openapi: 3.2.0
info:
  title: CTIA Casebook API
  version: 4178275a824512c2fd3a2acdb0e8277233919054 v2.71.0
  license:
    name: All Rights Reserved
    url: ''
  contact:
    name: 'Cisco Security Business Group -- Advanced Threat '
    url: http://github.com/threatgrid/ctia
    email: cisco-intel-api-support@cisco.com
  description: "A Threat Intelligence API service\n\n  This API provides a mechanism for making Judgements on the Disposition\n  of Observables, which are then distilled into a final Verdict.  A\n  Disposition is a statement regarding the malicious, or otherwise,\n  nature of an Observable.\n\n  The Judgements can be grouped into Indicators, which can be associated\n  with Campaigns, Actors and TTPs.  Feedback can be given on specific\n  Judgements, indicating agreement or disagreement, or clarification.\n\n  When an Observable with a malicious Verdict is seen, it can be recorded as\n  a Sighting, and the Relations that Observable had with other Observables can\n  be recorded as well.\n\n  We support a pre-defined set of Observable Types.  Each Observable Type has a\n  specific form of natural identifier, its ID, which is almost always\n  the default way it is represented when observed in the wild.\n\n  * Ipv4/IPv6  -- 192.168.1.1\n  * Domain/Hostname -- foo.com, www.bar.com\n  * SHA256  -- the sha256 checksum of a file, or other data blob\n  * MD5 -- the md5 checksum of a file, or other data blob\n  * SHA1 -- the sha1 checksum of a file, or other data blob\n  * URL -- A minimal form of the URL\n\n  The Verdict is derived from all of the Judgements on that Observable which\n  have not yet expired.  The highest priority Judgement becomes the\n  active verdict.  If there is more than one Judgement with that\n  priority, than Clean disposition has priority over all others, then\n  Malicious disposition, and so on down to Unknown.\n\n  <a href='/doc/README.md'>CTIA Documentation</a>"
  x-provenance:
    method: harvested
    authored_by: Cisco XDR (CTIA)
    harvested_by: API Evangelist
    harvested_on: '2026-08-19'
    first_party: true
    note: Published by Cisco. Retrieved unmodified except for this x-provenance block.
    provider_published: true
  x-evidence:
  - type: source
    url: https://private.intel.amp.cisco.com/index.html
  - type: raw
    url: https://private.intel.amp.cisco.com/swagger.json
servers:
- url: /
security:
- JWT: []
- oauth2:
  - private-intel
  - private-intel:read
  - private-intel:write
  - casebook
  - casebook:read
  - casebook:write
tags:
- name: Casebook
  description: Casebook operations
paths:
  /ctia/casebook/{id}:
    patch:
      tags:
      - Casebook
      description: Requires capability create-casebook.
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Casebook'
            application/x-yaml:
              schema:
                $ref: '#/components/schemas/Casebook'
            application/edn:
              schema:
                $ref: '#/components/schemas/Casebook'
            application/transit+json:
              schema:
                $ref: '#/components/schemas/Casebook'
            application/transit+msgpack:
              schema:
                $ref: '#/components/schemas/Casebook'
      parameters:
      - in: query
        name: wait_for
        description: wait for patched entity to be available for search
        required: false
        schema:
          type: boolean
      - in: path
        name: id
        description: ''
        required: true
        schema:
          type: string
      summary: Partially Update a Casebook
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PartialNewCasebook'
          application/x-yaml:
            schema:
              $ref: '#/components/schemas/PartialNewCasebook'
          application/edn:
            schema:
              $ref: '#/components/schemas/PartialNewCasebook'
          application/transit+json:
            schema:
              $ref: '#/components/schemas/PartialNewCasebook'
          application/transit+msgpack:
            schema:
              $ref: '#/components/schemas/PartialNewCasebook'
        description: a Casebook partial update
        required: true
    put:
      tags:
      - Casebook
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Casebook'
            application/x-yaml:
              schema:
                $ref: '#/components/schemas/Casebook'
            application/edn:
              schema:
                $ref: '#/components/schemas/Casebook'
            application/transit+json:
              schema:
                $ref: '#/components/schemas/Casebook'
            application/transit+msgpack:
              schema:
                $ref: '#/components/schemas/Casebook'
      parameters:
      - in: query
        name: wait_for
        description: wait for updated entity to be available for search
        required: false
        schema:
          type: boolean
      - in: path
        name: id
        description: ''
        required: true
        schema:
          type: string
      summary: Update an existing Casebook
      description: Requires capability create-casebook.
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/NewCasebook'
          application/x-yaml:
            schema:
              $ref: '#/components/schemas/NewCasebook'
          application/edn:
            schema:
              $ref: '#/components/schemas/NewCasebook'
          application/transit+json:
            schema:
              $ref: '#/components/schemas/NewCasebook'
          application/transit+msgpack:
            schema:
              $ref: '#/components/schemas/NewCasebook'
        description: an updated Casebook
        required: true
    get:
      tags:
      - Casebook
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PartialCasebook'
            application/x-yaml:
              schema:
                $ref: '#/components/schemas/PartialCasebook'
            application/edn:
              schema:
                $ref: '#/components/schemas/PartialCasebook'
            application/transit+json:
              schema:
                $ref: '#/components/schemas/PartialCasebook'
            application/transit+msgpack:
              schema:
                $ref: '#/components/schemas/PartialCasebook'
      summary: Get one Casebook by ID
      parameters:
      - in: path
        name: id
        description: ''
        required: true
        schema:
          type: string
      - in: query
        name: fields
        description: ''
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
            enum:
            - schema_version
            - revision
            - source
            - title
            - source_uri
            - language
            - id
            - tlp
            - timestamp
      description: Requires capability read-casebook.
    delete:
      tags:
      - Casebook
      responses:
        '204':
          description: ''
      x-no-doc: false
      parameters:
      - in: path
        name: id
        description: ''
        required: true
        schema:
          type: string
      - in: query
        name: wait_for
        description: wait for deleted entity to no more be available for search
        required: false
        schema:
          type: boolean
      summary: Delete one Casebook
      description: Requires capability delete-casebook.
  /ctia/casebook/{id}/observables:
    post:
      tags:
      - Casebook
      description: Requires capability create-casebook.
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Casebook'
            application/x-yaml:
              schema:
                $ref: '#/components/schemas/Casebook'
            application/edn:
              schema:
                $ref: '#/components/schemas/Casebook'
            application/transit+json:
              schema:
                $ref: '#/components/schemas/Casebook'
            application/transit+msgpack:
              schema:
                $ref: '#/components/schemas/Casebook'
      parameters:
      - in: query
        name: wait_for
        description: wait for patched entity to be available for search
        required: false
        schema:
          type: boolean
      - in: path
        name: id
        description: ''
        required: true
        schema:
          type: string
      summary: Edit Observables on a casebook
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CasebookObservablesUpdate'
          application/x-yaml:
            schema:
              $ref: '#/components/schemas/CasebookObservablesUpdate'
          application/edn:
            schema:
              $ref: '#/components/schemas/CasebookObservablesUpdate'
          application/transit+json:
            schema:
              $ref: '#/components/schemas/CasebookObservablesUpdate'
          application/transit+msgpack:
            schema:
              $ref: '#/components/schemas/CasebookObservablesUpdate'
        description: A casebook Observables operation
        required: true
  /ctia/casebook/{id}/texts:
    post:
      tags:
      - Casebook
      description: Requires capability create-casebook.
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Casebook'
            application/x-yaml:
              schema:
                $ref: '#/components/schemas/Casebook'
            application/edn:
              schema:
                $ref: '#/components/schemas/Casebook'
            application/transit+json:
              schema:
                $ref: '#/components/schemas/Casebook'
            application/transit+msgpack:
              schema:
                $ref: '#/components/schemas/Casebook'
      parameters:
      - in: query
        name: wait_for
        description: wait for patched entity to be available for search
        required: false
        schema:
          type: boolean
      - in: path
        name: id
        description: ''
        required: true
        schema:
          type: string
      summary: Edit Texts on a casebook
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CasebookTextsUpdate'
          application/x-yaml:
            schema:
              $ref: '#/components/schemas/CasebookTextsUpdate'
          application/edn:
            schema:
              $ref: '#/components/schemas/CasebookTextsUpdate'
          application/transit+json:
            schema:
              $ref: '#/components/schemas/CasebookTextsUpdate'
          application/transit+msgpack:
            schema:
              $ref: '#/components/schemas/CasebookTextsUpdate'
        description: A casebook Texts operation
        required: true
  /ctia/casebook/{id}/bundle:
    post:
      tags:
      - Casebook
      description: Requires capability create-casebook.
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Casebook'
            application/x-yaml:
              schema:
                $ref: '#/components/schemas/Casebook'
            application/edn:
              schema:
                $ref: '#/components/schemas/Casebook'
            application/transit+json:
              schema:
                $ref: '#/components/schemas/Casebook'
            application/transit+msgpack:
              schema:
                $ref: '#/components/schemas/Casebook'
      parameters:
      - in: query
        name: wait_for
        description: wait for patched entity to be available for search
        required: false
        schema:
          type: boolean
      - in: path
        name: id
        description: ''
        required: true
        schema:
          type: string
      summary: Edit a Bundle on a casebook
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CasebookBundleUpdate'
          application/x-yaml:
            schema:
              $ref: '#/components/schemas/CasebookBundleUpdate'
          application/edn:
            schema:
              $ref: '#/components/schemas/CasebookBundleUpdate'
          application/transit+json:
            schema:
              $ref: '#/components/schemas/CasebookBundleUpdate'
          application/transit+msgpack:
            schema:
              $ref: '#/components/schemas/CasebookBundleUpdate'
        description: A casebook Bundle operation
        required: true
  /ctia/casebook:
    post:
      tags:
      - Casebook
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Casebook'
            application/x-yaml:
              schema:
                $ref: '#/components/schemas/Casebook'
            application/edn:
              schema:
                $ref: '#/components/schemas/Casebook'
            application/transit+json:
              schema:
                $ref: '#/components/schemas/Casebook'
            application/transit+msgpack:
              schema:
                $ref: '#/components/schemas/Casebook'
      parameters:
      - in: query
        name: wait_for
        description: wait for entity to be available for search
        required: false
        schema:
          type: boolean
      summary: Adds a new Casebook
      description: Requires capability create-casebook.
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/NewCasebook'
          application/x-yaml:
            schema:
              $ref: '#/components/schemas/NewCasebook'
          application/edn:
            schema:
              $ref: '#/components/schemas/NewCasebook'
          application/transit+json:
            schema:
              $ref: '#/components/schemas/NewCasebook'
          application/transit+msgpack:
            schema:
              $ref: '#/components/schemas/NewCasebook'
        description: a new Casebook
        required: true
  /ctia/casebook/external_id/{external_id}:
    get:
      tags:
      - Casebook
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PartialCasebook'
            application/x-yaml:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PartialCasebook'
            application/edn:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PartialCasebook'
            application/transit+json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PartialCasebook'
            application/transit+msgpack:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PartialCasebook'
      parameters:
      - in: query
        name: sort_by
        description: Sort results on a field
        required: false
        schema:
          type: string
          enum:
          - schema_version
          - revision
          - source
          - title
          - source_uri
          - language
          - id
          - tlp
          - timestamp
      - in: query
        name: sort_order
        description: Sort direction
        required: false
        schema:
          type: string
          enum:
          - desc
          - asc
      - in: query
        name: offset
        description: Pagination Offset
        required: false
        schema:
          type: integer
          format: int64
      - in: query
        name: search_after
        description: Pagination stateless cursor
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
      - in: query
        name: limit
        description: Pagination Limit
        required: false
        schema:
          type: integer
          format: int64
      - in: query
        name: fields
        description: ''
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
            enum:
            - schema_version
            - revision
            - source
            - title
            - source_uri
            - language
            - id
            - tlp
            - timestamp
      - in: path
        name: external_id
        description: ''
        required: true
        schema:
          type: string
      summary: List Casebook by external id
      description: Requires capability read-casebook.
  /ctia/casebook/search:
    get:
      tags:
      - Casebook
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PartialCasebook'
            application/x-yaml:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PartialCasebook'
            application/edn:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PartialCasebook'
            application/transit+json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PartialCasebook'
            application/transit+msgpack:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PartialCasebook'
      summary: Search for Casebook entities using a ES query syntax and field filters
      description: Requires capability search-casebook.
      parameters:
      - in: query
        name: sort_order
        description: Sort direction
        required: false
        schema:
          type: string
          enum:
          - desc
          - asc
      - in: query
        name: tlp
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: from
        description: ''
        required: false
        schema:
          type: string
          format: date-time
      - in: query
        name: sort_by
        description: 'Sort result on fields.


          The following fields are supported: id, language, revision, schema_version, source, source_uri, timestamp, title, tlp


          Fields can be combined with '','' and sort order can be specified by '':asc'' and '':desc''. For example:


