
      example:
        file_name: string
        process_guid: 10
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        type: FileCreateEvent
        file_path: string
        process_name: string
        process_id: 10
        process_username: string
        failed: false
      type: object
      properties:
        file_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        time:
          $ref: '#/components/schemas/ObservedTime'
        type:
          example: FileCreateEvent
          type: string
          enum:
          - FileCreateEvent
        file_path:
          example: string
          description: String with at most 2048 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        failed:
          example: false
          type: boolean
      additionalProperties: false
      required:
      - file_name
      - time
      - type
      - file_path
      - process_name
      - process_id
    NewBundleExportIndicatorsCompositeIndicatorExpression:
      example:
        operator: and
        indicator_ids:
        - string
      type: object
      properties:
        operator:
          example: and
          type: string
          enum:
          - not
          - or
          - and
        indicator_ids:
          example:
          - string
          type: array
          items:
            type: string
      additionalProperties: {}
      required:
      - operator
      - indicator_ids
    IncidentTime:
      example:
        opened: '2016-01-01T01:01:01.000Z'
        discovered: '2016-01-01T01:01:01.000Z'
        reported: '2016-01-01T01:01:01.000Z'
        remediated: '2016-01-01T01:01:01.000Z'
        closed: '2016-01-01T01:01:01.000Z'
        rejected: '2016-01-01T01:01:01.000Z'
        contained: '2016-01-01T01:01:01.000Z'
      description: Relevant time values associated with this Incident.
      type: object
      properties:
        opened:
          example: '2016-01-01T01:01:01.000Z'
          description: Time the incident was first opened.
          type: string
          format: date-time
        discovered:
          example: '2016-01-01T01:01:01.000Z'
          description: Time the incident was first discovered.
          type: string
          format: date-time
        reported:
          example: '2016-01-01T01:01:01.000Z'
          description: Time the incident was first reported.
          type: string
          format: date-time
        remediated:
          example: '2016-01-01T01:01:01.000Z'
          description: Time that the remediation of the damage from the incident was completed.
          type: string
          format: date-time
        closed:
          example: '2016-01-01T01:01:01.000Z'
          description: Time that the incident was last closed.
          type: string
          format: date-time
        rejected:
          example: '2016-01-01T01:01:01.000Z'
          description: Time that the incident was first rejected.
          type: string
          format: date-time
        contained:
          example: '2016-01-01T01:01:01.000Z'
          description: Time that the incident was first contained.
          type: string
          format: date-time
      additionalProperties: false
      required:
      - opened
    NewBundleExportIdentityAssertionsIdentityObservables:
      example:
        value: 1.2.3.4
        type: ip
      description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature.  This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains.  These do not exist as objects within the CTIA storage model, so you never create an observable.
      type: object
      properties:
        value:
          example: 1.2.3.4
          description: The value of the observable.
          type: string
        type:
          example: ip
          description: The type of observable.
          type: string
          enum:
          - file_path
          - mac_address
          - trend_micro_id
          - cybereason_id
          - process_args
          - s1_agent_id
          - device
          - hostname
          - certificate_common_name
          - serial_number
          - meraki_network_id
          - url
          - jamf_management_id
          - certificate_serial
          - intune_id
          - meraki_org_id
          - cisco_cm_id
          - registry_key
          - process_path
          - darktrace_id
          - process_username
          - cortex_agent_id
          - orbital_node_id
          - process_uid
          - ngfw_name
          - user
          - certificate_issuer
          - ipv6
          - email
          - cisco_uc_id
          - cvm_id
          - sha256
          - crowdstrike_id
          - google_cloud_id
          - google_chromebook_id
          - acudid
          - sha1
          - registry_name
          - md5
          - service_now_id
          - ip
          - domain
          - email_subject
          - imei
          - ngfw_id
          - amp_computer_guid
          - ms_machine_id
          - secure_access_id
          - mutex
          - processor_id
          - swc_device_id
          - registry_path
          - odns_identity
          - odns_identity_label
          - cisco_mid
          - process_name
          - pki_serial
          - meraki_node_sn
          - email_messageid
          - imsi
          - user_agent
          - process_hash
          - file_name
      additionalProperties: {}
      required:
      - value
      - type
    NewBundleExportSightings:
      example:
        description: string
        schema_version: 1.3.30
        revision: 10
        relations:
        - origin: string
          origin_uri: string
          relation: Allocated
          relation_info:
            keyword: anything
          source:
            value: 1.2.3.4
            type: ip
          related:
            value: 1.2.3.4
            type: ip
        sensor_coordinates:
          type: endpoint
          observables:
          - value: 1.2.3.4
            type: ip
          os: string
        observables:
        - value: 1.2.3.4
          type: ip
        type: sighting
        source: string
        external_ids:
        - string
        targets:
        - type: endpoint
          observables:
          - value: 1.2.3.4
            type: ip
          observed_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          os: string
        short_description: string
        title: string
        resolution: detected
        internal: false
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        detection_interval:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        source_uri: string
        activity_interval:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        language: string
        id: string
        count: 10
        severity: Critical
        tlp: green
        modification_interval:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        context:
          http_events:
          - process_guid: 10
            traffic:
              destination_host_name: string
              protocol: 10
              source_ip: string
              destination_subnet: string
              destination_ip: string
              source_subnet: string
              destination_port: 10
              direction: incoming
              source_port: 10
            method: CONNECT
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: HTTPEvent
            host: string
            process_name: string
            process_id: 10
            process_username: string
            query: string
            encrypted: true
            url_port: 10
          process_create_events:
          - parent_process_name: string
            process_guid: 10
            parent_process_guid: 10
            process_disposition: string
            parent_process_size: 10
            process_size: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            parent_process_disposition: string
            type: ProcessCreateEvent
            parent_process_username: string
            parent_process_id: 10
            parent_process_args: string
            process_name: string
            process_hash: string
            process_id: 10
            parent_process_hash: string
            process_username: string
            parent_creation_time: '2016-01-01T01:01:01.000Z'
            process_args: string
          registry_delete_events:
          - time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            process_id: 10
            process_name: string
            process_guid: 10
            process_username: string
            registry_key: string
            type: RegistryDeleteEvent
            registry_value: string
          file_modify_events:
          - file_name: string
            process_guid: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: FileModifyEvent
            file_path: string
            process_name: string
            process_id: 10
            process_username: string
            failed: false
          registry_set_events:
          - process_guid: 10
            registry_data: string
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: RegistrySetEvent
            registry_data_length: 10
            registry_value: string
            registry_key: string
            process_name: string
            process_id: 10
            process_username: string
          file_create_events:
          - file_name: string
            process_guid: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: FileCreateEvent
            file_path: string
            process_name: string
            process_id: 10
            process_username: string
            failed: false
          registry_create_events:
          - time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            process_id: 10
            process_name: string
            process_guid: 10
            process_username: string
            registry_key: string
            type: RegistryCreateEvent
          library_load_events:
          - time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            process_id: 10
            process_name: string
            process_guid: 10
            process_username: string
            type: LibraryLoadEvent
            dll_library_name: string
            dll_library_path: string
          file_move_events:
          - file_name: string
            process_guid: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: FileMoveEvent
            old_name: string
            file_path: string
            process_name: string
            process_id: 10
            process_username: string
            new_name: string
          file_delete_events:
          - file_name: string
            process_guid: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: FileDeleteEvent
            file_path: string
            process_name: string
            process_id: 10
            process_username: string
            failed: false
          netflow_events:
          - parent_process_name: string
            byte_count_in: 10
            process_guid: 10
            process_path: string
            traffic:
              destination_host_name: string
              protocol: 10
              source_ip: string
              destination_subnet: string
              destination_ip: string
              source_subnet: string
              destination_port: 10
              direction: incoming
              source_port: 10
            flow_time: '2016-01-01T01:01:01.000Z'
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            parent_process_account: string
            type: NetflowEvent
            process_account_type: string
            parent_process_path: string
            parent_process_id: 10
            parent_process_args: string
            process_name: string
            process_account: string
            parent_process_account_type: string
            process_hash: string
            process_id: 10
            parent_process_hash: string
            process_username: string
            byte_count_out: 10
            process_args: string
          registry_rename_events:
          - time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            process_id: 10
            process_name: string
            process_guid: 10
            process_username: string
            registry_key: string
            type: RegistryRenameEvent
            registry_old_key: string
        timestamp: '2016-01-01T01:01:01.000Z'
        confidence: High
        observed_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        sensor: endpoint
        data:
          columns:
          - name: string
            type: integer
            description: string
            required: true
            short_description: string
          rows:
          - - anything
          row_count: 10
      description: For submitting a new Sighting.
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        relations:
          example:
          - origin: string
            origin_uri: string
            relation: Allocated
            relation_info:
              keyword: anything
            source:
              value: 1.2.3.4
              type: ip
            related:
              value: 1.2.3.4
              type: ip
          description: Provide any context we can about where the observable came from.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportSightingsRelations'
        sensor_coordinates:
          $ref: '#/components/schemas/NewBundleExportSightingsSensorCoordinates'
        observables:
          example:
          - value: 1.2.3.4
            type: ip
          description: The object(s) of interest.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportSightingsObservables'
        type:
          example: sighting
          type: string
          enum:
          - sighting
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        targets:
          example:
          - type: endpoint
            observables:
            - value: 1.2.3.4
              type: ip
            observed_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            os: string
          description: 'May include one or more targets that observed the associated indicator. Targets can include network devices, host devices, or other entities that are capable of detecting indicators of compromise.


            Can be used to assess the scope of potential threats, helping analysts understand which devices or components of the network may be vulnerable to attack. For example, if a particular malware strain is detected on several different systems within an organization, the `targets` field may indicate which systems are affected and which may need to be isolated or patched to prevent further spread.'
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportSightingsTargets'
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        resolution:
          example: detected
          description: Represents the disposition or actions taken on the associated threat intelligence.
          type: string
        internal:
          example: false
          description: "If `true`, indicates that the sighting was reported from internal sources, such as an organization's own internal security tools or SOC.\n Internal sightings are often considered more reliable and actionable than external sightings, which are reported from external sources and may have a lower level of trustworthiness. Internal sightings can provide more context and can help identify potential threats that are unique to a particular environment or organization.\n Internal sightings can also help organizations prioritize their security response efforts by identifying threats that are specific to their environment and may not yet be widely known."
          type: boolean
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportSightingsExternalReferences'
        detection_interval:
          $ref: '#/components/schemas/NewBundleExportSightingsDetectionInterval'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        activity_interval:
          $ref: '#/components/schemas/NewBundleExportSightingsActivityInterval'
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        count:
          example: 10
          description: Zero, or a positive integer.
          type: integer
          format: int64
        severity:
          example: Critical
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Critical
          - Low
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        modification_interval:
          $ref: '#/components/schemas/NewBundleExportSightingsModificationInterval'
        context:
          $ref: '#/components/schemas/NewBundleExportSightingsContext'
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        confidence:
          example: High
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        observed_time:
          $ref: '#/components/schemas/NewBundleExportSightingsObservedTime'
        sensor:
          example: endpoint
          description: The OpenC2 Actuator name that best fits the device that is creating this sighting (e.g. network.firewall)
          type: string
        data:
          $ref: '#/components/schemas/NewBundleExportSightingsData'
      additionalProperties: {}
      required:
      - observed_time
    NewBundleExportCampaigns:
      example:
        description: string
        valid_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        schema_version: 1.3.30
        revision: 10
        type: campaign
        campaign_type: string
        source: string
        external_ids:
        - string
        short_description: string
        title: string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        activity:
        - date_time: '2016-01-01T01:01:01.000Z'
          description: string
        source_uri: string
        intended_effect:
        - Account Takeover
        status: Future
        language: string
        id: string
        tlp: green
        timestamp: '2016-01-01T01:01:01.000Z'
        confidence: High
        names:
        - string
      description: Schema for submitting new Campaigns
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        valid_time:
          $ref: '#/components/schemas/NewBundleExportCampaignsValidTime'
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        type:
          example: campaign
          type: string
          enum:
          - campaign
        campaign_type:
          example: string
          description: 'String value that describes the type of campaign. For example, a campaign type could be ''Ransomware'', ''Advanced Persistent Threat'', ''Business Email Compromise'', ''Phishing'', etc. '
          type: string
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportCampaignsExternalReferences'
        activity:
          example:
          - date_time: '2016-01-01T01:01:01.000Z'
            description: string
          description: 'Used to capture specific activities or tactics associated with the campaign.

            The ''activity'' field is an array of objects, and each element represents a specific activity and time associated with the campaign. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc. By capturing these activities analysts can identify the specific tactics used by the threat actor(s) behind the campaign.'
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportCampaignsActivity'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        intended_effect:
          example:
          - Account Takeover
          description: Characterizes the intended effect of this cyber threat campaign.
          type: array
          items:
            type: string
        status:
          example: Future
          description: "Indicates current Status of the Campaign. \n\nCan have one of the following values: \n\n- Ongoing: Indicates that the campaign is currently active and ongoing. For   example, a mass phishing campaign that is actively targeting users is   considered 'ongoing'.\n\n- Historic: Campaign has already occurred and is now in the past.\n\n- Future: This indicates that a campaign is planned or expected to occur in the   future. For example, a threat actor may announce their intention to launch a   specific cyberattack campaign at a future date."
          type: string
          enum:
          - Historic
          - Future
          - Ongoing
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        confidence:
          example: High
          description: Level of confidence held in the characterization of this Campaign.
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        names:
          example:
          - string
          description: Used to capture alternate names or aliases associated with the campaign. A cyberattack campaign may have multiple names or aliases depending on the group or actor(s) behind the attack, e.g., 'Wannacry' is also known as 'WannaCrypt', 'WCry', 'Wanna Decryptor', etc.
          type: array
          items:
            type: string
      additionalProperties: {}
      required:
      - description
      - campaign_type
      - short_description
      - title
    CPEMatch:
      example:
        vulnerable: true
        cpe23Uri: string
        versionStartIncluding: string
        versionEndIncluding: string
        versionStartExcluding: string
        versionEndExcluding: string
      type: object
      properties:
        vulnerable:
          example: true
          type: boolean
        cpe23Uri:
          example: string
          description: A text representation of a software or hardware platform.
          type: string
        versionStartIncluding:
          example: string
          description: A string representing the lower bound(inclusive) of version in the CPE.
          type: string
        versionEndIncluding:
          example: string
          description: A string representing the upper bound(inclusive) of version in the CPE.
          type: string
        versionStartExcluding:
          example: string
          description: A string representing the lower bound(exclusive) of version in the CPE.
          type: string
        versionEndExcluding:
          example: string
          description: A string representing the upper bound(exclusive) of version in the CPE.
          type: string
      additionalProperties: false
      required:
      - vulnerable
      - cpe23Uri
    NewBundleExportVulnerabilitiesImpactCvssV3:
      example:
        integrity_impact: high
        modified_user_interaction: none
        modified_scope: not_defined
        availability_requirement: high
        user_interaction: none
        modified_integrity_impact: not_defined
        privileges_required: high
        exploitability_score: 10.0
        impact_score: 10.0
        environmental_severity: critical
        modified_availability_impact: not_defined
        availability_impact: high
        scope: changed
        exploit_code_maturity: functional
        modified_attack_complexity: not_defined
        base_severity: critical
        confidentiality_impact: high
        temporal_severity: critical
        modified_confidentiality_impact: not_defined
        confidentiality_requirement: high
        report_confidence: confirmed
        temporal_score: 10.0
        modified_privileges_required: not_defined
        modified_attack_vector: not_defined
        base_score: 10.0
        environmental_score: 10.0
        remediation_level: high
        vector_string: string
        integrity_requirement: high
        attack_vector: adjacent_network
        attack_complexity: high
      type: object
      properties:
        integrity_impact:
          example: high
          description: measures the impact to integrity of a successfully exploited vulnerability
          type: string
          enum:
          - low
          - none
          - high
        modified_user_interaction:
          example: none
          description: modified user interaction
          type: string
          enum:
          - none
          - required
          - not_defined
        modified_scope:
          example: not_defined
          description: modified scope
          type: string
          enum:
          - changed
          - unchanged
          - not_defined
        availability_requirement:
          example: high
          description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
          type: string
          enum:
          - low
          - none
          - high
          - not_defined
        user_interaction:
          example: none
          description: captures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerable component
          type: string
          enum:
          - none
          - required
        modified_integrity_impact:
          example: not_defined
          description: modified integrity impact
          type: string
          enum:
          - low
          - none
          - high
          - not_defined
        privileges_required:
          example: high
          description: describes the level of privileges an attacker must possess before successfully exploiting the vulnerability
          type: string
          enum:
          - low
          - none
          - high
        exploitability_score:
          example: 10.0
          description: a Score number from 0 to 10
          type: number
          format: double
        impact_score:
          example: 10.0
          description: a Score number from 0 to 10
          type: number
          format: double
        environmental_severity:
          example: critical
          type: string
          enum:
          - low
          - none
          - high
          - medium
          - critical
        modified_availability_impact:
          example: not_defined
          description: modified availability impact
          type: string
          enum:
          - low
          - none
          - high
          - not_defined
        availability_impact:
          example: high
          description: measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability
          type: string
          enum:
          - low
          - none
          - high
        scope:
          example: changed
          description: the ability for a vulnerability in one software component to impact resources beyond its means, or privileges
          type: string
          enum:
          - changed
          - unchanged
        exploit_code_maturity:
          example: functional
          description: measures the likelihood of the vulnerability being attacked
          type: string
          enum:
          - high
          - unproven
          - functional
          - proof_of_concept
          - not_defined
        modified_attack_complexity:
          example: not_defined
          description: modified attack complexity
          type: string
          enum:
          - low
          - high
          - not_defined
        base_severity:
          example: critical
          type: string
          enum:
          - low
          - none
          - high
          - medium
          - critical
        confidentiality_impact:
          example: high
          description: measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability
          type: string
          enum:
          - low
          - none
          - high
        temporal_severity:
          example: critical
          description: temporal severity
          type: string
          enum:
          - low
          - none
          - high
          - medium
          - critical
        modified_confidentiality_impact:
          example: not_defined
          description: modified confidentiality impact
          type: string
          enum:
          - low
          - none
          - high
          - not_defined
        confidentiality_requirement:
          example: high
          description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
          type: string
          enum:
          - low
          - none
          - high
          - not_defined
        report_confidence:
          example: confirmed
          description: measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details
          type: string
          enum:
          - unknown
          - reasonable
          - confirmed
        temporal_score:
          example: 10.0
          description: Round up(CVSSv3BaseScore × CVSSv3ExploitCodeMaturity × CVSSv3RemediationLevel × CVSSv3ReportConfidence)
          type: number
          format: double
        modified_privileges_required:
          example: not_defined
          description: modified privileges required
          type: string
          enum:
          - low
          - none
          - high
          - not_defined
        modified_attack_vector:
          example: not_defined
          description: modified attack vector
          type: string
          enum:
          - network
          - adjacent_network
          - local
          - physical
          - not_defined
        base_score:
          example: 10.0
          description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v3-1'
          type: number
          format: double
        environmental_score:
          example: 10.0
          description: a Score number from 0 to 10
          type: number
          format: double
        remediation_level:
          example: high
          description: Remediation Level of a vulnerability is an important factor for prioritization
          type: string
          enum:
          - temporary_fix
          - offical_fix
          - high
          - workaround
          - unavailable
          - not_defined
        vector_string:
          example: string
          description: a text representation of a set of CVSSv3 metrics. It is commonly used to record or transfer CVSSv3 metric information in a concise form
          type: string
        integrity_requirement:
          example: high
          description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
          type: string
          enum:
          - low
          - none
          - high
          - not_defined
        attack_vector:
          example: adjacent_network
          description: Reflects the context by which vulnerability exploitation is possible
          type: string
          enum:
          - network
          - adjacent_network
          - local
          - physical
        attack_complexity:
          example: high
          description: describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability
          type: string
          enum:
          - low
          - high
      additionalProperties: {}
      required:
      - base_severity
      - base_score
      - vector_string
    NewBundleExportMalwaresKillChainPhases:
      example:
        kill_chain_name: string
        phase_name: string
      description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
      type: object
      properties:
        kill_chain_name:
          example: string
          description: The name of the kill chain.
          type: string
        phase_name:
          example: string
          description: The name of the phase in the kill chain.
          type: string
      additionalProperties: {}
      required:
      - kill_chain_name
      - phase_name
    NewBundleExportVulnerabilitiesCve:
      example:
        cve_data_meta:
          id: string
          assigner: string
      type: object
      properties:
        cve_data_meta:
          $ref: '#/components/schemas/NewBundleExportVulnerabilitiesCveCveDataMeta'
      additionalProperties: {}
      required:
      - cve_data_meta
    NewBundleExportCoasOpenC2CoaModifiers:
      example:
        response: acknowledge
        method:
        - acl
        additional_properties:
          context: string
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        frequency: string
        duration: '2016-01-01T01:01:01.000Z'
        source: string
        search: cve
        option: string
        id: string
        location: internal
        delay: '2016-01-01T01:01:01.000Z'
        destination: copy-to
      type: object
      properties:
        response:
          example: acknowledge
          type: string
          enum:
          - query
          - status
          - acknowledge
          - command-ref
        method:
          example:
          - acl
          type: array
          items:
            type: string
            enum:
            - blackhole
            - unauthenticated
            - suspend
            - graceful
            - hibernate
            - whitelist
            - honeypot
            - immediate
            - spawn
            - blacklist
            - acl
            - segmentation
            - authenticated
        additional_properties:
          $ref: '#/components/schemas/NewBundleExportCoasOpenC2CoaModifiersAdditionalProperties'
        time:
          $ref: '#/components/schemas/NewBundleExportCoasOpenC2CoaModifiersTime'
        frequency:
          example: string
          description: String with at most 1024 characters.
          type: string
        duration:
          example: '2016-01-01T01:01:01.000Z'
          description: Schema definition for all date or timestamp values.  Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
          type: string
          format: date-time
        source:
          example: string
          description: String with at most 1024 characters.
          type: string
        search:
          example: cve
          type: string
          enum:
          - vendor_bulletin
          - patch
          - signature
          - cve
        option:
          example: string
          description: String with at most 1024 characters.
          type: string
        id:
          example: string
          description: String with at most 1024 characters.
          type: string
        location:
          example: internal
          type: string
          enum:
          - internal
          - perimeter
        delay:
          example: '2016-01-01T01:01:01.000Z'
          description: Schema definition for all date or timestamp values.  Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
          type: string
          format: date-time
        destination:
          example: copy-to
          type: string
          enum:
          - modify-to
          - set-to
          - copy-to
          - move-to
          - save-to
          - restore-point
          - report-to
      additionalProperties: {}
    NewBundleExportVulnerabilitiesCveCveDataMeta:
      example:
        id: string
        assigner: string
      type: object
      properties:
        id:
          example: string
          description: String with at most 1024 characters.
          type: string
        assigner:
          example: string
          description: String with at most 1024 characters.
          type: string
      additionalProperties: {}
    NewBundleExportAssetMappingsExternalReferences:
      example:
        source_name: string
        description: string
        url: string
        hashes:
        - string
        external_id: string
      description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
      type: object
      properties:
        source_name:
          example: string
          description: The source within which the external-reference is defined (system, registry, organization, etc.)
          type: string
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        url:
          example: string
          description: A URL reference to an external resource.
          type: string
        hashes:
          example:
          - string
          description: Specifies a dictionary of hashes for the contents of the url.
          type: array
          items:
            type: string
        external_id:
          example: string
          description: An identifier for the external reference content.
          type: string
      additionalProperties: {}
      required:
      - source_name
    NewSightingRelationsRelationInfo:
      example:
        keyword: anything
      type: object
      additionalProperties:
        example: anything
    NewBundleExportWeaknessesArchitectures:
      example:
        prevalence: Often
        name: string
        class: Embedded
      type: object
      properties:
        prevalence:
          example: Often
          description: Defines the different regularities that guide the applicability of platforms.
          type: string
          enum:
          - Undetermined
          - Sometimes
          - Often
          - Rarely
        name:
          example: string
          description: Architecture name (ARM, x86, ...)
          type: string
        class:
          example: Embedded
          description: Class of architecture
          type: string
      additionalProperties: {}
      required:
      - prevalence
    NewBundleExportSightingsActivityInterval:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: The time interval during which the malicious activity occurred. For example, the time when a malware sample was executing, or the time range of a network intrusion.
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If the observation was made over a period of time, than this field indicates the end of that period.
          type: string
          format: date-time
      additionalProperties: {}
      required:
      - start_time
    NewCampaign:
      description: a new Campaign
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        authorized_groups:
          type: array
          items:
            type: string
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        authorized_users:
          type: array
          items:
            type: string
        type:
          example: campaign
          type: string
          enum:
          - campaign
        created:
          type: string
          format: date-time
        campaign_type:
          example: string
          description: 'String value that describes the type of campaign. For example, a campaign type could be ''Ransomware'', ''Advanced Persistent Threat'', ''Business Email Compromise'', ''Phishing'', etc. '
          type: string
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        activity:
          example:
          - date_time: '2016-01-01T01:01:01.000Z'
            description: string
          description: 'Used to capture specific activities or tactics associated with the campaign.

            The ''activity'' field is an array of objects, and each element represents a specific activity and time associated with the campaign. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc. By capturing these activities analysts can identify the specific tactics used by the threat actor(s) behind the campaign.'
          type: array
          items:
            $ref: '#/components/schemas/Activity'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        intended_effect:
          example:
          - Account Takeover
          description: Characterizes the intended effect of this cyber threat campaign.
          type: array
          items:
            type: string
        status:
          example: Future
          description: "Indicates current Status of the Campaign. \n\nCan have one of the following values: \n\n- Ongoing: Indicates that the campaign is currently active and ongoing. For   example, a mass phishing campaign that is actively targeting users is   considered 'ongoing'.\n\n- Historic: Campaign has already occurred and is now in the past.\n\n- Future: This indicates that a campaign is planned or expected to occur in the   future. For example, a threat actor may announce their intention to launch a   specific cyberattack campaign at a future date."
          type: string
          enum:
          - Historic
          - Future
          - Ongoing
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        client_id:
          type: string
        groups:
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        confidence:
          example: High
          description: Level of confidence held in the characterization of this Campaign.
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        owner:
          type: string
        names:
          example:
          - string
          description: Used to capture alternate names or aliases associated with the campaign. A cyberattack campaign may have multiple names or aliases depending on the group or actor(s) behind the attack, e.g., 'Wannacry' is also known as 'WannaCrypt', 'WCry', 'Wanna Decryptor', etc.
          type: array
          items:
            type: string
      additionalProperties: false
      required:
      - description
      - campaign_type
      - short_description
      - title
    NewBundleExportTargetRecordsTargetsObservedTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If the observation was made over a period of time, than this field indicates the end of that period.
          type: string
          format: date-time
      additionalProperties: {}
      required:
      - start_time
    ModifierType:
      example:
        response: acknowledge
        method:
        - acl
        additional_properties:
          context: string
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        frequency: string
        duration: '2016-01-01T01:01:01.000Z'
        source: string
        search: cve
        option: string
        id: string
        location: internal
        delay: '2016-01-01T01:01:01.000Z'
        destination: copy-to
      type: object
      properties:
        response:
          example: acknowledge
          type: string
          enum:
          - query
          - status
          - acknowledge
          - command-ref
        method:
          example:
          - acl
          type: array
          items:
            type: string
            enum:
            - blackhole
            - unauthenticated
            - suspend
            - graceful
            - hibernate
            - whitelist
            - honeypot
            - immediate
            - spawn
            - blacklist
            - acl
            - segmentation
            - authenticated
        additional_properties:
          $ref: '#/components/schemas/AdditionalProperties'
        time:
          $ref: '#/components/schemas/ValidTime'
        frequency:
          example: string
          description: String with at most 1024 characters.
          type: string
        duration:
          example: '2016-01-01T01:01:01.000Z'
          description: Schema definition for all date or timestamp values.  Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
          type: string
          format: date-time
        source:
          example: string
          description: String with at most 1024 characters.
          type: string
        search:
          example: cve
          type: string
          enum:
          - vendor_bulletin
          - patch
          - signature
          - cve
        option:
          example: string
          description: String with at most 1024 characters.
          type: string
        id:
          example: string
          description: String with at most 1024 characters.
          type: string
        location:
          example: internal
          type: string
          enum:
          - internal
          - perimeter
        delay:
          example: '2016-01-01T01:01:01.000Z'
          description: Schema definition for all date or timestamp values.  Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
          type: string
          format: date-time
        destination:
          example: copy-to
          type: string
          enum:
          - modify-to
          - set-to
          - copy-to
          - move-to
          - save-to
          - restore-point
          - report-to
      additionalProperties: false
    NewBundleExportTools:
      example:
        description: string
        labels:
        - credential-exploitation
        schema_version: 1.3.30
        revision: 10
        type: tool
        x_mitre_aliases:
        - string
        source: string
        external_ids:
        - string
        short_description: string
        title: string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        source_uri: string
        language: string
        id: string
        tool_version: string
        tlp: green
        kill_chain_phases:
        - kill_chain_name: string
          phase_name: string
        timestamp: '2016-01-01T01:01:01.000Z'
      description: For submitting a new Tool.
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        labels:
          example:
          - credential-exploitation
          description: The kind(s) of tool(s) being described.
          type: array
          items:
            type: string
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        type:
          example: tool
          type: string
          enum:
          - tool
        x_mitre_aliases:
          example:
          - string
          description: ATT&CK Software.aliases.
          type: array
          items:
            type: string
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportToolsExternalReferences'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tool_version:
          example: string
          description: The version identifier associated with the Tool.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        kill_chain_phases:
          example:
          - kill_chain_name: string
            phase_name: string
          description: The list of kill chain phases for which this Tool can be used.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportToolsKillChainPhases'
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
      additionalProperties: {}
      required:
      - description
      - labels
      - short_description
      - title
    NewBundleExportCoasOpenC2CoaModifiersAdditionalProperties:
      example:
        context: string
      type: object
      properties:
        context:
          example: string
          description: String with at most 1024 characters.
          type: string
      additionalProperties: {}
      required:
      - context
    NewBundleExportCoasOpenC2CoaModifiersTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid.
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If not present, the valid time position of the indicator does not have an upper bound.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If end_time is not present, then the valid time position of the object does not have an upper bound.
          type: string
          format: date-time
      additionalProperties: {}
    NewBundleExportActorsValidTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid.
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If not present, the valid time position of the indicator does not have an upper bound.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If end_time is not present, then the valid time position of the object does not have an upper bound.
          type: string
          format: date-time
      additionalProperties: {}
    NewBundleExportToolsExternalReferences:
      example:
        source_name: string
        description: string
        url: string
        hashes:
        - string
        external_id: string
      description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
      type: object
      properties:
        source_name:
          example: string
          description: The source within which the external-reference is defined (system, registry, organization, etc.)
          type: string
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        url:
          example: string
          description: A URL reference to an external resource.
          type: string
        hashes:
          example:
          - string
          description: Specifies a dictionary of hashes for the contents of the url.
          type: array
          items:
            type: string
        external_id:
          example: string
          description: An identifier for the external reference content.
          type: string
      additionalProperties: {}
      required:
      - source_name
    NewBundleExportAttackPatternsKillChainPhases:
      example:
        kill_chain_name: string
        phase_name: string
      description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
      type: object
      properties:
        kill_chain_name:
          example: string
          description: The name of the kill chain.
          type: string
        phase_name:
          example: string
          description: The name of the phase in the kill chain.
          type: string
      additionalProperties: {}
      required:
      - kill_chain_name
      - phase_name
    NewBundleExportTargetRecords:
      example:
        description: string
        schema_version: 1.3.30
        revision: 10
        type: target-record
        source: string
        external_ids:
        - string
        targets:
        - type: endpoint
          observables:
          - value: 1.2.3.4
            type: ip
          observed_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          os: string
          internal: false
          sensor: string
          source_uri: string
        short_description: string
        title: string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        source_uri: string
        language: string
        id: string
        tlp: green
        timestamp: '2016-01-01T01:01:01.000Z'
      description: Schema for submitting new TargetRecord.
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        type:
          example: target-record
          type: string
          enum:
          - target-record
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        targets:
          example:
          - type: endpoint
            observables:
            - value: 1.2.3.4
              type: ip
            observed_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            os: string
            internal: false
            sensor: string
            source_uri: string
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportTargetRecordsTargets'
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportTargetRecordsExternalReferences'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
      additionalProperties: {}
      required:
      - source
      - targets
    NewBundleExportSightingsModificationInterval:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: The time interval during which the sighting record was created or last updated in the system.
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If the observation was made over a period of time, than this field indicates the end of that period.
          type: string
          format: date-time
      additionalProperties: {}
      required:
      - start_time
    NewBundleExportDataTables:
      example:
        description: string
        valid_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        schema_version: 1.3.30
        revision: 10
        columns:
        - name: string
          type: integer
          description: string
          required: true
          short_description: string
        type: data-table
        source: string
        external_ids:
        - string
        short_description: string
        title: string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        rows:
        - - anything
        source_uri: string
        language: string
        id: string
        tlp: green
        row_count: 10
        timestamp: '2016-01-01T01:01:01.000Z'
      description: Schema for submitting a NewDataTable record.
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        valid_time:
          $ref: '#/components/schemas/NewBundleExportDataTablesValidTime'
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        columns:
          example:
          - name: string
            type: integer
            description: string
            required: true
            short_description: string
          description: An ordered list of column definitions.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportDataTablesColumns'
        type:
          example: data-table
          type: string
          enum:
          - data-table
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportDataTablesExternalReferences'
        rows:
          example:
          - - anything
          description: An ordered list of rows
          type: array
          items:
            type: array
            items: {}
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        row_count:
          example: 10
          description: The number of rows in the data table.
          type: integer
          format: int64
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
      additionalProperties: {}
      required:
      - columns
      - rows
    NewBundleExportRelationships:
      example:
        description: string
        schema_version: 1.3.30
        revision: 10
        target_ref: string
        type: relationship
        source: string
        external_ids:
        - string
        short_description: string
        title: string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        source_uri: string
        source_ref: string
        language: string
        id: string
        tlp: green
        timestamp: '2016-01-01T01:01:01.000Z'
        relationship_type: attributed-to
      description: Schema for submitting new Relationships.
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        target_ref:
          example: string
          description: A URI leading to an entity.
          type: string
        type:
          example: relationship
          type: string
          enum:
          - relationship
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportRelationshipsExternalReferences'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        source_ref:
          example: string
          description: A URI leading to an entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        relationship_type:
          example: attributed-to
          type: string
      additionalProperties: {}
      required:
      - target_ref
      - source_ref
      - relationship_type
    NewBundleExportExternalReferences:
      example:
        source_name: string
        description: string
        url: string
        hashes:
        - string
        external_id: string
      description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
      type: object
      properties:
        source_name:
          example: string
          description: The source within which the external-reference is defined (system, registry, organization, etc.)
          type: string
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        url:
          example: string
          description: A URL reference to an external resource.
          type: string
        hashes:
          example:
          - string
          description: Specifies a dictionary of hashes for the contents of the url.
          type: array
          items:
            type: string
        external_id:
          example: string
          description: An identifier for the external reference content.
          type: string
      additionalProperties: {}
      required:
      - source_name
    NewBundleExportIndicatorsSpecificationRequiredJudgements:
      example:
        confidence: High
        source: string
        relationship: string
        judgement_id: string
      type: object
      properties:
        confidence:
          example: High
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        source:
          example: string
          type: string
        relationship:
          example: string
          type: string
        judgement_id:
          example: string
          description: A URI leading to a judgement.
          type: string
      additionalProperties: {}
      required:
      - judgement_id
    NewBundleExportWeaknessesModesOfIntroduction:
      example:
        phase: Architecture and Design
        note: string
      type: object
      properties:
        phase:
          example: Architecture and Design
          description: Identifies the point in the software life cycle at which the weakness may be introduced.
          type: string
        note:
          example: string
          description: Provides a typical scenario related to introduction during the given phase.
          type: string
      additionalProperties: {}
      required:
      - phase
    NewBundleExportNotesRelatedEntities:
      example:
        entity_type: string
        entity_id: string
      type: object
      properties:
        entity_type:
          example: string
          type: string
        entity_id:
          example: string
          description: A URI leading to an entity.
          type: string
      additionalProperties: {}
      required:
      - entity_type
      - entity_id
    NewBundleExportAssets:
      example:
        description: string
        asset_type: application
        valid_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        schema_version: 1.3.30
        revision: 10
        type: asset
        source: string
        external_ids:
        - string
        short_description: string
        title: string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        source_uri: string
        language: string
        id: string
        tlp: green
        timestamp: '2016-01-01T01:01:01.000Z'
      description: Schema for submitting new Assets
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        asset_type:
          example: application
          description: 'Type of the Asset: Device, Person, Application, etc.'
          type: string
          enum:
          - device
          - network
          - application
          - person
          - data
        valid_time:
          $ref: '#/components/schemas/NewBundleExportAssetsValidTime'
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        type:
          example: asset
          type: string
          enum:
          - asset
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportAssetsExternalReferences'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
      additionalProperties: {}
      required:
      - asset_type
      - valid_time
      - source
    NewIncidentScores:
      type: object
      properties:
        asset:
          type: number
          format: double
        ttp:
          type: number
          format: double
        probability:
          type: number
          format: double
        global:
          type: number
          format: double
        ml_score:
          type: number
          format: double
      additionalProperties: false
    NewBundleExportSightingsObservedTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If the observation was made over a period of time, than this field indicates the end of that period.
          type: string
          format: date-time
      additionalProperties: {}
      required:
      - start_time
    NewBundleExportFeedbacks:
      example:
        feedback: -1
        schema_version: 1.3.30
        revision: 10
        type: feedback
        source: string
        external_ids:
        - string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        reason: string
        source_uri: string
        language: string
        id: string
        tlp: green
        entity_id: string
        timestamp: '2016-01-01T01:01:01.000Z'
      description: Schema for submitting new Feedback.
      type: object
      properties:
        feedback:
          example: -1
          type: integer
          format: int64
          enum:
          - 0
          - 1
          - -1
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        type:
          example: feedback
          type: string
          enum:
          - feedback
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportFeedbacksExternalReferences'
        reason:
          example: string
          type: string
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        entity_id:
          example: string
          description: A URI leading to an entity.
          type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
      additionalProperties: {}
      required:
      - feedback
      - reason
      - entity_id
    NewBundleExportWeaknessesDetectionMethods:
      example:
        method: Architecture or Design Review
        description: string
        effectiveness: High
        effectiveness_notes: string
      type: object
      properties:
        method:
          example: Architecture or Design Review
          description: Identifies the particular detection method being described.
          type: string
        description:
          example: string
          description: Provides some context of how this method can be applied to a specific weakness.
          type: string
        effectiveness:
          example: High
          description: How effective the detection method may be in detecting the associated weakness.
          type: string
        effectiveness_notes:
          example: string
          description: Provides additional discussion of the strengths and shortcomings of this detection method.
          type: string
      additionalProperties: {}
      required:
      - method
      - description
    Configurations:
      example:
        CVE_data_version: string
        nodes:
        - operator: AND
          cpe_match:
          - vulnerable: true
            cpe23Uri: string
            versionStartIncluding: string
            versionEndIncluding: string
            versionStartExcluding: string
            versionEndExcluding: string
          children:
          - operator: AND
            cpe_match:
            - vulnerable: true
              cpe23Uri: string
              versionStartIncluding: string
              versionEndIncluding: string
              versionStartExcluding: string
              versionEndExcluding: string
            negate: true
          negate: true
      description: "Represents a list of affected versions or configurations of a software component that is impacted by a vulnerability. \nBy tracking the affected software components and versions, defenders can identify which systems are potentially exposed to an attack, and apply appropriate mitigations."
      type: object
      properties:
        CVE_data_version:
          example: string
          description: Specifies the version of the CVE (Common Vulnerabilities and Exposures) dictionary used by the vulnerability information provider.
          type: string
        nodes:
          example:
          - operator: AND
            cpe_match:
            - vulnerable: true
              cpe23Uri: string
              versionStartIncluding: string
              versionEndIncluding: string
              versionStartExcluding: string
              versionEndExcluding: string
            children:
            - operator: AND
              cpe_match:
              - vulnerable: true
                cpe23Uri: string
                versionStartIncluding: string
                versionEndIncluding: string
                versionStartExcluding: string
                versionEndExcluding: string
              negate: true
            negate: true
          description: Each `node` in the CTIM standard configuration includes information such as the `operator` (such as "less than", or "greater than or equal to"), and the `cpe` (Common Platform Enumeration) string which identifies the specific software, `CPE` is a structured naming scheme for IT systems, platforms, and software packages, and it is instrumental in enabling data exchange between different systems.
          type: array
          items:
            $ref: '#/components/schemas/CPENode'
      additionalProperties: false
      required:
      - CVE_data_version
      - nodes
    NewBundleExportWeaknessesAlternateTerms:
      example:
        term: string
        description: string
      type: object
      properties:
        term:
          example: string
          description: The actual alternate term.
          type: string
        description:
          example: string
          description: Provides context for the alternate term by which this weakness may be known.
          type: string
      additionalProperties: {}
      required:
      - term
    NewRelationship:
      description: a new Relationship
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        authorized_groups:
          type: array
          items:
            type: string
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        target_ref:
          example: string
          description: A URI leading to an entity.
          type: string
        authorized_users:
          type: array
          items:
            type: string
        type:
          example: relationship
          type: string
          enum:
          - relationship
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        source_ref:
          example: string
          description: A URI leading to an entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        client_id:
          type: string
        groups:
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        owner:
          type: string
        relationship_type:
          example: attributed-to
          type: string
      additionalProperties: false
      required:
      - target_ref
      - source_ref
      - relationship_type
    NewBundleExportAssetPropertiesProperties:
      example:
        name: string
        value: string
      type: object
      properties:
        name:
          example: string
          description: The properties are an open vocabulary.
          type: string
        value:
          example: string
          type: string
      additionalProperties: {}
      required:
      - name
      - value
    NewBundleExportSightingsObservables:
      example:
        value: 1.2.3.4
        type: ip
      description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature.  This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains.  These do not exist as objects within the CTIA storage model, so you never create an observable.
      type: object
      properties:
        value:
          example: 1.2.3.4
          description: The value of the observable.
          type: string
        type:
          example: ip
          description: The type of observable.
          type: string
          enum:
          - file_path
          - mac_address
          - trend_micro_id
          - cybereason_id
          - process_args
          - s1_agent_id
          - device
          - hostname
          - certificate_common_name
          - serial_number
          - meraki_network_id
          - url
          - jamf_management_id
          - certificate_serial
          - intune_id
          - meraki_org_id
          - cisco_cm_id
          - registry_key
          - process_path
          - darktrace_id
          - process_username
          - cortex_agent_id
          - orbital_node_id
          - process_uid
          - ngfw_name
          - user
          - certificate_issuer
          - ipv6
          - email
          - cisco_uc_id
          - cvm_id
          - sha256
          - crowdstrike_id
          - google_cloud_id
          - google_chromebook_id
          - acudid
          - sha1
          - registry_name
          - md5
          - service_now_id
          - ip
          - domain
          - email_subject
          - imei
          - ngfw_id
          - amp_computer_guid
          - ms_machine_id
          - secure_access_id
          - mutex
          - processor_id
          - swc_device_id
          - registry_path
          - odns_identity
          - odns_identity_label
          - cisco_mid
          - process_name
          - pki_serial
          - meraki_node_sn
          - email_messageid
          - imsi
          - user_agent
          - process_hash
          - file_name
      additionalProperties: {}
      required:
      - value
      - type
    NewBundleExportSightingsContextHttpEventsTraffic:
      example:
        destination_host_name: string
        protocol: 10
        source_ip: string
        destination_subnet: string
        destination_ip: string
        source_subnet: string
        destination_port: 10
        direction: incoming
        source_port: 10
      type: object
      properties:
        destination_host_name:
          example: string
          type: string
        protocol:
          example: 10
          description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)
          type: integer
          format: int64
        source_ip:
          example: string
          type: string
        destination_subnet:
          example: string
          type: string
        destination_ip:
          example: string
          type: string
        source_subnet:
          example: string
          type: string
        destination_port:
          example: 10
          type: integer
          format: int64
        direction:
          example: incoming
          type: string
          enum:
          - incoming
          - outgoing
        source_port:
          example: 10
          type: integer
          format: int64
      additionalProperties: {}
      required:
      - protocol
      - source_ip
      - destination_ip
      - destination_port
      - direction
      - source_port
    NewBundleExportWeaknessesOperatingSystems:
      example:
        prevalence: Often
        name: string
        version: string
        cpe_id: string
        class: Android
      type: object
      properties:
        prevalence:
          example: Often
          description: Defines the different regularities that guide the applicability of platforms.
          type: string
          enum:
          - Undetermined
          - Sometimes
          - Often
          - Rarely
        name:
          example: string
          description: String with at most 1024 characters.
          type: string
        version:
          example: string
          description: String with at most 1024 characters.
          type: string
        cpe_id:
          example: string
          description: String with at most 1024 characters.
          type: string
        class:
          example: Android
          description: Class of Operating System.
          type: string
      additionalProperties: {}
      required:
      - prevalence
    Traffic:
      example:
        destination_host_name: string
        protocol: 10
        source_ip: string
        destination_subnet: string
        destination_ip: string
        source_subnet: string
        destination_port: 10
        direction: incoming
        source_port: 10
      type: object
      properties:
        destination_host_name:
          example: string
          type: string
        protocol:
          example: 10
          description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)
          type: integer
          format: int64
        source_ip:
          example: string
          type: string
        destination_subnet:
          example: string
          type: string
        destination_ip:
          example: string
          type: string
        source_subnet:
          example: string
          type: string
        destination_port:
          example: 10
          type: integer
          format: int64
        direction:
          example: incoming
          type: string
          enum:
          - incoming
          - outgoing
        source_port:
          example: 10
          type: integer
          format: int64
      additionalProperties: false
      required:
      - protocol
      - source_ip
      - destination_ip
      - destination_port
      - direction
      - source_port
    NewBundleExportIncidentsIncidentTime:
      example:
        opened: '2016-01-01T01:01:01.000Z'
        discovered: '2016-01-01T01:01:01.000Z'
        reported: '2016-01-01T01:01:01.000Z'
        remediated: '2016-01-01T01:01:01.000Z'
        closed: '2016-01-01T01:01:01.000Z'
        rejected: '2016-01-01T01:01:01.000Z'
        contained: '2016-01-01T01:01:01.000Z'
      description: Relevant time values associated with this Incident.
      type: object
      properties:
        opened:
          example: '2016-01-01T01:01:01.000Z'
          description: Time the incident was first opened.
          type: string
          format: date-time
        discovered:
          example: '2016-01-01T01:01:01.000Z'
          description: Time the incident was first discovered.
          type: string
          format: date-time
        reported:
          example: '2016-01-01T01:01:01.000Z'
          description: Time the incident was first reported.
          type: string
          format: date-time
        remediated:
          example: '2016-01-01T01:01:01.000Z'
          description: Time that the remediation of the damage from the incident was completed.
          type: string
          format: date-time
        closed:
          example: '2016-01-01T01:01:01.000Z'
          description: Time that the incident was last closed.
          type: string
          format: date-time
        rejected:
          example: '2016-01-01T01:01:01.000Z'
          description: Time that the incident was first rejected.
          type: string
          format: date-time
        contained:
          example: '2016-01-01T01:01:01.000Z'
          description: Time that the incident was first contained.
          type: string
          format: date-time
      additionalProperties: {}
      required:
      - opened
    IncidentScores:
      example:
        asset: 10.0
      description: Used to indicate the severity or impact score of the threat represented by the incident.
      type: object
      additionalProperties:
        example: 10.0
        description: "Field is used to indicate the severity or impact of the threat represented by the incident.\nIt's an open-type dictionary object with score types and numeric value of the score.\n\nFor example, systems can have the following score types:\n\n- `asset` - assesses the potential damage or harm that the threat can cause to the affected asset(s). The scale ranges from 0 to 10, with 10 indicating the highest potential harm. \n\n- `global` - assesses the overall impact or significance of the threat to the organization or wider community. The scale ranges from 0 to 1000, with 1000 indicating the highest impact.\n\n- `ttp` - a measure of the threat actor's proficiency in utilizing TTPs. Typically, ranges from 0-100, with a higher score indicating a greater threat or concern."
        type: number
        format: double
    CVE:
      example:
        cve_data_meta:
          id: string
          assigner: string
      type: object
      properties:
        cve_data_meta:
          $ref: '#/components/schemas/CVEDataMeta'
      additionalProperties: false
      required:
      - cve_data_meta
    RegistryRenameType:
      example:
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        process_id: 10
        process_name: string
        process_guid: 10
        process_username: string
        registry_key: string
        type: RegistryRenameEvent
        registry_old_key: string
      type: object
      properties:
        time:
          $ref: '#/components/schemas/ObservedTime'
        process_id:
          example: 10
          type: integer
          format: int64
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        registry_key:
          example: string
          description: String with at most 1024 characters.
          type: string
        type:
          example: RegistryRenameEvent
          type: string
          enum:
          - RegistryRenameEvent
        registry_old_key:
          example: string
          description: String with at most 1024 characters.
          type: string
      additionalProperties: false
      required:
      - time
      - process_id
      - process_name
      - registry_key
      - type
      - registry_old_key
    NewBundleExportVulnerabilitiesConfigurationsNodesCpeMatch:
      example:
        vulnerable: true
        cpe23Uri: string
        versionStartIncluding: string
        versionEndIncluding: string
        versionStartExcluding: string
        versionEndExcluding: string
      type: object
      properties:
        vulnerable:
          example: true
          type: boolean
        cpe23Uri:
          example: string
          description: A text representation of a software or hardware platform.
          type: string
        versionStartIncluding:
          example: string
          description: A string representing the lower bound(inclusive) of version in the CPE.
          type: string
        versionEndIncluding:
          example: string
          description: A string representing the upper bound(inclusive) of version in the CPE.
          type: string
        versionStartExcluding:
          example: string
          description: A string representing the lower bound(exclusive) of version in the CPE.
          type: string
        versionEndExcluding:
          example: string
          description: A string representing the upper bound(exclusive) of version in the CPE.
          type: string
      additionalProperties: {}
      required:
      - vulnerable
      - cpe23Uri
    NewBundleExportIdentityAssertionsExternalReferences:
      example:
        source_name: string
        description: string
        url: string
        hashes:
        - string
        external_id: string
      description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
      type: object
      properties:
        source_name:
          example: string
          description: The source within which the external-reference is defined (system, registry, organization, etc.)
          type: string
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        url:
          example: string
          description: A URL reference to an external resource.
          type: string
        hashes:
          example:
          - string
          description: Specifies a dictionary of hashes for the contents of the url.
          type: array
          items:
            type: string
        external_id:
          example: string
          description: An identifier for the external reference content.
          type: string
      additionalProperties: {}
      required:
      - source_name
    NewAssetProperties:
      description: a new Asset-properties
      type: object
      properties:
        properties:
          example:
          - name: string
            value: string
          type: array
          items:
            $ref: '#/components/schemas/AssetProperty'
        authorized_groups:
          type: array
          items:
            type: string
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        asset_ref:
          example: string
          description: URI that points to the associated Asset.
          type: string
        authorized_users:
          type: array
          items:
            type: string
        type:
          example: asset-properties
          type: string
          enum:
          - asset-properties
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        client_id:
          type: string
        groups:
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        owner:
          type: string
      additionalProperties: false
      required:
      - valid_time
      - asset_ref
      - source
    AdditionalProperties:
      example:
        context: string
      type: object
      properties:
        context:
          example: string
          description: String with at most 1024 characters.
          type: string
      additionalProperties: false
      required:
      - context
    NewBundleExportSightingsContext:
      example:
        http_events:
        - process_guid: 10
          traffic:
            destination_host_name: string
            protocol: 10
            source_ip: string
            destination_subnet: string
            destination_ip: string
            source_subnet: string
            destination_port: 10
            direction: incoming
            source_port: 10
          method: CONNECT
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: HTTPEvent
          host: string
          process_name: string
          process_id: 10
          process_username: string
          query: string
          encrypted: true
          url_port: 10
        process_create_events:
        - parent_process_name: string
          process_guid: 10
          parent_process_guid: 10
          process_disposition: string
          parent_process_size: 10
          process_size: 10
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          parent_process_disposition: string
          type: ProcessCreateEvent
          parent_process_username: string
          parent_process_id: 10
          parent_process_args: string
          process_name: string
          process_hash: string
          process_id: 10
          parent_process_hash: string
          process_username: string
          parent_creation_time: '2016-01-01T01:01:01.000Z'
          process_args: string
        registry_delete_events:
        - time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          process_id: 10
          process_name: string
          process_guid: 10
          process_username: string
          registry_key: string
          type: RegistryDeleteEvent
          registry_value: string
        file_modify_events:
        - file_name: string
          process_guid: 10
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: FileModifyEvent
          file_path: string
          process_name: string
          process_id: 10
          process_username: string
          failed: false
        registry_set_events:
        - process_guid: 10
          registry_data: string
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: RegistrySetEvent
          registry_data_length: 10
          registry_value: string
          registry_key: string
          process_name: string
          process_id: 10
          process_username: string
        file_create_events:
        - file_name: string
          process_guid: 10
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: FileCreateEvent
          file_path: string
          process_name: string
          process_id: 10
          process_username: string
          failed: false
        registry_create_events:
        - time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          process_id: 10
          process_name: string
          process_guid: 10
          process_username: string
          registry_key: string
          type: RegistryCreateEvent
        library_load_events:
        - time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          process_id: 10
          process_name: string
          process_guid: 10
          process_username: string
          type: LibraryLoadEvent
          dll_library_name: string
          dll_library_path: string
        file_move_events:
        - file_name: string
          process_guid: 10
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: FileMoveEvent
          old_name: string
          file_path: string
          process_name: string
          process_id: 10
          process_username: string
          new_name: string
        file_delete_events:
        - file_name: string
          process_guid: 10
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: FileDeleteEvent
          file_path: string
          process_name: string
          process_id: 10
          process_username: string
          failed: false
        netflow_events:
        - parent_process_name: string
          byte_count_in: 10
          process_guid: 10
          process_path: string
          traffic:
            destination_host_name: string
            protocol: 10
            source_ip: string
            destination_subnet: string
            destination_ip: string
            source_subnet: string
            destination_port: 10
            direction: incoming
            source_port: 10
          flow_time: '2016-01-01T01:01:01.000Z'
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          parent_process_account: string
          type: NetflowEvent
          process_account_type: string
          parent_process_path: string
          parent_process_id: 10
          parent_process_args: string
          process_name: string
          process_account: string
          parent_process_account_type: string
          process_hash: string
          process_id: 10
          parent_process_hash: string
          process_username: string
          byte_count_out: 10
          process_args: string
        registry_rename_events:
        - time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          process_id: 10
          process_name: string
          process_guid: 10
          process_username: string
          registry_key: string
          type: RegistryRenameEvent
          registry_old_key: string
      description: Context including the event type that best fits the type of the sighting.