          -  id       # sort by id ascending

          -  id:desc  # sort by id descending

          -  id,language:desc  # sort by id ascending, then language descending'
        required: false
        schema:
          type: string
      - in: query
        name: fields
        description: ''
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
            enum:
            - schema_version
            - revision
            - source
            - title
            - source_uri
            - language
            - id
            - tlp
            - timestamp
      - in: query
        name: search_after
        description: Pagination stateless cursor
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
      - in: query
        name: language
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: id
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: limit
        description: Pagination Limit
        required: false
        schema:
          type: integer
          format: int64
      - in: query
        name: search_fields
        description: '''fields'' key of Elasticsearch Fulltext Query.'
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
            enum:
            - id
            - short_description
            - observables.value
            - title
            - source
            - description
      - in: query
        name: offset
        description: Pagination Offset
        required: false
        schema:
          type: integer
          format: int64
      - in: query
        name: source
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: query
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: texts.text
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: simple_query
        description: Query String with simple query format
        required: false
        schema:
          type: string
      - in: query
        name: revision
        description: ''
        required: false
        schema:
          type: integer
          format: int64
      - in: query
        name: to
        description: ''
        required: false
        schema:
          type: string
          format: date-time
    delete:
      tags:
      - Casebook
      description: Requires capabilities delete-casebook, search-casebook.
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: integer
                format: int64
            application/x-yaml:
              schema:
                type: integer
                format: int64
            application/edn:
              schema:
                type: integer
                format: int64
            application/transit+json:
              schema:
                type: integer
                format: int64
            application/transit+msgpack:
              schema:
                type: integer
                format: int64
      summary: Delete Casebook entities matching given Lucene/ES query string or/and field filters
      parameters:
      - in: query
        name: tlp
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: from
        description: ''
        required: false
        schema:
          type: string
          format: date-time
      - in: query
        name: search_after
        description: Pagination stateless cursor
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
      - in: query
        name: language
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: id
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: REALLY_DELETE_ALL_THESE_ENTITIES
        description: ' If you do not set this value or set it to false this route will perform a dry run. Set this value to true to perform the deletion. You MUST confirm you will fix the mess after the inevitable disaster that will occur after you perform that operation. DO NOT FORGET TO SET THAT TO FALSE AFTER EACH DELETION IF YOU INTEND TO USE THAT ROUTE MULTIPLE TIMES.'
        required: false
        schema:
          type: boolean
      - in: query
        name: source
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: wait_for
        description: wait for matched entity to be deleted
        required: false
        schema:
          type: boolean
      - in: query
        name: query
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: texts.text
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: simple_query
        description: Query String with simple query format
        required: false
        schema:
          type: string
      - in: query
        name: revision
        description: ''
        required: false
        schema:
          type: integer
          format: int64
      - in: query
        name: to
        description: ''
        required: false
        schema:
          type: string
          format: date-time
  /ctia/casebook/search/count:
    get:
      tags:
      - Casebook
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: integer
                format: int64
            application/x-yaml:
              schema:
                type: integer
                format: int64
            application/edn:
              schema:
                type: integer
                format: int64
            application/transit+json:
              schema:
                type: integer
                format: int64
            application/transit+msgpack:
              schema:
                type: integer
                format: int64
      summary: Count Casebook matching a Lucene/ES query string and field filters
      description: Requires capability search-casebook.
      parameters:
      - in: query
        name: tlp
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: from
        description: ''
        required: false
        schema:
          type: string
          format: date-time
      - in: query
        name: search_after
        description: Pagination stateless cursor
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
      - in: query
        name: language
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: id
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: source
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: query
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: texts.text
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: simple_query
        description: Query String with simple query format
        required: false
        schema:
          type: string
      - in: query
        name: revision
        description: ''
        required: false
        schema:
          type: integer
          format: int64
      - in: query
        name: to
        description: ''
        required: false
        schema:
          type: string
          format: date-time
  /ctia/casebook/metric/histogram:
    get:
      tags:
      - Casebook
      description: Requires capability search-casebook.
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MetricResult'
            application/x-yaml:
              schema:
                $ref: '#/components/schemas/MetricResult'
            application/edn:
              schema:
                $ref: '#/components/schemas/MetricResult'
            application/transit+json:
              schema:
                $ref: '#/components/schemas/MetricResult'
            application/transit+msgpack:
              schema:
                $ref: '#/components/schemas/MetricResult'
      summary: Histogram for some Casebook field
      parameters:
      - in: query
        name: tlp
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: search_after
        description: Pagination stateless cursor
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
      - in: query
        name: language
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: id
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: granularity
        description: ''
        required: true
        schema:
          type: string
          enum:
          - day
          - week
          - month
      - in: query
        name: from
        description: Start date of the histogram. Filters the value of selected aggregated-on field.
        required: true
        schema:
          type: string
          format: date-time
      - in: query
        name: source
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: aggregate-on
        description: ''
        required: true
        schema:
          type: string
          enum:
          - timestamp
      - in: query
        name: agg-key
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: timezone
        description: ''
        required: false
        schema:
          type: string
          enum:
          - -05:00
          - +02:00
          - +01:00
          - -09:00
          - -01:00
          - +03:00
          - +08:00
          - +04:00
          - +00:00
          - '+11:00'
          - '-10:00'
          - +05:00
          - -03:00
          - -04:00
          - -02:00
          - -07:00
          - '-11:00'
          - -06:00
          - '+10:00'
          - +09:00
          - +07:00
          - -08:00
          - +06:00
      - in: query
        name: query
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: texts.text
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: simple_query
        description: Query String with simple query format
        required: false
        schema:
          type: string
      - in: query
        name: revision
        description: ''
        required: false
        schema:
          type: integer
          format: int64
      - in: query
        name: to
        description: End date of the histogram. Filters the value of selected aggregated-on field.
        required: false
        schema:
          type: string
          format: date-time
  /ctia/casebook/metric/topn:
    get:
      tags:
      - Casebook
      description: Requires capability search-casebook.
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MetricResult'
            application/x-yaml:
              schema:
                $ref: '#/components/schemas/MetricResult'
            application/edn:
              schema:
                $ref: '#/components/schemas/MetricResult'
            application/transit+json:
              schema:
                $ref: '#/components/schemas/MetricResult'
            application/transit+msgpack:
              schema:
                $ref: '#/components/schemas/MetricResult'
      summary: Topn for some Casebook field
      parameters:
      - in: query
        name: sort_order
        description: ''
        required: false
        schema:
          type: string
          enum:
          - desc
          - asc
      - in: query
        name: tlp
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: search_after
        description: Pagination stateless cursor
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
      - in: query
        name: language
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: id
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: limit
        description: ''
        required: false
        schema:
          type: integer
          format: int64
      - in: query
        name: from
        description: ''
        required: true
        schema:
          type: string
          format: date-time
      - in: query
        name: source
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: aggregate-on
        description: ''
        required: true
        schema:
          type: string
          enum:
          - observables.type
          - observables.value
          - source
      - in: query
        name: agg-key
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: query
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: texts.text
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: simple_query
        description: Query String with simple query format
        required: false
        schema:
          type: string
      - in: query
        name: revision
        description: ''
        required: false
        schema:
          type: integer
          format: int64
      - in: query
        name: to
        description: ''
        required: false
        schema:
          type: string
          format: date-time
  /ctia/casebook/metric/cardinality:
    get:
      tags:
      - Casebook
      description: Requires capability search-casebook.
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MetricResult'
            application/x-yaml:
              schema:
                $ref: '#/components/schemas/MetricResult'
            application/edn:
              schema:
                $ref: '#/components/schemas/MetricResult'
            application/transit+json:
              schema:
                $ref: '#/components/schemas/MetricResult'
            application/transit+msgpack:
              schema:
                $ref: '#/components/schemas/MetricResult'
      summary: Cardinality for some Casebook field
      parameters:
      - in: query
        name: tlp
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: search_after
        description: Pagination stateless cursor
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
      - in: query
        name: language
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: id
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: from
        description: ''
        required: true
        schema:
          type: string
          format: date-time
      - in: query
        name: source
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: aggregate-on
        description: ''
        required: true
        schema:
          type: string
          enum:
          - observables.type
          - observables.value
          - source
      - in: query
        name: query
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: texts.text
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: simple_query
        description: Query String with simple query format
        required: false
        schema:
          type: string
      - in: query
        name: revision
        description: ''
        required: false
        schema:
          type: integer
          format: int64
      - in: query
        name: to
        description: ''
        required: false
        schema:
          type: string
          format: date-time
components:
  schemas:
    AttackPattern:
      example:
        description: string
        abstraction_level: aggregate
        schema_version: 1.3.30
        revision: 10
        type: attack-pattern
        source: string
        external_ids:
        - string
        short_description: string
        title: string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        source_uri: string
        x_mitre_platforms:
        - string
        language: string
        id: string
        tlp: green
        x_mitre_data_sources:
        - string
        kill_chain_phases:
        - kill_chain_name: string
          phase_name: string
        x_mitre_contributors:
        - string
        timestamp: '2016-01-01T01:01:01.000Z'
      description: Attack Patterns are a type of TTP that describe ways that adversaries attempt to compromise targets.
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        abstraction_level:
          example: aggregate
          description: The CAPEC abstraction level for patterns describing techniques to attack a system.
          type: string
          enum:
          - detailed
          - standard
          - aggregate
          - meta
          - category
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        type:
          example: attack-pattern
          type: string
          enum:
          - attack-pattern
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        x_mitre_platforms:
          example:
          - string
          description: ATT&CK Technique.Platforms.
          type: array
          items:
            type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        x_mitre_data_sources:
          example:
          - string
          description: ATT&CK Technique.Data Sources.
          type: array
          items:
            type: string
        kill_chain_phases:
          example:
          - kill_chain_name: string
            phase_name: string
          description: A kill chain is a series of steps that an attacker must go through to successfully achieve their objective. The concept was originally developed by the military, but has been adapted to the cybersecurity field to describe the steps an attacker goes through to compromise a target system and achieve their goal.
          type: array
          items:
            $ref: '#/components/schemas/KillChainPhase'
        x_mitre_contributors:
          example:
          - string
          description: ATT&CK Technique.Contributors.
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
      additionalProperties: false
    Assertion:
      example:
        name: cisco:ctr:ad:host_domain_name
        value: string
      type: object
      properties:
        name:
          example: cisco:ctr:ad:host_domain_name
          description: An open vocabulary containing well known assertion types
          type: string
        value:
          example: string
          type: string
      additionalProperties: false
    LibraryLoadType:
      example:
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        process_id: 10
        process_name: string
        process_guid: 10
        process_username: string
        type: LibraryLoadEvent
        dll_library_name: string
        dll_library_path: string
      type: object
      properties:
        time:
          $ref: '#/components/schemas/ObservedTime'
        process_id:
          example: 10
          type: integer
          format: int64
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        type:
          example: LibraryLoadEvent
          type: string
          enum:
          - LibraryLoadEvent
        dll_library_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        dll_library_path:
          example: string
          description: String with at most 2048 characters.
          type: string
      additionalProperties: false
      required:
      - time
      - process_id
      - process_name
      - type
      - dll_library_name
      - dll_library_path
    CompositeIndicatorExpression:
      example:
        operator: and
        indicator_ids:
        - string
      type: object
      properties:
        operator:
          example: and
          type: string
          enum:
          - not
          - or
          - and
        indicator_ids:
          example:
          - string
          type: array
          items:
            type: string
      additionalProperties: false
      required:
      - operator
      - indicator_ids
    Target:
      example:
        type: endpoint
        observables:
        - value: 1.2.3.4
          type: ip
        observed_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        os: string
        internal: false
        sensor: string
        source_uri: string
      description: Schema for TargetRecord Targets
      type: object
      properties:
        type:
          example: endpoint
          description: The sensor/actuator name that best fits a device.
          type: string
        observables:
          example:
          - value: 1.2.3.4
            type: ip
          type: array
          items:
            $ref: '#/components/schemas/Observable'
        observed_time:
          $ref: '#/components/schemas/ObservedTime'
        os:
          example: string
          type: string
        internal:
          example: false
          description: Is it internal to our network?
          type: boolean
        sensor:
          example: string
          description: 'The OpenC2 Actuator name that best fits the device that is creating this TargetRecord (e.g.: network.firewall, etc.)'
          type: string
        source_uri:
          example: string
          description: A URI
          type: string
      additionalProperties: false
      required:
      - type
      - observables
      - observed_time
    OperatingSystem:
      example:
        prevalence: Often
        name: string
        version: string
        cpe_id: string
        class: Android
      type: object
      properties:
        prevalence:
          example: Often
          description: Defines the different regularities that guide the applicability of platforms.
          type: string
          enum:
          - Undetermined
          - Sometimes
          - Often
          - Rarely
        name:
          example: string
          description: String with at most 1024 characters.
          type: string
        version:
          example: string
          description: String with at most 1024 characters.
          type: string
        cpe_id:
          example: string
          description: String with at most 1024 characters.
          type: string
        class:
          example: Android
          description: Class of Operating System.
          type: string
      additionalProperties: false
    NetflowType:
      example:
        parent_process_name: string
        byte_count_in: 10
        process_guid: 10
        process_path: string
        traffic:
          destination_host_name: string
          protocol: 10
          source_ip: string
          destination_subnet: string
          destination_ip: string
          source_subnet: string
          destination_port: 10
          direction: incoming
          source_port: 10
        flow_time: '2016-01-01T01:01:01.000Z'
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        parent_process_account: string
        type: NetflowEvent
        process_account_type: string
        parent_process_path: string
        parent_process_id: 10
        parent_process_args: string
        process_name: string
        process_account: string
        parent_process_account_type: string
        process_hash: string
        process_id: 10
        parent_process_hash: string
        process_username: string
        byte_count_out: 10
        process_args: string
      type: object
      properties:
        parent_process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        byte_count_in:
          example: 10
          type: integer
          format: int64
        process_guid:
          example: 10
          type: integer
          format: int64
        process_path:
          example: string
          description: String with at most 1024 characters.
          type: string
        traffic:
          $ref: '#/components/schemas/Traffic'
        flow_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Schema definition for all date or timestamp values.  Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
          type: string
          format: date-time
        time:
          $ref: '#/components/schemas/ObservedTime'
        parent_process_account:
          example: string
          description: String with at most 1024 characters.
          type: string
        type:
          example: NetflowEvent
          type: string
          enum:
          - NetflowEvent
        process_account_type:
          example: string
          description: String with at most 1024 characters.
          type: string
        parent_process_path:
          example: string
          description: String with at most 1024 characters.
          type: string
        parent_process_id:
          example: 10
          type: integer
          format: int64
        parent_process_args:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_account:
          example: string
          description: String with at most 1024 characters.
          type: string
        parent_process_account_type:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_hash:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        parent_process_hash:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        byte_count_out:
          example: 10
          type: integer
          format: int64
        process_args:
          example: string
          description: String with at most 1024 characters.
          type: string
      additionalProperties: false
      required:
      - traffic
      - time
      - type
      - process_name
      - process_id
    ObservedTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If the observation was made over a period of time, than this field indicates the end of that period.
          type: string
          format: date-time
      additionalProperties: false
      required:
      - start_time
    ActionType:
      example:
        type: alert
      type: object
      properties:
        type:
          example: alert
          type: string
          enum:
          - stop
          - save
          - delete
          - remediate
          - redirect
          - alert
          - query
          - augment
          - snapshot
          - update
          - allow
          - scan
          - investigate
          - modify
          - sync
          - start
          - pause
          - deny
          - substitute
          - distill
          - move
          - restart
          - other
          - detonate
          - response
          - set
          - notify
          - report
          - restore
          - get
          - throttle
          - mitigate
          - resume
          - locate
          - contain
      additionalProperties: false
      required:
      - type
    Incident:
      example:
        description: string
        assignees:
        - string
        detection_sources:
        - string
        meta:
          keyword: anything
        schema_version: 1.3.30
        revision: 10
        type: incident
        source: string
        external_ids:
        - string
        short_description: string
        title: string
        incident_time:
          opened: '2016-01-01T01:01:01.000Z'
          discovered: '2016-01-01T01:01:01.000Z'
          reported: '2016-01-01T01:01:01.000Z'
          remediated: '2016-01-01T01:01:01.000Z'
          closed: '2016-01-01T01:01:01.000Z'
          rejected: '2016-01-01T01:01:01.000Z'
          contained: '2016-01-01T01:01:01.000Z'
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        discovery_method: Agent Disclosure
        source_uri: string
        intended_effect: Account Takeover
        categories:
        - Attrition
        status: Closed
        language: string
        detection_status: active
        id: string
        promotion_method: Automated
        severity: Critical
        tlp: green
        scores:
          asset: 10.0
        techniques:
        - string
        timestamp: '2016-01-01T01:01:01.000Z'
        confidence: High
        short_id: string
        tactics:
        - string
      description: "Information about computer security incident response. A computer security\n   incident is a violation or imminent threat of violation of computer\n   security policies, acceptable use policies, or standard security practices.\n   Incidents pertain to one or more *adverse events*, each of which is modeled\n   as a [sighting](sighting.md)."
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        assignees:
          example:
          - string
          description: A set of owners assigned to this incident.
          type: array
          items:
            type: string
        detection_sources:
          example:
          - string
          description: A set of sources that contributed threat detections to the incident.
          type: array
          items:
            type: string
        meta:
          $ref: '#/components/schemas/MetaData'
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        type:
          example: incident
          type: string
          enum:
          - incident
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        incident_time:
          $ref: '#/components/schemas/IncidentTime'
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        discovery_method:
          example: Agent Disclosure
          description: Identifies how the incident was discovered.
          type: string
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        intended_effect:
          example: Account Takeover
          description: Specifies the suspected intended effect of this incident
          type: string
        categories:
          example:
          - Attrition
          description: A set of categories for this incident.
          type: array
          items:
            type: string
        status:
          example: Closed
          description: The `status` field represents the current state of an incident within the incident management process. Its values help in tracking and reporting the progress of the incident from its discovery to its resolution.
          type: string
          enum:
          - New
          - Closed
          - 'Open: Recovered'
          - 'Closed: Other'
          - 'Hold: Internal'
          - 'Hold: Legal'
          - 'Closed: Under Review'
          - Rejected
          - Open
          - 'Closed: Merged'
          - Restoration Achieved
          - Incident Reported
          - 'Closed: Suspected'
          - Stalled
          - 'Open: Contained'
          - 'Closed: Near-Miss'
          - 'Hold: External'
          - Containment Achieved
          - 'New: Processing'
          - 'Closed: Confirmed Threat'
          - 'Closed: False Positive'
          - 'Open: Reported'
          - 'Open: Investigating'
          - Hold
          - 'New: Presented'
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        detection_status:
          example: active
          description: Represents the state of an incident within the incident generation process, indicating whether the incident is actively receiving updates or is no longer being updated.
          type: string
          enum:
          - inactive_oversized
          - inactive_user_closed
          - active
          - inactive_merged
          - inactive_expired
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        promotion_method:
          example: Automated
          description: Describes method for promoting an Incident, whether manually or automatically. An Incident may be created manually by a SOAR analyst or SOC operator, or through an automated correlation or aggregation rule or engine that matches a specific set of events or alerts, and promotes them to Incident(s).
          type: string
          enum:
          - Automated
          - Manual
        severity:
          example: Critical
          description: "Represents the potential impact of an incident on an organization's security posture and business operations. It helps organizations prioritize and allocate resources for incident response based on the severity level of the incident \nIt helps analysts and incident handlers prioritize incidents by indicating the level of risk and potential impact associated with the incident. This enables organizations to allocate resources efficiently and address the most critical incidents first.\nCan also be used to generate reports and metrics for measuring the effectiveness of the incident response process and to identify trends and patterns in the threat landscape.\nIt is important to note that the `severity` field is subjective and can be interpreted differently by different organizations or analysts. Therefore, it should be used in conjunction with other intelligence attributes, such as the `confidence` field, to provide a more comprehensive view of the incident."
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Critical
          - Low
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        scores:
          $ref: '#/components/schemas/IncidentScores'
        techniques:
          example:
          - string
          description: Represents the specific methods or actions used by an attacker to carry out an offensive maneuver or achieve their goals.
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        confidence:
          example: High
          description: 'Represents the level of certainty or trustworthiness associated with the incident. It denotes the reliability of the intelligence associated with the incident.

            The `confidence` field can take on several values, including:

            - `info`: Indicates that the incident information is based on sources with no previous track record or there is no track record for the source reporting the incident.

            - `low`: Indicates that the incident information is based on sources with a questionable track record or there is limited information about the accuracy of the source.

            - `medium`: Indicates that the incident information is based on sources with a mixed track record or of uncertain reliability.

            - `high`: Indicates that the incident information is based on sources with a proven track record and high degree of reliability.

            The `confidence` field can be used to indicate the level of trust and confidence that can be attributed to the incident, and it may impact how the incident is prioritized, analyzed and addressed. It can also help in the decision-making process associated with the incident response activities.

            It is important to note that the `confidence` field is subjective and can be interpreted differently by different organizations or analysts. As such, it is often used in conjunction with other intelligence attributes, such as the `severity` field, to provide a more complete picture of the incident.'
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        short_id:
          example: string
          description: A human-readable, short identifier for the incident, unique within an organization.
          type: string
        tactics:
          example:
          - string
          description: Represents the offensive techniques, approaches, or procedures that an adversary may use to achieve their objectives during an attack. It helps in understanding the intent and capabilities of the adversary and can be used to identify indicators of attack (IoAs) or indicators of compromise (IoCs) that are associated with the adversary's tactics.
          type: array
          items:
            type: string
      additionalProperties: false
    CVSSv2:
      example:
        integrity_impact: complete
        target_distribution: not_defined
        availability_requirement: not_defined
        exploitability: not_defined
        access_complexity: low
        temporal_vector_string: string
        exploitability_score: 10.0
        impact_score: 10.0
        user_interaction_required: true
        environmental_vector_string: string
        obtain_other_privilege: true
        availability_impact: complete
        access_vector: network
        base_severity: High
        confidentiality_impact: complete
        confidentiality_requirement: not_defined
        report_confidence: not_defined
        authentication: none
        base_score: 10.0
        obtain_user_privilege: true
        obtain_all_privilege: true
        collateral_damage_potential: not_defined
        remediation_level: not_defined
        vector_string: string
        integrity_requirement: not_defined
      type: object
      properties:
        integrity_impact:
          example: complete
          description: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and guaranteed veracity of information. Increased integrity impact increases the vulnerability score.
          type: string
          enum:
          - partial
          - none
          - complete
        target_distribution:
          example: not_defined
          description: This metric measures the proportion of vulnerable systems. It is meant as an environment-specific indicator in order to approximate the percentage of systems that could be affected by the vulnerability. The greater the proportion of vulnerable systems, the higher the score.
          type: string
          enum:
          - low
          - none
          - high
          - medium
          - not_defined
        availability_requirement:
          example: not_defined
          description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
          type: string
          enum:
          - low
          - high
          - medium
          - not_defined
        exploitability:
          example: not_defined
          description: This metric measures the current state of exploit techniques or code availability. Public availability of easy-to-use exploit code increases the number of potential attackers by including those who are unskilled thereby increasing the severity of the vulnerability.
          type: string
          enum:
          - high
          - unproven
          - functional
          - proof_of_concept
          - not_defined
        access_complexity:
          example: low
          description: 'This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system. For example, consider a buffer overflow in an Internet service: once the target system is located, the attacker can launch an exploit at will.'
          type: string
          enum:
          - low
          - high
          - medium
        temporal_vector_string:
          example: string
          description: A text representation of a set of CVSSv2 temporal metrics. Temporal metrics allow analysists to calculate threat severity based on temporal factors such as reliability of vulnerability reports, availability of mitigations, and the ease or difficulty of conducting the exploit. It is commonly used to record or transfer CVSSv2 metric information in a concise form
          type: string
        exploitability_score:
          example: 10.0
          description: a Score number from 0 to 10
          type: number
          format: double
        impact_score:
          example: 10.0
          description: a Score number from 0 to 10
          type: number
          format: double
        user_interaction_required:
          example: true
          type: boolean
        environmental_vector_string:
          example: string
          description: A text representation of a set of CVSSv2 environmental metrics. Environmental metrics allow analysists to calculate threat scores in relation to environmental security requirements, collateral damage potential, and target availability. It is commonly used to record or transfer CVSSv2 metric information in a concise form
          type: string
        obtain_other_privilege:
          example: true
          type: boolean
        availability_impact:
          example: complete
          description: This metric measures the impact to availability of a successfully exploited vulnerability. Availability refers to the accessibility of information resources. Attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system. Increased availability impact increases the vulnerability score.
          type: string
          enum:
          - partial
          - none
          - complete
        access_vector:
          example: network
          description: This metric reflects how the vulnerability is exploited.The more remote an attacker can be to attack a host, the greater the vulnerability score.
          type: string
          enum:
          - network
          - adjacent network
          - local
        base_severity:
          example: High
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        confidentiality_impact:
          example: complete
          description: This metric measures the impact on confidentiality of a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. Increasedconfidentiality impact increases the vulnerability score.
          type: string
          enum:
          - partial
          - none
          - complete
        confidentiality_requirement:
          example: not_defined
          description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
          type: string
          enum:
          - low
          - high
          - medium
          - not_defined
        report_confidence:
          example: not_defined
          description: This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details. Sometimes, only the existence of vulnerabilities are publicized, but without specific details. The vulnerability may later be corroborated and then confirmed through acknowledgement by the author or vendor of the affected technology. The urgency of a vulnerability is higher when a vulnerability is known to exist with certainty. This metric also suggests the level of technical knowledge available to would-be attackers. The more a vulnerability is validated by the vendor or other reputable sources, the higher the score.
          type: string
          enum:
          - uncorroborated
          - unconfirmed
          - confirmed
          - not_defined
        authentication:
          example: none
          description: This metric measures the number of times an attacker must authenticate to a target in order to exploit a vulnerability. This metric does not gauge the strength or complexity of the authentication process, only that an attacker is required to provide credentials before an exploit may occur. The fewer authentication instances that are required, the higher the vulnerability score.
          type: string
          enum:
          - none
          - single
          - multiple
        base_score:
          example: 10.0
          description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v2/guide'
          type: number
          format: double
        obtain_user_privilege:
          example: true
          type: boolean
        obtain_all_privilege:
          example: true
          type: boolean
        collateral_damage_potential:
          example: not_defined
          description: This metric measures the potential for loss of life or physical assets through damage or theft of property or equipment.  The metric may also measure economic loss of productivity or revenue. Naturally, the greater the damage potential, the higher the vulnerability score.
          type: string
          enum:
          - low
          - none
          - high
          - medium_high
          - low_medium
          - not_defined
        remediation_level:
          example: not_defined
          description: The remediation level of a vulnerability is an important factor for prioritization. The typical vulnerability is unpatched when initially published. Workarounds or hotfixes may offer interim remediation until an official patch or upgrade is issued. Each of these respective stages adjusts the temporal score downwards, reflecting the decreasing urgency as remediation becomes final. The less official and permanent a fix, the higher the vulnerability score is.
          type: string
          enum:
          - temporary_fix
          - workaround
          - official_fix
          - unavailable
          - not_defined
        vector_string:
          example: string
          description: a text representation of a set of CVSSv2 metrics. It is commonly used to record or transfer CVSSv2 metric information in a concise form
          type: string
        integrity_requirement:
          example: not_defined
          description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
          type: string
          enum:
          - low
          - high
          - medium
          - not_defined
      additionalProperties: false
      required:
      - base_severity
      - base_score
      - vector_string
    RegistryDeleteType:
      example:
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        process_id: 10
        process_name: string
        process_guid: 10
        process_username: string
        registry_key: string
        type: RegistryDeleteEvent
        registry_value: string
      type: object
      properties:
        time:
          $ref: '#/components/schemas/ObservedTime'
        process_id:
          example: 10
          type: integer
          format: int64
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        registry_key:
          example: string
          description: String with at most 1024 characters.
          type: string
        type:
          example: RegistryDeleteEvent
          type: string
          enum:
          - RegistryDeleteEvent
        registry_value:
          example: string
          description: String with at most 2048 characters.
          type: string
      additionalProperties: false
      required:
      - time
      - process_id
      - process_name
      - registry_key
      - type
    MetaData:
      example:
        keyword: anything
      description: metadata associated to the incident.
      type: object
      additionalProperties:
        example: anything
        description: custom field relevant to attach meta data to.
    MetricResultFilters:
      type: object
      properties:
        from:
          type: string
          format: date-time
        to:
          type: string
          format: date-time
      additionalProperties: {}
      required:
      - from
      - to
    Tool:
      example:
        description: string
        labels:
        - credential-exploitation
        schema_version: 1.3.30
        revision: 10
        type: tool
        x_mitre_aliases:
        - string
        source: string
        external_ids:
        - string
        short_description: string
        title: string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        source_uri: string
        language: string
        id: string
        tool_version: string
        tlp: green
        kill_chain_phases:
        - kill_chain_name: string
          phase_name: string
        timestamp: '2016-01-01T01:01:01.000Z'
      description: Tools are legitimate software that can be used by threat actors to perform attacks. Knowing how and when threat actors use such tools can be important for understanding how campaigns are executed. Unlike malware, these tools or software packages are often found on a system and have legitimate purposes for power users, system administrators, network administrators, or even normal users. Remote access tools (e.g., RDP) and network scanning tools (e.g., Nmap) are examples of Tools that may be used by a Threat Actor during an attack.
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        labels:
          example:
          - credential-exploitation
          description: The kind(s) of tool(s) being described.
          type: array
          items:
            type: string
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        type:
          example: tool
          type: string
          enum:
          - tool
        x_mitre_aliases:
          example:
          - string
          description: ATT&CK Software.aliases.
          type: array
          items:
            type: string
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tool_version:
          example: string
          description: The version identifier associated with the Tool.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        kill_chain_phases:
          example:
          - kill_chain_name: string
            phase_name: string
          description: The list of kill chain phases for which this Tool can be used.
          type: array
          items:
            $ref: '#/components/schemas/KillChainPhase'
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
      additionalProperties: false
    NewCasebook:
      description: an updated Casebook
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        authorized_groups:
          type: array
          items:
            type: string
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        texts:
          example:
          - type: string
            text: string
          type: array
          items:
            $ref: '#/components/schemas/Text'
        bundle:
          $ref: '#/components/schemas/Bundle'
        observables:
          example:
          - value: 1.2.3.4
            type: ip
          type: array
          items:
            $ref: '#/components/schemas/Observable'
        authorized_users:
          type: array
          items:
            type: string
        type:
          example: casebook
          type: string
          enum:
          - casebook
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: IDs are URIs, for example `https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014` for a [Judgement](judgement.md). This _ID_ type compares to the STIX _id_ field. The optional STIX _idref_ field is not used.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        client_id:
          type: string
        groups:
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        owner:
          type: string
      additionalProperties: false
    Weakness:
      example:
        description: string
        background_details: string
        paradigms:
        - prevalence: Often
          name: string
        abstraction_level: Base
        architectures:
        - prevalence: Often
          name: string
          class: Embedded
        schema_version: 1.3.30
        revision: 10
        alternate_terms:
        - term: string
          description: string
        likelihood: High
        type: weakness
        source: string
        external_ids:
        - string
        short_description: string
        title: string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        functional_areas:
        - Authentication
        source_uri: string
        modes_of_introduction:
        - phase: Architecture and Design
          note: string
        structure: Chain
        language: string
        id: string
        notes:
        - type: Applicable Platform
          note: string
        common_consequences:
        - scopes:
          - Access Control
          impacts:
          - Alter Execution Logic
          likelihood: High
          note: string
        tlp: green
        detection_methods:
        - method: Architecture or Design Review
          description: string
          effectiveness: High
          effectiveness_notes: string
        operating_systems:
        - prevalence: Often
          name: string
          version: string
          cpe_id: string
          class: Android
        affected_resources:
        - CPU
        languages:
        - prevalence: Often
          name: string
          class: Assembly
        timestamp: '2016-01-01T01:01:01.000Z'
        potential_mitigations:
        - description: string
          phases:
          - Architecture and Design
          strategy: Attack Surface Reduction
          effectiveness: Defense in Depth
          effectiveness_notes: string
        technologies:
        - prevalence: Often
          name: string
      description: A mistake or condition that, if left unaddressed, could under the proper conditions contribute to a cyber-enabled capability being vulnerable to attack, allowing an adversary to make items function in unintended ways.
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        background_details:
          example: string
          description: Information that is relevant but not related to the nature of the weakness itself.
          type: string
        paradigms:
          example:
          - prevalence: Often
            name: string
          description: Applicable paradigms.
          type: array
          items:
            $ref: '#/components/schemas/Paradigm'
        abstraction_level:
          example: Base
          description: Refers to the level of abstraction or granularity used to describe the weakness. It helps to categorize the vulnerability based on the level of detail provided.
          type: string
          enum:
          - Variant
          - Class
          - Base
          - Compound
        architectures:
          example:
          - prevalence: Often
            name: string
            class: Embedded
          description: Applicable architectures.
          type: array
          items:
            $ref: '#/components/schemas/Architecture'
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        alternate_terms:
          example:
          - term: string
            description: string
          description: Indicates one or more other names used to describe this weakness.
          type: array
          items:
            $ref: '#/components/schemas/AlternateTerm'
        likelihood:
          example: High
          description: Likelihood of exploit.
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        type:
          example: weakness
          description: The fixed value weakness
          type: string
          enum:
          - weakness
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        functional_areas:
          example:
          - Authentication
          description: Identifies the functional area of the software in which the weakness is most likely to occur.
          type: array
          items:
            type: string
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        modes_of_introduction:
          example:
          - phase: Architecture and Design
            note: string
          description: Information about how and when a given weakness may be introduced.
          type: array
          items:
            $ref: '#/components/schemas/ModeOfIntroduction'
        structure:
          example: Chain
          description: Defines the structural nature of the weakness.
          type: string
          enum:
          - Chain
          - Simple
          - Composite
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        notes:
          example:
          - type: Applicable Platform
            note: string
          description: Provides any additional comments about the weakness.
          type: array
          items:
            $ref: '#/components/schemas/Note'
        common_consequences:
          example:
          - scopes:
            - Access Control
            impacts:
            - Alter Execution Logic
            likelihood: High
            note: string
          description: Refers to the typical or expected negative effects that can result from exploiting the weakness. This could include anything from unauthorized access to data, denial of service, system crashes or other things.
          type: array
          items:
            $ref: '#/components/schemas/Consequence'
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        detection_methods:
          example:
          - method: Architecture or Design Review
            description: string
            effectiveness: High
            effectiveness_notes: string
          description: Identifies methods that may be employed to detect this weakness, including their strengths and limitations.
          type: array
          items:
            $ref: '#/components/schemas/DetectionMethod'
        operating_systems:
          example:
          - prevalence: Often
            name: string
            version: string
            cpe_id: string
            class: Android
          description: Applicable operating systems.
          type: array
          items:
            $ref: '#/components/schemas/OperatingSystem'
        affected_resources:
          example:
          - CPU
          description: Identifies system resources that can be affected by an exploit of this weakness.
          type: array
          items:
            type: string
        languages:
          example:
          - prevalence: Often
            name: string
            class: Assembly
          description: Applicable Languages.
          type: array
          items:
            $ref: '#/components/schemas/Language'
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        potential_mitigations:
          example:
          - description: string
            phases:
            - Architecture and Design
            strategy: Attack Surface Reduction
            effectiveness: Defense in Depth
            effectiveness_notes: string
          description: Describes potential mitigations associated with a weakness.
          type: array
          items:
            $ref: '#/components/schemas/Mitigation'
        technologies:
          example:
          - prevalence: Often
            name: string
          description: Applicable technologies.
          type: array
          items:
            $ref: '#/components/schemas/Technology'
      additionalProperties: false
    Context:
      example:
        http_events:
        - process_guid: 10
          traffic:
            destination_host_name: string
            protocol: 10
            source_ip: string
            destination_subnet: string
            destination_ip: string
            source_subnet: string
            destination_port: 10
            direction: incoming
            source_port: 10
          method: CONNECT
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: HTTPEvent
          host: string
          process_name: string
          process_id: 10
          process_username: string
          query: string
          encrypted: true
          url_port: 10
        process_create_events:
        - parent_process_name: string
          process_guid: 10
          parent_process_guid: 10
          process_disposition: string
          parent_process_size: 10
          process_size: 10
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          parent_process_disposition: string
          type: ProcessCreateEvent
          parent_process_username: string
          parent_process_id: 10
          parent_process_args: string
          process_name: string
          process_hash: string
          process_id: 10
          parent_process_hash: string
          process_username: string
          parent_creation_time: '2016-01-01T01:01:01.000Z'
          process_args: string
        registry_delete_events:
        - time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          process_id: 10
          process_name: string
          process_guid: 10
          process_username: string
          registry_key: string
          type: RegistryDeleteEvent
          registry_value: string
        file_modify_events:
        - file_name: string
          process_guid: 10
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: FileModifyEvent
          file_path: string
          process_name: string
          process_id: 10
          process_username: string
          failed: false
        registry_set_events:
        - process_guid: 10
          registry_data: string
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: RegistrySetEvent
          registry_data_length: 10
          registry_value: string
          registry_key: string
          process_name: string
          process_id: 10
          process_username: string
        file_create_events:
        - file_name: string
          process_guid: 10
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: FileCreateEvent
          file_path: string
          process_name: string
          process_id: 10
          process_username: string
          failed: false
        registry_create_events:
        - time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          process_id: 10
          process_name: string
          process_guid: 10
          process_username: string
          registry_key: string
          type: RegistryCreateEvent
        library_load_events:
        - time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          process_id: 10
          process_name: string
          process_guid: 10
          process_username: string
          type: LibraryLoadEvent
          dll_library_name: string
          dll_library_path: string
        file_move_events:
        - file_name: string
          process_guid: 10
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: FileMoveEvent
          old_name: string
          file_path: string
          process_name: string
          process_id: 10
          process_username: string
          new_name: string
        file_delete_events:
        - file_name: string
          process_guid: 10
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: FileDeleteEvent
          file_path: string
          process_name: string
          process_id: 10
          process_username: string
          failed: false
        netflow_events:
        - parent_process_name: string
          byte_count_in: 10
          process_guid: 10
          process_path: string
          traffic:
            destination_host_name: string
            protocol: 10
            source_ip: string
            destination_subnet: string
            destination_ip: string
            source_subnet: string
            destination_port: 10
            direction: incoming
            source_port: 10
          flow_time: '2016-01-01T01:01:01.000Z'
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          parent_process_account: string
          type: NetflowEvent
          process_account_type: string
          parent_process_path: string
          parent_process_id: 10
          parent_process_args: string
          process_name: string
          process_account: string
          parent_process_account_type: string
          process_hash: string
          process_id: 10
          parent_process_hash: string
          process_username: string
          byte_count_out: 10
          process_args: string
        registry_rename_events:
        - time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          process_id: 10
          process_name: string
          process_guid: 10
          process_username: string
          registry_key: string
          type: RegistryRenameEvent
          registry_old_key: string
      description: Context including the event type that best fits the type of the sighting.
      type: object
      properties:
        http_events:
          example:
          - process_guid: 10
            traffic:
              destination_host_name: string
              protocol: 10
              source_ip: string
              destination_subnet: string
              destination_ip: string
              source_subnet: string
              destination_port: 10
              direction: incoming
              source_port: 10
            method: CONNECT
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: HTTPEvent
            host: string
            process_name: string
            process_id: 10
            process_username: string
            query: string
            encrypted: true
            url_port: 10
          description: a list of `HTTPType`
          type: array
          items:
            $ref: '#/components/schemas/HTTPType'
        process_create_events:
          example:
          - parent_process_name: string
            process_guid: 10
            parent_process_guid: 10
            process_disposition: string
            parent_process_size: 10
            process_size: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            parent_process_disposition: string
            type: ProcessCreateEvent
            parent_process_username: string
            parent_process_id: 10
            parent_process_args: string
            process_name: string
            process_hash: string
            process_id: 10
            parent_process_hash: string
            process_username: string
            parent_creation_time: '2016-01-01T01:01:01.000Z'
            process_args: string
          description: a list of `ProcessCreate`
          type: array
          items:
            $ref: '#/components/schemas/ProcessCreateType'
        registry_delete_events:
          example:
          - time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            process_id: 10
            process_name: string
            process_guid: 10
            process_username: string
            registry_key: string
            type: RegistryDeleteEvent
            registry_value: string
          description: a list of `RegistryDeleteType`
          type: array
          items:
            $ref: '#/components/schemas/RegistryDeleteType'
        file_modify_events:
          example:
          - file_name: string
            process_guid: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: FileModifyEvent
            file_path: string
            process_name: string
            process_id: 10
            process_username: string
            failed: false
          description: a list of `FileModifyType`
          type: array
          items:
            $ref: '#/components/schemas/FileModifyType'
        registry_set_events:
          example:
          - process_guid: 10
            registry_data: string
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: RegistrySetEvent
            registry_data_length: 10
            registry_value: string
            registry_key: string
            process_name: string
            process_id: 10
            process_username: string
          description: a list of `RegistrySetType`
          type: array
          items:
            $ref: '#/components/schemas/RegistrySetType'
        file_create_events:
          example:
          - file_name: string
            process_guid: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: FileCreateEvent
            file_path: string
            process_name: string
            process_id: 10
            process_username: string
            failed: false
          description: a list of `FileCreateType`
          type: array
          items:
            $ref: '#/components/schemas/FileCreateType'
        registry_create_events:
          example:
          - time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            process_id: 10
            process_name: string
            process_guid: 10
            process_username: string
            registry_key: string
            type: RegistryCreateEvent
          description: a list of `RegistryCreateType`