      type: object
      properties:
        http_events:
          example:
          - process_guid: 10
            traffic:
              destination_host_name: string
              protocol: 10
              source_ip: string
              destination_subnet: string
              destination_ip: string
              source_subnet: string
              destination_port: 10
              direction: incoming
              source_port: 10
            method: CONNECT
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: HTTPEvent
            host: string
            process_name: string
            process_id: 10
            process_username: string
            query: string
            encrypted: true
            url_port: 10
          description: a list of `HTTPType`
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportSightingsContextHttpEvents'
        process_create_events:
          example:
          - parent_process_name: string
            process_guid: 10
            parent_process_guid: 10
            process_disposition: string
            parent_process_size: 10
            process_size: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            parent_process_disposition: string
            type: ProcessCreateEvent
            parent_process_username: string
            parent_process_id: 10
            parent_process_args: string
            process_name: string
            process_hash: string
            process_id: 10
            parent_process_hash: string
            process_username: string
            parent_creation_time: '2016-01-01T01:01:01.000Z'
            process_args: string
          description: a list of `ProcessCreate`
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportSightingsContextProcessCreateEvents'
        registry_delete_events:
          example:
          - time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            process_id: 10
            process_name: string
            process_guid: 10
            process_username: string
            registry_key: string
            type: RegistryDeleteEvent
            registry_value: string
          description: a list of `RegistryDeleteType`
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportSightingsContextRegistryDeleteEvents'
        file_modify_events:
          example:
          - file_name: string
            process_guid: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: FileModifyEvent
            file_path: string
            process_name: string
            process_id: 10
            process_username: string
            failed: false
          description: a list of `FileModifyType`
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportSightingsContextFileModifyEvents'
        registry_set_events:
          example:
          - process_guid: 10
            registry_data: string
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: RegistrySetEvent
            registry_data_length: 10
            registry_value: string
            registry_key: string
            process_name: string
            process_id: 10
            process_username: string
          description: a list of `RegistrySetType`
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportSightingsContextRegistrySetEvents'
        file_create_events:
          example:
          - file_name: string
            process_guid: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: FileCreateEvent
            file_path: string
            process_name: string
            process_id: 10
            process_username: string
            failed: false
          description: a list of `FileCreateType`
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportSightingsContextFileCreateEvents'
        registry_create_events:
          example:
          - time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            process_id: 10
            process_name: string
            process_guid: 10
            process_username: string
            registry_key: string
            type: RegistryCreateEvent
          description: a list of `RegistryCreateType`
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportSightingsContextRegistryCreateEvents'
        library_load_events:
          example:
          - time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            process_id: 10
            process_name: string
            process_guid: 10
            process_username: string
            type: LibraryLoadEvent
            dll_library_name: string
            dll_library_path: string
          description: a list of `LibraryLoadType`
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportSightingsContextLibraryLoadEvents'
        file_move_events:
          example:
          - file_name: string
            process_guid: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: FileMoveEvent
            old_name: string
            file_path: string
            process_name: string
            process_id: 10
            process_username: string
            new_name: string
          description: a list of `FileMoveType`
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportSightingsContextFileMoveEvents'
        file_delete_events:
          example:
          - file_name: string
            process_guid: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: FileDeleteEvent
            file_path: string
            process_name: string
            process_id: 10
            process_username: string
            failed: false
          description: a list of `FileDeleteType`
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportSightingsContextFileDeleteEvents'
        netflow_events:
          example:
          - parent_process_name: string
            byte_count_in: 10
            process_guid: 10
            process_path: string
            traffic:
              destination_host_name: string
              protocol: 10
              source_ip: string
              destination_subnet: string
              destination_ip: string
              source_subnet: string
              destination_port: 10
              direction: incoming
              source_port: 10
            flow_time: '2016-01-01T01:01:01.000Z'
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            parent_process_account: string
            type: NetflowEvent
            process_account_type: string
            parent_process_path: string
            parent_process_id: 10
            parent_process_args: string
            process_name: string
            process_account: string
            parent_process_account_type: string
            process_hash: string
            process_id: 10
            parent_process_hash: string
            process_username: string
            byte_count_out: 10
            process_args: string
          description: a list of `NetflowType`
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportSightingsContextNetflowEvents'
        registry_rename_events:
          example:
          - time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            process_id: 10
            process_name: string
            process_guid: 10
            process_username: string
            registry_key: string
            type: RegistryRenameEvent
            registry_old_key: string
          description: a list of `RegistryRenameType`
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportSightingsContextRegistryRenameEvents'
      additionalProperties: {}
    Body116683:
      example:
        description: string
        valid_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        asset_mapping_refs:
        - string
        note_refs:
        - string
        data_table_refs:
        - string
        attack_pattern_refs:
        - string
        sighting_refs:
        - string
        schema_version: 1.3.30
        revision: 10
        assets:
        - description: string
          asset_type: application
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          schema_version: 1.3.30
          revision: 10
          type: asset
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
        weakness_refs:
        - string
        tool_refs:
        - string
        target_record_refs:
        - string
        asset_refs:
        - string
        tools:
        - description: string
          labels:
          - credential-exploitation
          schema_version: 1.3.30
          revision: 10
          type: tool
          x_mitre_aliases:
          - string
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tool_version: string
          tlp: green
          kill_chain_phases:
          - kill_chain_name: string
            phase_name: string
          timestamp: '2016-01-01T01:01:01.000Z'
        indicators:
        - description: string
          tags:
          - string
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          producer: string
          schema_version: 1.3.30
          revision: 10
          type: indicator
          test_mechanisms:
          - string
          source: string
          external_ids:
          - string
          short_description: string
          composite_indicator_expression:
            operator: and
            indicator_ids:
            - string
          title: string
          likely_impact: string
          indicator_type:
          - Anonymization
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          severity: Critical
          tlp: green
          kill_chain_phases:
          - kill_chain_name: string
            phase_name: string
          negate: true
          timestamp: '2016-01-01T01:01:01.000Z'
          confidence: High
          specification:
            type: Judgement
            judgements:
            - string
            required_judgements:
            - confidence: High
              source: string
              relationship: string
              judgement_id: string
        attack_patterns:
        - description: string
          abstraction_level: aggregate
          schema_version: 1.3.30
          revision: 10
          type: attack-pattern
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          x_mitre_platforms:
          - string
          language: string
          id: string
          tlp: green
          x_mitre_data_sources:
          - string
          kill_chain_phases:
          - kill_chain_name: string
            phase_name: string
          x_mitre_contributors:
          - string
          timestamp: '2016-01-01T01:01:01.000Z'
        type: bundle
        weaknesses:
        - description: string
          background_details: string
          paradigms:
          - prevalence: Often
            name: string
          abstraction_level: Base
          architectures:
          - prevalence: Often
            name: string
            class: Embedded
          schema_version: 1.3.30
          revision: 10
          alternate_terms:
          - term: string
            description: string
          likelihood: High
          type: weakness
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          functional_areas:
          - Authentication
          source_uri: string
          modes_of_introduction:
          - phase: Architecture and Design
            note: string
          structure: Chain
          language: string
          id: string
          notes:
          - type: Applicable Platform
            note: string
          common_consequences:
          - scopes:
            - Access Control
            impacts:
            - Alter Execution Logic
            likelihood: High
            note: string
          tlp: green
          detection_methods:
          - method: Architecture or Design Review
            description: string
            effectiveness: High
            effectiveness_notes: string
          operating_systems:
          - prevalence: Often
            name: string
            version: string
            cpe_id: string
            class: Android
          affected_resources:
          - CPU
          languages:
          - prevalence: Often
            name: string
            class: Assembly
          timestamp: '2016-01-01T01:01:01.000Z'
          potential_mitigations:
          - description: string
            phases:
            - Architecture and Design
            strategy: Attack Surface Reduction
            effectiveness: Defense in Depth
            effectiveness_notes: string
          technologies:
          - prevalence: Often
            name: string
        source: string
        external_ids:
        - string
        feedback_refs:
        - string
        asset_properties:
        - properties:
          - name: string
            value: string
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          schema_version: 1.3.30
          revision: 10
          asset_ref: string
          type: asset-properties
          source: string
          external_ids:
          - string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
        short_description: string
        feedbacks:
        - feedback: -1
          schema_version: 1.3.30
          revision: 10
          type: feedback
          source: string
          external_ids:
          - string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          reason: string
          source_uri: string
          language: string
          id: string
          tlp: green
          entity_id: string
          timestamp: '2016-01-01T01:01:01.000Z'
        judgement_refs:
        - string
        title: string
        coa_refs:
        - string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        verdicts:
        - type: verdict
          disposition: 1
          observable:
            value: 1.2.3.4
            type: ip
          judgement_id: string
          disposition_name: Clean
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
        campaigns:
        - description: string
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          schema_version: 1.3.30
          revision: 10
          type: campaign
          campaign_type: string
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          activity:
          - date_time: '2016-01-01T01:01:01.000Z'
            description: string
          source_uri: string
          intended_effect:
          - Account Takeover
          status: Future
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
          confidence: High
          names:
          - string
        source_uri: string
        actors:
        - description: string
          motivation: Ego
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          identity:
            description: string
            related_identities:
            - identity: string
              confidence: High
              information_source: string
              relationship: string
          sophistication: Aspirant
          schema_version: 1.3.30
          revision: 10
          planning_and_operational_support: string
          type: actor
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          intended_effect: Account Takeover
          language: string
          id: string
          tlp: green
          aliases:
          - string
          timestamp: '2016-01-01T01:01:01.000Z'
          confidence: High
          actor_types:
          - Cyber Espionage Operations
        indicator_refs:
        - string
        actor_refs:
        - string
        language: string
        data_tables:
        - description: string
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          schema_version: 1.3.30
          revision: 10
          columns:
          - name: string
            type: integer
            description: string
            required: true
            short_description: string
          type: data-table
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          rows:
          - - anything
          source_uri: string
          language: string
          id: string
          tlp: green
          row_count: 10
          timestamp: '2016-01-01T01:01:01.000Z'
        id: string
        notes:
        - schema_version: 1.3.30
          revision: 10
          content: string
          note_class: keyword
          type: note
          source: string
          external_ids:
          - string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          author: string
          source_uri: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
          related_entities:
          - entity_type: string
            entity_id: string
        identity_assertions:
        - valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          identity:
            observables:
            - value: 1.2.3.4
              type: ip
          schema_version: 1.3.30
          revision: 10
          type: identity-assertion
          source: string
          external_ids:
          - string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
          assertions:
          - name: cisco:ctr:ad:host_domain_name
            value: string
        judgements:
        - valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          schema_version: 1.3.30
          revision: 10
          observable:
            value: 1.2.3.4
            type: ip
          reason_uri: string
          type: judgement
          source: string
          external_ids:
          - string
          disposition: 1
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          reason: string
          source_uri: string
          disposition_name: Clean
          priority: 10
          language: string
          id: string
          severity: Critical
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
          confidence: High
        malwares:
        - description: string
          labels:
          - adware
          abstraction_level: family
          schema_version: 1.3.30
          revision: 10
          type: malware
          x_mitre_aliases:
          - string
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tlp: green
          kill_chain_phases:
          - kill_chain_name: string
            phase_name: string
          timestamp: '2016-01-01T01:01:01.000Z'
        target_records:
        - description: string
          schema_version: 1.3.30
          revision: 10
          type: target-record
          source: string
          external_ids:
          - string
          targets:
          - type: endpoint
            observables:
            - value: 1.2.3.4
              type: ip
            observed_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            os: string
            internal: false
            sensor: string
            source_uri: string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
        asset_mappings:
        - asset_type: application
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          stability: Managed
          schema_version: 1.3.30
          revision: 10
          observable:
            value: 1.2.3.4
            type: ip
          asset_ref: string
          type: asset-mapping
          source: string
          external_ids:
          - string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
          specificity: Low
          confidence: High
        relationship_refs:
        - string
        tlp: green
        incidents:
        - description: string
          assignees:
          - string
          detection_sources:
          - string
          meta:
            keyword: string
          schema_version: 1.3.30
          revision: 10
          type: incident
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          incident_time:
            opened: '2016-01-01T01:01:01.000Z'
            discovered: '2016-01-01T01:01:01.000Z'
            reported: '2016-01-01T01:01:01.000Z'
            remediated: '2016-01-01T01:01:01.000Z'
            closed: '2016-01-01T01:01:01.000Z'
            rejected: '2016-01-01T01:01:01.000Z'
            contained: '2016-01-01T01:01:01.000Z'
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          discovery_method: Agent Disclosure
          source_uri: string
          intended_effect: Account Takeover
          categories:
          - Attrition
          status: Closed
          language: string
          detection_status: active
          id: string
          promotion_method: Automated
          severity: Critical
          tlp: green
          scores:
            asset: 10.0
          techniques:
          - string
          timestamp: '2016-01-01T01:01:01.000Z'
          confidence: High
          short_id: string
          tactics:
          - string
        identity_assertion_refs:
        - string
        sightings:
        - description: string
          schema_version: 1.3.30
          revision: 10
          relations:
          - origin: string
            origin_uri: string
            relation: Allocated
            relation_info:
              keyword: anything
            source:
              value: 1.2.3.4
              type: ip
            related:
              value: 1.2.3.4
              type: ip
          sensor_coordinates:
            type: endpoint
            observables:
            - value: 1.2.3.4
              type: ip
            os: string
          observables:
          - value: 1.2.3.4
            type: ip
          type: sighting
          source: string
          external_ids:
          - string
          targets:
          - type: endpoint
            observables:
            - value: 1.2.3.4
              type: ip
            observed_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            os: string
          short_description: string
          title: string
          resolution: detected
          internal: false
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          detection_interval:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          source_uri: string
          activity_interval:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          language: string
          id: string
          count: 10
          severity: Critical
          tlp: green
          modification_interval:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          context:
            http_events:
            - process_guid: 10
              traffic:
                destination_host_name: string
                protocol: 10
                source_ip: string
                destination_subnet: string
                destination_ip: string
                source_subnet: string
                destination_port: 10
                direction: incoming
                source_port: 10
              method: CONNECT
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              type: HTTPEvent
              host: string
              process_name: string
              process_id: 10
              process_username: string
              query: string
              encrypted: true
              url_port: 10
            process_create_events:
            - parent_process_name: string
              process_guid: 10
              parent_process_guid: 10
              process_disposition: string
              parent_process_size: 10
              process_size: 10
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              parent_process_disposition: string
              type: ProcessCreateEvent
              parent_process_username: string
              parent_process_id: 10
              parent_process_args: string
              process_name: string
              process_hash: string
              process_id: 10
              parent_process_hash: string
              process_username: string
              parent_creation_time: '2016-01-01T01:01:01.000Z'
              process_args: string
            registry_delete_events:
            - time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              process_id: 10
              process_name: string
              process_guid: 10
              process_username: string
              registry_key: string
              type: RegistryDeleteEvent
              registry_value: string
            file_modify_events:
            - file_name: string
              process_guid: 10
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              type: FileModifyEvent
              file_path: string
              process_name: string
              process_id: 10
              process_username: string
              failed: false
            registry_set_events:
            - process_guid: 10
              registry_data: string
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              type: RegistrySetEvent
              registry_data_length: 10
              registry_value: string
              registry_key: string
              process_name: string
              process_id: 10
              process_username: string
            file_create_events:
            - file_name: string
              process_guid: 10
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              type: FileCreateEvent
              file_path: string
              process_name: string
              process_id: 10
              process_username: string
              failed: false
            registry_create_events:
            - time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              process_id: 10
              process_name: string
              process_guid: 10
              process_username: string
              registry_key: string
              type: RegistryCreateEvent
            library_load_events:
            - time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              process_id: 10
              process_name: string
              process_guid: 10
              process_username: string
              type: LibraryLoadEvent
              dll_library_name: string
              dll_library_path: string
            file_move_events:
            - file_name: string
              process_guid: 10
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              type: FileMoveEvent
              old_name: string
              file_path: string
              process_name: string
              process_id: 10
              process_username: string
              new_name: string
            file_delete_events:
            - file_name: string
              process_guid: 10
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              type: FileDeleteEvent
              file_path: string
              process_name: string
              process_id: 10
              process_username: string
              failed: false
            netflow_events:
            - parent_process_name: string
              byte_count_in: 10
              process_guid: 10
              process_path: string
              traffic:
                destination_host_name: string
                protocol: 10
                source_ip: string
                destination_subnet: string
                destination_ip: string
                source_subnet: string
                destination_port: 10
                direction: incoming
                source_port: 10
              flow_time: '2016-01-01T01:01:01.000Z'
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              parent_process_account: string
              type: NetflowEvent
              process_account_type: string
              parent_process_path: string
              parent_process_id: 10
              parent_process_args: string
              process_name: string
              process_account: string
              parent_process_account_type: string
              process_hash: string
              process_id: 10
              parent_process_hash: string
              process_username: string
              byte_count_out: 10
              process_args: string
            registry_rename_events:
            - time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              process_id: 10
              process_name: string
              process_guid: 10
              process_username: string
              registry_key: string
              type: RegistryRenameEvent
              registry_old_key: string
          timestamp: '2016-01-01T01:01:01.000Z'
          confidence: High
          observed_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          sensor: endpoint
          data:
            columns:
            - name: string
              type: integer
              description: string
              required: true
              short_description: string
            rows:
            - - anything
            row_count: 10
        campaign_refs:
        - string
        vulnerability_refs:
        - string
        asset_properties_refs:
        - string
        relationships:
        - description: string
          schema_version: 1.3.30
          revision: 10
          target_ref: string
          type: relationship
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          source_ref: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
          relationship_type: attributed-to
        timestamp: '2016-01-01T01:01:01.000Z'
        verdict_refs:
        - string
        malware_refs:
        - string
        incident_refs:
        - string
        vulnerabilities:
        - description: string
          schema_version: 1.3.30
          revision: 10
          published_date: '2016-01-01T01:01:01.000Z'
          cve:
            cve_data_meta:
              id: string
              assigner: string
          configurations:
            CVE_data_version: string
            nodes:
            - operator: AND
              cpe_match:
              - vulnerable: true
                cpe23Uri: string
                versionStartIncluding: string
                versionEndIncluding: string
                versionStartExcluding: string
                versionEndExcluding: string
              children:
              - operator: AND
                cpe_match:
                - vulnerable: true
                  cpe23Uri: string
                  versionStartIncluding: string
                  versionEndIncluding: string
                  versionStartExcluding: string
                  versionEndExcluding: string
                negate: true
              negate: true
          type: vulnerability
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
          last_modified_date: '2016-01-01T01:01:01.000Z'
          impact:
            cvss_v2:
              integrity_impact: complete
              target_distribution: not_defined
              availability_requirement: not_defined
              exploitability: not_defined
              access_complexity: low
              temporal_vector_string: string
              exploitability_score: 10.0
              impact_score: 10.0
              user_interaction_required: true
              environmental_vector_string: string
              obtain_other_privilege: true
              availability_impact: complete
              access_vector: network
              base_severity: High
              confidentiality_impact: complete
              confidentiality_requirement: not_defined
              report_confidence: not_defined
              authentication: none
              base_score: 10.0
              obtain_user_privilege: true
              obtain_all_privilege: true
              collateral_damage_potential: not_defined
              remediation_level: not_defined
              vector_string: string
              integrity_requirement: not_defined
            cvss_v3:
              integrity_impact: high
              modified_user_interaction: none
              modified_scope: not_defined
              availability_requirement: high
              user_interaction: none
              modified_integrity_impact: not_defined
              privileges_required: high
              exploitability_score: 10.0
              impact_score: 10.0
              environmental_severity: critical
              modified_availability_impact: not_defined
              availability_impact: high
              scope: changed
              exploit_code_maturity: functional
              modified_attack_complexity: not_defined
              base_severity: critical
              confidentiality_impact: high
              temporal_severity: critical
              modified_confidentiality_impact: not_defined
              confidentiality_requirement: high
              report_confidence: confirmed
              temporal_score: 10.0
              modified_privileges_required: not_defined
              modified_attack_vector: not_defined
              base_score: 10.0
              environmental_score: 10.0
              remediation_level: high
              vector_string: string
              integrity_requirement: high
              attack_vector: adjacent_network
              attack_complexity: high
        coas:
        - description: string
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          stage: Containment
          schema_version: 1.3.30
          revision: 10
          efficacy: High
          type: coa
          related_COAs:
          - confidence: High
            source: string
            relationship: string
            COA_id: string
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          coa_type: Diplomatic Actions
          language: string
          id: string
          tlp: green
          objective:
          - string
          cost: High
          timestamp: '2016-01-01T01:01:01.000Z'
          open_c2_coa:
            type: structured_coa
            id: string
            action:
              type: alert
            target:
              type: acudid
              specifiers: string
            actuator:
              type: endpoint
              specifiers:
              - string
            modifiers:
              response: acknowledge
              method:
              - acl
              additional_properties:
                context: string
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              frequency: string
              duration: '2016-01-01T01:01:01.000Z'
              source: string
              search: cve
              option: string
              id: string
              location: internal
              delay: '2016-01-01T01:01:01.000Z'
              destination: copy-to
          structured_coa_type: openc2
          impact: string
      description: Describes a Bundle of any set of CTIM entities.
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        authorized_groups:
          type: array
          items:
            type: string
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        asset_mapping_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        note_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        attack_pattern_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        sighting_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        assets:
          example:
          - description: string
            asset_type: application
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            type: asset
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `NewAsset`s.
          type: array
          items:
            $ref: '#/components/schemas/NewAsset'
          uniqueItems: true
        tool_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        target_record_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        asset_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        tools:
          example:
          - description: string
            labels:
            - credential-exploitation
            schema_version: 1.3.30
            revision: 10
            type: tool
            x_mitre_aliases:
            - string
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tool_version: string
            tlp: green
            kill_chain_phases:
            - kill_chain_name: string
              phase_name: string
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `NewTool`s.
          type: array
          items:
            $ref: '#/components/schemas/NewTool'
          uniqueItems: true
        indicators:
          example:
          - description: string
            tags:
            - string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            producer: string
            schema_version: 1.3.30
            revision: 10
            type: indicator
            test_mechanisms:
            - string
            source: string
            external_ids:
            - string
            short_description: string
            composite_indicator_expression:
              operator: and
              indicator_ids:
              - string
            title: string
            likely_impact: string
            indicator_type:
            - Anonymization
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            severity: Critical
            tlp: green
            kill_chain_phases:
            - kill_chain_name: string
              phase_name: string
            negate: true
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            specification:
              type: Judgement
              judgements:
              - string
              required_judgements:
              - confidence: High
                source: string
                relationship: string
                judgement_id: string
          description: a list of `NewIndicator`s.
          type: array
          items:
            $ref: '#/components/schemas/NewIndicator'
          uniqueItems: true
        authorized_users:
          type: array
          items:
            type: string
        attack_patterns:
          example:
          - description: string
            abstraction_level: aggregate
            schema_version: 1.3.30
            revision: 10
            type: attack-pattern
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            x_mitre_platforms:
            - string
            language: string
            id: string
            tlp: green
            x_mitre_data_sources:
            - string
            kill_chain_phases:
            - kill_chain_name: string
              phase_name: string
            x_mitre_contributors:
            - string
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `NewAttackPattern`s.
          type: array
          items:
            $ref: '#/components/schemas/NewAttackPattern'
          uniqueItems: true
        type:
          example: bundle
          type: string
          enum:
          - bundle
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        asset_properties:
          example:
          - properties:
            - name: string
              value: string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            asset_ref: string
            type: asset-properties
            source: string
            external_ids:
            - string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `NewAssetProperties`s.
          type: array
          items:
            $ref: '#/components/schemas/NewAssetProperties'
          uniqueItems: true
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        judgement_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        coa_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        verdicts:
          example:
          - type: verdict
            disposition: 1
            observable:
              value: 1.2.3.4
              type: ip
            judgement_id: string
            disposition_name: Clean
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
          description: a list of `Verdict`s.
          type: array
          items:
            $ref: '#/components/schemas/Verdict'
          uniqueItems: true
        campaigns:
          example:
          - description: string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            type: campaign
            campaign_type: string
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            activity:
            - date_time: '2016-01-01T01:01:01.000Z'
              description: string
            source_uri: string
            intended_effect:
            - Account Takeover
            status: Future
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            names:
            - string
          description: a list of `NewCampaign`s.
          type: array
          items:
            $ref: '#/components/schemas/NewCampaign'
          uniqueItems: true
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        actors:
          example:
          - description: string
            motivation: Ego
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            identity:
              description: string
              related_identities:
              - identity: string
                confidence: High
                information_source: string
                relationship: string
            sophistication: Aspirant
            schema_version: 1.3.30
            revision: 10
            planning_and_operational_support: string
            type: actor
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            intended_effect: Account Takeover
            language: string
            id: string
            tlp: green
            aliases:
            - string
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            actor_types:
            - Cyber Espionage Operations
          description: a list of `NewActor`s.
          type: array
          items:
            $ref: '#/components/schemas/NewActor'
          uniqueItems: true
        indicator_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        actor_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        notes:
          example:
          - schema_version: 1.3.30
            revision: 10
            content: string
            note_class: keyword
            type: note
            source: string
            external_ids:
            - string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            author: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            related_entities:
            - entity_type: string
              entity_id: string
          description: a list of `NewNote`s.
          type: array
          items:
            $ref: '#/components/schemas/NewNote'
          uniqueItems: true
        judgements:
          example:
          - valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            observable:
              value: 1.2.3.4
              type: ip
            reason_uri: string
            type: judgement
            source: string
            external_ids:
            - string
            disposition: 1
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            reason: string
            source_uri: string
            disposition_name: Clean
            priority: 10
            language: string
            id: string
            severity: Critical
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
          description: a list of `NewJudgement`s.
          type: array
          items:
            $ref: '#/components/schemas/NewJudgement'
          uniqueItems: true
        malwares:
          example:
          - description: string
            labels:
            - adware
            abstraction_level: family
            schema_version: 1.3.30
            revision: 10
            type: malware
            x_mitre_aliases:
            - string
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            kill_chain_phases:
            - kill_chain_name: string
              phase_name: string
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `NewMalware`s.
          type: array
          items:
            $ref: '#/components/schemas/NewMalware'
          uniqueItems: true
        target_records:
          example:
          - description: string
            schema_version: 1.3.30
            revision: 10
            type: target-record
            source: string
            external_ids:
            - string
            targets:
            - type: endpoint
              observables:
              - value: 1.2.3.4
                type: ip
              observed_time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              os: string
              internal: false
              sensor: string
              source_uri: string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `NewTargetRecord`s.
          type: array
          items:
            $ref: '#/components/schemas/NewTargetRecord'
          uniqueItems: true
        asset_mappings:
          example:
          - asset_type: application
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            stability: Managed
            schema_version: 1.3.30
            revision: 10
            observable:
              value: 1.2.3.4
              type: ip
            asset_ref: string
            type: asset-mapping
            source: string
            external_ids:
            - string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            specificity: Low
            confidence: High
          description: a list of `NewAssetMapping`s.
          type: array
          items:
            $ref: '#/components/schemas/NewAssetMapping'
          uniqueItems: true
        relationship_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        incidents:
          example:
          - description: string
            assignees:
            - string
            detection_sources:
            - string
            meta:
              keyword: string
            schema_version: 1.3.30
            revision: 10
            type: incident
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            incident_time:
              opened: '2016-01-01T01:01:01.000Z'
              discovered: '2016-01-01T01:01:01.000Z'
              reported: '2016-01-01T01:01:01.000Z'
              remediated: '2016-01-01T01:01:01.000Z'
              closed: '2016-01-01T01:01:01.000Z'
              rejected: '2016-01-01T01:01:01.000Z'
              contained: '2016-01-01T01:01:01.000Z'
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            discovery_method: Agent Disclosure
            source_uri: string
            intended_effect: Account Takeover
            categories:
            - Attrition
            status: Closed
            language: string
            detection_status: active
            id: string
            promotion_method: Automated
            severity: Critical
            tlp: green
            scores:
              asset: 10.0
            techniques:
            - string
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            short_id: string
            tactics:
            - string
          description: a list of `NewIncident`s.