          type: array
          items:
            $ref: '#/components/schemas/RegistryCreateType'
        library_load_events:
          example:
          - time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            process_id: 10
            process_name: string
            process_guid: 10
            process_username: string
            type: LibraryLoadEvent
            dll_library_name: string
            dll_library_path: string
          description: a list of `LibraryLoadType`
          type: array
          items:
            $ref: '#/components/schemas/LibraryLoadType'
        file_move_events:
          example:
          - file_name: string
            process_guid: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: FileMoveEvent
            old_name: string
            file_path: string
            process_name: string
            process_id: 10
            process_username: string
            new_name: string
          description: a list of `FileMoveType`
          type: array
          items:
            $ref: '#/components/schemas/FileMoveType'
        file_delete_events:
          example:
          - file_name: string
            process_guid: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: FileDeleteEvent
            file_path: string
            process_name: string
            process_id: 10
            process_username: string
            failed: false
          description: a list of `FileDeleteType`
          type: array
          items:
            $ref: '#/components/schemas/FileDeleteType'
        netflow_events:
          example:
          - parent_process_name: string
            byte_count_in: 10
            process_guid: 10
            process_path: string
            traffic:
              destination_host_name: string
              protocol: 10
              source_ip: string
              destination_subnet: string
              destination_ip: string
              source_subnet: string
              destination_port: 10
              direction: incoming
              source_port: 10
            flow_time: '2016-01-01T01:01:01.000Z'
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            parent_process_account: string
            type: NetflowEvent
            process_account_type: string
            parent_process_path: string
            parent_process_id: 10
            parent_process_args: string
            process_name: string
            process_account: string
            parent_process_account_type: string
            process_hash: string
            process_id: 10
            parent_process_hash: string
            process_username: string
            byte_count_out: 10
            process_args: string
          description: a list of `NetflowType`
          type: array
          items:
            $ref: '#/components/schemas/NetflowType'
        registry_rename_events:
          example:
          - time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            process_id: 10
            process_name: string
            process_guid: 10
            process_username: string
            registry_key: string
            type: RegistryRenameEvent
            registry_old_key: string
          description: a list of `RegistryRenameType`
          type: array
          items:
            $ref: '#/components/schemas/RegistryRenameType'
      additionalProperties: false
    FileCreateType:
      example:
        file_name: string
        process_guid: 10
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        type: FileCreateEvent
        file_path: string
        process_name: string
        process_id: 10
        process_username: string
        failed: false
      type: object
      properties:
        file_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        time:
          $ref: '#/components/schemas/ObservedTime'
        type:
          example: FileCreateEvent
          type: string
          enum:
          - FileCreateEvent
        file_path:
          example: string
          description: String with at most 2048 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        failed:
          example: false
          type: boolean
      additionalProperties: false
      required:
      - file_name
      - time
      - type
      - file_path
      - process_name
      - process_id
    IncidentTime:
      example:
        opened: '2016-01-01T01:01:01.000Z'
        discovered: '2016-01-01T01:01:01.000Z'
        reported: '2016-01-01T01:01:01.000Z'
        remediated: '2016-01-01T01:01:01.000Z'
        closed: '2016-01-01T01:01:01.000Z'
        rejected: '2016-01-01T01:01:01.000Z'
        contained: '2016-01-01T01:01:01.000Z'
      description: Relevant time values associated with this Incident.
      type: object
      properties:
        opened:
          example: '2016-01-01T01:01:01.000Z'
          description: Time the incident was first opened.
          type: string
          format: date-time
        discovered:
          example: '2016-01-01T01:01:01.000Z'
          description: Time the incident was first discovered.
          type: string
          format: date-time
        reported:
          example: '2016-01-01T01:01:01.000Z'
          description: Time the incident was first reported.
          type: string
          format: date-time
        remediated:
          example: '2016-01-01T01:01:01.000Z'
          description: Time that the remediation of the damage from the incident was completed.
          type: string
          format: date-time
        closed:
          example: '2016-01-01T01:01:01.000Z'
          description: Time that the incident was last closed.
          type: string
          format: date-time
        rejected:
          example: '2016-01-01T01:01:01.000Z'
          description: Time that the incident was first rejected.
          type: string
          format: date-time
        contained:
          example: '2016-01-01T01:01:01.000Z'
          description: Time that the incident was first contained.
          type: string
          format: date-time
      additionalProperties: false
      required:
      - opened
    CPEMatch:
      example:
        vulnerable: true
        cpe23Uri: string
        versionStartIncluding: string
        versionEndIncluding: string
        versionStartExcluding: string
        versionEndExcluding: string
      type: object
      properties:
        vulnerable:
          example: true
          type: boolean
        cpe23Uri:
          example: string
          description: A text representation of a software or hardware platform.
          type: string
        versionStartIncluding:
          example: string
          description: A string representing the lower bound(inclusive) of version in the CPE.
          type: string
        versionEndIncluding:
          example: string
          description: A string representing the upper bound(inclusive) of version in the CPE.
          type: string
        versionStartExcluding:
          example: string
          description: A string representing the lower bound(exclusive) of version in the CPE.
          type: string
        versionEndExcluding:
          example: string
          description: A string representing the upper bound(exclusive) of version in the CPE.
          type: string
      additionalProperties: false
      required:
      - vulnerable
      - cpe23Uri
    Mitigation:
      example:
        description: string
        phases:
        - Architecture and Design
        strategy: Attack Surface Reduction
        effectiveness: Defense in Depth
        effectiveness_notes: string
      type: object
      properties:
        description:
          example: string
          description: A description of this individual mitigation including any strengths and shortcomings of this mitigation for the weakness.
          type: string
        phases:
          example:
          - Architecture and Design
          description: Indicates the development life cycle phase during which this particular mitigation may be applied.
          type: array
          items:
            type: string
        strategy:
          example: Attack Surface Reduction
          description: A general strategy for protecting a system to which this mitigation contributes.
          type: string
        effectiveness:
          example: Defense in Depth
          description: Summarizes how effective the mitigation may be in preventing the weakness.
          type: string
        effectiveness_notes:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
      additionalProperties: false
    NewSightingRelationsRelationInfo:
      example:
        keyword: anything
      type: object
      additionalProperties:
        example: anything
    Text:
      example:
        type: string
        text: string
      type: object
      properties:
        type:
          example: string
          type: string
        text:
          example: string
          type: string
      additionalProperties: false
    ModifierType:
      example:
        response: acknowledge
        method:
        - acl
        additional_properties:
          context: string
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        frequency: string
        duration: '2016-01-01T01:01:01.000Z'
        source: string
        search: cve
        option: string
        id: string
        location: internal
        delay: '2016-01-01T01:01:01.000Z'
        destination: copy-to
      type: object
      properties:
        response:
          example: acknowledge
          type: string
          enum:
          - query
          - status
          - acknowledge
          - command-ref
        method:
          example:
          - acl
          type: array
          items:
            type: string
            enum:
            - blackhole
            - unauthenticated
            - suspend
            - graceful
            - hibernate
            - whitelist
            - honeypot
            - immediate
            - spawn
            - blacklist
            - acl
            - segmentation
            - authenticated
        additional_properties:
          $ref: '#/components/schemas/AdditionalProperties'
        time:
          $ref: '#/components/schemas/ValidTime'
        frequency:
          example: string
          description: String with at most 1024 characters.
          type: string
        duration:
          example: '2016-01-01T01:01:01.000Z'
          description: Schema definition for all date or timestamp values.  Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
          type: string
          format: date-time
        source:
          example: string
          description: String with at most 1024 characters.
          type: string
        search:
          example: cve
          type: string
          enum:
          - vendor_bulletin
          - patch
          - signature
          - cve
        option:
          example: string
          description: String with at most 1024 characters.
          type: string
        id:
          example: string
          description: String with at most 1024 characters.
          type: string
        location:
          example: internal
          type: string
          enum:
          - internal
          - perimeter
        delay:
          example: '2016-01-01T01:01:01.000Z'
          description: Schema definition for all date or timestamp values.  Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
          type: string
          format: date-time
        destination:
          example: copy-to
          type: string
          enum:
          - modify-to
          - set-to
          - copy-to
          - move-to
          - save-to
          - restore-point
          - report-to
      additionalProperties: false
    AssetMapping:
      example:
        asset_type: application
        valid_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        stability: Managed
        schema_version: 1.3.30
        revision: 10
        observable:
          value: 1.2.3.4
          type: ip
        asset_ref: string
        type: asset-mapping
        source: string
        external_ids:
        - string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        source_uri: string
        language: string
        id: string
        tlp: green
        timestamp: '2016-01-01T01:01:01.000Z'
        specificity: Low
        confidence: High
      description: A record that maps a specific Observable to an asset for a specified period of time.
      type: object
      properties:
        asset_type:
          example: application
          description: 'Type of the mapped Asset: Device, Person, Application, etc.'
          type: string
          enum:
          - device
          - network
          - application
          - person
          - data
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        stability:
          example: Managed
          description: Do we manage when it changes, or is it always a time bound assignment?
          type: string
          enum:
          - Physical
          - Managed
          - Temporary
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        observable:
          $ref: '#/components/schemas/Observable'
        asset_ref:
          example: string
          description: URI that points to the mapped Asset.
          type: string
        type:
          example: asset-mapping
          type: string
          enum:
          - asset-mapping
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        specificity:
          example: Low
          description: Denotes the level of how many assets potentially could have this same identifier.
          type: string
          enum:
          - Medium
          - Unique
          - Low
        confidence:
          example: High
          description: 'Level of confidence held in the characterization of this AssetMapping e.g.: is it susceptible to manipulation or translation?'
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
      additionalProperties: false
    ModeOfIntroduction:
      example:
        phase: Architecture and Design
        note: string
      type: object
      properties:
        phase:
          example: Architecture and Design
          description: Identifies the point in the software life cycle at which the weakness may be introduced.
          type: string
        note:
          example: string
          description: Provides a typical scenario related to introduction during the given phase.
          type: string
      additionalProperties: false
    Configurations:
      example:
        CVE_data_version: string
        nodes:
        - operator: AND
          cpe_match:
          - vulnerable: true
            cpe23Uri: string
            versionStartIncluding: string
            versionEndIncluding: string
            versionStartExcluding: string
            versionEndExcluding: string
          children:
          - operator: AND
            cpe_match:
            - vulnerable: true
              cpe23Uri: string
              versionStartIncluding: string
              versionEndIncluding: string
              versionStartExcluding: string
              versionEndExcluding: string
            negate: true
          negate: true
      description: "Represents a list of affected versions or configurations of a software component that is impacted by a vulnerability. \nBy tracking the affected software components and versions, defenders can identify which systems are potentially exposed to an attack, and apply appropriate mitigations."
      type: object
      properties:
        CVE_data_version:
          example: string
          description: Specifies the version of the CVE (Common Vulnerabilities and Exposures) dictionary used by the vulnerability information provider.
          type: string
        nodes:
          example:
          - operator: AND
            cpe_match:
            - vulnerable: true
              cpe23Uri: string
              versionStartIncluding: string
              versionEndIncluding: string
              versionStartExcluding: string
              versionEndExcluding: string
            children:
            - operator: AND
              cpe_match:
              - vulnerable: true
                cpe23Uri: string
                versionStartIncluding: string
                versionEndIncluding: string
                versionStartExcluding: string
                versionEndExcluding: string
              negate: true
            negate: true
          description: Each `node` in the CTIM standard configuration includes information such as the `operator` (such as "less than", or "greater than or equal to"), and the `cpe` (Common Platform Enumeration) string which identifies the specific software, `CPE` is a structured naming scheme for IT systems, platforms, and software packages, and it is instrumental in enabling data exchange between different systems.
          type: array
          items:
            $ref: '#/components/schemas/CPENode'
      additionalProperties: false
      required:
      - CVE_data_version
      - nodes
    PartialNewCasebook:
      description: a Casebook partial update
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        authorized_groups:
          type: array
          items:
            type: string
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        texts:
          example:
          - type: string
            text: string
          type: array
          items:
            $ref: '#/components/schemas/Text'
        bundle:
          $ref: '#/components/schemas/Bundle'
        observables:
          example:
          - value: 1.2.3.4
            type: ip
          type: array
          items:
            $ref: '#/components/schemas/Observable'
        authorized_users:
          type: array
          items:
            type: string
        type:
          example: casebook
          type: string
          enum:
          - casebook
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        client_id:
          type: string
        groups:
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        owner:
          type: string
      additionalProperties: false
    CasebookObservablesUpdate:
      description: A casebook Observables operation
      type: object
      properties:
        operation:
          type: string
          enum:
          - remove
          - replace
          - add
        observables:
          example:
          - value: 1.2.3.4
            type: ip
          type: array
          items:
            $ref: '#/components/schemas/Observable'
      additionalProperties: false
      required:
      - operation
    Asset:
      example:
        description: string
        asset_type: application
        valid_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        schema_version: 1.3.30
        revision: 10
        type: asset
        source: string
        external_ids:
        - string
        short_description: string
        title: string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        source_uri: string
        language: string
        id: string
        tlp: green
        timestamp: '2016-01-01T01:01:01.000Z'
      description: Describes a protected resource. It could be a Device, User, Network, Application or Data.
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        asset_type:
          example: application
          description: 'Type of the Asset: Device, Person, Application, etc.'
          type: string
          enum:
          - device
          - network
          - application
          - person
          - data
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        type:
          example: asset
          type: string
          enum:
          - asset
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
      additionalProperties: false
    Traffic:
      example:
        destination_host_name: string
        protocol: 10
        source_ip: string
        destination_subnet: string
        destination_ip: string
        source_subnet: string
        destination_port: 10
        direction: incoming
        source_port: 10
      type: object
      properties:
        destination_host_name:
          example: string
          type: string
        protocol:
          example: 10
          description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)
          type: integer
          format: int64
        source_ip:
          example: string
          type: string
        destination_subnet:
          example: string
          type: string
        destination_ip:
          example: string
          type: string
        source_subnet:
          example: string
          type: string
        destination_port:
          example: 10
          type: integer
          format: int64
        direction:
          example: incoming
          type: string
          enum:
          - incoming
          - outgoing
        source_port:
          example: 10
          type: integer
          format: int64
      additionalProperties: false
      required:
      - protocol
      - source_ip
      - destination_ip
      - destination_port
      - direction
      - source_port
    CVE:
      example:
        cve_data_meta:
          id: string
          assigner: string
      type: object
      properties:
        cve_data_meta:
          $ref: '#/components/schemas/CVEDataMeta'
      additionalProperties: false
      required:
      - cve_data_meta
    IncidentScores:
      example:
        asset: 10.0
      description: Used to indicate the severity or impact score of the threat represented by the incident.
      type: object
      additionalProperties:
        example: 10.0
        description: "Field is used to indicate the severity or impact of the threat represented by the incident.\nIt's an open-type dictionary object with score types and numeric value of the score.\n\nFor example, systems can have the following score types:\n\n- `asset` - assesses the potential damage or harm that the threat can cause to the affected asset(s). The scale ranges from 0 to 10, with 10 indicating the highest potential harm. \n\n- `global` - assesses the overall impact or significance of the threat to the organization or wider community. The scale ranges from 0 to 1000, with 1000 indicating the highest impact.\n\n- `ttp` - a measure of the threat actor's proficiency in utilizing TTPs. Typically, ranges from 0-100, with a higher score indicating a greater threat or concern."
        type: number
        format: double
    RegistryRenameType:
      example:
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        process_id: 10
        process_name: string
        process_guid: 10
        process_username: string
        registry_key: string
        type: RegistryRenameEvent
        registry_old_key: string
      type: object
      properties:
        time:
          $ref: '#/components/schemas/ObservedTime'
        process_id:
          example: 10
          type: integer
          format: int64
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        registry_key:
          example: string
          description: String with at most 1024 characters.
          type: string
        type:
          example: RegistryRenameEvent
          type: string
          enum:
          - RegistryRenameEvent
        registry_old_key:
          example: string
          description: String with at most 1024 characters.
          type: string
      additionalProperties: false
      required:
      - time
      - process_id
      - process_name
      - registry_key
      - type
      - registry_old_key
    Sighting:
      example:
        description: string
        schema_version: 1.3.30
        revision: 10
        relations:
        - origin: string
          origin_uri: string
          relation: Allocated
          relation_info:
            keyword: anything
          source:
            value: 1.2.3.4
            type: ip
          related:
            value: 1.2.3.4
            type: ip
        sensor_coordinates:
          type: endpoint
          observables:
          - value: 1.2.3.4
            type: ip
          os: string
        observables:
        - value: 1.2.3.4
          type: ip
        type: sighting
        source: string
        external_ids:
        - string
        targets:
        - type: endpoint
          observables:
          - value: 1.2.3.4
            type: ip
          observed_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          os: string
        short_description: string
        title: string
        resolution: detected
        internal: false
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        detection_interval:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        source_uri: string
        activity_interval:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        language: string
        id: string
        count: 10
        severity: Critical
        tlp: green
        modification_interval:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        context:
          http_events:
          - process_guid: 10
            traffic:
              destination_host_name: string
              protocol: 10
              source_ip: string
              destination_subnet: string
              destination_ip: string
              source_subnet: string
              destination_port: 10
              direction: incoming
              source_port: 10
            method: CONNECT
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: HTTPEvent
            host: string
            process_name: string
            process_id: 10
            process_username: string
            query: string
            encrypted: true
            url_port: 10
          process_create_events:
          - parent_process_name: string
            process_guid: 10
            parent_process_guid: 10
            process_disposition: string
            parent_process_size: 10
            process_size: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            parent_process_disposition: string
            type: ProcessCreateEvent
            parent_process_username: string
            parent_process_id: 10
            parent_process_args: string
            process_name: string
            process_hash: string
            process_id: 10
            parent_process_hash: string
            process_username: string
            parent_creation_time: '2016-01-01T01:01:01.000Z'
            process_args: string
          registry_delete_events:
          - time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            process_id: 10
            process_name: string
            process_guid: 10
            process_username: string
            registry_key: string
            type: RegistryDeleteEvent
            registry_value: string
          file_modify_events:
          - file_name: string
            process_guid: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: FileModifyEvent
            file_path: string
            process_name: string
            process_id: 10
            process_username: string
            failed: false
          registry_set_events:
          - process_guid: 10
            registry_data: string
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: RegistrySetEvent
            registry_data_length: 10
            registry_value: string
            registry_key: string
            process_name: string
            process_id: 10
            process_username: string
          file_create_events:
          - file_name: string
            process_guid: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: FileCreateEvent
            file_path: string
            process_name: string
            process_id: 10
            process_username: string
            failed: false
          registry_create_events:
          - time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            process_id: 10
            process_name: string
            process_guid: 10
            process_username: string
            registry_key: string
            type: RegistryCreateEvent
          library_load_events:
          - time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            process_id: 10
            process_name: string
            process_guid: 10
            process_username: string
            type: LibraryLoadEvent
            dll_library_name: string
            dll_library_path: string
          file_move_events:
          - file_name: string
            process_guid: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: FileMoveEvent
            old_name: string
            file_path: string
            process_name: string
            process_id: 10
            process_username: string
            new_name: string
          file_delete_events:
          - file_name: string
            process_guid: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: FileDeleteEvent
            file_path: string
            process_name: string
            process_id: 10
            process_username: string
            failed: false
          netflow_events:
          - parent_process_name: string
            byte_count_in: 10
            process_guid: 10
            process_path: string
            traffic:
              destination_host_name: string
              protocol: 10
              source_ip: string
              destination_subnet: string
              destination_ip: string
              source_subnet: string
              destination_port: 10
              direction: incoming
              source_port: 10
            flow_time: '2016-01-01T01:01:01.000Z'
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            parent_process_account: string
            type: NetflowEvent
            process_account_type: string
            parent_process_path: string
            parent_process_id: 10
            parent_process_args: string
            process_name: string
            process_account: string
            parent_process_account_type: string
            process_hash: string
            process_id: 10
            parent_process_hash: string
            process_username: string
            byte_count_out: 10
            process_args: string
          registry_rename_events:
          - time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            process_id: 10
            process_name: string
            process_guid: 10
            process_username: string
            registry_key: string
            type: RegistryRenameEvent
            registry_old_key: string
        timestamp: '2016-01-01T01:01:01.000Z'
        confidence: High
        observed_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        sensor: endpoint
        data:
          columns:
          - name: string
            type: integer
            description: string
            required: true
            short_description: string
          rows:
          - - anything
          row_count: 10
      description: A sighting indicates that a particular entity or [indicator](indicator.md) was observed in an environment and can be an indication of a current or potential threat.
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        relations:
          example:
          - origin: string
            origin_uri: string
            relation: Allocated
            relation_info:
              keyword: anything
            source:
              value: 1.2.3.4
              type: ip
            related:
              value: 1.2.3.4
              type: ip
          description: Provide any context we can about where the observable came from.
          type: array
          items:
            $ref: '#/components/schemas/ObservedRelation'
        sensor_coordinates:
          $ref: '#/components/schemas/SensorCoordinates'
        observables:
          example:
          - value: 1.2.3.4
            type: ip
          description: The object(s) of interest.
          type: array
          items:
            $ref: '#/components/schemas/Observable'
        type:
          example: sighting
          type: string
          enum:
          - sighting
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        targets:
          example:
          - type: endpoint
            observables:
            - value: 1.2.3.4
              type: ip
            observed_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            os: string
          description: 'May include one or more targets that observed the associated indicator. Targets can include network devices, host devices, or other entities that are capable of detecting indicators of compromise.


            Can be used to assess the scope of potential threats, helping analysts understand which devices or components of the network may be vulnerable to attack. For example, if a particular malware strain is detected on several different systems within an organization, the `targets` field may indicate which systems are affected and which may need to be isolated or patched to prevent further spread.'
          type: array
          items:
            $ref: '#/components/schemas/IdentitySpecification'
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        resolution:
          example: detected
          description: Represents the disposition or actions taken on the associated threat intelligence.
          type: string
        internal:
          example: false
          description: "If `true`, indicates that the sighting was reported from internal sources, such as an organization's own internal security tools or SOC.\n Internal sightings are often considered more reliable and actionable than external sightings, which are reported from external sources and may have a lower level of trustworthiness. Internal sightings can provide more context and can help identify potential threats that are unique to a particular environment or organization.\n Internal sightings can also help organizations prioritize their security response efforts by identifying threats that are specific to their environment and may not yet be widely known."
          type: boolean
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        detection_interval:
          $ref: '#/components/schemas/ObservedTime'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        activity_interval:
          $ref: '#/components/schemas/ObservedTime'
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        count:
          example: 10
          description: 'The number of times an indicator was observed within a certain period of time.

            For example, if an IP address associated with known malicious activity is observed once within a period of time, it may indicate a low-level threat. However, if the same IP address is observed multiple times within a short time frame, it may indicate a more severe and persistent threat.

            It can also be used to prioritize security alerts and indicate the urgency of a response. High counts indicate that an indicator is actively being used in a larger campaign, while low counts may indicate isolated incidents.'
          type: integer
          format: int64
        severity:
          example: Critical
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Critical
          - Low
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        modification_interval:
          $ref: '#/components/schemas/ObservedTime'
        context:
          $ref: '#/components/schemas/Context'
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        confidence:
          example: High
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        observed_time:
          $ref: '#/components/schemas/ObservedTime'
        sensor:
          example: endpoint
          description: The OpenC2 Actuator name that best fits the device that is creating this sighting (e.g. network.firewall)
          type: string
        data:
          $ref: '#/components/schemas/SightingDataTable'
      additionalProperties: false
    AdditionalProperties:
      example:
        context: string
      type: object
      properties:
        context:
          example: string
          description: String with at most 1024 characters.
          type: string
      additionalProperties: false
      required:
      - context
    Language:
      example:
        prevalence: Often
        name: string
        class: Assembly
      type: object
      properties:
        prevalence:
          example: Often
          description: Defines the different regularities that guide the applicability of platforms.
          type: string
          enum:
          - Undetermined
          - Sometimes
          - Often
          - Rarely
        name:
          example: string
          description: Language name (Clojure, Java, ...)
          type: string
        class:
          example: Assembly
          description: Class of language.
          type: string
      additionalProperties: false
    Vulnerability:
      example:
        description: string
        schema_version: 1.3.30
        revision: 10
        published_date: '2016-01-01T01:01:01.000Z'
        cve:
          cve_data_meta:
            id: string
            assigner: string
        configurations:
          CVE_data_version: string
          nodes:
          - operator: AND
            cpe_match:
            - vulnerable: true
              cpe23Uri: string
              versionStartIncluding: string
              versionEndIncluding: string
              versionStartExcluding: string
              versionEndExcluding: string
            children:
            - operator: AND
              cpe_match:
              - vulnerable: true
                cpe23Uri: string
                versionStartIncluding: string
                versionEndIncluding: string
                versionStartExcluding: string
                versionEndExcluding: string
              negate: true
            negate: true
        type: vulnerability
        source: string
        external_ids:
        - string
        short_description: string
        title: string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        source_uri: string
        language: string
        id: string
        tlp: green
        timestamp: '2016-01-01T01:01:01.000Z'
        last_modified_date: '2016-01-01T01:01:01.000Z'
        impact:
          cvss_v2:
            integrity_impact: complete
            target_distribution: not_defined
            availability_requirement: not_defined
            exploitability: not_defined
            access_complexity: low
            temporal_vector_string: string
            exploitability_score: 10.0
            impact_score: 10.0
            user_interaction_required: true
            environmental_vector_string: string
            obtain_other_privilege: true
            availability_impact: complete
            access_vector: network
            base_severity: High
            confidentiality_impact: complete
            confidentiality_requirement: not_defined
            report_confidence: not_defined
            authentication: none
            base_score: 10.0
            obtain_user_privilege: true
            obtain_all_privilege: true
            collateral_damage_potential: not_defined
            remediation_level: not_defined
            vector_string: string
            integrity_requirement: not_defined
          cvss_v3:
            integrity_impact: high
            modified_user_interaction: none
            modified_scope: not_defined
            availability_requirement: high
            user_interaction: none
            modified_integrity_impact: not_defined
            privileges_required: high
            exploitability_score: 10.0
            impact_score: 10.0
            environmental_severity: critical
            modified_availability_impact: not_defined
            availability_impact: high
            scope: changed
            exploit_code_maturity: functional
            modified_attack_complexity: not_defined
            base_severity: critical
            confidentiality_impact: high
            temporal_severity: critical
            modified_confidentiality_impact: not_defined
            confidentiality_requirement: high
            report_confidence: confirmed
            temporal_score: 10.0
            modified_privileges_required: not_defined
            modified_attack_vector: not_defined
            base_score: 10.0
            environmental_score: 10.0
            remediation_level: high
            vector_string: string
            integrity_requirement: high
            attack_vector: adjacent_network
            attack_complexity: high
      description: Indicates weakness or flaw in the system that can be exploited by an attacker to gain unauthorized access or cause harm to the system. Vulnerabilities can exist in various components of the system, such as the operating system, applications, network devices, and databases.
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        published_date:
          example: '2016-01-01T01:01:01.000Z'
          description: "Represents the date when a vulnerability was publicly disclosed or made available to the general public. \n\nImportant for tracking the age of a vulnerability, as well as for determining when a particular vulnerability was first introduced into a system. The published date can be used to identify the time window during which a system may have been vulnerable to a particular exploit.\n\nFor example, if an organization discovers that a vulnerability was published before their system's installation date, but they did not apply the necessary security updates in a timely manner, it can be concluded that their system was vulnerable for the period between the installation date and the date when the necessary security updates were applied."
          type: string
          format: date-time
        cve:
          $ref: '#/components/schemas/CVE'
        configurations:
          $ref: '#/components/schemas/Configurations'
        type:
          example: vulnerability
          description: The fixed value vulnerability
          type: string
          enum:
          - vulnerability
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        last_modified_date:
          example: '2016-01-01T01:01:01.000Z'
          description: 'Represents the date when the vulnerability metadata was last updated in the internal database.

            It can be used to track the freshness of the vulnerability information. If the `last_modified_date` is more recent than the `published_date`, it can indicate that there has been some new information or updates related to the vulnerability, such as new patch releases or changes in the severity or impact rating.'
          type: string
          format: date-time
        impact:
          $ref: '#/components/schemas/VulnerabilityImpact'
      additionalProperties: false
    CPELeafNode:
      example:
        operator: AND
        cpe_match:
        - vulnerable: true
          cpe23Uri: string
          versionStartIncluding: string
          versionEndIncluding: string
          versionStartExcluding: string
          versionEndExcluding: string
        negate: true
      type: object
      properties:
        operator:
          example: AND
          description: The operator string influences how seqs of cpe matches are related to one another.
          type: string
          enum:
          - AND
          - OR
        cpe_match:
          example:
          - vulnerable: true
            cpe23Uri: string
            versionStartIncluding: string
            versionEndIncluding: string
            versionStartExcluding: string
            versionEndExcluding: string
          type: array
          items:
            $ref: '#/components/schemas/CPEMatch'
        negate:
          example: true
          description: Negates operator when true.
          type: boolean
      additionalProperties: false
      required:
      - operator
      - cpe_match
    FileModifyType:
      example:
        file_name: string
        process_guid: 10
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        type: FileModifyEvent
        file_path: string
        process_name: string
        process_id: 10
        process_username: string
        failed: false
      type: object
      properties:
        file_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        time:
          $ref: '#/components/schemas/ObservedTime'
        type:
          example: FileModifyEvent
          type: string
          enum:
          - FileModifyEvent
        file_path:
          example: string
          description: String with at most 2048 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        failed:
          example: false
          type: boolean
      additionalProperties: false
      required:
      - file_name
      - time
      - type
      - file_path
      - process_name
      - process_id
    FileMoveType:
      example:
        file_name: string
        process_guid: 10
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        type: FileMoveEvent
        old_name: string
        file_path: string
        process_name: string
        process_id: 10
        process_username: string
        new_name: string
      type: object
      properties:
        file_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        time:
          $ref: '#/components/schemas/ObservedTime'
        type:
          example: FileMoveEvent
          type: string
          enum:
          - FileMoveEvent
        old_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        file_path:
          example: string
          description: String with at most 2048 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        new_name:
          example: string
          description: String with at most 1024 characters.
          type: string
      additionalProperties: false
      required:
      - file_name
      - time
      - type
      - old_name
      - file_path
      - process_name
      - process_id
      - new_name
    TargetType:
      example:
        type: acudid
        specifiers: string
      type: object
      properties:
        type:
          example: acudid
          type: string
        specifiers:
          example: string
          description: Observable types that can be acted upon.
          type: string
      additionalProperties: false
      required:
      - type
    ColumnDefinition:
      example:
        name: string
        type: integer
        description: string
        required: true
        short_description: string
      type: object
      properties:
        name:
          example: string
          type: string
        type:
          example: integer
          type: string
          enum:
          - url
          - string
          - observable
          - number
          - integer
          - markdown
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        required:
          example: true
          description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`.
          type: boolean
        short_description:
          example: string
          type: string
      additionalProperties: false
      required:
      - name
      - type
    IdentityCoordinates:
      example:
        observables:
        - value: 1.2.3.4
          type: ip
      description: Attributes for which the assertion is being made.
      type: object
      properties:
        observables:
          example:
          - value: 1.2.3.4
            type: ip
          type: array
          items:
            $ref: '#/components/schemas/Observable'
      additionalProperties: false
    Feedback:
      example:
        feedback: -1
        schema_version: 1.3.30
        revision: 10
        type: feedback
        source: string
        external_ids:
        - string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        reason: string
        source_uri: string
        language: string
        id: string
        tlp: green
        entity_id: string
        timestamp: '2016-01-01T01:01:01.000Z'
      description: "Feedback on any entity. Is it wrong? If so why? Was\n  it right-on, and worthy of confirmation?"
      type: object
      properties:
        feedback:
          example: -1
          type: integer
          format: int64
          enum:
          - 0
          - 1
          - -1
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        type:
          example: feedback
          type: string
          enum:
          - feedback
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        reason:
          example: string
          type: string
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        entity_id:
          example: string
          description: A URI leading to an entity.
          type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
      additionalProperties: false
    Technology:
      example:
        prevalence: Often
        name: string
      type: object
      properties:
        prevalence:
          example: Often
          description: Defines the different regularities that guide the applicability of platforms.
          type: string
          enum:
          - Undetermined
          - Sometimes
          - Often
          - Rarely
        name:
          example: string
          description: Technology name (Web Server, Web Client)
          type: string
      additionalProperties: false
    ObservedRelation:
      example:
        origin: string
        origin_uri: string
        relation: Allocated
        relation_info:
          keyword: anything
        source:
          value: 1.2.3.4
          type: ip
        related:
          value: 1.2.3.4
          type: ip
      description: A relation inside a Sighting.
      type: object
      properties:
        origin:
          example: string
          type: string
        origin_uri:
          example: string
          description: A URI
          type: string
        relation:
          example: Allocated
          type: string
        relation_info:
          $ref: '#/components/schemas/NewSightingRelationsRelationInfo'
        source:
          $ref: '#/components/schemas/Observable'
        related:
          $ref: '#/components/schemas/Observable'
      additionalProperties: false
      required:
      - origin
      - relation
      - source
      - related
    Relationship:
      example:
        description: string
        schema_version: 1.3.30
        revision: 10
        target_ref: string
        type: relationship
        source: string
        external_ids:
        - string
        short_description: string
        title: string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        source_uri: string
        source_ref: string
        language: string
        id: string
        tlp: green
        timestamp: '2016-01-01T01:01:01.000Z'
        relationship_type: attributed-to
      description: Represents a relationship between two entities.
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        target_ref:
          example: string
          description: A URI leading to an entity.
          type: string
        type:
          example: relationship
          type: string
          enum:
          - relationship
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        source_ref:
          example: string
          description: A URI leading to an entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        relationship_type:
          example: attributed-to
          type: string
      additionalProperties: false
    Actor:
      example:
        description: string
        motivation: Ego
        valid_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        identity:
          description: string
          related_identities:
          - identity: string
            confidence: High
            information_source: string
            relationship: string
        sophistication: Aspirant
        schema_version: 1.3.30
        revision: 10
        planning_and_operational_support: string
        type: actor
        source: string
        external_ids:
        - string
        short_description: string
        title: string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        source_uri: string
        intended_effect: Account Takeover
        language: string
        id: string
        tlp: green
        aliases:
        - string
        timestamp: '2016-01-01T01:01:01.000Z'
        confidence: High
        actor_types:
        - Cyber Espionage Operations
      description: Describes malicious actors or adversaries related to a cyber attack.
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        motivation:
          example: Ego
          description: The reason or purpose behind the malicious activity attributed to this Actor. By understanding a threat actor's motivation, analysts can better predict the attacker's behavior and anticipate future malicious actions.
          type: string
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        identity:
          $ref: '#/components/schemas/Identity'
        sophistication:
          example: Aspirant
          description: "Represents the level of expertise and skill that the threat actor has displayed in their malicious activities. Can help security analysts assess the potential impact of an attacker's TTPs and determine the potential attack surface. \n\nFor example, a threat actor with a low sophistication level may primarily rely on off-the-shelf malware and attack tools, while an attacker with high sophistication may use custom tools with advanced evasion techniques, zero-day exploits, and sophisticated methods for command and control of their malware. \n\nThe sophistication level of an attacker can also be inferred based on several factors such as the complexity of attacks, the attacker's knowledge of the targeted organization's systems, and the attacker's ability to remain undetected.\n\nIf an attacker shows a high level of sophistication in reconnaissances, social engineering, and phishing, then the attacker may have a good knowledge of the targeted organization and its employees. This means that the attacker may be more successful in infiltrating the organization's network and compromising its systems."
          type: string
          enum:
          - Aspirant
          - Innovator
          - Practitioner
          - Novice
          - Expert
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        planning_and_operational_support:
          example: string
          description: "Provides information about the resources and capabilities of the attacker that could be used to assist in planning and operations related to the threat.\n\n It can be used to describe Infrastructure, Tools, Techniques, and Capabilities used by the threat actor."
          type: string
        type:
          example: actor
          type: string
          enum:
          - actor
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        intended_effect:
          example: Account Takeover
          description: "Represents the desired outcome or impact the threat actor is trying to achieve through their malicious activities. \n\n Helps security analysts to understand the attacker's goals beyond the immediate impact of the attack. By understanding the intended effect, analysts can draw connections between seemingly unrelated attacks and build a more complete understanding of an attacker's long-term goals and motivations."
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        aliases:
          example:
          - string
          description: A list of other names that this Threat Actor is believed to use.
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        confidence:
          example: High
          description: 'This field can help analysts decide how much trust they can put in the information provided by the threat intelligence sources.