          type: array
          items:
            $ref: '#/components/schemas/NewIncident'
          uniqueItems: true
        client_id:
          type: string
        sightings:
          example:
          - description: string
            schema_version: 1.3.30
            revision: 10
            relations:
            - origin: string
              origin_uri: string
              relation: Allocated
              relation_info:
                keyword: anything
              source:
                value: 1.2.3.4
                type: ip
              related:
                value: 1.2.3.4
                type: ip
            sensor_coordinates:
              type: endpoint
              observables:
              - value: 1.2.3.4
                type: ip
              os: string
            observables:
            - value: 1.2.3.4
              type: ip
            type: sighting
            source: string
            external_ids:
            - string
            targets:
            - type: endpoint
              observables:
              - value: 1.2.3.4
                type: ip
              observed_time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              os: string
            short_description: string
            title: string
            resolution: detected
            internal: false
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            detection_interval:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            source_uri: string
            activity_interval:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            language: string
            id: string
            count: 10
            severity: Critical
            tlp: green
            modification_interval:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            context:
              http_events:
              - process_guid: 10
                traffic:
                  destination_host_name: string
                  protocol: 10
                  source_ip: string
                  destination_subnet: string
                  destination_ip: string
                  source_subnet: string
                  destination_port: 10
                  direction: incoming
                  source_port: 10
                method: CONNECT
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: HTTPEvent
                host: string
                process_name: string
                process_id: 10
                process_username: string
                query: string
                encrypted: true
                url_port: 10
              process_create_events:
              - parent_process_name: string
                process_guid: 10
                parent_process_guid: 10
                process_disposition: string
                parent_process_size: 10
                process_size: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                parent_process_disposition: string
                type: ProcessCreateEvent
                parent_process_username: string
                parent_process_id: 10
                parent_process_args: string
                process_name: string
                process_hash: string
                process_id: 10
                parent_process_hash: string
                process_username: string
                parent_creation_time: '2016-01-01T01:01:01.000Z'
                process_args: string
              registry_delete_events:
              - time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                process_id: 10
                process_name: string
                process_guid: 10
                process_username: string
                registry_key: string
                type: RegistryDeleteEvent
                registry_value: string
              file_modify_events:
              - file_name: string
                process_guid: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: FileModifyEvent
                file_path: string
                process_name: string
                process_id: 10
                process_username: string
                failed: false
              registry_set_events:
              - process_guid: 10
                registry_data: string
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: RegistrySetEvent
                registry_data_length: 10
                registry_value: string
                registry_key: string
                process_name: string
                process_id: 10
                process_username: string
              file_create_events:
              - file_name: string
                process_guid: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: FileCreateEvent
                file_path: string
                process_name: string
                process_id: 10
                process_username: string
                failed: false
              registry_create_events:
              - time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                process_id: 10
                process_name: string
                process_guid: 10
                process_username: string
                registry_key: string
                type: RegistryCreateEvent
              library_load_events:
              - time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                process_id: 10
                process_name: string
                process_guid: 10
                process_username: string
                type: LibraryLoadEvent
                dll_library_name: string
                dll_library_path: string
              file_move_events:
              - file_name: string
                process_guid: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: FileMoveEvent
                old_name: string
                file_path: string
                process_name: string
                process_id: 10
                process_username: string
                new_name: string
              file_delete_events:
              - file_name: string
                process_guid: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: FileDeleteEvent
                file_path: string
                process_name: string
                process_id: 10
                process_username: string
                failed: false
              netflow_events:
              - parent_process_name: string
                byte_count_in: 10
                process_guid: 10
                process_path: string
                traffic:
                  destination_host_name: string
                  protocol: 10
                  source_ip: string
                  destination_subnet: string
                  destination_ip: string
                  source_subnet: string
                  destination_port: 10
                  direction: incoming
                  source_port: 10
                flow_time: '2016-01-01T01:01:01.000Z'
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                parent_process_account: string
                type: NetflowEvent
                process_account_type: string
                parent_process_path: string
                parent_process_id: 10
                parent_process_args: string
                process_name: string
                process_account: string
                parent_process_account_type: string
                process_hash: string
                process_id: 10
                parent_process_hash: string
                process_username: string
                byte_count_out: 10
                process_args: string
              registry_rename_events:
              - time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                process_id: 10
                process_name: string
                process_guid: 10
                process_username: string
                registry_key: string
                type: RegistryRenameEvent
                registry_old_key: string
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            observed_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            sensor: endpoint
            data:
              columns:
              - name: string
                type: integer
                description: string
                required: true
                short_description: string
              rows:
              - - anything
              row_count: 10
          description: a list of `NewSighting`s.
          type: array
          items:
            $ref: '#/components/schemas/NewSighting'
          uniqueItems: true
        campaign_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        vulnerability_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        groups:
          type: array
          items:
            type: string
        asset_properties_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        relationships:
          example:
          - description: string
            schema_version: 1.3.30
            revision: 10
            target_ref: string
            type: relationship
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            source_ref: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            relationship_type: attributed-to
          description: a list of `NewRelationship`s.
          type: array
          items:
            $ref: '#/components/schemas/NewRelationship'
          uniqueItems: true
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        verdict_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        malware_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        owner:
          type: string
        incident_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        vulnerabilities:
          example:
          - description: string
            schema_version: 1.3.30
            revision: 10
            published_date: '2016-01-01T01:01:01.000Z'
            cve:
              cve_data_meta:
                id: string
                assigner: string
            configurations:
              CVE_data_version: string
              nodes:
              - operator: AND
                cpe_match:
                - vulnerable: true
                  cpe23Uri: string
                  versionStartIncluding: string
                  versionEndIncluding: string
                  versionStartExcluding: string
                  versionEndExcluding: string
                children:
                - operator: AND
                  cpe_match:
                  - vulnerable: true
                    cpe23Uri: string
                    versionStartIncluding: string
                    versionEndIncluding: string
                    versionStartExcluding: string
                    versionEndExcluding: string
                  negate: true
                negate: true
            type: vulnerability
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            last_modified_date: '2016-01-01T01:01:01.000Z'
            impact:
              cvss_v2:
                integrity_impact: complete
                target_distribution: not_defined
                availability_requirement: not_defined
                exploitability: not_defined
                access_complexity: low
                temporal_vector_string: string
                exploitability_score: 10.0
                impact_score: 10.0
                user_interaction_required: true
                environmental_vector_string: string
                obtain_other_privilege: true
                availability_impact: complete
                access_vector: network
                base_severity: High
                confidentiality_impact: complete
                confidentiality_requirement: not_defined
                report_confidence: not_defined
                authentication: none
                base_score: 10.0
                obtain_user_privilege: true
                obtain_all_privilege: true
                collateral_damage_potential: not_defined
                remediation_level: not_defined
                vector_string: string
                integrity_requirement: not_defined
              cvss_v3:
                integrity_impact: high
                modified_user_interaction: none
                modified_scope: not_defined
                availability_requirement: high
                user_interaction: none
                modified_integrity_impact: not_defined
                privileges_required: high
                exploitability_score: 10.0
                impact_score: 10.0
                environmental_severity: critical
                modified_availability_impact: not_defined
                availability_impact: high
                scope: changed
                exploit_code_maturity: functional
                modified_attack_complexity: not_defined
                base_severity: critical
                confidentiality_impact: high
                temporal_severity: critical
                modified_confidentiality_impact: not_defined
                confidentiality_requirement: high
                report_confidence: confirmed
                temporal_score: 10.0
                modified_privileges_required: not_defined
                modified_attack_vector: not_defined
                base_score: 10.0
                environmental_score: 10.0
                remediation_level: high
                vector_string: string
                integrity_requirement: high
                attack_vector: adjacent_network
                attack_complexity: high
          description: a list of `NewVulnerability`s.
          type: array
          items:
            $ref: '#/components/schemas/NewVulnerability'
          uniqueItems: true
        coas:
          example:
          - description: string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            stage: Containment
            schema_version: 1.3.30
            revision: 10
            efficacy: High
            type: coa
            related_COAs:
            - confidence: High
              source: string
              relationship: string
              COA_id: string
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            coa_type: Diplomatic Actions
            language: string
            id: string
            tlp: green
            objective:
            - string
            cost: High
            timestamp: '2016-01-01T01:01:01.000Z'
            open_c2_coa:
              type: structured_coa
              id: string
              action:
                type: alert
              target:
                type: acudid
                specifiers: string
              actuator:
                type: endpoint
                specifiers:
                - string
              modifiers:
                response: acknowledge
                method:
                - acl
                additional_properties:
                  context: string
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                frequency: string
                duration: '2016-01-01T01:01:01.000Z'
                source: string
                search: cve
                option: string
                id: string
                location: internal
                delay: '2016-01-01T01:01:01.000Z'
                destination: copy-to
            structured_coa_type: openc2
            impact: string
          description: a list of `NewCOA`s.
          type: array
          items:
            $ref: '#/components/schemas/NewCOA'
          uniqueItems: true
      additionalProperties: false
      required:
      - source
    NewAsset:
      description: a new Asset
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        asset_type:
          example: application
          description: 'Type of the Asset: Device, Person, Application, etc.'
          type: string
          enum:
          - device
          - network
          - application
          - person
          - data
        authorized_groups:
          type: array
          items:
            type: string
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        authorized_users:
          type: array
          items:
            type: string
        type:
          example: asset
          type: string
          enum:
          - asset
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        client_id:
          type: string
        groups:
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        owner:
          type: string
      additionalProperties: false
      required:
      - asset_type
      - valid_time
      - source
    NewBundleExportVulnerabilitiesExternalReferences:
      example:
        source_name: string
        description: string
        url: string
        hashes:
        - string
        external_id: string
      description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
      type: object
      properties:
        source_name:
          example: string
          description: The source within which the external-reference is defined (system, registry, organization, etc.)
          type: string
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        url:
          example: string
          description: A URL reference to an external resource.
          type: string
        hashes:
          example:
          - string
          description: Specifies a dictionary of hashes for the contents of the url.
          type: array
          items:
            type: string
        external_id:
          example: string
          description: An identifier for the external reference content.
          type: string
      additionalProperties: {}
      required:
      - source_name
    NewBundleExportJudgements:
      example:
        valid_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        schema_version: 1.3.30
        revision: 10
        observable:
          value: 1.2.3.4
          type: ip
        reason_uri: string
        type: judgement
        source: string
        external_ids:
        - string
        disposition: 1
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        reason: string
        source_uri: string
        disposition_name: Clean
        priority: 10
        language: string
        id: string
        severity: Critical
        tlp: green
        timestamp: '2016-01-01T01:01:01.000Z'
        confidence: High
      description: Schema for submitting new Judgements.
      type: object
      properties:
        valid_time:
          $ref: '#/components/schemas/NewBundleExportJudgementsValidTime'
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        observable:
          $ref: '#/components/schemas/NewBundleExportJudgementsObservable'
        reason_uri:
          example: string
          description: A URI
          type: string
        type:
          example: judgement
          type: string
          enum:
          - judgement
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        disposition:
          example: 1
          description: Numeric verdict identifiers.
          type: integer
          format: int64
          enum:
          - 1
          - 4
          - 3
          - 2
          - 5
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportJudgementsExternalReferences'
        reason:
          example: string
          description: String with at most 1024 characters.
          type: string
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        disposition_name:
          example: Clean
          description: String verdict identifiers.
          type: string
          enum:
          - Common
          - Unknown
          - Suspicious
          - Malicious
          - Clean
        priority:
          example: 10
          description: A value 0-100 that determine the priority of a judgement. Curated feeds of black/white lists, for example known good products within your organizations, should use a 95. All automated systems should use a priority of 90, or less.  Human judgements should have a priority of 100, so that humans can always override machines.
          type: integer
          format: int64
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        severity:
          example: Critical
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Critical
          - Low
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        confidence:
          example: High
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
      additionalProperties: {}
      required:
      - observable
      - source
      - priority
      - severity
      - confidence
    CPELeafNode:
      example:
        operator: AND
        cpe_match:
        - vulnerable: true
          cpe23Uri: string
          versionStartIncluding: string
          versionEndIncluding: string
          versionStartExcluding: string
          versionEndExcluding: string
        negate: true
      type: object
      properties:
        operator:
          example: AND
          description: The operator string influences how seqs of cpe matches are related to one another.
          type: string
          enum:
          - AND
          - OR
        cpe_match:
          example:
          - vulnerable: true
            cpe23Uri: string
            versionStartIncluding: string
            versionEndIncluding: string
            versionStartExcluding: string
            versionEndExcluding: string
          type: array
          items:
            $ref: '#/components/schemas/CPEMatch'
        negate:
          example: true
          description: Negates operator when true.
          type: boolean
      additionalProperties: false
      required:
      - operator
      - cpe_match
    NewBundleExportJudgementsValidTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid.
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If not present, the valid time position of the indicator does not have an upper bound.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If end_time is not present, then the valid time position of the object does not have an upper bound.
          type: string
          format: date-time
      additionalProperties: {}
    NewBundleExportTargetRecordsExternalReferences:
      example:
        source_name: string
        description: string
        url: string
        hashes:
        - string
        external_id: string
      description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
      type: object
      properties:
        source_name:
          example: string
          description: The source within which the external-reference is defined (system, registry, organization, etc.)
          type: string
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        url:
          example: string
          description: A URL reference to an external resource.
          type: string
        hashes:
          example:
          - string
          description: Specifies a dictionary of hashes for the contents of the url.
          type: array
          items:
            type: string
        external_id:
          example: string
          description: An identifier for the external reference content.
          type: string
      additionalProperties: {}
      required:
      - source_name
    NewBundleExportIdentityAssertionsValidTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid.
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If not present, the valid time position of the indicator does not have an upper bound.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If end_time is not present, then the valid time position of the object does not have an upper bound.
          type: string
          format: date-time
      additionalProperties: {}
    FileModifyType:
      example:
        file_name: string
        process_guid: 10
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        type: FileModifyEvent
        file_path: string
        process_name: string
        process_id: 10
        process_username: string
        failed: false
      type: object
      properties:
        file_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        time:
          $ref: '#/components/schemas/ObservedTime'
        type:
          example: FileModifyEvent
          type: string
          enum:
          - FileModifyEvent
        file_path:
          example: string
          description: String with at most 2048 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        failed:
          example: false
          type: boolean
      additionalProperties: false
      required:
      - file_name
      - time
      - type
      - file_path
      - process_name
      - process_id
    NewCOA:
      description: a new Coa
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        authorized_groups:
          type: array
          items:
            type: string
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        stage:
          example: Containment
          description: Specifies what stage in the cyber threat management lifecycle this Course Of Action is relevant to.
          type: string
          enum:
          - Identification
          - Lessons Learned
          - Remedy
          - Preparation
          - Containment
          - Response
          - Eradication
          - Recovery
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        efficacy:
          example: High
          description: Effectiveness of this course of action in achieving its targeted objective.
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        authorized_users:
          type: array
          items:
            type: string
        type:
          example: coa
          type: string
          enum:
          - coa
        created:
          type: string
          format: date-time
        related_COAs:
          example:
          - confidence: High
            source: string
            relationship: string
            COA_id: string
          description: Identifies or characterizes relationships to one or more related courses of action.
          type: array
          items:
            $ref: '#/components/schemas/RelatedCOA'
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        coa_type:
          example: Diplomatic Actions
          description: The type of this COA
          type: string
          enum:
          - Diplomatic Actions
          - Physical Access Restrictions
          - Policy Actions
          - Internal Blocking
          - Playbook
          - Redirection
          - Phase
          - Eradication
          - Public Disclosure
          - Monitoring
          - Patching
          - Logical Access Restrictions
          - Redirection (Honey Pot)
          - Rebuilding
          - Perimeter Blocking
          - Hardening
          - Other
          - Training
          - Task
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        objective:
          example:
          - string
          description: Characterizes the objective to provide guidance on how to mitigate a security incident that has been identified.
          type: array
          items:
            type: string
        cost:
          example: High
          description: Characterizes the estimated cost for applying this course of action.
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        client_id:
          type: string
        groups:
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        open_c2_coa:
          $ref: '#/components/schemas/OpenC2COA'
        structured_coa_type:
          example: openc2
          type: string
          enum:
          - openc2
        impact:
          example: string
          description: Characterizes the estimated impact of applying this course of action.
          type: string
        owner:
          type: string
      additionalProperties: false
    NewBundleExportCoasOpenC2CoaAction:
      example:
        type: alert
      type: object
      properties:
        type:
          example: alert
          type: string
          enum:
          - stop
          - save
          - delete
          - remediate
          - redirect
          - alert
          - query
          - augment
          - snapshot
          - update
          - allow
          - scan
          - investigate
          - modify
          - sync
          - start
          - pause
          - deny
          - substitute
          - distill
          - move
          - restart
          - other
          - detonate
          - response
          - set
          - notify
          - report
          - restore
          - get
          - throttle
          - mitigate
          - resume
          - locate
          - contain
      additionalProperties: {}
      required:
      - type
    NewBundleExportAssetPropertiesValidTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: The time range during which the AssetProperties is considered valid.
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If not present, the valid time position of the indicator does not have an upper bound.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If end_time is not present, then the valid time position of the object does not have an upper bound.
          type: string
          format: date-time
      additionalProperties: {}
    NewBundleExportIndicators:
      example:
        description: string
        tags:
        - string
        valid_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        producer: string
        schema_version: 1.3.30
        revision: 10
        type: indicator
        test_mechanisms:
        - string
        source: string
        external_ids:
        - string
        short_description: string
        composite_indicator_expression:
          operator: and
          indicator_ids:
          - string
        title: string
        likely_impact: string
        indicator_type:
        - Anonymization
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        source_uri: string
        language: string
        id: string
        severity: Critical
        tlp: green
        kill_chain_phases:
        - kill_chain_name: string
          phase_name: string
        negate: true
        timestamp: '2016-01-01T01:01:01.000Z'
        confidence: High
        specification:
          type: Judgement
          judgements:
          - string
          required_judgements:
          - confidence: High
            source: string
            relationship: string
            judgement_id: string
      description: For submitting a new Indicator
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        tags:
          example:
          - string
          description: Descriptors for this indicator.
          type: array
          items:
            type: string
        valid_time:
          $ref: '#/components/schemas/NewBundleExportIndicatorsValidTime'
        producer:
          example: string
          description: String with at most 1024 characters.
          type: string
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        type:
          example: indicator
          description: The fixed value "indicator"
          type: string
          enum:
          - indicator
        test_mechanisms:
          example:
          - string
          description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator.
          type: array
          items:
            type: string
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        composite_indicator_expression:
          $ref: '#/components/schemas/NewBundleExportIndicatorsCompositeIndicatorExpression'
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        likely_impact:
          example: string
          description: Likely potential impact within the relevant context if this Indicator were to occur.
          type: string
        indicator_type:
          example:
          - Anonymization
          description: Specifies the type or types for this Indicator.
          type: array
          items:
            type: string
            enum:
            - File Hash Watchlist
            - Private Threat Feed
            - IMEI Watchlist
            - Malicious E-mail
            - Exfiltration
            - C2
            - URL Watchlist
            - IMSI Watchlist
            - Malware Artifacts
            - Domain Watchlist
            - Anonymization
            - Host Characteristics
            - IP Watchlist
            - Compromised PKI Certificate
            - Login Name
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportIndicatorsExternalReferences'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        severity:
          example: Critical
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Critical
          - Low
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        kill_chain_phases:
          example:
          - kill_chain_name: string
            phase_name: string
          description: Relevant kill chain phases indicated by this Indicator.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportIndicatorsKillChainPhases'
        negate:
          example: true
          description: Specifies the absence of the pattern.
          type: boolean
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        confidence:
          example: High
          description: level of confidence held in the accuracy of this Indicator.
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        specification:
          example:
            type: Judgement
            judgements:
            - string
            required_judgements:
            - confidence: High
              source: string
              relationship: string
              judgement_id: string
          x-oneOf:
          - $ref: '#/components/schemas/NewBundleExportIndicatorsSpecification'
          - $ref: '#/components/schemas/NewBundleExportIndicatorsSpecification'
          - $ref: '#/components/schemas/NewBundleExportIndicatorsSpecification'
          - $ref: '#/components/schemas/NewBundleExportIndicatorsSpecification'
          - $ref: '#/components/schemas/NewBundleExportIndicatorsSpecification'
      additionalProperties: {}
      required:
      - producer
    NewSighting:
      description: a new Sighting
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        authorized_groups:
          type: array
          items:
            type: string
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        relations:
          example:
          - origin: string
            origin_uri: string
            relation: Allocated
            relation_info:
              keyword: anything
            source:
              value: 1.2.3.4
              type: ip
            related:
              value: 1.2.3.4
              type: ip
          description: Provide any context we can about where the observable came from.
          type: array
          items:
            $ref: '#/components/schemas/ObservedRelation'
        sensor_coordinates:
          $ref: '#/components/schemas/SensorCoordinates'
        observables:
          example:
          - value: 1.2.3.4
            type: ip
          description: The object(s) of interest.
          type: array
          items:
            $ref: '#/components/schemas/Observable'
        authorized_users:
          type: array
          items:
            type: string
        type:
          example: sighting
          type: string
          enum:
          - sighting
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        targets:
          example:
          - type: endpoint
            observables:
            - value: 1.2.3.4
              type: ip
            observed_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            os: string
          description: 'May include one or more targets that observed the associated indicator. Targets can include network devices, host devices, or other entities that are capable of detecting indicators of compromise.


            Can be used to assess the scope of potential threats, helping analysts understand which devices or components of the network may be vulnerable to attack. For example, if a particular malware strain is detected on several different systems within an organization, the `targets` field may indicate which systems are affected and which may need to be isolated or patched to prevent further spread.'
          type: array
          items:
            $ref: '#/components/schemas/IdentitySpecification'
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        resolution:
          example: detected
          description: Represents the disposition or actions taken on the associated threat intelligence.
          type: string
        internal:
          example: false
          description: "If `true`, indicates that the sighting was reported from internal sources, such as an organization's own internal security tools or SOC.\n Internal sightings are often considered more reliable and actionable than external sightings, which are reported from external sources and may have a lower level of trustworthiness. Internal sightings can provide more context and can help identify potential threats that are unique to a particular environment or organization.\n Internal sightings can also help organizations prioritize their security response efforts by identifying threats that are specific to their environment and may not yet be widely known."
          type: boolean
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        detection_interval:
          $ref: '#/components/schemas/ObservedTime'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        activity_interval:
          $ref: '#/components/schemas/ObservedTime'
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        count:
          example: 10
          description: Zero, or a positive integer.
          type: integer
          format: int64
        severity:
          example: Critical
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Critical
          - Low
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        modification_interval:
          $ref: '#/components/schemas/ObservedTime'
        context:
          $ref: '#/components/schemas/Context'
        client_id:
          type: string
        groups:
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        confidence:
          example: High
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        observed_time:
          $ref: '#/components/schemas/ObservedTime'
        owner:
          type: string
        sensor:
          example: endpoint
          description: The OpenC2 Actuator name that best fits the device that is creating this sighting (e.g. network.firewall)
          type: string
        data:
          $ref: '#/components/schemas/SightingDataTable'
      additionalProperties: false
      required:
      - observed_time
    NewBundleExportSightingsContextNetflowEventsTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If the observation was made over a period of time, than this field indicates the end of that period.
          type: string
          format: date-time
      additionalProperties: {}
      required:
      - start_time
    NewBundleExportAssetPropertiesExternalReferences:
      example:
        source_name: string
        description: string
        url: string
        hashes:
        - string
        external_id: string
      description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
      type: object
      properties:
        source_name:
          example: string
          description: The source within which the external-reference is defined (system, registry, organization, etc.)
          type: string
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        url:
          example: string
          description: A URL reference to an external resource.
          type: string
        hashes:
          example:
          - string
          description: Specifies a dictionary of hashes for the contents of the url.
          type: array
          items:
            type: string
        external_id:
          example: string
          description: An identifier for the external reference content.
          type: string
      additionalProperties: {}
      required:
      - source_name
    FileMoveType:
      example:
        file_name: string
        process_guid: 10
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        type: FileMoveEvent
        old_name: string
        file_path: string
        process_name: string
        process_id: 10
        process_username: string
        new_name: string
      type: object
      properties:
        file_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        time:
          $ref: '#/components/schemas/ObservedTime'
        type:
          example: FileMoveEvent
          type: string
          enum:
          - FileMoveEvent
        old_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        file_path:
          example: string
          description: String with at most 2048 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        new_name:
          example: string
          description: String with at most 1024 characters.
          type: string
      additionalProperties: false
      required:
      - file_name
      - time
      - type
      - old_name
      - file_path
      - process_name
      - process_id
      - new_name
    NewBundleExportAttackPatternsExternalReferences:
      example:
        source_name: string
        description: string
        url: string
        hashes:
        - string
        external_id: string
      description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
      type: object
      properties:
        source_name:
          example: string
          description: The source within which the external-reference is defined (system, registry, organization, etc.)
          type: string
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        url:
          example: string
          description: A URL reference to an external resource.
          type: string
        hashes:
          example:
          - string
          description: Specifies a dictionary of hashes for the contents of the url.
          type: array
          items:
            type: string
        external_id:
          example: string
          description: An identifier for the external reference content.
          type: string
      additionalProperties: {}
      required:
      - source_name
    NewBundleExportIndicatorsKillChainPhases:
      example:
        kill_chain_name: string
        phase_name: string
      description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
      type: object
      properties:
        kill_chain_name:
          example: string
          description: The name of the kill chain.
          type: string
        phase_name:
          example: string
          description: The name of the phase in the kill chain.
          type: string
      additionalProperties: {}
      required:
      - kill_chain_name
      - phase_name
    TargetType:
      example:
        type: acudid
        specifiers: string
      type: object
      properties:
        type:
          example: acudid
          type: string
        specifiers:
          example: string
          description: Observable types that can be acted upon.
          type: string
      additionalProperties: false
      required:
      - type
    ColumnDefinition:
      example:
        name: string
        type: integer
        description: string
        required: true
        short_description: string
      type: object
      properties:
        name:
          example: string
          type: string
        type:
          example: integer
          type: string
          enum:
          - url
          - string
          - observable
          - number
          - integer
          - markdown
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        required:
          example: true
          description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`.
          type: boolean
        short_description:
          example: string
          type: string
      additionalProperties: false
      required:
      - name
      - type
    NewBundleExportVerdicts:
      example:
        type: verdict
        disposition: 1
        observable:
          value: 1.2.3.4
          type: ip
        judgement_id: string
        disposition_name: Clean
        valid_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
      description: "A Verdict is chosen from all of the Judgements on that Observable which have not yet expired.  The highest priority Judgement becomes the active verdict.  If there is more than one Judgement with that priority, then Clean disposition has priority over all others, then Malicious disposition, and so on down to Unknown.\n\n The ID of a verdict is a a str of the form \"observable.type:observable.value\" for example, \"ip:1.1.1.1\""
      type: object
      properties:
        type:
          example: verdict
          type: string
          enum:
          - verdict
        disposition:
          example: 1
          description: Numeric verdict identifiers.
          type: integer
          format: int64
          enum:
          - 1
          - 4
          - 3
          - 2
          - 5
        observable:
          $ref: '#/components/schemas/NewBundleExportVerdictsObservable'
        judgement_id:
          example: string
          description: A URI leading to a judgement.
          type: string
        disposition_name:
          example: Clean
          description: 'The disposition_name field is optional, but is intended to be shown to a user.  Applications must therefore remember the mapping of numbers to human words, as in: {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}'
          type: string
          enum:
          - Common
          - Unknown
          - Suspicious
          - Malicious
          - Clean
        valid_time:
          $ref: '#/components/schemas/NewBundleExportVerdictsValidTime'
      additionalProperties: {}
      required:
      - type
      - disposition
      - observable
      - valid_time
    NewBundleExportRelationshipsExternalReferences:
      example:
        source_name: string
        description: string
        url: string
        hashes:
        - string
        external_id: string
      description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
      type: object
      properties:
        source_name:
          example: string
          description: The source within which the external-reference is defined (system, registry, organization, etc.)
          type: string
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        url:
          example: string
          description: A URL reference to an external resource.
          type: string
        hashes:
          example:
          - string
          description: Specifies a dictionary of hashes for the contents of the url.
          type: array
          items:
            type: string
        external_id:
          example: string
          description: An identifier for the external reference content.
          type: string
      additionalProperties: {}
      required:
      - source_name
    NewBundleExportWeaknessesLanguages:
      example:
        prevalence: Often
        name: string
        class: Assembly
      type: object
      properties:
        prevalence:
          example: Often
          description: Defines the different regularities that guide the applicability of platforms.
          type: string
          enum:
          - Undetermined
          - Sometimes
          - Often
          - Rarely
        name:
          example: string
          description: Language name (Clojure, Java, ...)
          type: string
        class:
          example: Assembly
          description: Class of language.
          type: string
      additionalProperties: {}
      required:
      - prevalence
    ObservedRelation:
      example:
        origin: string
        origin_uri: string
        relation: Allocated
        relation_info:
          keyword: anything
        source:
          value: 1.2.3.4
          type: ip
        related:
          value: 1.2.3.4
          type: ip
      description: A relation inside a Sighting.
      type: object
      properties:
        origin:
          example: string
          type: string
        origin_uri:
          example: string
          description: A URI
          type: string
        relation:
          example: Allocated
          type: string
        relation_info:
          $ref: '#/components/schemas/NewSightingRelationsRelationInfo'
        source:
          $ref: '#/components/schemas/Observable'
        related:
          $ref: '#/components/schemas/Observable'
      additionalProperties: false
      required:
      - origin
      - relation
      - source
      - related
    NewBundleExportDataTablesValidTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid.