            For example, an Actor entity can have high confidence if the organization''s security researchers have been tracking it for a long time and have gathered a significant amount of intelligence about it through various sources, such as analysis of malware, network traffic, and human intelligence. In contrast, low confidence may indicate the organization has only seen limited or circumstantial evidence.'
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        actor_types:
          example:
          - Cyber Espionage Operations
          type: array
          items:
            type: string
      additionalProperties: false
    PartialCasebook:
      example:
        description: string
        schema_version: 1.3.30
        revision: 10
        texts:
        - type: string
          text: string
        bundle:
          description: string
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          asset_mapping_refs:
          - string
          note_refs:
          - string
          data_table_refs:
          - string
          attack_pattern_refs:
          - string
          sighting_refs:
          - string
          schema_version: 1.3.30
          revision: 10
          assets:
          - description: string
            asset_type: application
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            type: asset
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
          weakness_refs:
          - string
          tool_refs:
          - string
          target_record_refs:
          - string
          asset_refs:
          - string
          tools:
          - description: string
            labels:
            - credential-exploitation
            schema_version: 1.3.30
            revision: 10
            type: tool
            x_mitre_aliases:
            - string
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tool_version: string
            tlp: green
            kill_chain_phases:
            - kill_chain_name: string
              phase_name: string
            timestamp: '2016-01-01T01:01:01.000Z'
          indicators:
          - description: string
            tags:
            - string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            producer: string
            schema_version: 1.3.30
            revision: 10
            type: indicator
            test_mechanisms:
            - string
            source: string
            external_ids:
            - string
            short_description: string
            composite_indicator_expression:
              operator: and
              indicator_ids:
              - string
            title: string
            likely_impact: string
            indicator_type:
            - Anonymization
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            severity: Critical
            tlp: green
            kill_chain_phases:
            - kill_chain_name: string
              phase_name: string
            negate: true
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            specification: anything
          attack_patterns:
          - description: string
            abstraction_level: aggregate
            schema_version: 1.3.30
            revision: 10
            type: attack-pattern
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            x_mitre_platforms:
            - string
            language: string
            id: string
            tlp: green
            x_mitre_data_sources:
            - string
            kill_chain_phases:
            - kill_chain_name: string
              phase_name: string
            x_mitre_contributors:
            - string
            timestamp: '2016-01-01T01:01:01.000Z'
          type: bundle
          weaknesses:
          - description: string
            background_details: string
            paradigms:
            - prevalence: Often
              name: string
            abstraction_level: Base
            architectures:
            - prevalence: Often
              name: string
              class: Embedded
            schema_version: 1.3.30
            revision: 10
            alternate_terms:
            - term: string
              description: string
            likelihood: High
            type: weakness
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            functional_areas:
            - Authentication
            source_uri: string
            modes_of_introduction:
            - phase: Architecture and Design
              note: string
            structure: Chain
            language: string
            id: string
            notes:
            - type: Applicable Platform
              note: string
            common_consequences:
            - scopes:
              - Access Control
              impacts:
              - Alter Execution Logic
              likelihood: High
              note: string
            tlp: green
            detection_methods:
            - method: Architecture or Design Review
              description: string
              effectiveness: High
              effectiveness_notes: string
            operating_systems:
            - prevalence: Often
              name: string
              version: string
              cpe_id: string
              class: Android
            affected_resources:
            - CPU
            languages:
            - prevalence: Often
              name: string
              class: Assembly
            timestamp: '2016-01-01T01:01:01.000Z'
            potential_mitigations:
            - description: string
              phases:
              - Architecture and Design
              strategy: Attack Surface Reduction
              effectiveness: Defense in Depth
              effectiveness_notes: string
            technologies:
            - prevalence: Often
              name: string
          source: string
          external_ids:
          - string
          feedback_refs:
          - string
          asset_properties:
          - properties:
            - name: string
              value: string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            asset_ref: string
            type: asset-properties
            source: string
            external_ids:
            - string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
          short_description: string
          feedbacks:
          - feedback: -1
            schema_version: 1.3.30
            revision: 10
            type: feedback
            source: string
            external_ids:
            - string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            reason: string
            source_uri: string
            language: string
            id: string
            tlp: green
            entity_id: string
            timestamp: '2016-01-01T01:01:01.000Z'
          judgement_refs:
          - string
          title: string
          coa_refs:
          - string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          verdicts:
          - type: verdict
            disposition: 1
            observable:
              value: 1.2.3.4
              type: ip
            judgement_id: string
            disposition_name: Clean
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
          campaigns:
          - description: string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            type: campaign
            campaign_type: string
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            activity:
            - date_time: '2016-01-01T01:01:01.000Z'
              description: string
            source_uri: string
            intended_effect:
            - Account Takeover
            status: Future
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            names:
            - string
          source_uri: string
          actors:
          - description: string
            motivation: Ego
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            identity:
              description: string
              related_identities:
              - identity: string
                confidence: High
                information_source: string
                relationship: string
            sophistication: Aspirant
            schema_version: 1.3.30
            revision: 10
            planning_and_operational_support: string
            type: actor
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            intended_effect: Account Takeover
            language: string
            id: string
            tlp: green
            aliases:
            - string
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            actor_types:
            - Cyber Espionage Operations
          indicator_refs:
          - string
          actor_refs:
          - string
          language: string
          data_tables:
          - description: string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            columns:
            - name: string
              type: integer
              description: string
              required: true
              short_description: string
            type: data-table
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            rows:
            - - anything
            source_uri: string
            language: string
            id: string
            tlp: green
            row_count: 10
            timestamp: '2016-01-01T01:01:01.000Z'
          id: string
          notes:
          - schema_version: 1.3.30
            revision: 10
            content: string
            note_class: keyword
            type: note
            source: string
            external_ids:
            - string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            author: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            related_entities:
            - entity_type: string
              entity_id: string
          identity_assertions:
          - valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            identity:
              observables:
              - value: 1.2.3.4
                type: ip
            schema_version: 1.3.30
            revision: 10
            type: identity-assertion
            source: string
            external_ids:
            - string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            assertions:
            - name: cisco:ctr:ad:host_domain_name
              value: string
          judgements:
          - valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            observable:
              value: 1.2.3.4
              type: ip
            reason_uri: string
            type: judgement
            source: string
            external_ids:
            - string
            disposition: 1
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            reason: string
            source_uri: string
            disposition_name: Clean
            priority: 10
            language: string
            id: string
            severity: Critical
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
          malwares:
          - description: string
            labels:
            - adware
            abstraction_level: family
            schema_version: 1.3.30
            revision: 10
            type: malware
            x_mitre_aliases:
            - string
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            kill_chain_phases:
            - kill_chain_name: string
              phase_name: string
            timestamp: '2016-01-01T01:01:01.000Z'
          target_records:
          - description: string
            schema_version: 1.3.30
            revision: 10
            type: target-record
            source: string
            external_ids:
            - string
            targets:
            - type: endpoint
              observables:
              - value: 1.2.3.4
                type: ip
              observed_time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              os: string
              internal: false
              sensor: string
              source_uri: string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
          asset_mappings:
          - asset_type: application
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            stability: Managed
            schema_version: 1.3.30
            revision: 10
            observable:
              value: 1.2.3.4
              type: ip
            asset_ref: string
            type: asset-mapping
            source: string
            external_ids:
            - string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            specificity: Low
            confidence: High
          relationship_refs:
          - string
          tlp: green
          incidents:
          - description: string
            assignees:
            - string
            detection_sources:
            - string
            meta:
              keyword: anything
            schema_version: 1.3.30
            revision: 10
            type: incident
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            incident_time:
              opened: '2016-01-01T01:01:01.000Z'
              discovered: '2016-01-01T01:01:01.000Z'
              reported: '2016-01-01T01:01:01.000Z'
              remediated: '2016-01-01T01:01:01.000Z'
              closed: '2016-01-01T01:01:01.000Z'
              rejected: '2016-01-01T01:01:01.000Z'
              contained: '2016-01-01T01:01:01.000Z'
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            discovery_method: Agent Disclosure
            source_uri: string
            intended_effect: Account Takeover
            categories:
            - Attrition
            status: Closed
            language: string
            detection_status: active
            id: string
            promotion_method: Automated
            severity: Critical
            tlp: green
            scores:
              asset: 10.0
            techniques:
            - string
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            short_id: string
            tactics:
            - string
          identity_assertion_refs:
          - string
          sightings:
          - description: string
            schema_version: 1.3.30
            revision: 10
            relations:
            - origin: string
              origin_uri: string
              relation: Allocated
              relation_info:
                keyword: anything
              source:
                value: 1.2.3.4
                type: ip
              related:
                value: 1.2.3.4
                type: ip
            sensor_coordinates:
              type: endpoint
              observables:
              - value: 1.2.3.4
                type: ip
              os: string
            observables:
            - value: 1.2.3.4
              type: ip
            type: sighting
            source: string
            external_ids:
            - string
            targets:
            - type: endpoint
              observables:
              - value: 1.2.3.4
                type: ip
              observed_time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              os: string
            short_description: string
            title: string
            resolution: detected
            internal: false
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            detection_interval:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            source_uri: string
            activity_interval:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            language: string
            id: string
            count: 10
            severity: Critical
            tlp: green
            modification_interval:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            context:
              http_events:
              - process_guid: 10
                traffic:
                  destination_host_name: string
                  protocol: 10
                  source_ip: string
                  destination_subnet: string
                  destination_ip: string
                  source_subnet: string
                  destination_port: 10
                  direction: incoming
                  source_port: 10
                method: CONNECT
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: HTTPEvent
                host: string
                process_name: string
                process_id: 10
                process_username: string
                query: string
                encrypted: true
                url_port: 10
              process_create_events:
              - parent_process_name: string
                process_guid: 10
                parent_process_guid: 10
                process_disposition: string
                parent_process_size: 10
                process_size: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                parent_process_disposition: string
                type: ProcessCreateEvent
                parent_process_username: string
                parent_process_id: 10
                parent_process_args: string
                process_name: string
                process_hash: string
                process_id: 10
                parent_process_hash: string
                process_username: string
                parent_creation_time: '2016-01-01T01:01:01.000Z'
                process_args: string
              registry_delete_events:
              - time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                process_id: 10
                process_name: string
                process_guid: 10
                process_username: string
                registry_key: string
                type: RegistryDeleteEvent
                registry_value: string
              file_modify_events:
              - file_name: string
                process_guid: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: FileModifyEvent
                file_path: string
                process_name: string
                process_id: 10
                process_username: string
                failed: false
              registry_set_events:
              - process_guid: 10
                registry_data: string
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: RegistrySetEvent
                registry_data_length: 10
                registry_value: string
                registry_key: string
                process_name: string
                process_id: 10
                process_username: string
              file_create_events:
              - file_name: string
                process_guid: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: FileCreateEvent
                file_path: string
                process_name: string
                process_id: 10
                process_username: string
                failed: false
              registry_create_events:
              - time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                process_id: 10
                process_name: string
                process_guid: 10
                process_username: string
                registry_key: string
                type: RegistryCreateEvent
              library_load_events:
              - time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                process_id: 10
                process_name: string
                process_guid: 10
                process_username: string
                type: LibraryLoadEvent
                dll_library_name: string
                dll_library_path: string
              file_move_events:
              - file_name: string
                process_guid: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: FileMoveEvent
                old_name: string
                file_path: string
                process_name: string
                process_id: 10
                process_username: string
                new_name: string
              file_delete_events:
              - file_name: string
                process_guid: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: FileDeleteEvent
                file_path: string
                process_name: string
                process_id: 10
                process_username: string
                failed: false
              netflow_events:
              - parent_process_name: string
                byte_count_in: 10
                process_guid: 10
                process_path: string
                traffic:
                  destination_host_name: string
                  protocol: 10
                  source_ip: string
                  destination_subnet: string
                  destination_ip: string
                  source_subnet: string
                  destination_port: 10
                  direction: incoming
                  source_port: 10
                flow_time: '2016-01-01T01:01:01.000Z'
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                parent_process_account: string
                type: NetflowEvent
                process_account_type: string
                parent_process_path: string
                parent_process_id: 10
                parent_process_args: string
                process_name: string
                process_account: string
                parent_process_account_type: string
                process_hash: string
                process_id: 10
                parent_process_hash: string
                process_username: string
                byte_count_out: 10
                process_args: string
              registry_rename_events:
              - time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                process_id: 10
                process_name: string
                process_guid: 10
                process_username: string
                registry_key: string
                type: RegistryRenameEvent
                registry_old_key: string
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            observed_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            sensor: endpoint
            data:
              columns:
              - name: string
                type: integer
                description: string
                required: true
                short_description: string
              rows:
              - - anything
              row_count: 10
          campaign_refs:
          - string
          vulnerability_refs:
          - string
          asset_properties_refs:
          - string
          relationships:
          - description: string
            schema_version: 1.3.30
            revision: 10
            target_ref: string
            type: relationship
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            source_ref: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            relationship_type: attributed-to
          timestamp: '2016-01-01T01:01:01.000Z'
          verdict_refs:
          - string
          malware_refs:
          - string
          incident_refs:
          - string
          vulnerabilities:
          - description: string
            schema_version: 1.3.30
            revision: 10
            published_date: '2016-01-01T01:01:01.000Z'
            cve:
              cve_data_meta:
                id: string
                assigner: string
            configurations:
              CVE_data_version: string
              nodes:
              - operator: AND
                cpe_match:
                - vulnerable: true
                  cpe23Uri: string
                  versionStartIncluding: string
                  versionEndIncluding: string
                  versionStartExcluding: string
                  versionEndExcluding: string
                children:
                - operator: AND
                  cpe_match:
                  - vulnerable: true
                    cpe23Uri: string
                    versionStartIncluding: string
                    versionEndIncluding: string
                    versionStartExcluding: string
                    versionEndExcluding: string
                  negate: true
                negate: true
            type: vulnerability
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            last_modified_date: '2016-01-01T01:01:01.000Z'
            impact:
              cvss_v2:
                integrity_impact: complete
                target_distribution: not_defined
                availability_requirement: not_defined
                exploitability: not_defined
                access_complexity: low
                temporal_vector_string: string
                exploitability_score: 10.0
                impact_score: 10.0
                user_interaction_required: true
                environmental_vector_string: string
                obtain_other_privilege: true
                availability_impact: complete
                access_vector: network
                base_severity: High
                confidentiality_impact: complete
                confidentiality_requirement: not_defined
                report_confidence: not_defined
                authentication: none
                base_score: 10.0
                obtain_user_privilege: true
                obtain_all_privilege: true
                collateral_damage_potential: not_defined
                remediation_level: not_defined
                vector_string: string
                integrity_requirement: not_defined
              cvss_v3:
                integrity_impact: high
                modified_user_interaction: none
                modified_scope: not_defined
                availability_requirement: high
                user_interaction: none
                modified_integrity_impact: not_defined
                privileges_required: high
                exploitability_score: 10.0
                impact_score: 10.0
                environmental_severity: critical
                modified_availability_impact: not_defined
                availability_impact: high
                scope: changed
                exploit_code_maturity: functional
                modified_attack_complexity: not_defined
                base_severity: critical
                confidentiality_impact: high
                temporal_severity: critical
                modified_confidentiality_impact: not_defined
                confidentiality_requirement: high
                report_confidence: confirmed
                temporal_score: 10.0
                modified_privileges_required: not_defined
                modified_attack_vector: not_defined
                base_score: 10.0
                environmental_score: 10.0
                remediation_level: high
                vector_string: string
                integrity_requirement: high
                attack_vector: adjacent_network
                attack_complexity: high
          coas:
          - description: string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            stage: Containment
            schema_version: 1.3.30
            revision: 10
            efficacy: High
            type: coa
            related_COAs:
            - confidence: High
              source: string
              relationship: string
              COA_id: string
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            coa_type: Diplomatic Actions
            language: string
            id: string
            tlp: green
            objective:
            - string
            cost: High
            timestamp: '2016-01-01T01:01:01.000Z'
            open_c2_coa:
              type: structured_coa
              id: string
              action:
                type: alert
              target:
                type: acudid
                specifiers: string
              actuator:
                type: endpoint
                specifiers:
                - string
              modifiers:
                response: acknowledge
                method:
                - acl
                additional_properties:
                  context: string
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                frequency: string
                duration: '2016-01-01T01:01:01.000Z'
                source: string
                search: cve
                option: string
                id: string
                location: internal
                delay: '2016-01-01T01:01:01.000Z'
                destination: copy-to
            structured_coa_type: openc2
            impact: string
        observables:
        - value: 1.2.3.4
          type: ip
        type: casebook
        source: string
        external_ids:
        - string
        short_description: string
        title: string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        source_uri: string
        language: string
        id: string
        tlp: green
        timestamp: '2016-01-01T01:01:01.000Z'
      description: Allows to gather and group observables and related analyst notes in one place from across multiple products for easy retrieval and further actions. Through Casebook, analysts can collaborate, share information, track progress, and take necessary actions to mitigate the incident.
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        authorized_groups:
          type: array
          items:
            type: string
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        texts:
          example:
          - type: string
            text: string
          type: array
          items:
            $ref: '#/components/schemas/Text'
        bundle:
          $ref: '#/components/schemas/Bundle'
        observables:
          example:
          - value: 1.2.3.4
            type: ip
          type: array
          items:
            $ref: '#/components/schemas/Observable'
        authorized_users:
          type: array
          items:
            type: string
        type:
          example: casebook
          type: string
          enum:
          - casebook
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        client_id:
          type: string
        groups:
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        owner:
          type: string
      additionalProperties: false
    ValidTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid.
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If not present, the valid time position of the indicator does not have an upper bound.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If end_time is not present, then the valid time position of the object does not have an upper bound.
          type: string
          format: date-time