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If not present, the valid time position of the indicator does not have an upper bound.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If end_time is not present, then the valid time position of the object does not have an upper bound.
          type: string
          format: date-time
      additionalProperties: {}
    ValidTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid.
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If not present, the valid time position of the indicator does not have an upper bound.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If end_time is not present, then the valid time position of the object does not have an upper bound.
          type: string
          format: date-time
      additionalProperties: false
    EntityImportResult:
      type: object
      properties:
        id:
          type: string
        original_id:
          type: string
        result:
          type: string
          enum:
          - created
          - error
          - exists
        type:
          type: string
        external_ids:
          type: array
          items:
            type: string
        error: {}
        msg:
          type: string
      additionalProperties: false
    NewBundleExportSightingsTargetsObservedTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If the observation was made over a period of time, than this field indicates the end of that period.
          type: string
          format: date-time
      additionalProperties: {}
      required:
      - start_time
    NewBundleExportSightingsContextFileMoveEvents:
      example:
        file_name: string
        process_guid: 10
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        type: FileMoveEvent
        old_name: string
        file_path: string
        process_name: string
        process_id: 10
        process_username: string
        new_name: string
      type: object
      properties:
        file_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        time:
          $ref: '#/components/schemas/NewBundleExportSightingsContextFileMoveEventsTime'
        type:
          example: FileMoveEvent
          type: string
          enum:
          - FileMoveEvent
        old_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        file_path:
          example: string
          description: String with at most 2048 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        new_name:
          example: string
          description: String with at most 1024 characters.
          type: string
      additionalProperties: {}
      required:
      - file_name
      - time
      - type
      - old_name
      - file_path
      - process_name
      - process_id
      - new_name
    Activity:
      example:
        date_time: '2016-01-01T01:01:01.000Z'
        description: string
      description: Captures the specific activities or tactics associated with the entity. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc.
      type: object
      properties:
        date_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Specifies the date and time at which the activity occured.
          type: string
          format: date-time
        description:
          example: string
          description: A description of the activity.
          type: string
      additionalProperties: false
      required:
      - date_time
      - description
    NewBundleExportVulnerabilitiesImpactCvssV2:
      example:
        integrity_impact: complete
        target_distribution: not_defined
        availability_requirement: not_defined
        exploitability: not_defined
        access_complexity: low
        temporal_vector_string: string
        exploitability_score: 10.0
        impact_score: 10.0
        user_interaction_required: true
        environmental_vector_string: string
        obtain_other_privilege: true
        availability_impact: complete
        access_vector: network
        base_severity: High
        confidentiality_impact: complete
        confidentiality_requirement: not_defined
        report_confidence: not_defined
        authentication: none
        base_score: 10.0
        obtain_user_privilege: true
        obtain_all_privilege: true
        collateral_damage_potential: not_defined
        remediation_level: not_defined
        vector_string: string
        integrity_requirement: not_defined
      type: object
      properties:
        integrity_impact:
          example: complete
          description: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and guaranteed veracity of information. Increased integrity impact increases the vulnerability score.
          type: string
          enum:
          - partial
          - none
          - complete
        target_distribution:
          example: not_defined
          description: This metric measures the proportion of vulnerable systems. It is meant as an environment-specific indicator in order to approximate the percentage of systems that could be affected by the vulnerability. The greater the proportion of vulnerable systems, the higher the score.
          type: string
          enum:
          - low
          - none
          - high
          - medium
          - not_defined
        availability_requirement:
          example: not_defined
          description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
          type: string
          enum:
          - low
          - high
          - medium
          - not_defined
        exploitability:
          example: not_defined
          description: This metric measures the current state of exploit techniques or code availability. Public availability of easy-to-use exploit code increases the number of potential attackers by including those who are unskilled thereby increasing the severity of the vulnerability.
          type: string
          enum:
          - high
          - unproven
          - functional
          - proof_of_concept
          - not_defined
        access_complexity:
          example: low
          description: 'This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system. For example, consider a buffer overflow in an Internet service: once the target system is located, the attacker can launch an exploit at will.'
          type: string
          enum:
          - low
          - high
          - medium
        temporal_vector_string:
          example: string
          description: A text representation of a set of CVSSv2 temporal metrics. Temporal metrics allow analysists to calculate threat severity based on temporal factors such as reliability of vulnerability reports, availability of mitigations, and the ease or difficulty of conducting the exploit. It is commonly used to record or transfer CVSSv2 metric information in a concise form
          type: string
        exploitability_score:
          example: 10.0
          description: a Score number from 0 to 10
          type: number
          format: double
        impact_score:
          example: 10.0
          description: a Score number from 0 to 10
          type: number
          format: double
        user_interaction_required:
          example: true
          type: boolean
        environmental_vector_string:
          example: string
          description: A text representation of a set of CVSSv2 environmental metrics. Environmental metrics allow analysists to calculate threat scores in relation to environmental security requirements, collateral damage potential, and target availability. It is commonly used to record or transfer CVSSv2 metric information in a concise form
          type: string
        obtain_other_privilege:
          example: true
          type: boolean
        availability_impact:
          example: complete
          description: This metric measures the impact to availability of a successfully exploited vulnerability. Availability refers to the accessibility of information resources. Attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system. Increased availability impact increases the vulnerability score.
          type: string
          enum:
          - partial
          - none
          - complete
        access_vector:
          example: network
          description: This metric reflects how the vulnerability is exploited.The more remote an attacker can be to attack a host, the greater the vulnerability score.
          type: string
          enum:
          - network
          - adjacent network
          - local
        base_severity:
          example: High
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        confidentiality_impact:
          example: complete
          description: This metric measures the impact on confidentiality of a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. Increasedconfidentiality impact increases the vulnerability score.
          type: string
          enum:
          - partial
          - none
          - complete
        confidentiality_requirement:
          example: not_defined
          description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
          type: string
          enum:
          - low
          - high
          - medium
          - not_defined
        report_confidence:
          example: not_defined
          description: This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details. Sometimes, only the existence of vulnerabilities are publicized, but without specific details. The vulnerability may later be corroborated and then confirmed through acknowledgement by the author or vendor of the affected technology. The urgency of a vulnerability is higher when a vulnerability is known to exist with certainty. This metric also suggests the level of technical knowledge available to would-be attackers. The more a vulnerability is validated by the vendor or other reputable sources, the higher the score.
          type: string
          enum:
          - uncorroborated
          - unconfirmed
          - confirmed
          - not_defined
        authentication:
          example: none
          description: This metric measures the number of times an attacker must authenticate to a target in order to exploit a vulnerability. This metric does not gauge the strength or complexity of the authentication process, only that an attacker is required to provide credentials before an exploit may occur. The fewer authentication instances that are required, the higher the vulnerability score.
          type: string
          enum:
          - none
          - single
          - multiple
        base_score:
          example: 10.0
          description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v2/guide'
          type: number
          format: double
        obtain_user_privilege:
          example: true
          type: boolean
        obtain_all_privilege:
          example: true
          type: boolean
        collateral_damage_potential:
          example: not_defined
          description: This metric measures the potential for loss of life or physical assets through damage or theft of property or equipment.  The metric may also measure economic loss of productivity or revenue. Naturally, the greater the damage potential, the higher the vulnerability score.
          type: string
          enum:
          - low
          - none
          - high
          - medium_high
          - low_medium
          - not_defined
        remediation_level:
          example: not_defined
          description: The remediation level of a vulnerability is an important factor for prioritization. The typical vulnerability is unpatched when initially published. Workarounds or hotfixes may offer interim remediation until an official patch or upgrade is issued. Each of these respective stages adjusts the temporal score downwards, reflecting the decreasing urgency as remediation becomes final. The less official and permanent a fix, the higher the vulnerability score is.
          type: string
          enum:
          - temporary_fix
          - workaround
          - official_fix
          - unavailable
          - not_defined
        vector_string:
          example: string
          description: a text representation of a set of CVSSv2 metrics. It is commonly used to record or transfer CVSSv2 metric information in a concise form
          type: string
        integrity_requirement:
          example: not_defined
          description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
          type: string
          enum:
          - low
          - high
          - medium
          - not_defined
      additionalProperties: {}
      required:
      - base_severity
      - base_score
      - vector_string
    NewBundleExportCampaignsActivity:
      example:
        date_time: '2016-01-01T01:01:01.000Z'
        description: string
      description: Captures the specific activities or tactics associated with the entity. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc.
      type: object
      properties:
        date_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Specifies the date and time at which the activity occured.
          type: string
          format: date-time
        description:
          example: string
          description: A description of the activity.
          type: string
      additionalProperties: {}
      required:
      - date_time
      - description
    NewBundleExportCoasExternalReferences:
      example:
        source_name: string
        description: string
        url: string
        hashes:
        - string
        external_id: string
      description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
      type: object
      properties:
        source_name:
          example: string
          description: The source within which the external-reference is defined (system, registry, organization, etc.)
          type: string
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        url:
          example: string
          description: A URL reference to an external resource.
          type: string
        hashes:
          example:
          - string
          description: Specifies a dictionary of hashes for the contents of the url.
          type: array
          items:
            type: string
        external_id:
          example: string
          description: An identifier for the external reference content.
          type: string
      additionalProperties: {}
      required:
      - source_name
    NewBundleExportCoasOpenC2CoaTarget:
      example:
        type: acudid
        specifiers: string
      type: object
      properties:
        type:
          example: acudid
          type: string
        specifiers:
          example: string
          description: Observable types that can be acted upon.
          type: string
      additionalProperties: {}
      required:
      - type
    NewBundleExportVulnerabilitiesImpact:
      example:
        cvss_v2:
          integrity_impact: complete
          target_distribution: not_defined
          availability_requirement: not_defined
          exploitability: not_defined
          access_complexity: low
          temporal_vector_string: string
          exploitability_score: 10.0
          impact_score: 10.0
          user_interaction_required: true
          environmental_vector_string: string
          obtain_other_privilege: true
          availability_impact: complete
          access_vector: network
          base_severity: High
          confidentiality_impact: complete
          confidentiality_requirement: not_defined
          report_confidence: not_defined
          authentication: none
          base_score: 10.0
          obtain_user_privilege: true
          obtain_all_privilege: true
          collateral_damage_potential: not_defined
          remediation_level: not_defined
          vector_string: string
          integrity_requirement: not_defined
        cvss_v3:
          integrity_impact: high
          modified_user_interaction: none
          modified_scope: not_defined
          availability_requirement: high
          user_interaction: none
          modified_integrity_impact: not_defined
          privileges_required: high
          exploitability_score: 10.0
          impact_score: 10.0
          environmental_severity: critical
          modified_availability_impact: not_defined
          availability_impact: high
          scope: changed
          exploit_code_maturity: functional
          modified_attack_complexity: not_defined
          base_severity: critical
          confidentiality_impact: high
          temporal_severity: critical
          modified_confidentiality_impact: not_defined
          confidentiality_requirement: high
          report_confidence: confirmed
          temporal_score: 10.0
          modified_privileges_required: not_defined
          modified_attack_vector: not_defined
          base_score: 10.0
          environmental_score: 10.0
          remediation_level: high
          vector_string: string
          integrity_requirement: high
          attack_vector: adjacent_network
          attack_complexity: high
      description: "Describes the potential impact of a vulnerability that is being tracked in the system. Provides information on the extent of damage that a vulnerability can cause and how serious the consequences could be if it is exploited. \n\nMay contain granular information about the vulnerability severity using the CVSS system, versions 2 and 3.\n\nCVSSv2 and CVSSv3 have different methods of calculating base scores, but both are designed to provide an indication of the level of risk that a vulnerability poses. The base score ranges from 0 to 10, with 10 being the most severe. Additionally, both CVSSv2 and CVSSv3 define severity levels, such as low, medium, high, and critical, based on the base score."
      type: object
      properties:
        cvss_v2:
          $ref: '#/components/schemas/NewBundleExportVulnerabilitiesImpactCvssV2'
        cvss_v3:
          $ref: '#/components/schemas/NewBundleExportVulnerabilitiesImpactCvssV3'
      additionalProperties: {}
    NewBundleExportCoasOpenC2Coa:
      example:
        type: structured_coa
        id: string
        action:
          type: alert
        target:
          type: acudid
          specifiers: string
        actuator:
          type: endpoint
          specifiers:
          - string
        modifiers:
          response: acknowledge
          method:
          - acl
          additional_properties:
            context: string
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          frequency: string
          duration: '2016-01-01T01:01:01.000Z'
          source: string
          search: cve
          option: string
          id: string
          location: internal
          delay: '2016-01-01T01:01:01.000Z'
          destination: copy-to
      type: object
      properties:
        type:
          example: structured_coa
          type: string
          enum:
          - structured_coa
        id:
          example: string
          description: String with at most 1024 characters.
          type: string
        action:
          $ref: '#/components/schemas/NewBundleExportCoasOpenC2CoaAction'
        target:
          $ref: '#/components/schemas/NewBundleExportCoasOpenC2CoaTarget'
        actuator:
          $ref: '#/components/schemas/NewBundleExportCoasOpenC2CoaActuator'
        modifiers:
          $ref: '#/components/schemas/NewBundleExportCoasOpenC2CoaModifiers'
      additionalProperties: {}
      required:
      - type
      - action
    NewBundleExportSightingsContextRegistryCreateEventsTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If the observation was made over a period of time, than this field indicates the end of that period.
          type: string
          format: date-time
      additionalProperties: {}
      required:
      - start_time
    NewBundleExportVerdictsObservable:
      example:
        value: 1.2.3.4
        type: ip
      description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature.  This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains.  These do not exist as objects within the CTIA storage model, so you never create an observable.
      type: object
      properties:
        value:
          example: 1.2.3.4
          description: The value of the observable.
          type: string
        type:
          example: ip
          description: The type of observable.
          type: string
          enum:
          - file_path
          - mac_address
          - trend_micro_id
          - cybereason_id
          - process_args
          - s1_agent_id
          - device
          - hostname
          - certificate_common_name
          - serial_number
          - meraki_network_id
          - url
          - jamf_management_id
          - certificate_serial
          - intune_id
          - meraki_org_id
          - cisco_cm_id
          - registry_key
          - process_path
          - darktrace_id
          - process_username
          - cortex_agent_id
          - orbital_node_id
          - process_uid
          - ngfw_name
          - user
          - certificate_issuer
          - ipv6
          - email
          - cisco_uc_id
          - cvm_id
          - sha256
          - crowdstrike_id
          - google_cloud_id
          - google_chromebook_id
          - acudid
          - sha1
          - registry_name
          - md5
          - service_now_id
          - ip
          - domain
          - email_subject
          - imei
          - ngfw_id
          - amp_computer_guid
          - ms_machine_id
          - secure_access_id
          - mutex
          - processor_id
          - swc_device_id
          - registry_path
          - odns_identity
          - odns_identity_label
          - cisco_mid
          - process_name
          - pki_serial
          - meraki_node_sn
          - email_messageid
          - imsi
          - user_agent
          - process_hash
          - file_name
      additionalProperties: {}
      required:
      - value
      - type
    HTTPType:
      example:
        process_guid: 10
        traffic:
          destination_host_name: string
          protocol: 10
          source_ip: string
          destination_subnet: string
          destination_ip: string
          source_subnet: string
          destination_port: 10
          direction: incoming
          source_port: 10
        method: CONNECT
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        type: HTTPEvent
        host: string
        process_name: string
        process_id: 10
        process_username: string
        query: string
        encrypted: true
        url_port: 10
      type: object
      properties:
        process_guid:
          example: 10
          type: integer
          format: int64
        traffic:
          $ref: '#/components/schemas/Traffic'
        method:
          example: CONNECT
          type: string
          enum:
          - OPTIONS
          - PATCH
          - TRACE
          - HEAD
          - POST
          - CONNECT
          - GET
          - PUT
        time:
          $ref: '#/components/schemas/ObservedTime'
        type:
          example: HTTPEvent
          type: string
          enum:
          - HTTPEvent
        host:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        query:
          example: string
          description: String with at most 5000 characters.
          type: string
        encrypted:
          example: true
          type: boolean
        url_port:
          example: 10
          type: integer
          format: int64
      additionalProperties: false
      required:
      - traffic
      - time
      - type
      - host
      - process_name
      - process_id
    NewBundleExportAssetProperties:
      example:
        properties:
        - name: string
          value: string
        valid_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        schema_version: 1.3.30
        revision: 10
        asset_ref: string
        type: asset-properties
        source: string
        external_ids:
        - string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        source_uri: string
        language: string
        id: string
        tlp: green
        timestamp: '2016-01-01T01:01:01.000Z'
      description: Schema for submitting new AssetProperties
      type: object
      properties:
        properties:
          example:
          - name: string
            value: string
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportAssetPropertiesProperties'
        valid_time:
          $ref: '#/components/schemas/NewBundleExportAssetPropertiesValidTime'
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        asset_ref:
          example: string
          description: URI that points to the associated Asset.
          type: string
        type:
          example: asset-properties
          type: string
          enum:
          - asset-properties
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportAssetPropertiesExternalReferences'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
      additionalProperties: {}
      required:
      - valid_time
      - asset_ref
      - source
    RegistrySetType:
      example:
        process_guid: 10
        registry_data: string
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        type: RegistrySetEvent
        registry_data_length: 10
        registry_value: string
        registry_key: string
        process_name: string
        process_id: 10
        process_username: string
      type: object
      properties:
        process_guid:
          example: 10
          type: integer
          format: int64
        registry_data:
          example: string
          description: String with at most 5000 characters.
          type: string
        time:
          $ref: '#/components/schemas/ObservedTime'
        type:
          example: RegistrySetEvent
          type: string
          enum:
          - RegistrySetEvent
        registry_data_length:
          example: 10
          type: integer
          format: int64
        registry_value:
          example: string
          description: String with at most 2048 characters.
          type: string
        registry_key:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
      additionalProperties: false
      required:
      - time
      - type
      - registry_value
      - registry_key
      - process_name
      - process_id
    NewBundleExportFeedbacksExternalReferences:
      example:
        source_name: string
        description: string
        url: string
        hashes:
        - string
        external_id: string
      description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
      type: object
      properties:
        source_name:
          example: string
          description: The source within which the external-reference is defined (system, registry, organization, etc.)
          type: string
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        url:
          example: string
          description: A URL reference to an external resource.
          type: string
        hashes:
          example:
          - string
          description: Specifies a dictionary of hashes for the contents of the url.
          type: array
          items:
            type: string
        external_id:
          example: string
          description: An identifier for the external reference content.
          type: string
      additionalProperties: {}
      required:
      - source_name
    VulnerabilityImpact:
      example:
        cvss_v2:
          integrity_impact: complete
          target_distribution: not_defined
          availability_requirement: not_defined
          exploitability: not_defined
          access_complexity: low
          temporal_vector_string: string
          exploitability_score: 10.0
          impact_score: 10.0
          user_interaction_required: true
          environmental_vector_string: string
          obtain_other_privilege: true
          availability_impact: complete
          access_vector: network
          base_severity: High
          confidentiality_impact: complete
          confidentiality_requirement: not_defined
          report_confidence: not_defined
          authentication: none
          base_score: 10.0
          obtain_user_privilege: true
          obtain_all_privilege: true
          collateral_damage_potential: not_defined
          remediation_level: not_defined
          vector_string: string
          integrity_requirement: not_defined
        cvss_v3:
          integrity_impact: high
          modified_user_interaction: none
          modified_scope: not_defined
          availability_requirement: high
          user_interaction: none
          modified_integrity_impact: not_defined
          privileges_required: high
          exploitability_score: 10.0
          impact_score: 10.0
          environmental_severity: critical
          modified_availability_impact: not_defined
          availability_impact: high
          scope: changed
          exploit_code_maturity: functional
          modified_attack_complexity: not_defined
          base_severity: critical
          confidentiality_impact: high
          temporal_severity: critical
          modified_confidentiality_impact: not_defined
          confidentiality_requirement: high
          report_confidence: confirmed
          temporal_score: 10.0
          modified_privileges_required: not_defined
          modified_attack_vector: not_defined
          base_score: 10.0
          environmental_score: 10.0
          remediation_level: high
          vector_string: string
          integrity_requirement: high
          attack_vector: adjacent_network
          attack_complexity: high
      description: "Describes the potential impact of a vulnerability that is being tracked in the system. Provides information on the extent of damage that a vulnerability can cause and how serious the consequences could be if it is exploited. \n\nMay contain granular information about the vulnerability severity using the CVSS system, versions 2 and 3.\n\nCVSSv2 and CVSSv3 have different methods of calculating base scores, but both are designed to provide an indication of the level of risk that a vulnerability poses. The base score ranges from 0 to 10, with 10 being the most severe. Additionally, both CVSSv2 and CVSSv3 define severity levels, such as low, medium, high, and critical, based on the base score."
      type: object
      properties:
        cvss_v2:
          $ref: '#/components/schemas/CVSSv2'
        cvss_v3:
          $ref: '#/components/schemas/CVSSv3'
      additionalProperties: false
    NewBundleExportSightingsSensorCoordinates:
      example:
        type: endpoint
        observables:
        - value: 1.2.3.4
          type: ip
        os: string
      description: Describes the device that made the sighting (sensor) and contains identifying observables for the sensor.
      type: object
      properties:
        type:
          example: endpoint
          description: The sensor/actuator name that best fits a device.
          type: string
        observables:
          example:
          - value: 1.2.3.4
            type: ip
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportSightingsSensorCoordinatesObservables'
        os:
          example: string
          type: string
      additionalProperties: {}
      required:
      - type
      - observables
    NewTool:
      description: a new Tool
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        labels:
          example:
          - credential-exploitation
          description: The kind(s) of tool(s) being described.
          type: array
          items:
            type: string
        authorized_groups:
          type: array
          items:
            type: string
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        authorized_users:
          type: array
          items:
            type: string
        type:
          example: tool
          type: string
          enum:
          - tool
        created:
          type: string
          format: date-time
        x_mitre_aliases:
          example:
          - string
          description: ATT&CK Software.aliases.
          type: array
          items:
            type: string
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tool_version:
          example: string
          description: The version identifier associated with the Tool.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        kill_chain_phases:
          example:
          - kill_chain_name: string
            phase_name: string
          description: The list of kill chain phases for which this Tool can be used.
          type: array
          items:
            $ref: '#/components/schemas/KillChainPhase'
        client_id:
          type: string
        groups:
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        owner:
          type: string
      additionalProperties: false
      required:
      - description
      - labels
      - short_description
      - title
    SensorCoordinates:
      example:
        type: endpoint
        observables:
        - value: 1.2.3.4
          type: ip
        os: string
      description: Describes the device that made the sighting (sensor) and contains identifying observables for the sensor.
      type: object
      properties:
        type:
          example: endpoint
          description: The sensor/actuator name that best fits a device.
          type: string
        observables:
          example:
          - value: 1.2.3.4
            type: ip
          type: array
          items:
            $ref: '#/components/schemas/Observable'
        os:
          example: string
          type: string
      additionalProperties: false
      required:
      - type
      - observables
    NewBundleExportSightingsExternalReferences:
      example:
        source_name: string
        description: string
        url: string
        hashes:
        - string
        external_id: string
      description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
      type: object
      properties:
        source_name:
          example: string
          description: The source within which the external-reference is defined (system, registry, organization, etc.)
          type: string
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        url:
          example: string
          description: A URL reference to an external resource.
          type: string
        hashes:
          example:
          - string
          description: Specifies a dictionary of hashes for the contents of the url.
          type: array
          items:
            type: string
        external_id:
          example: string
          description: An identifier for the external reference content.
          type: string
      additionalProperties: {}
      required:
      - source_name
    NewBundleExportCoas:
      example:
        description: string
        valid_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        stage: Containment
        schema_version: 1.3.30
        revision: 10
        efficacy: High
        type: coa
        related_COAs:
        - confidence: High
          source: string
          relationship: string
          COA_id: string
        source: string
        external_ids:
        - string
        short_description: string
        title: string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        source_uri: string
        coa_type: Diplomatic Actions
        language: string
        id: string
        tlp: green
        objective:
        - string
        cost: High
        timestamp: '2016-01-01T01:01:01.000Z'
        open_c2_coa:
          type: structured_coa
          id: string
          action:
            type: alert
          target:
            type: acudid
            specifiers: string
          actuator:
            type: endpoint
            specifiers:
            - string
          modifiers:
            response: acknowledge
            method:
            - acl
            additional_properties:
              context: string
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            frequency: string
            duration: '2016-01-01T01:01:01.000Z'
            source: string
            search: cve
            option: string
            id: string
            location: internal
            delay: '2016-01-01T01:01:01.000Z'
            destination: copy-to
        structured_coa_type: openc2
        impact: string
      description: Schema for submitting new COAs
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        valid_time:
          $ref: '#/components/schemas/NewBundleExportCoasValidTime'
        stage:
          example: Containment
          description: Specifies what stage in the cyber threat management lifecycle this Course Of Action is relevant to.
          type: string
          enum:
          - Identification
          - Lessons Learned
          - Remedy
          - Preparation
          - Containment
          - Response
          - Eradication
          - Recovery
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        efficacy:
          example: High
          description: Effectiveness of this course of action in achieving its targeted objective.