      additionalProperties: false
    CasebookBundleUpdateBundle:
      example:
        description: string
        valid_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        asset_mapping_refs:
        - string
        note_refs:
        - string
        data_table_refs:
        - string
        attack_pattern_refs:
        - string
        sighting_refs:
        - string
        schema_version: 1.3.30
        revision: 10
        assets:
        - description: string
          asset_type: application
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          schema_version: 1.3.30
          revision: 10
          type: asset
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
        weakness_refs:
        - string
        tool_refs:
        - string
        target_record_refs:
        - string
        asset_refs:
        - string
        tools:
        - description: string
          labels:
          - credential-exploitation
          schema_version: 1.3.30
          revision: 10
          type: tool
          x_mitre_aliases:
          - string
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tool_version: string
          tlp: green
          kill_chain_phases:
          - kill_chain_name: string
            phase_name: string
          timestamp: '2016-01-01T01:01:01.000Z'
        indicators:
        - description: string
          tags:
          - string
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          producer: string
          schema_version: 1.3.30
          revision: 10
          type: indicator
          test_mechanisms:
          - string
          source: string
          external_ids:
          - string
          short_description: string
          composite_indicator_expression:
            operator: and
            indicator_ids:
            - string
          title: string
          likely_impact: string
          indicator_type:
          - Anonymization
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          severity: Critical
          tlp: green
          kill_chain_phases:
          - kill_chain_name: string
            phase_name: string
          negate: true
          timestamp: '2016-01-01T01:01:01.000Z'
          confidence: High
          specification:
            type: Judgement
            judgements:
            - string
            required_judgements:
            - confidence: High
              source: string
              relationship: string
              judgement_id: string
        attack_patterns:
        - description: string
          abstraction_level: aggregate
          schema_version: 1.3.30
          revision: 10
          type: attack-pattern
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          x_mitre_platforms:
          - string
          language: string
          id: string
          tlp: green
          x_mitre_data_sources:
          - string
          kill_chain_phases:
          - kill_chain_name: string
            phase_name: string
          x_mitre_contributors:
          - string
          timestamp: '2016-01-01T01:01:01.000Z'
        type: bundle
        weaknesses:
        - description: string
          background_details: string
          paradigms:
          - prevalence: Often
            name: string
          abstraction_level: Base
          architectures:
          - prevalence: Often
            name: string
            class: Embedded
          schema_version: 1.3.30
          revision: 10
          alternate_terms:
          - term: string
            description: string
          likelihood: High
          type: weakness
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          functional_areas:
          - Authentication
          source_uri: string
          modes_of_introduction:
          - phase: Architecture and Design
            note: string
          structure: Chain
          language: string
          id: string
          notes:
          - type: Applicable Platform
            note: string
          common_consequences:
          - scopes:
            - Access Control
            impacts:
            - Alter Execution Logic
            likelihood: High
            note: string
          tlp: green
          detection_methods:
          - method: Architecture or Design Review
            description: string
            effectiveness: High
            effectiveness_notes: string
          operating_systems:
          - prevalence: Often
            name: string
            version: string
            cpe_id: string
            class: Android
          affected_resources:
          - CPU
          languages:
          - prevalence: Often
            name: string
            class: Assembly
          timestamp: '2016-01-01T01:01:01.000Z'
          potential_mitigations:
          - description: string
            phases:
            - Architecture and Design
            strategy: Attack Surface Reduction
            effectiveness: Defense in Depth
            effectiveness_notes: string
          technologies:
          - prevalence: Often
            name: string
        source: string
        external_ids:
        - string
        feedback_refs:
        - string
        asset_properties:
        - properties:
          - name: string
            value: string
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          schema_version: 1.3.30
          revision: 10
          asset_ref: string
          type: asset-properties
          source: string
          external_ids:
          - string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
        short_description: string
        feedbacks:
        - feedback: -1
          schema_version: 1.3.30
          revision: 10
          type: feedback
          source: string
          external_ids:
          - string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          reason: string
          source_uri: string
          language: string
          id: string
          tlp: green
          entity_id: string
          timestamp: '2016-01-01T01:01:01.000Z'
        judgement_refs:
        - string
        title: string
        coa_refs:
        - string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        verdicts:
        - type: verdict
          disposition: 1
          observable:
            value: 1.2.3.4
            type: ip
          judgement_id: string
          disposition_name: Clean
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
        campaigns:
        - description: string
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          schema_version: 1.3.30
          revision: 10
          type: campaign
          campaign_type: string
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          activity:
          - date_time: '2016-01-01T01:01:01.000Z'
            description: string
          source_uri: string
          intended_effect:
          - Account Takeover
          status: Future
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
          confidence: High
          names:
          - string
        source_uri: string
        actors:
        - description: string
          motivation: Ego
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          identity:
            description: string
            related_identities:
            - identity: string
              confidence: High
              information_source: string
              relationship: string
          sophistication: Aspirant
          schema_version: 1.3.30
          revision: 10
          planning_and_operational_support: string
          type: actor
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          intended_effect: Account Takeover
          language: string
          id: string
          tlp: green
          aliases:
          - string
          timestamp: '2016-01-01T01:01:01.000Z'
          confidence: High
          actor_types:
          - Cyber Espionage Operations
        indicator_refs:
        - string
        actor_refs:
        - string
        language: string
        data_tables:
        - description: string
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          schema_version: 1.3.30
          revision: 10
          columns:
          - name: string
            type: integer
            description: string
            required: true
            short_description: string
          type: data-table
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          rows:
          - - anything
          source_uri: string
          language: string
          id: string
          tlp: green
          row_count: 10
          timestamp: '2016-01-01T01:01:01.000Z'
        id: string
        notes:
        - schema_version: 1.3.30
          revision: 10
          content: string
          note_class: keyword
          type: note
          source: string
          external_ids:
          - string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          author: string
          source_uri: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
          related_entities:
          - entity_type: string
            entity_id: string
        identity_assertions:
        - valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          identity:
            observables:
            - value: 1.2.3.4
              type: ip
          schema_version: 1.3.30
          revision: 10
          type: identity-assertion
          source: string
          external_ids:
          - string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
          assertions:
          - name: cisco:ctr:ad:host_domain_name
            value: string
        judgements:
        - valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          schema_version: 1.3.30
          revision: 10
          observable:
            value: 1.2.3.4
            type: ip
          reason_uri: string
          type: judgement
          source: string
          external_ids:
          - string
          disposition: 1
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          reason: string
          source_uri: string
          disposition_name: Clean
          priority: 10
          language: string
          id: string
          severity: Critical
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
          confidence: High
        malwares:
        - description: string
          labels:
          - adware
          abstraction_level: family
          schema_version: 1.3.30
          revision: 10
          type: malware
          x_mitre_aliases:
          - string
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tlp: green
          kill_chain_phases:
          - kill_chain_name: string
            phase_name: string
          timestamp: '2016-01-01T01:01:01.000Z'
        target_records:
        - description: string
          schema_version: 1.3.30
          revision: 10
          type: target-record
          source: string
          external_ids:
          - string
          targets:
          - type: endpoint
            observables:
            - value: 1.2.3.4
              type: ip
            observed_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            os: string
            internal: false
            sensor: string
            source_uri: string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
        asset_mappings:
        - asset_type: application
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          stability: Managed
          schema_version: 1.3.30
          revision: 10
          observable:
            value: 1.2.3.4
            type: ip
          asset_ref: string
          type: asset-mapping
          source: string
          external_ids:
          - string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
          specificity: Low
          confidence: High
        relationship_refs:
        - string
        tlp: green
        incidents:
        - description: string
          assignees:
          - string
          detection_sources:
          - string
          meta:
            keyword: string
          schema_version: 1.3.30
          revision: 10
          type: incident
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          incident_time:
            opened: '2016-01-01T01:01:01.000Z'
            discovered: '2016-01-01T01:01:01.000Z'
            reported: '2016-01-01T01:01:01.000Z'
            remediated: '2016-01-01T01:01:01.000Z'
            closed: '2016-01-01T01:01:01.000Z'
            rejected: '2016-01-01T01:01:01.000Z'
            contained: '2016-01-01T01:01:01.000Z'
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          discovery_method: Agent Disclosure
          source_uri: string
          intended_effect: Account Takeover
          categories:
          - Attrition
          status: Closed
          language: string
          detection_status: active
          id: string
          promotion_method: Automated
          severity: Critical
          tlp: green
          scores:
            asset: 10.0
          techniques:
          - string
          timestamp: '2016-01-01T01:01:01.000Z'
          confidence: High
          short_id: string
          tactics:
          - string
        identity_assertion_refs:
        - string
        sightings:
        - description: string
          schema_version: 1.3.30
          revision: 10
          relations:
          - origin: string
            origin_uri: string
            relation: Allocated
            relation_info:
              keyword: anything
            source:
              value: 1.2.3.4
              type: ip
            related:
              value: 1.2.3.4
              type: ip
          sensor_coordinates:
            type: endpoint
            observables:
            - value: 1.2.3.4
              type: ip
            os: string
          observables:
          - value: 1.2.3.4
            type: ip
          type: sighting
          source: string
          external_ids:
          - string
          targets:
          - type: endpoint
            observables:
            - value: 1.2.3.4
              type: ip
            observed_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            os: string
          short_description: string
          title: string
          resolution: detected
          internal: false
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          detection_interval:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          source_uri: string
          activity_interval:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          language: string
          id: string
          count: 10
          severity: Critical
          tlp: green
          modification_interval:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          context:
            http_events:
            - process_guid: 10
              traffic:
                destination_host_name: string
                protocol: 10
                source_ip: string
                destination_subnet: string
                destination_ip: string
                source_subnet: string
                destination_port: 10
                direction: incoming
                source_port: 10
              method: CONNECT
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              type: HTTPEvent
              host: string
              process_name: string
              process_id: 10
              process_username: string
              query: string
              encrypted: true
              url_port: 10
            process_create_events:
            - parent_process_name: string
              process_guid: 10
              parent_process_guid: 10
              process_disposition: string
              parent_process_size: 10
              process_size: 10
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              parent_process_disposition: string
              type: ProcessCreateEvent
              parent_process_username: string
              parent_process_id: 10
              parent_process_args: string
              process_name: string
              process_hash: string
              process_id: 10
              parent_process_hash: string
              process_username: string
              parent_creation_time: '2016-01-01T01:01:01.000Z'
              process_args: string
            registry_delete_events:
            - time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              process_id: 10
              process_name: string
              process_guid: 10
              process_username: string
              registry_key: string
              type: RegistryDeleteEvent
              registry_value: string
            file_modify_events:
            - file_name: string
              process_guid: 10
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              type: FileModifyEvent
              file_path: string
              process_name: string
              process_id: 10
              process_username: string
              failed: false
            registry_set_events:
            - process_guid: 10
              registry_data: string
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              type: RegistrySetEvent
              registry_data_length: 10
              registry_value: string
              registry_key: string
              process_name: string
              process_id: 10
              process_username: string
            file_create_events:
            - file_name: string
              process_guid: 10
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              type: FileCreateEvent
              file_path: string
              process_name: string
              process_id: 10
              process_username: string
              failed: false
            registry_create_events:
            - time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              process_id: 10
              process_name: string
              process_guid: 10
              process_username: string
              registry_key: string
              type: RegistryCreateEvent
            library_load_events:
            - time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              process_id: 10
              process_name: string
              process_guid: 10
              process_username: string
              type: LibraryLoadEvent
              dll_library_name: string
              dll_library_path: string
            file_move_events:
            - file_name: string
              process_guid: 10
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              type: FileMoveEvent
              old_name: string
              file_path: string
              process_name: string
              process_id: 10
              process_username: string
              new_name: string
            file_delete_events:
            - file_name: string
              process_guid: 10
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              type: FileDeleteEvent
              file_path: string
              process_name: string
              process_id: 10
              process_username: string
              failed: false
            netflow_events:
            - parent_process_name: string
              byte_count_in: 10
              process_guid: 10
              process_path: string
              traffic:
                destination_host_name: string
                protocol: 10
                source_ip: string
                destination_subnet: string
                destination_ip: string
                source_subnet: string
                destination_port: 10
                direction: incoming
                source_port: 10
              flow_time: '2016-01-01T01:01:01.000Z'
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              parent_process_account: string
              type: NetflowEvent
              process_account_type: string
              parent_process_path: string
              parent_process_id: 10
              parent_process_args: string
              process_name: string
              process_account: string
              parent_process_account_type: string
              process_hash: string
              process_id: 10
              parent_process_hash: string
              process_username: string
              byte_count_out: 10
              process_args: string
            registry_rename_events:
            - time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              process_id: 10
              process_name: string
              process_guid: 10
              process_username: string
              registry_key: string
              type: RegistryRenameEvent
              registry_old_key: string
          timestamp: '2016-01-01T01:01:01.000Z'
          confidence: High
          observed_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          sensor: endpoint
          data:
            columns:
            - name: string
              type: integer
              description: string
              required: true
              short_description: string
            rows:
            - - anything
            row_count: 10
        campaign_refs:
        - string
        vulnerability_refs:
        - string
        asset_properties_refs:
        - string
        relationships:
        - description: string
          schema_version: 1.3.30
          revision: 10
          target_ref: string
          type: relationship
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          source_ref: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
          relationship_type: attributed-to
        timestamp: '2016-01-01T01:01:01.000Z'
        verdict_refs:
        - string
        malware_refs:
        - string
        incident_refs:
        - string
        vulnerabilities:
        - description: string
          schema_version: 1.3.30
          revision: 10
          published_date: '2016-01-01T01:01:01.000Z'
          cve:
            cve_data_meta:
              id: string
              assigner: string
          configurations:
            CVE_data_version: string
            nodes:
            - operator: AND
              cpe_match:
              - vulnerable: true
                cpe23Uri: string
                versionStartIncluding: string
                versionEndIncluding: string
                versionStartExcluding: string
                versionEndExcluding: string
              children:
              - operator: AND
                cpe_match:
                - vulnerable: true
                  cpe23Uri: string
                  versionStartIncluding: string
                  versionEndIncluding: string
                  versionStartExcluding: string
                  versionEndExcluding: string
                negate: true
              negate: true
          type: vulnerability
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
          last_modified_date: '2016-01-01T01:01:01.000Z'
          impact:
            cvss_v2:
              integrity_impact: complete
              target_distribution: not_defined
              availability_requirement: not_defined
              exploitability: not_defined
              access_complexity: low
              temporal_vector_string: string
              exploitability_score: 10.0
              impact_score: 10.0
              user_interaction_required: true
              environmental_vector_string: string
              obtain_other_privilege: true
              availability_impact: complete
              access_vector: network
              base_severity: High
              confidentiality_impact: complete
              confidentiality_requirement: not_defined
              report_confidence: not_defined
              authentication: none
              base_score: 10.0
              obtain_user_privilege: true
              obtain_all_privilege: true
              collateral_damage_potential: not_defined
              remediation_level: not_defined
              vector_string: string
              integrity_requirement: not_defined
            cvss_v3:
              integrity_impact: high
              modified_user_interaction: none
              modified_scope: not_defined
              availability_requirement: high
              user_interaction: none
              modified_integrity_impact: not_defined
              privileges_required: high
              exploitability_score: 10.0
              impact_score: 10.0
              environmental_severity: critical
              modified_availability_impact: not_defined
              availability_impact: high
              scope: changed
              exploit_code_maturity: functional
              modified_attack_complexity: not_defined
              base_severity: critical
              confidentiality_impact: high
              temporal_severity: critical
              modified_confidentiality_impact: not_defined
              confidentiality_requirement: high
              report_confidence: confirmed
              temporal_score: 10.0
              modified_privileges_required: not_defined
              modified_attack_vector: not_defined
              base_score: 10.0
              environmental_score: 10.0
              remediation_level: high
              vector_string: string
              integrity_requirement: high
              attack_vector: adjacent_network
              attack_complexity: high
        coas:
        - description: string
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          stage: Containment
          schema_version: 1.3.30
          revision: 10
          efficacy: High
          type: coa
          related_COAs:
          - confidence: High
            source: string
            relationship: string
            COA_id: string
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          coa_type: Diplomatic Actions
          language: string
          id: string
          tlp: green
          objective:
          - string
          cost: High
          timestamp: '2016-01-01T01:01:01.000Z'
          open_c2_coa:
            type: structured_coa
            id: string
            action:
              type: alert
            target:
              type: acudid
              specifiers: string
            actuator:
              type: endpoint
              specifiers:
              - string
            modifiers:
              response: acknowledge
              method:
              - acl
              additional_properties:
                context: string
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              frequency: string
              duration: '2016-01-01T01:01:01.000Z'
              source: string
              search: cve
              option: string
              id: string
              location: internal
              delay: '2016-01-01T01:01:01.000Z'
              destination: copy-to
          structured_coa_type: openc2
          impact: string
      description: Describes a Bundle of any set of CTIM entities.
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        authorized_groups:
          type: array
          items:
            type: string
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        asset_mapping_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        note_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        data_table_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        attack_pattern_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        sighting_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        assets:
          example:
          - description: string
            asset_type: application
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            type: asset
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `Asset`s.
          type: array
          items:
            $ref: '#/components/schemas/Asset'
          uniqueItems: true
        weakness_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        tool_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        target_record_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        asset_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        tools:
          example:
          - description: string
            labels:
            - credential-exploitation
            schema_version: 1.3.30
            revision: 10
            type: tool
            x_mitre_aliases:
            - string
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tool_version: string
            tlp: green
            kill_chain_phases:
            - kill_chain_name: string
              phase_name: string
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `Tool`s.
          type: array
          items:
            $ref: '#/components/schemas/Tool'
          uniqueItems: true
        indicators:
          example:
          - description: string
            tags:
            - string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            producer: string
            schema_version: 1.3.30
            revision: 10
            type: indicator
            test_mechanisms:
            - string
            source: string
            external_ids:
            - string
            short_description: string
            composite_indicator_expression:
              operator: and
              indicator_ids:
              - string
            title: string
            likely_impact: string
            indicator_type:
            - Anonymization
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            severity: Critical
            tlp: green
            kill_chain_phases:
            - kill_chain_name: string
              phase_name: string
            negate: true
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            specification:
              type: Judgement
              judgements:
              - string
              required_judgements:
              - confidence: High
                source: string
                relationship: string
                judgement_id: string
          description: a list of `Indicator`s.
          type: array
          items:
            $ref: '#/components/schemas/Indicator'
          uniqueItems: true
        authorized_users:
          type: array
          items:
            type: string
        attack_patterns:
          example:
          - description: string
            abstraction_level: aggregate
            schema_version: 1.3.30
            revision: 10
            type: attack-pattern