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        type:
          example: coa
          type: string
          enum:
          - coa
        related_COAs:
          example:
          - confidence: High
            source: string
            relationship: string
            COA_id: string
          description: Identifies or characterizes relationships to one or more related courses of action.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportCoasRelatedCoAs'
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportCoasExternalReferences'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        coa_type:
          example: Diplomatic Actions
          description: The type of this COA
          type: string
          enum:
          - Diplomatic Actions
          - Physical Access Restrictions
          - Policy Actions
          - Internal Blocking
          - Playbook
          - Redirection
          - Phase
          - Eradication
          - Public Disclosure
          - Monitoring
          - Patching
          - Logical Access Restrictions
          - Redirection (Honey Pot)
          - Rebuilding
          - Perimeter Blocking
          - Hardening
          - Other
          - Training
          - Task
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        objective:
          example:
          - string
          description: Characterizes the objective to provide guidance on how to mitigate a security incident that has been identified.
          type: array
          items:
            type: string
        cost:
          example: High
          description: Characterizes the estimated cost for applying this course of action.
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        open_c2_coa:
          $ref: '#/components/schemas/NewBundleExportCoasOpenC2Coa'
        structured_coa_type:
          example: openc2
          type: string
          enum:
          - openc2
        impact:
          example: string
          description: Characterizes the estimated impact of applying this course of action.
          type: string
      additionalProperties: {}
    NewBundleExportCampaignsValidTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid.
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If not present, the valid time position of the indicator does not have an upper bound.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If end_time is not present, then the valid time position of the object does not have an upper bound.
          type: string
          format: date-time
      additionalProperties: {}
    NewBundleExportAssetMappingsObservable:
      example:
        value: 1.2.3.4
        type: ip
      description: An AssetMapping is a record that a specific Observable maps to an Asset for an indicated period of time.
      type: object
      properties:
        value:
          example: 1.2.3.4
          description: The value of the observable.
          type: string
        type:
          example: ip
          description: The type of observable.
          type: string
          enum:
          - file_path
          - mac_address
          - trend_micro_id
          - cybereason_id
          - process_args
          - s1_agent_id
          - device
          - hostname
          - certificate_common_name
          - serial_number
          - meraki_network_id
          - url
          - jamf_management_id
          - certificate_serial
          - intune_id
          - meraki_org_id
          - cisco_cm_id
          - registry_key
          - process_path
          - darktrace_id
          - process_username
          - cortex_agent_id
          - orbital_node_id
          - process_uid
          - ngfw_name
          - user
          - certificate_issuer
          - ipv6
          - email
          - cisco_uc_id
          - cvm_id
          - sha256
          - crowdstrike_id
          - google_cloud_id
          - google_chromebook_id
          - acudid
          - sha1
          - registry_name
          - md5
          - service_now_id
          - ip
          - domain
          - email_subject
          - imei
          - ngfw_id
          - amp_computer_guid
          - ms_machine_id
          - secure_access_id
          - mutex
          - processor_id
          - swc_device_id
          - registry_path
          - odns_identity
          - odns_identity_label
          - cisco_mid
          - process_name
          - pki_serial
          - meraki_node_sn
          - email_messageid
          - imsi
          - user_agent
          - process_hash
          - file_name
      additionalProperties: {}
      required:
      - value
      - type
    NewAttackPattern:
      description: a new Attack-pattern
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        authorized_groups:
          type: array
          items:
            type: string
        abstraction_level:
          example: aggregate
          description: The CAPEC abstraction level for patterns describing techniques to attack a system.
          type: string
          enum:
          - detailed
          - standard
          - aggregate
          - meta
          - category
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        authorized_users:
          type: array
          items:
            type: string
        type:
          example: attack-pattern
          type: string
          enum:
          - attack-pattern
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        x_mitre_platforms:
          example:
          - string
          description: ATT&CK Technique.Platforms.
          type: array
          items:
            type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        x_mitre_data_sources:
          example:
          - string
          description: ATT&CK Technique.Data Sources.
          type: array
          items:
            type: string
        kill_chain_phases:
          example:
          - kill_chain_name: string
            phase_name: string
          description: A kill chain is a series of steps that an attacker must go through to successfully achieve their objective. The concept was originally developed by the military, but has been adapted to the cybersecurity field to describe the steps an attacker goes through to compromise a target system and achieve their goal.
          type: array
          items:
            $ref: '#/components/schemas/KillChainPhase'
        client_id:
          type: string
        x_mitre_contributors:
          example:
          - string
          description: ATT&CK Technique.Contributors.
          type: array
          items:
            type: string
        groups:
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        owner:
          type: string
      additionalProperties: false
      required:
      - description
      - short_description
      - title
    NewBundleExportToolsKillChainPhases:
      example:
        kill_chain_name: string
        phase_name: string
      description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
      type: object
      properties:
        kill_chain_name:
          example: string
          description: The name of the kill chain.
          type: string
        phase_name:
          example: string
          description: The name of the phase in the kill chain.
          type: string
      additionalProperties: {}
      required:
      - kill_chain_name
      - phase_name
    NewBundleExportSightingsData:
      example:
        columns:
        - name: string
          type: integer
          description: string
          required: true
          short_description: string
        rows:
        - - anything
        row_count: 10
      description: An embedded data table for the Sighting.
      type: object
      properties:
        columns:
          example:
          - name: string
            type: integer
            description: string
            required: true
            short_description: string
          description: an ordered list of column definitions
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportSightingsDataColumns'
        rows:
          example:
          - - anything
          description: an ordered list of rows
          type: array
          items:
            type: array
            items: {}
        row_count:
          example: 10
          description: The number of rows in the data table.
          type: integer
          format: int64
      additionalProperties: {}
      required:
      - columns
      - rows
    NewBundleExportVulnerabilitiesConfigurationsNodes:
      example:
        operator: AND
        cpe_match:
        - vulnerable: true
          cpe23Uri: string
          versionStartIncluding: string
          versionEndIncluding: string
          versionStartExcluding: string
          versionEndExcluding: string
        children:
        - operator: AND
          cpe_match:
          - vulnerable: true
            cpe23Uri: string
            versionStartIncluding: string
            versionEndIncluding: string
            versionStartExcluding: string
            versionEndExcluding: string
          negate: true
        negate: true
      type: object
      properties:
        operator:
          example: AND
          description: The operator string influences how seqs of cpe matches are related to one another.
          type: string
          enum:
          - AND
          - OR
        cpe_match:
          example:
          - vulnerable: true
            cpe23Uri: string
            versionStartIncluding: string
            versionEndIncluding: string
            versionStartExcluding: string
            versionEndExcluding: string
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportVulnerabilitiesConfigurationsNodesCpeMatch'
        children:
          example:
          - operator: AND
            cpe_match:
            - vulnerable: true
              cpe23Uri: string
              versionStartIncluding: string
              versionEndIncluding: string
              versionStartExcluding: string
              versionEndExcluding: string
            negate: true
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportVulnerabilitiesConfigurationsNodesChildren'
        negate:
          example: true
          description: Negates operator when true.
          type: boolean
      additionalProperties: {}
      required:
      - operator
    ActuatorType:
      example:
        type: endpoint
        specifiers:
        - string
      type: object
      properties:
        type:
          example: endpoint
          type: string
          enum:
          - endpoint.sensor
          - process.network-scanner
          - network.switch
          - network.security_manager
          - process.vulnerability-scanner
          - network.hub
          - network.ids
          - network.firewall
          - process
          - network.sense_making
          - process.sandbox
          - network.modem
          - process.email-service
          - process.dns-server
          - network.vpn
          - process.connection-scanner
          - network.nic
          - endpoint.printer
          - network.gateway
          - process.reputation-service
          - process.remediation-service
          - network
          - process.virtualization-service
          - network.ips
          - endpoint.smart-meter
          - endpoint.digital-telephone-handset
          - endpoint.workstation
          - endpoint.server
          - network.wap
          - endpoint.laptop
          - process.aaa-server
          - process.directory-service
          - endpoint.pos-terminal
          - network.bridge
          - other
          - process.file-scanner
          - network.proxy
          - endpoint
          - process.location-service
          - network.sensor
          - endpoint.smart-phone
          - network.hips
          - process.anti-virus-scanner
          - endpoint.tablet
          - network.guard
          - network.router
        specifiers:
          example:
          - string
          description: List of additional properties describing the actuator.
          type: array
          items:
            type: string
      additionalProperties: false
      required:
      - type
    NewBundleExportSightingsContextRegistryDeleteEventsTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If the observation was made over a period of time, than this field indicates the end of that period.
          type: string
          format: date-time
      additionalProperties: {}
      required:
      - start_time
    NewBundleExportIdentityAssertionsIdentity:
      example:
        observables:
        - value: 1.2.3.4
          type: ip
      description: Attributes for which the assertion is being made.
      type: object
      properties:
        observables:
          example:
          - value: 1.2.3.4
            type: ip
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportIdentityAssertionsIdentityObservables'
      additionalProperties: {}
      required:
      - observables
    AssetProperty:
      example:
        name: string
        value: string
      type: object
      properties:
        name:
          example: string
          description: The properties are an open vocabulary.
          type: string
        value:
          example: string
          type: string
      additionalProperties: false
      required:
      - name
      - value
    NewBundleExportAssetsExternalReferences:
      example:
        source_name: string
        description: string
        url: string
        hashes:
        - string
        external_id: string
      description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
      type: object
      properties:
        source_name:
          example: string
          description: The source within which the external-reference is defined (system, registry, organization, etc.)
          type: string
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        url:
          example: string
          description: A URL reference to an external resource.
          type: string
        hashes:
          example:
          - string
          description: Specifies a dictionary of hashes for the contents of the url.
          type: array
          items:
            type: string
        external_id:
          example: string
          description: An identifier for the external reference content.
          type: string
      additionalProperties: {}
      required:
      - source_name
    NewBundleExportDataTablesExternalReferences:
      example:
        source_name: string
        description: string
        url: string
        hashes:
        - string
        external_id: string
      description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
      type: object
      properties:
        source_name:
          example: string
          description: The source within which the external-reference is defined (system, registry, organization, etc.)
          type: string
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        url:
          example: string
          description: A URL reference to an external resource.
          type: string
        hashes:
          example:
          - string
          description: Specifies a dictionary of hashes for the contents of the url.
          type: array
          items:
            type: string
        external_id:
          example: string
          description: An identifier for the external reference content.
          type: string
      additionalProperties: {}
      required:
      - source_name
    NewBundleExportSightingsContextRegistryRenameEvents:
      example:
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        process_id: 10
        process_name: string
        process_guid: 10
        process_username: string
        registry_key: string
        type: RegistryRenameEvent
        registry_old_key: string
      type: object
      properties:
        process_guid:
          example: 10
          type: integer
          format: int64
        time:
          $ref: '#/components/schemas/NewBundleExportSightingsContextRegistryRenameEventsTime'
        type:
          example: RegistryRenameEvent
          type: string
          enum:
          - RegistryRenameEvent
        registry_old_key:
          example: string
          description: String with at most 1024 characters.
          type: string
        registry_key:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
      additionalProperties: {}
      required:
      - time
      - type
      - registry_old_key
      - registry_key
      - process_name
      - process_id
    OpenC2COA:
      example:
        type: structured_coa
        id: string
        action:
          type: alert
        target:
          type: acudid
          specifiers: string
        actuator:
          type: endpoint
          specifiers:
          - string
        modifiers:
          response: acknowledge
          method:
          - acl
          additional_properties:
            context: string
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          frequency: string
          duration: '2016-01-01T01:01:01.000Z'
          source: string
          search: cve
          option: string
          id: string
          location: internal
          delay: '2016-01-01T01:01:01.000Z'
          destination: copy-to
      type: object
      properties:
        type:
          example: structured_coa
          type: string
          enum:
          - structured_coa
        id:
          example: string
          description: String with at most 1024 characters.
          type: string
        action:
          $ref: '#/components/schemas/ActionType'
        target:
          $ref: '#/components/schemas/TargetType'
        actuator:
          $ref: '#/components/schemas/ActuatorType'
        modifiers:
          $ref: '#/components/schemas/ModifierType'
      additionalProperties: false
      required:
      - type
      - action
    NewBundleExportActors:
      example:
        description: string
        motivation: Ego
        valid_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        identity:
          description: string
          related_identities:
          - identity: string
            confidence: High
            information_source: string
            relationship: string
        sophistication: Aspirant
        schema_version: 1.3.30
        revision: 10
        planning_and_operational_support: string
        type: actor
        source: string
        external_ids:
        - string
        short_description: string
        title: string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        source_uri: string
        intended_effect: Account Takeover
        language: string
        id: string
        tlp: green
        aliases:
        - string
        timestamp: '2016-01-01T01:01:01.000Z'
        confidence: High
        actor_types:
        - Cyber Espionage Operations
      description: Schema for submitting new Actors
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        motivation:
          example: Ego
          description: The reason or purpose behind the malicious activity attributed to this Actor. By understanding a threat actor's motivation, analysts can better predict the attacker's behavior and anticipate future malicious actions.
          type: string
        valid_time:
          $ref: '#/components/schemas/NewBundleExportActorsValidTime'
        identity:
          $ref: '#/components/schemas/NewBundleExportActorsIdentity'
        sophistication:
          example: Aspirant
          description: "Represents the level of expertise and skill that the threat actor has displayed in their malicious activities. Can help security analysts assess the potential impact of an attacker's TTPs and determine the potential attack surface. \n\nFor example, a threat actor with a low sophistication level may primarily rely on off-the-shelf malware and attack tools, while an attacker with high sophistication may use custom tools with advanced evasion techniques, zero-day exploits, and sophisticated methods for command and control of their malware. \n\nThe sophistication level of an attacker can also be inferred based on several factors such as the complexity of attacks, the attacker's knowledge of the targeted organization's systems, and the attacker's ability to remain undetected.\n\nIf an attacker shows a high level of sophistication in reconnaissances, social engineering, and phishing, then the attacker may have a good knowledge of the targeted organization and its employees. This means that the attacker may be more successful in infiltrating the organization's network and compromising its systems."
          type: string
          enum:
          - Aspirant
          - Innovator
          - Practitioner
          - Novice
          - Expert
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        planning_and_operational_support:
          example: string
          description: "Provides information about the resources and capabilities of the attacker that could be used to assist in planning and operations related to the threat.\n\n It can be used to describe Infrastructure, Tools, Techniques, and Capabilities used by the threat actor."
          type: string
        type:
          example: actor
          type: string
          enum:
          - actor
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportActorsExternalReferences'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        intended_effect:
          example: Account Takeover
          description: "Represents the desired outcome or impact the threat actor is trying to achieve through their malicious activities. \n\n Helps security analysts to understand the attacker's goals beyond the immediate impact of the attack. By understanding the intended effect, analysts can draw connections between seemingly unrelated attacks and build a more complete understanding of an attacker's long-term goals and motivations."
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        aliases:
          example:
          - string
          description: A list of other names that this Threat Actor is believed to use.
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        confidence:
          example: High
          description: 'This field can help analysts decide how much trust they can put in the information provided by the threat intelligence sources.


            For example, an Actor entity can have high confidence if the organization''s security researchers have been tracking it for a long time and have gathered a significant amount of intelligence about it through various sources, such as analysis of malware, network traffic, and human intelligence. In contrast, low confidence may indicate the organization has only seen limited or circumstantial evidence.'
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        actor_types:
          example:
          - Cyber Espionage Operations
          type: array
          items:
            type: string
      additionalProperties: {}
      required:
      - description
      - source
      - short_description
      - title
    NewBundleExportWeaknessesCommonConsequences:
      example:
        scopes:
        - Access Control
        impacts:
        - Alter Execution Logic
        likelihood: High
        note: string
      type: object
      properties:
        scopes:
          example:
          - Access Control
          description: Identifies the security property that is violated.
          type: array
          items:
            type: string
        impacts:
          example:
          - Alter Execution Logic
          description: Describes the technical impact that arises if an adversary succeeds in exploiting this weakness.
          type: array
          items:
            type: string
        likelihood:
          example: High
          description: How likely the specific consequence is expected to be seen relative to the other consequences.
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        note:
          example: string
          description: Additional commentary about a consequence.
          type: string
      additionalProperties: {}
      required:
      - scopes
    NewBundleExportCampaignsExternalReferences:
      example:
        source_name: string
        description: string
        url: string
        hashes:
        - string
        external_id: string
      description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
      type: object
      properties:
        source_name:
          example: string
          description: The source within which the external-reference is defined (system, registry, organization, etc.)
          type: string
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        url:
          example: string
          description: A URL reference to an external resource.
          type: string
        hashes:
          example:
          - string
          description: Specifies a dictionary of hashes for the contents of the url.
          type: array
          items:
            type: string
        external_id:
          example: string
          description: An identifier for the external reference content.
          type: string
      additionalProperties: {}
      required:
      - source_name
    NewBundleExportActorsIdentityRelatedIdentities:
      example:
        identity: string
        confidence: High
        information_source: string
        relationship: string
      description: Describes a related Identity
      type: object
      properties:
        identity:
          example: string
          description: The reference (URI) of the related Identity object.
          type: string
        confidence:
          example: High
          description: Specifies the level of confidence in the assertion of the relationship between the two objects.
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        information_source:
          example: string
          description: Specifies the source of the information about the relationship between the two components.
          type: string
        relationship:
          example: string
          type: string
      additionalProperties: {}
      required:
      - identity
    NewBundleExportVulnerabilitiesConfigurations:
      example:
        CVE_data_version: string
        nodes:
        - operator: AND
          cpe_match:
          - vulnerable: true
            cpe23Uri: string
            versionStartIncluding: string
            versionEndIncluding: string
            versionStartExcluding: string
            versionEndExcluding: string
          children:
          - operator: AND
            cpe_match:
            - vulnerable: true
              cpe23Uri: string
              versionStartIncluding: string
              versionEndIncluding: string
              versionStartExcluding: string
              versionEndExcluding: string
            negate: true
          negate: true
      description: "Represents a list of affected versions or configurations of a software component that is impacted by a vulnerability. \nBy tracking the affected software components and versions, defenders can identify which systems are potentially exposed to an attack, and apply appropriate mitigations."
      type: object
      properties:
        CVE_data_version:
          example: string
          description: Specifies the version of the CVE (Common Vulnerabilities and Exposures) dictionary used by the vulnerability information provider.
          type: string
        nodes:
          example:
          - operator: AND
            cpe_match:
            - vulnerable: true
              cpe23Uri: string
              versionStartIncluding: string
              versionEndIncluding: string
              versionStartExcluding: string
              versionEndExcluding: string
            children:
            - operator: AND
              cpe_match:
              - vulnerable: true
                cpe23Uri: string
                versionStartIncluding: string
                versionEndIncluding: string
                versionStartExcluding: string
                versionEndExcluding: string
              negate: true
            negate: true
          description: Each `node` in the CTIM standard configuration includes information such as the `operator` (such as "less than", or "greater than or equal to"), and the `cpe` (Common Platform Enumeration) string which identifies the specific software, `CPE` is a structured naming scheme for IT systems, platforms, and software packages, and it is instrumental in enabling data exchange between different systems.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportVulnerabilitiesConfigurationsNodes'
      additionalProperties: {}
      required:
      - CVE_data_version
      - nodes
    IdentitySpecification:
      example:
        type: endpoint
        observables:
        - value: 1.2.3.4
          type: ip
        observed_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        os: string
      description: Describes the target of the sighting and contains identifying observables for the target.
      type: object
      properties:
        type:
          example: endpoint
          description: The sensor/actuator name that best fits a device.
          type: string
        observables:
          example:
          - value: 1.2.3.4
            type: ip
          type: array
          items:
            $ref: '#/components/schemas/Observable'
        observed_time:
          $ref: '#/components/schemas/ObservedTime'
        os:
          example: string
          type: string
      additionalProperties: false
      required:
      - type
      - observables
      - observed_time
    KillChainPhase:
      example:
        kill_chain_name: string
        phase_name: string
      description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
      type: object
      properties:
        kill_chain_name:
          example: string
          description: The name of the kill chain.
          type: string
        phase_name:
          example: string
          description: The name of the phase in the kill chain.
          type: string
      additionalProperties: false
      required:
      - kill_chain_name
      - phase_name
    NewBundleExportSightingsContextNetflowEvents:
      example:
        parent_process_name: string
        byte_count_in: 10
        process_guid: 10
        process_path: string
        traffic:
          destination_host_name: string
          protocol: 10
          source_ip: string
          destination_subnet: string
          destination_ip: string
          source_subnet: string
          destination_port: 10
          direction: incoming
          source_port: 10
        flow_time: '2016-01-01T01:01:01.000Z'
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        parent_process_account: string
        type: NetflowEvent
        process_account_type: string
        parent_process_path: string
        parent_process_id: 10
        parent_process_args: string
        process_name: string
        process_account: string
        parent_process_account_type: string
        process_hash: string
        process_id: 10
        parent_process_hash: string
        process_username: string
        byte_count_out: 10
        process_args: string
      type: object
      properties:
        parent_process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        byte_count_in:
          example: 10
          type: integer
          format: int64
        process_guid:
          example: 10
          type: integer
          format: int64
        process_path:
          example: string
          description: String with at most 1024 characters.
          type: string
        traffic:
          $ref: '#/components/schemas/NewBundleExportSightingsContextNetflowEventsTraffic'
        flow_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Schema definition for all date or timestamp values.  Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
          type: string
          format: date-time
        time:
          $ref: '#/components/schemas/NewBundleExportSightingsContextNetflowEventsTime'
        parent_process_account:
          example: string
          description: String with at most 1024 characters.
          type: string
        type:
          example: NetflowEvent
          type: string
          enum:
          - NetflowEvent
        process_account_type:
          example: string
          description: String with at most 1024 characters.
          type: string
        parent_process_path:
          example: string
          description: String with at most 1024 characters.
          type: string
        parent_process_id:
          example: 10
          type: integer
          format: int64
        parent_process_args:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_account:
          example: string
          description: String with at most 1024 characters.
          type: string
        parent_process_account_type:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_hash:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        parent_process_hash:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        byte_count_out:
          example: 10
          type: integer
          format: int64
        process_args:
          example: string
          description: String with at most 1024 characters.
          type: string
      additionalProperties: {}
      required:
      - traffic
      - time
      - type
      - process_name
      - process_id
    NewBundleExportSightingsContextFileDeleteEvents:
      example:
        file_name: string
        process_guid: 10
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        type: FileDeleteEvent
        file_path: string
        process_name: string
        process_id: 10
        process_username: string
        failed: false
      type: object
      properties:
        file_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        time:
          $ref: '#/components/schemas/NewBundleExportSightingsContextFileDeleteEventsTime'
        type:
          example: FileDeleteEvent
          type: string
          enum:
          - FileDeleteEvent
        file_path:
          example: string
          description: String with at most 2048 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        failed:
          example: false
          type: boolean
      additionalProperties: {}
      required:
      - file_name
      - time
      - type
      - file_path
      - process_name
      - process_id
    NewBundleExportSightingsRelationsSource:
      example:
        value: 1.2.3.4
        type: ip
      description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature.  This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains.  These do not exist as objects within the CTIA storage model, so you never create an observable.
      type: object
      properties:
        value:
          example: 1.2.3.4
          description: The value of the observable.
          type: string
        type:
          example: ip
          description: The type of observable.
          type: string
          enum:
          - file_path
          - mac_address
          - trend_micro_id
          - cybereason_id
          - process_args
          - s1_agent_id
          - device
          - hostname
          - certificate_common_name
          - serial_number
          - meraki_network_id
          - url
          - jamf_management_id
          - certificate_serial
          - intune_id
          - meraki_org_id
          - cisco_cm_id
          - registry_key
          - process_path
          - darktrace_id
          - process_username
          - cortex_agent_id
          - orbital_node_id
          - process_uid
          - ngfw_name
          - user
          - certificate_issuer
          - ipv6
          - email
          - cisco_uc_id
          - cvm_id
          - sha256
          - crowdstrike_id
          - google_cloud_id
          - google_chromebook_id
          - acudid
          - sha1
          - registry_name
          - md5
          - service_now_id
          - ip
          - domain
          - email_subject
          - imei
          - ngfw_id
          - amp_computer_guid
          - ms_machine_id
          - secure_access_id
          - mutex
          - processor_id
          - swc_device_id
          - registry_path
          - odns_identity
          - odns_identity_label
          - cisco_mid
          - process_name
          - pki_serial
          - meraki_node_sn
          - email_messageid
          - imsi
          - user_agent
          - process_hash
          - file_name
      additionalProperties: {}
      required:
      - value
      - type
    NewBundleExportJudgementsExternalReferences:
      example:
        source_name: string
        description: string
        url: string
        hashes:
        - string
        external_id: string
      description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
      type: object
      properties:
        source_name:
          example: string
          description: The source within which the external-reference is defined (system, registry, organization, etc.)
          type: string
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        url:
          example: string
          description: A URL reference to an external resource.
          type: string
        hashes:
          example:
          - string
          description: Specifies a dictionary of hashes for the contents of the url.
          type: array
          items:
            type: string
        external_id:
          example: string
          description: An identifier for the external reference content.
          type: string
      additionalProperties: {}
      required:
      - source_name
    NewBundleExportSightingsContextHttpEventsTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If the observation was made over a period of time, than this field indicates the end of that period.
          type: string
          format: date-time
      additionalProperties: {}
      required:
      - start_time
    NewNote:
      description: a new Note
      type: object
      properties:
        authorized_groups:
          type: array
          items:
            type: string
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        content:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        note_class:
          example: keyword
          type: string
        authorized_users:
          type: array
          items:
            type: string
        type:
          example: note
          type: string
          enum:
          - note
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        author:
          example: string
          type: string
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        client_id:
          type: string
        groups:
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        related_entities:
          example:
          - entity_type: string
            entity_id: string
          type: array
          items:
            $ref: '#/components/schemas/NoteRelatedEntity'
        owner:
          type: string
      additionalProperties: false
      required:
      - content
      - note_class
      - related_entities
    FileDeleteType:
      example:
        file_name: string
        process_guid: 10
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        type: FileDeleteEvent
        file_path: string
        process_name: string
        process_id: 10
        process_username: string
        failed: false
      type: object
      properties:
        file_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        time:
          $ref: '#/components/schemas/ObservedTime'
        type:
          example: FileDeleteEvent
          type: string
          enum:
          - FileDeleteEvent
        file_path:
          example: string
          description: String with at most 2048 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        failed:
          example: false
          type: boolean
      additionalProperties: false
      required:
      - file_name
      - time
      - type
      - file_path
      - process_name
      - process_id
    RegistryCreateType:
      example:
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        process_id: 10
        process_name: string
        process_guid: 10
        process_username: string
        registry_key: string
        type: RegistryCreateEvent
      type: object
      properties:
        time:
          $ref: '#/components/schemas/ObservedTime'
        process_id:
          example: 10
          type: integer
          format: int64
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        registry_key:
          example: string
          description: String with at most 1024 characters.
          type: string
        type:
          example: RegistryCreateEvent
          type: string
          enum:
          - RegistryCreateEvent
      additionalProperties: false
      required:
      - time
      - process_id
      - process_name
      - registry_key
      - type
    NewJudgement:
      description: a new Judgement
      type: object
      properties:
        authorized_groups:
          type: array
          items:
            type: string
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        observable:
          $ref: '#/components/schemas/Observable'
        reason_uri:
          example: string
          description: A URI
          type: string
        authorized_users:
          type: array
          items:
            type: string
        type:
          example: judgement
          type: string
          enum:
          - judgement
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        disposition:
          example: 1
          description: Numeric verdict identifiers.
          type: integer
          format: int64
          enum:
          - 1
          - 4
          - 3
          - 2
          - 5
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        reason:
          example: string
          description: String with at most 1024 characters.
          type: string
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        disposition_name:
          example: Clean
          description: String verdict identifiers.
          type: string
          enum:
          - Common
          - Unknown
          - Suspicious
          - Malicious
          - Clean
        priority:
          example: 10
          description: A value 0-100 that determine the priority of a judgement. Curated feeds of black/white lists, for example known good products within your organizations, should use a 95. All automated systems should use a priority of 90, or less.  Human judgements should have a priority of 100, so that humans can always override machines.
          type: integer
          format: int64
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        severity:
          example: Critical
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Critical
          - Low
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        client_id:
          type: string
        groups:
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        confidence:
          example: High
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        owner:
          type: string
      additionalProperties: false
      required:
      - observable
      - source
      - priority
      - severity
      - confidence
    NewBundleExportSightingsContextNetflowEventsTraffic:
      example:
        destination_host_name: string
        protocol: 10
        source_ip: string
        destination_subnet: string
        destination_ip: string
        source_subnet: string
        destination_port: 10
        direction: incoming
        source_port: 10
      type: object
      properties:
        destination_host_name:
          example: string
          type: string
        protocol:
          example: 10
          description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)
          type: integer
          format: int64
        source_ip:
          example: string
          type: string
        destination_subnet:
          example: string
          type: string
        destination_ip:
          example: string
          type: string
        source_subnet:
          example: string
          type: string
        destination_port:
          example: 10
          type: integer
          format: int64
        direction:
          example: incoming
          type: string
          enum:
          - incoming
          - outgoing
        source_port:
          example: 10
          type: integer
          format: int64
      additionalProperties: {}
      required:
      - protocol
      - source_ip
      - destination_ip
      - destination_port
      - direction
      - source_port
    NewBundleExportIncidents:
      example:
        description: string
        assignees:
        - string
        detection_sources:
        - string
        meta:
          keyword: string
        schema_version: 1.3.30
        revision: 10
        type: incident
        source: string
        external_ids:
        - string
        short_description: string
        title: string
        incident_time:
          opened: '2016-01-01T01:01:01.000Z'
          discovered: '2016-01-01T01:01:01.000Z'
          reported: '2016-01-01T01:01:01.000Z'
          remediated: '2016-01-01T01:01:01.000Z'
          closed: '2016-01-01T01:01:01.000Z'
          rejected: '2016-01-01T01:01:01.000Z'
          contained: '2016-01-01T01:01:01.000Z'
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        discovery_method: Agent Disclosure
        source_uri: string
        intended_effect: Account Takeover
        categories:
        - Attrition
        status: Closed
        language: string
        detection_status: active
        id: string
        promotion_method: Automated
        severity: Critical
        tlp: green
        scores:
          asset: 10.0
        techniques:
        - string
        timestamp: '2016-01-01T01:01:01.000Z'
        confidence: High
        short_id: string
        tactics:
        - string
      description: For submitting a new Incident.
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        assignees:
          example:
          - string
          description: A set of owners assigned to this incident.
          type: array
          items:
            type: string
        detection_sources:
          example:
          - string
          description: A set of sources that contributed threat detections to the incident.
          type: array
          items:
            type: string
        meta:
          $ref: '#/components/schemas/MetaData'
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        type:
          example: incident
          type: string
          enum:
          - incident
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        incident_time:
          $ref: '#/components/schemas/NewBundleExportIncidentsIncidentTime'
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportIncidentsExternalReferences'
        discovery_method:
          example: Agent Disclosure
          description: Identifies how the incident was discovered.
          type: string
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        intended_effect:
          example: Account Takeover
          description: Specifies the suspected intended effect of this incident
          type: string
        categories:
          example:
          - Attrition
          description: A set of categories for this incident.
          type: array
          items:
            type: string
        status:
          example: Closed
          description: The `status` field represents the current state of an incident within the incident management process. Its values help in tracking and reporting the progress of the incident from its discovery to its resolution.
          type: string
          enum:
          - New
          - Closed
          - 'Open: Recovered'
          - 'Closed: Other'
          - 'Hold: Internal'
          - 'Hold: Legal'
          - 'Closed: Under Review'
          - Rejected
          - Open
          - 'Closed: Merged'
          - Restoration Achieved
          - Incident Reported
          - 'Closed: Suspected'
          - Stalled
          - 'Open: Contained'
          - 'Closed: Near-Miss'
          - 'Hold: External'
          - Containment Achieved
          - 'New: Processing'
          - 'Closed: Confirmed Threat'
          - 'Closed: False Positive'
          - 'Open: Reported'
          - 'Open: Investigating'
          - Hold
          - 'New: Presented'
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        detection_status:
          example: active
          description: Represents the state of an incident within the incident generation process, indicating whether the incident is actively receiving updates or is no longer being updated.
          type: string
          enum:
          - inactive_oversized
          - inactive_user_closed
          - active
          - inactive_merged
          - inactive_expired
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        promotion_method:
          example: Automated
          description: Describes method for promoting an Incident, whether manually or automatically. An Incident may be created manually by a SOAR analyst or SOC operator, or through an automated correlation or aggregation rule or engine that matches a specific set of events or alerts, and promotes them to Incident(s).
          type: string
          enum:
          - Automated
          - Manual
        severity:
          example: Critical
          description: "Represents the potential impact of an incident on an organization's security posture and business operations. It helps organizations prioritize and allocate resources for incident response based on the severity level of the incident \nIt helps analysts and incident handlers prioritize incidents by indicating the level of risk and potential impact associated with the incident. This enables organizations to allocate resources efficiently and address the most critical incidents first.\nCan also be used to generate reports and metrics for measuring the effectiveness of the incident response process and to identify trends and patterns in the threat landscape.\nIt is important to note that the `severity` field is subjective and can be interpreted differently by different organizations or analysts. Therefore, it should be used in conjunction with other intelligence attributes, such as the `confidence` field, to provide a more comprehensive view of the incident."
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Critical
          - Low
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        scores:
          $ref: '#/components/schemas/IncidentScores'
        techniques:
          example:
          - string
          description: Represents the specific methods or actions used by an attacker to carry out an offensive maneuver or achieve their goals.
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        confidence:
          example: High
          description: 'Represents the level of certainty or trustworthiness associated with the incident. It denotes the reliability of the intelligence associated with the incident.

            The `confidence` field can take on several values, including:

            - `info`: Indicates that the incident information is based on sources with no previous track record or there is no track record for the source reporting the incident.

            - `low`: Indicates that the incident information is based on sources with a questionable track record or there is limited information about the accuracy of the source.

            - `medium`: Indicates that the incident information is based on sources with a mixed track record or of uncertain reliability.

            - `high`: Indicates that the incident information is based on sources with a proven track record and high degree of reliability.

            The `confidence` field can be used to indicate the level of trust and confidence that can be attributed to the incident, and it may impact how the incident is prioritized, analyzed and addressed. It can also help in the decision-making process associated with the incident response activities.

            It is important to note that the `confidence` field is subjective and can be interpreted differently by different organizations or analysts. As such, it is often used in conjunction with other intelligence attributes, such as the `severity` field, to provide a more complete picture of the incident.'
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        short_id:
          example: string
          description: A human-readable, short identifier for the incident, unique within an organization.
          type: string
        tactics:
          example:
          - string
          description: Represents the offensive techniques, approaches, or procedures that an adversary may use to achieve their objectives during an attack. It helps in understanding the intent and capabilities of the adversary and can be used to identify indicators of attack (IoAs) or indicators of compromise (IoCs) that are associated with the adversary's tactics.
          type: array
          items:
            type: string
      additionalProperties: {}
      required:
      - incident_time
      - status
      - confidence
    NewBundleExportSightingsContextProcessCreateEventsTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If the observation was made over a period of time, than this field indicates the end of that period.
          type: string
          format: date-time
      additionalProperties: {}
      required:
      - start_time
    CVEDataMeta:
      example:
        id: string
        assigner: string
      type: object
      properties:
        id:
          example: string
          description: String with at most 1024 characters.
          type: string
        assigner:
          example: string
          description: String with at most 1024 characters.
          type: string
      additionalProperties: false
    NewBundleExportSightingsContextFileCreateEvents:
      example:
        file_name: string
        process_guid: 10
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        type: FileCreateEvent
        file_path: string
        process_name: string
        process_id: 10
        process_username: string
        failed: false
      type: object
      properties:
        file_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        time:
          $ref: '#/components/schemas/NewBundleExportSightingsContextFileCreateEventsTime'
        type:
          example: FileCreateEvent
          type: string
          enum:
          - FileCreateEvent
        file_path:
          example: string
          description: String with at most 2048 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        failed:
          example: false
          type: boolean
      additionalProperties: {}
      required:
      - file_name
      - time
      - type
      - file_path
      - process_name
      - process_id
    NewIndicator:
      description: a new Indicator
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        tags:
          example:
          - string
          description: Descriptors for this indicator.
          type: array
          items:
            type: string
        authorized_groups:
          type: array
          items:
            type: string
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        producer:
          example: string
          description: String with at most 1024 characters.
          type: string
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        authorized_users:
          type: array
          items:
            type: string
        type:
          example: indicator
          description: The fixed value "indicator"
          type: string
          enum:
          - indicator
        created:
          type: string
          format: date-time
        test_mechanisms:
          example:
          - string
          description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator.
          type: array
          items:
            type: string
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        composite_indicator_expression:
          $ref: '#/components/schemas/CompositeIndicatorExpression'
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        likely_impact:
          example: string
          description: Likely potential impact within the relevant context if this Indicator were to occur.
          type: string
        indicator_type:
          example:
          - Anonymization
          description: Specifies the type or types for this Indicator.
          type: array
          items:
            type: string
            enum:
            - File Hash Watchlist
            - Private Threat Feed
            - IMEI Watchlist
            - Malicious E-mail
            - Exfiltration
            - C2
            - URL Watchlist
            - IMSI Watchlist
            - Malware Artifacts
            - Domain Watchlist
            - Anonymization
            - Host Characteristics
            - IP Watchlist
            - Compromised PKI Certificate
            - Login Name
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        severity:
          example: Critical
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Critical
          - Low
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        kill_chain_phases:
          example:
          - kill_chain_name: string
            phase_name: string
          description: Relevant kill chain phases indicated by this Indicator.
          type: array
          items:
            $ref: '#/components/schemas/KillChainPhase'
        client_id:
          type: string
        groups:
          type: array
          items:
            type: string
        negate:
          example: true
          description: Specifies the absence of the pattern.
          type: boolean
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        confidence:
          example: High
          description: level of confidence held in the accuracy of this Indicator.
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        specification:
          example: anything
          description: Simplified conditional branch
        owner:
          type: string
      additionalProperties: false
      required:
      - producer
    NewBundleExportSightingsContextRegistrySetEventsTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If the observation was made over a period of time, than this field indicates the end of that period.
          type: string
          format: date-time
      additionalProperties: {}
      required:
      - start_time
    NewBundleExportIdentityAssertionsAssertions:
      example:
        name: cisco:ctr:ad:host_domain_name
        value: string
      type: object
      properties:
        name:
          example: cisco:ctr:ad:host_domain_name
          description: An open vocabulary containing well known assertion types
          type: string
        value:
          example: string
          type: string
      additionalProperties: {}
      required:
      - name
      - value
    NewBundleExportSightingsDetectionInterval:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: The time interval during which the malicious activity was detected by the source engine or security tool. This may differ from the activity_interval if detection occurred after the activity.
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If the observation was made over a period of time, than this field indicates the end of that period.
          type: string
          format: date-time
      additionalProperties: {}
      required:
      - start_time
    SightingDataTable:
      example:
        columns:
        - name: string
          type: integer
          description: string
          required: true
          short_description: string
        rows:
        - - anything
        row_count: 10
      description: An embedded data table for the Sighting.
      type: object
      properties:
        columns:
          example:
          - name: string
            type: integer
            description: string
            required: true
            short_description: string
          description: an ordered list of column definitions
          type: array
          items:
            $ref: '#/components/schemas/ColumnDefinition'
        rows:
          example:
          - - anything
          description: an ordered list of rows
          type: array
          items:
            type: array
            items: {}
        row_count:
          example: 10
          description: The number of rows in the data table.
          type: integer
          format: int64
      additionalProperties: false
      required:
      - columns
      - rows
    NewBundleExportTargetRecordsTargets:
      example:
        type: endpoint
        observables:
        - value: 1.2.3.4
          type: ip
        observed_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        os: string
        internal: false
        sensor: string
        source_uri: string
      description: Schema for TargetRecord Targets
      type: object
      properties:
        type:
          example: endpoint
          description: The sensor/actuator name that best fits a device.
          type: string
        observables:
          example:
          - value: 1.2.3.4
            type: ip
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportTargetRecordsTargetsObservables'
        observed_time:
          $ref: '#/components/schemas/NewBundleExportTargetRecordsTargetsObservedTime'
        os:
          example: string
          type: string
        internal:
          example: false
          description: Is it internal to our network?
          type: boolean
        sensor:
          example: string
          description: 'The OpenC2 Actuator name that best fits the device that is creating this TargetRecord (e.g.: network.firewall, etc.)'
          type: string
        source_uri:
          example: string
          description: A URI
          type: string
      additionalProperties: {}
      required:
      - type
      - observables
      - observed_time
    ProcessCreateType:
      example:
        parent_process_name: string
        process_guid: 10
        parent_process_guid: 10
        process_disposition: string
        parent_process_size: 10
        process_size: 10
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        parent_process_disposition: string
        type: ProcessCreateEvent
        parent_process_username: string
        parent_process_id: 10
        parent_process_args: string
        process_name: string
        process_hash: string
        process_id: 10
        parent_process_hash: string
        process_username: string
        parent_creation_time: '2016-01-01T01:01:01.000Z'
        process_args: string
      type: object
      properties:
        parent_process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        parent_process_guid:
          example: 10
          type: integer
          format: int64
        process_disposition:
          example: string
          description: String with at most 1024 characters.
          type: string
        parent_process_size:
          example: 10
          type: integer
          format: int64
        process_size:
          example: 10
          type: integer
          format: int64
        time:
          $ref: '#/components/schemas/ObservedTime'
        parent_process_disposition:
          example: string
          description: String with at most 1024 characters.
          type: string
        type:
          example: ProcessCreateEvent
          type: string
          enum:
          - ProcessCreateEvent
        parent_process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        parent_process_id:
          example: 10
          type: integer
          format: int64
        parent_process_args:
          example: string
          description: String with at most 2048 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_hash:
          example: string
          description: String with at most 2048 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        parent_process_hash:
          example: string
          description: String with at most 2048 characters.
          type: string
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        parent_creation_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Schema definition for all date or timestamp values.  Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
          type: string
          format: date-time
        process_args:
          example: string
          description: String with at most 2048 characters.
          type: string
      additionalProperties: false
      required:
      - time
      - type
      - process_name
      - process_id
    Verdict:
      example:
        type: verdict
        disposition: 1
        observable:
          value: 1.2.3.4
          type: ip
        judgement_id: string
        disposition_name: Clean
        valid_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
      description: "A Verdict is chosen from all of the Judgements on that Observable which have not yet expired.  The highest priority Judgement becomes the active verdict.  If there is more than one Judgement with that priority, then Clean disposition has priority over all others, then Malicious disposition, and so on down to Unknown.\n\n The ID of a verdict is a a str of the form \"observable.type:observable.value\" for example, \"ip:1.1.1.1\""
      type: object
      properties:
        type:
          example: verdict
          type: string
          enum:
          - verdict
        disposition:
          example: 1
          description: Numeric verdict identifiers.
          type: integer
          format: int64
          enum:
          - 1
          - 4
          - 3
          - 2
          - 5
        observable:
          $ref: '#/components/schemas/Observable'
        judgement_id:
          example: string
          description: A URI leading to a judgement.
          type: string
        disposition_name:
          example: Clean
          description: 'The disposition_name field is optional, but is intended to be shown to a user.  Applications must therefore remember the mapping of numbers to human words, as in: {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}'
          type: string
          enum:
          - Common
          - Unknown
          - Suspicious
          - Malicious
          - Clean
        valid_time:
          $ref: '#/components/schemas/ValidTime'
      additionalProperties: false
    BundleExportIds:
      type: object
      properties:
        ids:
          type: array
          items:
            type: string
      additionalProperties: false
      required:
      - ids
    Observable:
      example:
        value: 1.2.3.4
        type: ip
      description: An AssetMapping is a record that a specific Observable maps to an Asset for an indicated period of time.
      type: object
      properties:
        value:
          example: 1.2.3.4
          description: The value of the observable.
          type: string
        type:
          example: ip
          description: The type of observable.
          type: string
          enum:
          - file_path
          - mac_address
          - trend_micro_id
          - cybereason_id
          - process_args
          - s1_agent_id
          - device
          - hostname
          - certificate_common_name
          - serial_number
          - meraki_network_id
          - url
          - jamf_management_id
          - certificate_serial
          - intune_id
          - meraki_org_id
          - cisco_cm_id
          - registry_key
          - process_path
          - darktrace_id
          - process_username
          - cortex_agent_id
          - orbital_node_id
          - process_uid
          - ngfw_name
          - user
          - certificate_issuer
          - ipv6
          - email
          - cisco_uc_id
          - cvm_id
          - sha256
          - crowdstrike_id
          - google_cloud_id
          - google_chromebook_id
          - acudid
          - sha1
          - registry_name
          - md5
          - service_now_id
          - ip
          - domain
          - email_subject
          - imei
          - ngfw_id
          - amp_computer_guid
          - ms_machine_id
          - secure_access_id
          - mutex
          - processor_id
          - swc_device_id
          - registry_path
          - odns_identity
          - odns_identity_label
          - cisco_mid
          - process_name
          - pki_serial
          - meraki_node_sn
          - email_messageid
          - imsi
          - user_agent
          - process_hash
          - file_name
      additionalProperties: false
      required:
      - value
      - type
    NewVulnerability:
      description: a new Vulnerability
      type: object
      properties:
        description:
          example: string
          description: "Various sources of vulnerability information can be used, including third-party  resources like the National Vulnerability Database (NVD) and the Common  Vulnerabilities and Exposures (CVE) database. The platform then analyzes this  data and provides the user with relevant details such as the severity of the  vulnerability, the affected systems, and remediation recommendations. \n\n Based on this information, the user can prioritize patching and other mitigation  strategies to reduce the risk of potential attacks."
          type: string
        authorized_groups:
          type: array
          items:
            type: string
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        published_date:
          example: '2016-01-01T01:01:01.000Z'
          description: "Represents the date when a vulnerability was publicly disclosed or made available to the general public. \n\nImportant for tracking the age of a vulnerability, as well as for determining when a particular vulnerability was first introduced into a system. The published date can be used to identify the time window during which a system may have been vulnerable to a particular exploit.\n\nFor example, if an organization discovers that a vulnerability was published before their system's installation date, but they did not apply the necessary security updates in a timely manner, it can be concluded that their system was vulnerable for the period between the installation date and the date when the necessary security updates were applied."
          type: string
          format: date-time
        cve:
          $ref: '#/components/schemas/CVE'
        configurations:
          $ref: '#/components/schemas/Configurations'
        authorized_users:
          type: array
          items:
            type: string
        type:
          example: vulnerability
          description: The fixed value "vulnerability"
          type: string
          enum:
          - vulnerability
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        client_id:
          type: string
        groups:
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        last_modified_date:
          example: '2016-01-01T01:01:01.000Z'
          description: 'Represents the date when the vulnerability metadata was last updated in the internal database.

            It can be used to track the freshness of the vulnerability information. If the `last_modified_date` is more recent than the `published_date`, it can indicate that there has been some new information or updates related to the vulnerability, such as new patch releases or changes in the severity or impact rating.'
          type: string
          format: date-time
        impact:
          $ref: '#/components/schemas/VulnerabilityImpact'
        owner:
          type: string
      additionalProperties: false
      required:
      - description
    NewBundleExportWeaknessesTechnologies:
      example:
        prevalence: Often
        name: string
      type: object
      properties:
        prevalence:
          example: Often
          description: Defines the different regularities that guide the applicability of platforms.
          type: string
          enum:
          - Undetermined
          - Sometimes
          - Often
          - Rarely
        name:
          example: string
          description: Technology name (Web Server, Web Client)
          type: string
      additionalProperties: {}
      required:
      - prevalence
    NewBundleExportSightingsContextHttpEvents:
      example:
        process_guid: 10
        traffic:
          destination_host_name: string
          protocol: 10
          source_ip: string
          destination_subnet: string
          destination_ip: string
          source_subnet: string
          destination_port: 10
          direction: incoming
          source_port: 10
        method: CONNECT
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        type: HTTPEvent
        host: string
        process_name: string
        process_id: 10
        process_username: string
        query: string
        encrypted: true
        url_port: 10
      type: object
      properties:
        process_guid:
          example: 10
          type: integer
          format: int64
        traffic:
          $ref: '#/components/schemas/NewBundleExportSightingsContextHttpEventsTraffic'
        method:
          example: CONNECT
          type: string
          enum:
          - OPTIONS
          - PATCH
          - TRACE
          - HEAD
          - POST
          - CONNECT
          - GET
          - PUT
        time:
          $ref: '#/components/schemas/NewBundleExportSightingsContextHttpEventsTime'
        type:
          example: HTTPEvent
          type: string
          enum:
          - HTTPEvent
        host:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        query:
          example: string
          description: String with at most 5000 characters.
          type: string
        encrypted:
          example: true
          type: boolean
        url_port:
          example: 10
          type: integer
          format: int64
      additionalProperties: {}
      required:
      - traffic
      - time
      - type
      - host
      - process_name
      - process_id
    NewBundleExportSightingsContextFileModifyEvents:
      example:
        file_name: string
        process_guid: 10
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        type: FileModifyEvent
        file_path: string
        process_name: string
        process_id: 10
        process_username: string
        failed: false
      type: object
      properties:
        file_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        time:
          $ref: '#/components/schemas/NewBundleExportSightingsContextFileModifyEventsTime'
        type:
          example: FileModifyEvent
          type: string
          enum:
          - FileModifyEvent
        file_path:
          example: string
          description: String with at most 2048 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        failed:
          example: false
          type: boolean
      additionalProperties: {}
      required:
      - file_name
      - time
      - type
      - file_path
      - process_name
      - process_id
    NewAssetMapping:
      description: a new Asset-mapping
      type: object
      properties:
        asset_type:
          example: application
          description: 'Type of the mapped Asset: Device, Person, Application, etc.'
          type: string
          enum:
          - device
          - network
          - application
          - person
          - data
        authorized_groups:
          type: array
          items:
            type: string
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        stability:
          example: Managed
          description: Do we manage when it changes, or is it always a time bound assignment?
          type: string
          enum:
          - Physical
          - Managed
          - Temporary
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        observable:
          $ref: '#/components/schemas/Observable'
        asset_ref:
          example: string
          description: URI that points to the mapped Asset.
          type: string
        authorized_users:
          type: array
          items:
            type: string
        type:
          example: asset-mapping
          type: string
          enum:
          - asset-mapping
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        client_id:
          type: string
        groups:
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        specificity:
          example: Low
          description: Denotes the level of how many assets potentially could have this same identifier.
          type: string
          enum:
          - Medium
          - Unique
          - Low
        confidence:
          example: High
          description: 'Level of confidence held in the characterization of this AssetMapping e.g.: is it susceptible to manipulation or translation?'
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        owner:
          type: string
      additionalProperties: false
      required:
      - asset_type
      - valid_time
      - stability
      - observable
      - asset_ref
      - source
      - specificity
      - confidence
    NewBundleExportVerdictsValidTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid.
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If not present, the valid time position of the indicator does not have an upper bound.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If end_time is not present, then the valid time position of the object does not have an upper bound.
          type: string
          format: date-time
      additionalProperties: {}
    NewBundleExportCoasOpenC2CoaActuator:
      example:
        type: endpoint
        specifiers:
        - string
      type: object
      properties:
        type:
          example: endpoint
          type: string
          enum:
          - endpoint.sensor
          - process.network-scanner
          - network.switch
          - network.security_manager
          - process.vulnerability-scanner
          - network.hub
          - network.ids
          - network.firewall
          - process
          - network.sense_making
          - process.sandbox
          - network.modem
          - process.email-service
          - process.dns-server
          - network.vpn
          - process.connection-scanner
          - network.nic
          - endpoint.printer
          - network.gateway
          - process.reputation-service
          - process.remediation-service
          - network
          - process.virtualization-service
          - network.ips
          - endpoint.smart-meter
          - endpoint.digital-telephone-handset
          - endpoint.workstation
          - endpoint.server
          - network.wap
          - endpoint.laptop
          - process.aaa-server
          - process.directory-service
          - endpoint.pos-terminal
          - network.bridge
          - other
          - process.file-scanner
          - network.proxy
          - endpoint
          - process.location-service
          - network.sensor
          - endpoint.smart-phone
          - network.hips
          - process.anti-virus-scanner
          - endpoint.tablet
          - network.guard
          - network.router
        specifiers:
          example:
          - string
          description: List of additional properties describing the actuator.
          type: array
          items:
            type: string
      additionalProperties: {}
      required:
      - type
    NewBundleExportSightingsContextFileDeleteEventsTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If the observation was made over a period of time, than this field indicates the end of that period.
          type: string
          format: date-time
      additionalProperties: {}
      required:
      - start_time
    NoteRelatedEntity:
      example:
        entity_type: string
        entity_id: string
      type: object
      properties:
        entity_type:
          example: string
          type: string
        entity_id:
          example: string
          description: A URI leading to an entity.
          type: string
      additionalProperties: false
      required:
      - entity_type
      - entity_id
    NewBundleExportVulnerabilities:
      example:
        description: string
        schema_version: 1.3.30
        revision: 10
        published_date: '2016-01-01T01:01:01.000Z'
        cve:
          cve_data_meta:
            id: string
            assigner: string
        configurations:
          CVE_data_version: string
          nodes:
          - operator: AND
            cpe_match:
            - vulnerable: true
              cpe23Uri: string
              versionStartIncluding: string
              versionEndIncluding: string
              versionStartExcluding: string
              versionEndExcluding: string
            children:
            - operator: AND
              cpe_match:
              - vulnerable: true
                cpe23Uri: string
                versionStartIncluding: string
                versionEndIncluding: string
                versionStartExcluding: string
                versionEndExcluding: string
              negate: true
            negate: true
        type: vulnerability
        source: string
        external_ids:
        - string
        short_description: string
        title: string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        source_uri: string
        language: string
        id: string
        tlp: green
        timestamp: '2016-01-01T01:01:01.000Z'
        last_modified_date: '2016-01-01T01:01:01.000Z'
        impact:
          cvss_v2:
            integrity_impact: complete
            target_distribution: not_defined
            availability_requirement: not_defined
            exploitability: not_defined
            access_complexity: low
            temporal_vector_string: string
            exploitability_score: 10.0
            impact_score: 10.0
            user_interaction_required: true
            environmental_vector_string: string
            obtain_other_privilege: true
            availability_impact: complete
            access_vector: network
            base_severity: High
            confidentiality_impact: complete
            confidentiality_requirement: not_defined
            report_confidence: not_defined
            authentication: none
            base_score: 10.0
            obtain_user_privilege: true
            obtain_all_privilege: true
            collateral_damage_potential: not_defined
            remediation_level: not_defined
            vector_string: string
            integrity_requirement: not_defined
          cvss_v3:
            integrity_impact: high
            modified_user_interaction: none
            modified_scope: not_defined
            availability_requirement: high
            user_interaction: none
            modified_integrity_impact: not_defined
            privileges_required: high
            exploitability_score: 10.0
            impact_score: 10.0
            environmental_severity: critical
            modified_availability_impact: not_defined
            availability_impact: high
            scope: changed
            exploit_code_maturity: functional
            modified_attack_complexity: not_defined
            base_severity: critical
            confidentiality_impact: high
            temporal_severity: critical
            modified_confidentiality_impact: not_defined
            confidentiality_requirement: high
            report_confidence: confirmed
            temporal_score: 10.0
            modified_privileges_required: not_defined
            modified_attack_vector: not_defined
            base_score: 10.0
            environmental_score: 10.0
            remediation_level: high
            vector_string: string
            integrity_requirement: high
            attack_vector: adjacent_network
            attack_complexity: high
      description: For submitting a new vulnerability.
      type: object
      properties:
        description:
          example: string
          description: "Various sources of vulnerability information can be used, including third-party  resources like the National Vulnerability Database (NVD) and the Common  Vulnerabilities and Exposures (CVE) database. The platform then analyzes this  data and provides the user with relevant details such as the severity of the  vulnerability, the affected systems, and remediation recommendations. \n\n Based on this information, the user can prioritize patching and other mitigation  strategies to reduce the risk of potential attacks."
          type: string
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        published_date:
          example: '2016-01-01T01:01:01.000Z'
          description: "Represents the date when a vulnerability was publicly disclosed or made available to the general public. \n\nImportant for tracking the age of a vulnerability, as well as for determining when a particular vulnerability was first introduced into a system. The published date can be used to identify the time window during which a system may have been vulnerable to a particular exploit.\n\nFor example, if an organization discovers that a vulnerability was published before their system's installation date, but they did not apply the necessary security updates in a timely manner, it can be concluded that their system was vulnerable for the period between the installation date and the date when the necessary security updates were applied."
          type: string
          format: date-time
        cve:
          $ref: '#/components/schemas/NewBundleExportVulnerabilitiesCve'
        configurations:
          $ref: '#/components/schemas/NewBundleExportVulnerabilitiesConfigurations'
        type:
          example: vulnerability
          description: The fixed value "vulnerability"
          type: string
          enum:
          - vulnerability
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportVulnerabilitiesExternalReferences'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        last_modified_date:
          example: '2016-01-01T01:01:01.000Z'
          description: 'Represents the date when the vulnerability metadata was last updated in the internal database.

            It can be used to track the freshness of the vulnerability information. If the `last_modified_date` is more recent than the `published_date`, it can indicate that there has been some new information or updates related to the vulnerability, such as new patch releases or changes in the severity or impact rating.'
          type: string
          format: date-time
        impact:
          $ref: '#/components/schemas/NewBundleExportVulnerabilitiesImpact'
      additionalProperties: {}
      required:
      - description
    NewBundleExportWeaknesses:
      example:
        description: string
        background_details: string
        paradigms:
        - prevalence: Often
          name: string
        abstraction_level: Base
        architectures:
        - prevalence: Often
          name: string
          class: Embedded
        schema_version: 1.3.30
        revision: 10
        alternate_terms:
        - term: string
          description: string
        likelihood: High
        type: weakness
        source: string
        external_ids:
        - string
        short_description: string
        title: string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        functional_areas:
        - Authentication
        source_uri: string
        modes_of_introduction:
        - phase: Architecture and Design
          note: string
        structure: Chain
        language: string
        id: string
        notes:
        - type: Applicable Platform
          note: string
        common_consequences:
        - scopes:
          - Access Control
          impacts:
          - Alter Execution Logic
          likelihood: High
          note: string
        tlp: green
        detection_methods:
        - method: Architecture or Design Review
          description: string
          effectiveness: High
          effectiveness_notes: string
        operating_systems:
        - prevalence: Often
          name: string
          version: string
          cpe_id: string
          class: Android
        affected_resources:
        - CPU
        languages:
        - prevalence: Often
          name: string
          class: Assembly
        timestamp: '2016-01-01T01:01:01.000Z'
        potential_mitigations:
        - description: string
          phases:
          - Architecture and Design
          strategy: Attack Surface Reduction
          effectiveness: Defense in Depth
          effectiveness_notes: string
        technologies:
        - prevalence: Often
          name: string
      description: For submitting a new weakness.
      type: object
      properties:
        description:
          example: string
          description: Should be short and limited to the key points that define this weakness.
          type: string
        background_details:
          example: string
          description: Information that is relevant but not related to the nature of the weakness itself.
          type: string
        paradigms:
          example:
          - prevalence: Often
            name: string
          description: Applicable paradigms.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportWeaknessesParadigms'
        abstraction_level:
          example: Base
          description: Refers to the level of abstraction or granularity used to describe the weakness. It helps to categorize the vulnerability based on the level of detail provided.
          type: string
          enum:
          - Variant
          - Class
          - Base
          - Compound
        architectures:
          example:
          - prevalence: Often
            name: string
            class: Embedded
          description: Applicable architectures.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportWeaknessesArchitectures'
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        alternate_terms:
          example:
          - term: string
            description: string
          description: Indicates one or more other names used to describe this weakness.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportWeaknessesAlternateTerms'
        likelihood:
          example: High
          description: Likelihood of exploit.
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        type:
          example: weakness
          description: The fixed value "weakness"
          type: string
          enum:
          - weakness
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportWeaknessesExternalReferences'
        functional_areas:
          example:
          - Authentication
          description: Identifies the functional area of the software in which the weakness is most likely to occur.
          type: array
          items:
            type: string
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        modes_of_introduction:
          example:
          - phase: Architecture and Design
            note: string
          description: Information about how and when a given weakness may be introduced.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportWeaknessesModesOfIntroduction'
        structure:
          example: Chain
          description: Defines the structural nature of the weakness.
          type: string
          enum:
          - Chain
          - Simple
          - Composite
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        notes:
          example:
          - type: Applicable Platform
            note: string
          description: Provides any additional comments about the weakness.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportWeaknessesNotes'
        common_consequences:
          example:
          - scopes:
            - Access Control
            impacts:
            - Alter Execution Logic
            likelihood: High
            note: string
          description: Refers to the typical or expected negative effects that can result from exploiting the weakness. This could include anything from unauthorized access to data, denial of service, system crashes or other things.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportWeaknessesCommonConsequences'
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        detection_methods:
          example:
          - method: Architecture or Design Review
            description: string
            effectiveness: High
            effectiveness_notes: string
          description: Identifies methods that may be employed to detect this weakness, including their strengths and limitations.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportWeaknessesDetectionMethods'
        operating_systems:
          example:
          - prevalence: Often
            name: string
            version: string
            cpe_id: string
            class: Android
          description: Applicable operating systems.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportWeaknessesOperatingSystems'
        affected_resources:
          example:
          - CPU
          description: Identifies system resources that can be affected by an exploit of this weakness.
          type: array
          items:
            type: string
        languages:
          example:
          - prevalence: Often
            name: string
            class: Assembly
          description: Applicable Languages.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportWeaknessesLanguages'
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        potential_mitigations:
          example:
          - description: string
            phases:
            - Architecture and Design
            strategy: Attack Surface Reduction
            effectiveness: Defense in Depth
            effectiveness_notes: string
          description: Describes potential mitigations associated with a weakness.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportWeaknessesPotentialMitigations'
        technologies:
          example:
          - prevalence: Often
            name: string
          description: Applicable technologies.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportWeaknessesTechnologies'
      additionalProperties: {}
      required:
      - description
    BundleImportResult:
      type: object
      properties:
        results:
          type: array
          items:
            $ref: '#/components/schemas/EntityImportResult'
      additionalProperties: false
      required:
      - results
    RelatedIdentity:
      example:
        identity: string
        confidence: High
        information_source: string
        relationship: string
      description: Describes a related Identity
      type: object
      properties:
        identity:
          example: string
          description: The reference (URI) of the related Identity object.
          type: string
        confidence:
          example: High
          description: Specifies the level of confidence in the assertion of the relationship between the two objects.
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        information_source:
          example: string
          description: Specifies the source of the information about the relationship between the two components.
          type: string
        relationship:
          example: string
          type: string
      additionalProperties: false
    CPENode:
      example:
        operator: AND
        cpe_match:
        - vulnerable: true
          cpe23Uri: string
          versionStartIncluding: string
          versionEndIncluding: string
          versionStartExcluding: string
          versionEndExcluding: string
        children:
        - operator: AND
          cpe_match:
          - vulnerable: true
            cpe23Uri: string
            versionStartIncluding: string
            versionEndIncluding: string
            versionStartExcluding: string
            versionEndExcluding: string
          negate: true
        negate: true
      type: object
      properties:
        operator:
          example: AND
          description: The operator string influences how seqs of cpe matches are related to one another.
          type: string
          enum:
          - AND
          - OR
        cpe_match:
          example:
          - vulnerable: true
            cpe23Uri: string
            versionStartIncluding: string
            versionEndIncluding: string
            versionStartExcluding: string
            versionEndExcluding: string
          type: array
          items:
            $ref: '#/components/schemas/CPEMatch'
        children:
          example:
          - operator: AND
            cpe_match:
            - vulnerable: true
              cpe23Uri: string
              versionStartIncluding: string
              versionEndIncluding: string
              versionStartExcluding: string
              versionEndExcluding: string
            negate: true
          type: array
          items:
            $ref: '#/components/schemas/CPELeafNode'
        negate:
          example: true
          description: Negates operator when true.
          type: boolean
      additionalProperties: false
      required:
      - operator
    NewBundleExportWeaknessesParadigms:
      example:
        prevalence: Often
        name: string
      type: object
      properties:
        prevalence:
          example: Often
          description: Defines the different regularities that guide the applicability of platforms.
          type: string
          enum:
          - Undetermined
          - Sometimes
          - Often
          - Rarely
        name:
          example: string
          description: Paradigm name (Client Server, Mainframe)
          type: string
      additionalProperties: {}
      required:
      - prevalence
    NewBundleExportVulnerabilitiesConfigurationsNodesChildren:
      example:
        operator: AND
        cpe_match:
        - vulnerable: true
          cpe23Uri: string
          versionStartIncluding: string
          versionEndIncluding: string
          versionStartExcluding: string
          versionEndExcluding: string
        negate: true
      type: object
      properties:
        operator:
          example: AND
          description: The operator string influences how seqs of cpe matches are related to one another.
          type: string
          enum:
          - AND
          - OR
        cpe_match:
          example:
          - vulnerable: true
            cpe23Uri: string
            versionStartIncluding: string
            versionEndIncluding: string
            versionStartExcluding: string
            versionEndExcluding: string
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportVulnerabilitiesConfigurationsNodesChildrenCpeMatch'
        negate:
          example: true
          description: Negates operator when true.
          type: boolean
      additionalProperties: {}
      required:
      - operator
      - cpe_match
    Identity:
      example:
        description: string
        related_identities:
        - identity: string
          confidence: High
          information_source: string
          relationship: string
      description: Can contain information such as the name of the attacker, the group or organization they belong to, or any other identifier that can help in the attribution process.
      type: object
      properties:
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        related_identities:
          example:
          - identity: string
            confidence: High
            information_source: string
            relationship: string
          description: Identifies other entity Identities related to this Identity.
          type: array
          items:
            $ref: '#/components/schemas/RelatedIdentity'
      additionalProperties: false
    NewBundleExportCoasRelatedCoAs:
      example:
        confidence: High
        source: string
        relationship: string
        COA_id: string
      type: object
      properties:
        confidence:
          example: High
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        source:
          example: string
          type: string
        relationship:
          example: string
          type: string
        COA_id:
          example: string
          description: A URI leading to a COA.
          type: string
      additionalProperties: {}
      required:
      - COA_id
    NewBundleExportSightingsSensorCoordinatesObservables:
      example:
        value: 1.2.3.4
        type: ip
      description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature.  This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains.  These do not exist as objects within the CTIA storage model, so you never create an observable.
      type: object
      properties:
        value:
          example: 1.2.3.4
          description: The value of the observable.
          type: string
        type:
          example: ip
          description: The type of observable.
          type: string
          enum:
          - file_path
          - mac_address
          - trend_micro_id
          - cybereason_id
          - process_args
          - s1_agent_id
          - device
          - hostname
          - certificate_common_name
          - serial_number
          - meraki_network_id
          - url
          - jamf_management_id
          - certificate_serial
          - intune_id
          - meraki_org_id
          - cisco_cm_id
          - registry_key
          - process_path
          - darktrace_id
          - process_username
          - cortex_agent_id
          - orbital_node_id
          - process_uid
          - ngfw_name
          - user
          - certificate_issuer
          - ipv6
          - email
          - cisco_uc_id
          - cvm_id
          - sha256
          - crowdstrike_id
          - google_cloud_id
          - google_chromebook_id
          - acudid
          - sha1
          - registry_name
          - md5
          - service_now_id
          - ip
          - domain
          - email_subject
          - imei
          - ngfw_id
          - amp_computer_guid
          - ms_machine_id
          - secure_access_id
          - mutex
          - processor_id
          - swc_device_id
          - registry_path
          - odns_identity
          - odns_identity_label
          - cisco_mid
          - process_name
          - pki_serial
          - meraki_node_sn
          - email_messageid
          - imsi
          - user_agent
          - process_hash
          - file_name
      additionalProperties: {}
      required:
      - value
      - type
    NewBundleExportNotesExternalReferences:
      example:
        source_name: string
        description: string
        url: string
        hashes:
        - string
        external_id: string
      description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
      type: object
      properties:
        source_name:
          example: string
          description: The source within which the external-reference is defined (system, registry, organization, etc.)
          type: string
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        url:
          example: string
          description: A URL reference to an external resource.
          type: string
        hashes:
          example:
          - string
          description: Specifies a dictionary of hashes for the contents of the url.
          type: array
          items:
            type: string
        external_id:
          example: string
          description: An identifier for the external reference content.
          type: string
      additionalProperties: {}
      required:
      - source_name
    RelatedCOA:
      example:
        confidence: High
        source: string
        relationship: string
        COA_id: string
      type: object
      properties:
        confidence:
          example: High
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        source:
          example: string
          type: string
        relationship:
          example: string
          type: string
        COA_id:
          example: string
          description: A URI leading to a COA.
          type: string
      additionalProperties: false
      required:
      - COA_id
    NewBundleExportSightingsContextFileCreateEventsTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If the observation was made over a period of time, than this field indicates the end of that period.
          type: string
          format: date-time
      additionalProperties: {}
      required:
      - start_time
    NewBundleExportNotes:
      example:
        schema_version: 1.3.30
        revision: 10
        content: string
        note_class: keyword
        type: note
        source: string
        external_ids:
        - string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        author: string
        source_uri: string
        language: string
        id: string
        tlp: green
        timestamp: '2016-01-01T01:01:01.000Z'
        related_entities:
        - entity_type: string
          entity_id: string
      description: Schema for submitting Notes
      type: object
      properties:
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        content:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        note_class:
          example: keyword
          type: string
        type:
          example: note
          type: string
          enum:
          - note
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportNotesExternalReferences'
        author:
          example: string
          type: string
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        related_entities:
          example:
          - entity_type: string
            entity_id: string
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportNotesRelatedEntities'
      additionalProperties: {}
      required:
      - content
      - note_class
      - related_entities
    NewBundleExportActorsIdentity:
      example:
        description: string
        related_identities:
        - identity: string
          confidence: High
          information_source: string
          relationship: string
      description: Can contain information such as the name of the attacker, the group or organization they belong to, or any other identifier that can help in the attribution process.
      type: object
      properties:
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        related_identities:
          example:
          - identity: string
            confidence: High
            information_source: string
            relationship: string
          description: Identifies other entity Identities related to this Identity.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportActorsIdentityRelatedIdentities'
      additionalProperties: {}
      required:
      - description
      - related_identities
    NewBundleExportTargetRecordsTargetsObservables:
      example:
        value: 1.2.3.4
        type: ip
      description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature.  This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains.  These do not exist as objects within the CTIA storage model, so you never create an observable.
      type: object
      properties:
        value:
          example: 1.2.3.4
          description: The value of the observable.
          type: string
        type:
          example: ip
          description: The type of observable.
          type: string
          enum:
          - file_path
          - mac_address
          - trend_micro_id
          - cybereason_id
          - process_args
          - s1_agent_id
          - device
          - hostname
          - certificate_common_name
          - serial_number
          - meraki_network_id
          - url
          - jamf_management_id
          - certificate_serial
          - intune_id
          - meraki_org_id
          - cisco_cm_id
          - registry_key
          - process_path
          - darktrace_id
          - process_username
          - cortex_agent_id
          - orbital_node_id
          - process_uid
          - ngfw_name
          - user
          - certificate_issuer
          - ipv6
          - email
          - cisco_uc_id
          - cvm_id
          - sha256
          - crowdstrike_id
          - google_cloud_id
          - google_chromebook_id
          - acudid
          - sha1
          - registry_name
          - md5
          - service_now_id
          - ip
          - domain
          - email_subject
          - imei
          - ngfw_id
          - amp_computer_guid
          - ms_machine_id
          - secure_access_id
          - mutex
          - processor_id
          - swc_device_id
          - registry_path
          - odns_identity
          - odns_identity_label
          - cisco_mid
          - process_name
          - pki_serial
          - meraki_node_sn
          - email_messageid
          - imsi
          - user_agent
          - process_hash
          - file_name
      additionalProperties: {}
      required:
      - value
      - type
    NewBundleExportWeaknessesNotes:
      example:
        type: Applicable Platform
        note: string
      type: object
      properties:
        type:
          example: Applicable Platform
          description: Defines the different types of notes that can be associated with a weakness.
          type: string
        note:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
      additionalProperties: {}
      required:
      - type
      - note
    CVSSv3:
      example:
        integrity_impact: high
        modified_user_interaction: none
        modified_scope: not_defined
        availability_requirement: high
        user_interaction: none
        modified_integrity_impact: not_defined
        privileges_required: high
        exploitability_score: 10.0
        impact_score: 10.0
        environmental_severity: critical
        modified_availability_impact: not_defined
        availability_impact: high
        scope: changed
        exploit_code_maturity: functional
        modified_attack_complexity: not_defined
        base_severity: critical
        confidentiality_impact: high
        temporal_severity: critical
        modified_confidentiality_impact: not_defined
        confidentiality_requirement: high
        report_confidence: confirmed
        temporal_score: 10.0
        modified_privileges_required: not_defined
        modified_attack_vector: not_defined
        base_score: 10.0
        environmental_score: 10.0
        remediation_level: high
        vector_string: string
        integrity_requirement: high
        attack_vector: adjacent_network
        attack_complexity: high
      type: object
      properties:
        integrity_impact:
          example: high
          description: measures the impact to integrity of a successfully exploited vulnerability
          type: string
          enum:
          - low
          - none
          - high
        modified_user_interaction:
          example: none
          description: modified user interaction
          type: string
          enum:
          - none
          - required
          - not_defined
        modified_scope:
          example: not_defined
          description: modified scope
          type: string
          enum:
          - changed
          - unchanged
          - not_defined
        availability_requirement:
          example: high
          description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
          type: string
          enum:
          - low
          - none
          - high
          - not_defined
        user_interaction:
          example: none
          description: captures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerable component
          type: string
          enum:
          - none
          - required
        modified_integrity_impact:
          example: not_defined
          description: modified integrity impact
          type: string
          enum:
          - low
          - none
          - high
          - not_defined
        privileges_required:
          example: high
          description: describes the level of privileges an attacker must possess before successfully exploiting the vulnerability
          type: string
          enum:
          - low
          - none
          - high
        exploitability_score:
          example: 10.0
          description: a Score number from 0 to 10
          type: number
          format: double
        impact_score:
          example: 10.0
          description: a Score number from 0 to 10
          type: number
          format: double
        environmental_severity:
          example: critical
          type: string
          enum:
          - low
          - none
          - high
          - medium
          - critical
        modified_availability_impact:
          example: not_defined
          description: modified availability impact
          type: string
          enum:
          - low
          - none
          - high
          - not_defined
        availability_impact:
          example: high
          description: measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability
          type: string
          enum:
          - low
          - none
          - high
        scope:
          example: changed
          description: the ability for a vulnerability in one software component to impact resources beyond its means, or privileges
          type: string
          enum:
          - changed
          - unchanged
        exploit_code_maturity:
          example: functional
          description: measures the likelihood of the vulnerability being attacked
          type: string
          enum:
          - high
          - unproven
          - functional
          - proof_of_concept
          - not_defined
        modified_attack_complexity:
          example: not_defined
          description: modified attack complexity
          type: string
          enum:
          - low
          - high
          - not_defined
        base_severity:
          example: critical
          type: string
          enum:
          - low
          - none
          - high
          - medium
          - critical
        confidentiality_impact:
          example: high
          description: measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability
          type: string
          enum:
          - low
          - none
          - high
        temporal_severity:
          example: critical
          description: temporal severity
          type: string
          enum:
          - low
          - none
          - high
          - medium
          - critical
        modified_confidentiality_impact:
          example: not_defined
          description: modified confidentiality impact
          type: string
          enum:
          - low
          - none
          - high
          - not_defined
        confidentiality_requirement:
          example: high
          description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
          type: string
          enum:
          - low
          - none
          - high
          - not_defined
        report_confidence:
          example: confirmed
          description: measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details
          type: string
          enum:
          - unknown
          - reasonable
          - confirmed
        temporal_score:
          example: 10.0
          description: Round up(CVSSv3BaseScore × CVSSv3ExploitCodeMaturity × CVSSv3RemediationLevel × CVSSv3ReportConfidence)
          type: number
          format: double
        modified_privileges_required:
          example: not_defined
          description: modified privileges required
          type: string
          enum:
          - low
          - none
          - high
          - not_defined
        modified_attack_vector:
          example: not_defined
          description: modified attack vector
          type: string
          enum:
          - network
          - adjacent_network
          - local
          - physical
          - not_defined
        base_score:
          example: 10.0
          description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v3-1'
          type: number
          format: double
        environmental_score:
          example: 10.0
          description: a Score number from 0 to 10
          type: number
          format: double
        remediation_level:
          example: high
          description: Remediation Level of a vulnerability is an important factor for prioritization
          type: string
          enum:
          - temporary_fix
          - offical_fix
          - high
          - workaround
          - unavailable
          - not_defined
        vector_string:
          example: string
          description: a text representation of a set of CVSSv3 metrics. It is commonly used to record or transfer CVSSv3 metric information in a concise form
          type: string
        integrity_requirement:
          example: high
          description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
          type: string
          enum:
          - low
          - none
          - high
          - not_defined
        attack_vector:
          example: adjacent_network
          description: Reflects the context by which vulnerability exploitation is possible
          type: string
          enum:
          - network
          - adjacent_network
          - local
          - physical
        attack_complexity:
          example: high
          description: describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability
          type: string
          enum:
          - low
          - high
      additionalProperties: false
      required:
      - base_severity
      - base_score
      - vector_string
    NewBundleExportValidTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid.
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If not present, the valid time position of the indicator does not have an upper bound.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If end_time is not present, then the valid time position of the object does not have an upper bound.
          type: string
          format: date-time
      additionalProperties: {}
    NewBundleExportAttackPatterns:
      example:
        description: string
        abstraction_level: aggregate
        schema_version: 1.3.30
        revision: 10
        type: attack-pattern
        source: string
        external_ids:
        - string
        short_description: string
        title: string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        source_uri: string
        x_mitre_platforms:
        - string
        language: string
        id: string
        tlp: green
        x_mitre_data_sources:
        - string
        kill_chain_phases:
        - kill_chain_name: string
          phase_name: string
        x_mitre_contributors:
        - string
        timestamp: '2016-01-01T01:01:01.000Z'
      description: For submitting a new AttackPattern
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        abstraction_level:
          example: aggregate
          description: The CAPEC abstraction level for patterns describing techniques to attack a system.
          type: string
          enum:
          - detailed
          - standard
          - aggregate
          - meta
          - category
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        type:
          example: attack-pattern
          type: string
          enum:
          - attack-pattern
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportAttackPatternsExternalReferences'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        x_mitre_platforms:
          example:
          - string
          description: ATT&CK Technique.Platforms.
          type: array
          items:
            type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        x_mitre_data_sources:
          example:
          - string
          description: ATT&CK Technique.Data Sources.
          type: array
          items:
            type: string
        kill_chain_phases:
          example:
          - kill_chain_name: string
            phase_name: string
          description: A kill chain is a series of steps that an attacker must go through to successfully achieve their objective. The concept was originally developed by the military, but has been adapted to the cybersecurity field to describe the steps an attacker goes through to compromise a target system and achieve their goal.
          type: array
          items:
            $ref: '#/components/schemas/NewBundleExportAttackPatternsKillChainPhases'
        x_mitre_contributors:
          example:
          - string
          description: ATT&CK Technique.Contributors.
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
      additionalProperties: {}
      required:
      - description
      - short_description
      - title
    NewBundleExportSightingsDataColumns:
      example:
        name: string
        type: integer
        description: string
        required: true
        short_description: string
      type: object
      properties:
        name:
          example: string
          type: string
        type:
          example: integer
          type: string
          enum:
          - url
          - string
          - observable
          - number
          - integer
          - markdown
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        required:
          example: true
          description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`.
          type: boolean
        short_description:
          example: string
          type: string
      additionalProperties: {}
      required:
      - name
      - type
    NewBundleExportSightingsContextProcessCreateEvents:
      example:
        parent_process_name: string
        process_guid: 10
        parent_process_guid: 10
        process_disposition: string
        parent_process_size: 10
        process_size: 10
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        parent_process_disposition: string
        type: ProcessCreateEvent
        parent_process_username: string
        parent_process_id: 10
        parent_process_args: string
        process_name: string
        process_hash: string
        process_id: 10
        parent_process_hash: string
        process_username: string
        parent_creation_time: '2016-01-01T01:01:01.000Z'
        process_args: string
      type: object
      properties:
        parent_process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        parent_process_guid:
          example: 10
          type: integer
          format: int64
        process_disposition:
          example: string
          description: String with at most 1024 characters.
          type: string
        parent_process_size:
          example: 10
          type: integer
          format: int64
        process_size:
          example: 10
          type: integer
          format: int64
        time:
          $ref: '#/components/schemas/NewBundleExportSightingsContextProcessCreateEventsTime'
        parent_process_disposition:
          example: string
          description: String with at most 1024 characters.
          type: string
        type:
          example: ProcessCreateEvent
          type: string
          enum:
          - ProcessCreateEvent
        parent_process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        parent_process_id:
          example: 10
          type: integer
          format: int64
        parent_process_args:
          example: string
          description: String with at most 2048 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_hash:
          example: string
          description: String with at most 2048 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        parent_process_hash:
          example: string
          description: String with at most 2048 characters.
          type: string
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        parent_creation_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Schema definition for all date or timestamp values.  Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
          type: string
          format: date-time
        process_args:
          example: string
          description: String with at most 2048 characters.
          type: string
      additionalProperties: {}
      required:
      - time
      - type
      - process_name
      - process_id
    ExternalReference:
      example:
        source_name: string
        description: string
        url: string
        hashes:
        - string
        external_id: string
      description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
      type: object
      properties:
        source_name:
          example: string
          description: The source within which the external-reference is defined (system, registry, organization, etc.)
          type: string
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        url:
          example: string
          description: A URL reference to an external resource.
          type: string
        hashes:
          example:
          - string
          description: Specifies a dictionary of hashes for the contents of the url.
          type: array
          items:
            type: string
        external_id:
          example: string
          description: An identifier for the external reference content.
          type: string
      additionalProperties: false
      required:
      - source_name
  securitySchemes:
    JWT:
      type: apiKey
      in: header
      name: Authorization
      description: 'Ex: Bearer \<token\>'
    oauth2:
      type: oauth2
      flows:
        authorizationCode:
          scopes:
            private-intel: Private Intelligence Full Access
            private-intel:read: Private Intelligence Read Access
            private-intel:write: Private Intelligence Write Access
            casebook: Casebook Full Access
            casebook:read: Casebook Read Access
            casebook:write: Casebook Write Access
          authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
          tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token