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            x_mitre_platforms:
            - string
            language: string
            id: string
            tlp: green
            x_mitre_data_sources:
            - string
            kill_chain_phases:
            - kill_chain_name: string
              phase_name: string
            x_mitre_contributors:
            - string
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `AttackPattern`s.
          type: array
          items:
            $ref: '#/components/schemas/AttackPattern'
          uniqueItems: true
        type:
          example: bundle
          type: string
          enum:
          - bundle
        created:
          type: string
          format: date-time
        weaknesses:
          example:
          - description: string
            background_details: string
            paradigms:
            - prevalence: Often
              name: string
            abstraction_level: Base
            architectures:
            - prevalence: Often
              name: string
              class: Embedded
            schema_version: 1.3.30
            revision: 10
            alternate_terms:
            - term: string
              description: string
            likelihood: High
            type: weakness
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            functional_areas:
            - Authentication
            source_uri: string
            modes_of_introduction:
            - phase: Architecture and Design
              note: string
            structure: Chain
            language: string
            id: string
            notes:
            - type: Applicable Platform
              note: string
            common_consequences:
            - scopes:
              - Access Control
              impacts:
              - Alter Execution Logic
              likelihood: High
              note: string
            tlp: green
            detection_methods:
            - method: Architecture or Design Review
              description: string
              effectiveness: High
              effectiveness_notes: string
            operating_systems:
            - prevalence: Often
              name: string
              version: string
              cpe_id: string
              class: Android
            affected_resources:
            - CPU
            languages:
            - prevalence: Often
              name: string
              class: Assembly
            timestamp: '2016-01-01T01:01:01.000Z'
            potential_mitigations:
            - description: string
              phases:
              - Architecture and Design
              strategy: Attack Surface Reduction
              effectiveness: Defense in Depth
              effectiveness_notes: string
            technologies:
            - prevalence: Often
              name: string
          description: a list of `Weakness`s.
          type: array
          items:
            $ref: '#/components/schemas/Weakness'
          uniqueItems: true
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        feedback_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        modified:
          type: string
          format: date-time
        asset_properties:
          example:
          - properties:
            - name: string
              value: string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            asset_ref: string
            type: asset-properties
            source: string
            external_ids:
            - string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `AssetProperties`.
          type: array
          items:
            $ref: '#/components/schemas/AssetProperties'
          uniqueItems: true
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        feedbacks:
          example:
          - feedback: -1
            schema_version: 1.3.30
            revision: 10
            type: feedback
            source: string
            external_ids:
            - string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            reason: string
            source_uri: string
            language: string
            id: string
            tlp: green
            entity_id: string
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `Feedback`s.
          type: array
          items:
            $ref: '#/components/schemas/Feedback'
          uniqueItems: true
        judgement_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        coa_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        verdicts:
          example:
          - type: verdict
            disposition: 1
            observable:
              value: 1.2.3.4
              type: ip
            judgement_id: string
            disposition_name: Clean
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
          description: a list of `Verdict`s.
          type: array
          items:
            $ref: '#/components/schemas/Verdict'
          uniqueItems: true
        campaigns:
          example:
          - description: string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            type: campaign
            campaign_type: string
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            activity:
            - date_time: '2016-01-01T01:01:01.000Z'
              description: string
            source_uri: string
            intended_effect:
            - Account Takeover
            status: Future
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            names:
            - string
          description: a list of `Campaign`s.
          type: array
          items:
            $ref: '#/components/schemas/Campaign'
          uniqueItems: true
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        actors:
          example:
          - description: string
            motivation: Ego
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            identity:
              description: string
              related_identities:
              - identity: string
                confidence: High
                information_source: string
                relationship: string
            sophistication: Aspirant
            schema_version: 1.3.30
            revision: 10
            planning_and_operational_support: string
            type: actor
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            intended_effect: Account Takeover
            language: string
            id: string
            tlp: green
            aliases:
            - string
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            actor_types:
            - Cyber Espionage Operations
          description: a list of `Actor`s.
          type: array
          items:
            $ref: '#/components/schemas/Actor'
          uniqueItems: true
        indicator_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        actor_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        data_tables:
          example:
          - description: string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            columns:
            - name: string
              type: integer
              description: string
              required: true
              short_description: string
            type: data-table
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            rows:
            - - anything
            source_uri: string
            language: string
            id: string
            tlp: green
            row_count: 10
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `DataTable`s.
          type: array
          items:
            $ref: '#/components/schemas/DataTable'
          uniqueItems: true
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        notes:
          example:
          - schema_version: 1.3.30
            revision: 10
            content: string
            note_class: keyword
            type: note
            source: string
            external_ids:
            - string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            author: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            related_entities:
            - entity_type: string
              entity_id: string
          description: a list of `Note`s.
          type: array
          items:
            $ref: '#/components/schemas/Note'
          uniqueItems: true
        identity_assertions:
          example:
          - valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            identity:
              observables:
              - value: 1.2.3.4
                type: ip
            schema_version: 1.3.30
            revision: 10
            type: identity-assertion
            source: string
            external_ids:
            - string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            assertions:
            - name: cisco:ctr:ad:host_domain_name
              value: string
          description: a list of `IdentityAssertion`s.
          type: array
          items:
            $ref: '#/components/schemas/IdentityAssertion'
          uniqueItems: true
        judgements:
          example:
          - valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            observable:
              value: 1.2.3.4
              type: ip
            reason_uri: string
            type: judgement
            source: string
            external_ids:
            - string
            disposition: 1
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            reason: string
            source_uri: string
            disposition_name: Clean
            priority: 10
            language: string
            id: string
            severity: Critical
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
          description: a list of `Judgement`s.
          type: array
          items:
            $ref: '#/components/schemas/Judgement'
          uniqueItems: true
        malwares:
          example:
          - description: string
            labels:
            - adware
            abstraction_level: family
            schema_version: 1.3.30
            revision: 10
            type: malware
            x_mitre_aliases:
            - string
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            kill_chain_phases:
            - kill_chain_name: string
              phase_name: string
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `Malware`s.
          type: array
          items:
            $ref: '#/components/schemas/Malware'
          uniqueItems: true
        target_records:
          example:
          - description: string
            schema_version: 1.3.30
            revision: 10
            type: target-record
            source: string
            external_ids:
            - string
            targets:
            - type: endpoint
              observables:
              - value: 1.2.3.4
                type: ip
              observed_time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              os: string
              internal: false
              sensor: string
              source_uri: string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `TargetRecord`s.
          type: array
          items:
            $ref: '#/components/schemas/TargetRecord'
          uniqueItems: true
        asset_mappings:
          example:
          - asset_type: application
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            stability: Managed
            schema_version: 1.3.30
            revision: 10
            observable:
              value: 1.2.3.4
              type: ip
            asset_ref: string
            type: asset-mapping
            source: string
            external_ids:
            - string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            specificity: Low
            confidence: High
          description: a list of `AssetMapping`s.
          type: array
          items:
            $ref: '#/components/schemas/AssetMapping'
          uniqueItems: true
        relationship_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        incidents:
          example:
          - description: string
            assignees:
            - string
            detection_sources:
            - string
            meta:
              keyword: string
            schema_version: 1.3.30
            revision: 10
            type: incident
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            incident_time:
              opened: '2016-01-01T01:01:01.000Z'
              discovered: '2016-01-01T01:01:01.000Z'
              reported: '2016-01-01T01:01:01.000Z'
              remediated: '2016-01-01T01:01:01.000Z'
              closed: '2016-01-01T01:01:01.000Z'
              rejected: '2016-01-01T01:01:01.000Z'
              contained: '2016-01-01T01:01:01.000Z'
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            discovery_method: Agent Disclosure
            source_uri: string
            intended_effect: Account Takeover
            categories:
            - Attrition
            status: Closed
            language: string
            detection_status: active
            id: string
            promotion_method: Automated
            severity: Critical
            tlp: green
            scores:
              asset: 10.0
            techniques:
            - string
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            short_id: string
            tactics:
            - string
          description: a list of `Incident`s.
          type: array
          items:
            $ref: '#/components/schemas/Incident'
          uniqueItems: true
        client_id:
          type: string
        identity_assertion_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        sightings:
          example:
          - description: string
            schema_version: 1.3.30
            revision: 10
            relations:
            - origin: string
              origin_uri: string
              relation: Allocated
              relation_info:
                keyword: anything
              source:
                value: 1.2.3.4
                type: ip
              related:
                value: 1.2.3.4
                type: ip
            sensor_coordinates:
              type: endpoint
              observables:
              - value: 1.2.3.4
                type: ip
              os: string
            observables:
            - value: 1.2.3.4
              type: ip
            type: sighting
            source: string
            external_ids:
            - string
            targets:
            - type: endpoint
              observables:
              - value: 1.2.3.4
                type: ip
              observed_time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              os: string
            short_description: string
            title: string
            resolution: detected
            internal: false
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            detection_interval:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            source_uri: string
            activity_interval:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            language: string
            id: string
            count: 10
            severity: Critical
            tlp: green
            modification_interval:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            context:
              http_events:
              - process_guid: 10
                traffic:
                  destination_host_name: string
                  protocol: 10
                  source_ip: string
                  destination_subnet: string
                  destination_ip: string
                  source_subnet: string
                  destination_port: 10
                  direction: incoming
                  source_port: 10
                method: CONNECT
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: HTTPEvent
                host: string
                process_name: string
                process_id: 10
                process_username: string
                query: string
                encrypted: true
                url_port: 10
              process_create_events:
              - parent_process_name: string
                process_guid: 10
                parent_process_guid: 10
                process_disposition: string
                parent_process_size: 10
                process_size: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                parent_process_disposition: string
                type: ProcessCreateEvent
                parent_process_username: string
                parent_process_id: 10
                parent_process_args: string
                process_name: string
                process_hash: string
                process_id: 10
                parent_process_hash: string
                process_username: string
                parent_creation_time: '2016-01-01T01:01:01.000Z'
                process_args: string
              registry_delete_events:
              - time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                process_id: 10
                process_name: string
                process_guid: 10
                process_username: string
                registry_key: string
                type: RegistryDeleteEvent
                registry_value: string
              file_modify_events:
              - file_name: string
                process_guid: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: FileModifyEvent
                file_path: string
                process_name: string
                process_id: 10
                process_username: string
                failed: false
              registry_set_events:
              - process_guid: 10
                registry_data: string
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: RegistrySetEvent
                registry_data_length: 10
                registry_value: string
                registry_key: string
                process_name: string
                process_id: 10
                process_username: string
              file_create_events:
              - file_name: string
                process_guid: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: FileCreateEvent
                file_path: string
                process_name: string
                process_id: 10
                process_username: string
                failed: false
              registry_create_events:
              - time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                process_id: 10
                process_name: string
                process_guid: 10
                process_username: string
                registry_key: string
                type: RegistryCreateEvent
              library_load_events:
              - time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                process_id: 10
                process_name: string
                process_guid: 10
                process_username: string
                type: LibraryLoadEvent
                dll_library_name: string
                dll_library_path: string
              file_move_events:
              - file_name: string
                process_guid: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: FileMoveEvent
                old_name: string
                file_path: string
                process_name: string
                process_id: 10
                process_username: string
                new_name: string
              file_delete_events:
              - file_name: string
                process_guid: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: FileDeleteEvent
                file_path: string
                process_name: string
                process_id: 10
                process_username: string
                failed: false
              netflow_events:
              - parent_process_name: string
                byte_count_in: 10
                process_guid: 10
                process_path: string
                traffic:
                  destination_host_name: string
                  protocol: 10
                  source_ip: string
                  destination_subnet: string
                  destination_ip: string
                  source_subnet: string
                  destination_port: 10
                  direction: incoming
                  source_port: 10
                flow_time: '2016-01-01T01:01:01.000Z'
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                parent_process_account: string
                type: NetflowEvent
                process_account_type: string
                parent_process_path: string
                parent_process_id: 10
                parent_process_args: string
                process_name: string
                process_account: string
                parent_process_account_type: string
                process_hash: string
                process_id: 10
                parent_process_hash: string
                process_username: string
                byte_count_out: 10
                process_args: string
              registry_rename_events:
              - time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                process_id: 10
                process_name: string
                process_guid: 10
                process_username: string
                registry_key: string
                type: RegistryRenameEvent
                registry_old_key: string
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            observed_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            sensor: endpoint
            data:
              columns:
              - name: string
                type: integer
                description: string
                required: true
                short_description: string
              rows:
              - - anything
              row_count: 10
          description: a list of `Sighting`s.
          type: array
          items:
            $ref: '#/components/schemas/Sighting'
          uniqueItems: true
        campaign_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        vulnerability_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        groups:
          type: array
          items:
            type: string
        asset_properties_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        relationships:
          example:
          - description: string
            schema_version: 1.3.30
            revision: 10
            target_ref: string
            type: relationship
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            source_ref: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            relationship_type: attributed-to
          description: a list of `Relationship`s.
          type: array
          items:
            $ref: '#/components/schemas/Relationship'
          uniqueItems: true
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        verdict_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        malware_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        owner:
          type: string
        incident_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        vulnerabilities:
          example:
          - description: string
            schema_version: 1.3.30
            revision: 10
            published_date: '2016-01-01T01:01:01.000Z'
            cve:
              cve_data_meta:
                id: string
                assigner: string
            configurations:
              CVE_data_version: string
              nodes:
              - operator: AND
                cpe_match:
                - vulnerable: true
                  cpe23Uri: string
                  versionStartIncluding: string
                  versionEndIncluding: string
                  versionStartExcluding: string
                  versionEndExcluding: string
                children:
                - operator: AND
                  cpe_match:
                  - vulnerable: true
                    cpe23Uri: string
                    versionStartIncluding: string
                    versionEndIncluding: string
                    versionStartExcluding: string
                    versionEndExcluding: string
                  negate: true
                negate: true
            type: vulnerability
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            last_modified_date: '2016-01-01T01:01:01.000Z'
            impact:
              cvss_v2:
                integrity_impact: complete
                target_distribution: not_defined
                availability_requirement: not_defined
                exploitability: not_defined
                access_complexity: low
                temporal_vector_string: string
                exploitability_score: 10.0
                impact_score: 10.0
                user_interaction_required: true
                environmental_vector_string: string
                obtain_other_privilege: true
                availability_impact: complete
                access_vector: network
                base_severity: High
                confidentiality_impact: complete
                confidentiality_requirement: not_defined
                report_confidence: not_defined
                authentication: none
                base_score: 10.0
                obtain_user_privilege: true
                obtain_all_privilege: true
                collateral_damage_potential: not_defined
                remediation_level: not_defined
                vector_string: string
                integrity_requirement: not_defined
              cvss_v3:
                integrity_impact: high
                modified_user_interaction: none
                modified_scope: not_defined
                availability_requirement: high
                user_interaction: none
                modified_integrity_impact: not_defined
                privileges_required: high
                exploitability_score: 10.0
                impact_score: 10.0
                environmental_severity: critical
                modified_availability_impact: not_defined
                availability_impact: high
                scope: changed
                exploit_code_maturity: functional
                modified_attack_complexity: not_defined
                base_severity: critical
                confidentiality_impact: high
                temporal_severity: critical
                modified_confidentiality_impact: not_defined
                confidentiality_requirement: high
                report_confidence: confirmed
                temporal_score: 10.0
                modified_privileges_required: not_defined
                modified_attack_vector: not_defined
                base_score: 10.0
                environmental_score: 10.0
                remediation_level: high
                vector_string: string
                integrity_requirement: high
                attack_vector: adjacent_network
                attack_complexity: high
          description: a list of `Vulnerability`s.
          type: array
          items:
            $ref: '#/components/schemas/Vulnerability'
          uniqueItems: true
        coas:
          example:
          - description: string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            stage: Containment
            schema_version: 1.3.30
            revision: 10
            efficacy: High
            type: coa
            related_COAs:
            - confidence: High
              source: string
              relationship: string
              COA_id: string
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            coa_type: Diplomatic Actions
            language: string
            id: string
            tlp: green
            objective:
            - string
            cost: High
            timestamp: '2016-01-01T01:01:01.000Z'
            open_c2_coa:
              type: structured_coa
              id: string
              action:
                type: alert
              target:
                type: acudid
                specifiers: string
              actuator:
                type: endpoint
                specifiers:
                - string
              modifiers:
                response: acknowledge
                method:
                - acl
                additional_properties:
                  context: string
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                frequency: string
                duration: '2016-01-01T01:01:01.000Z'
                source: string
                search: cve
                option: string
                id: string
                location: internal
                delay: '2016-01-01T01:01:01.000Z'
                destination: copy-to
            structured_coa_type: openc2
            impact: string
          description: a list of `COA`s.
          type: array
          items:
            $ref: '#/components/schemas/COA'
          uniqueItems: true
      additionalProperties: false
    Activity:
      example:
        date_time: '2016-01-01T01:01:01.000Z'
        description: string
      description: Captures the specific activities or tactics associated with the entity. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc.
      type: object
      properties:
        date_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Specifies the date and time at which the activity occured.
          type: string
          format: date-time
        description:
          example: string
          description: A description of the activity.
          type: string
      additionalProperties: false
      required:
      - date_time
      - description
    HTTPType:
      example:
        process_guid: 10
        traffic:
          destination_host_name: string
          protocol: 10
          source_ip: string
          destination_subnet: string
          destination_ip: string
          source_subnet: string
          destination_port: 10
          direction: incoming
          source_port: 10
        method: CONNECT
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        type: HTTPEvent
        host: string
        process_name: string
        process_id: 10
        process_username: string
        query: string
        encrypted: true
        url_port: 10
      type: object
      properties:
        process_guid:
          example: 10
          type: integer
          format: int64
        traffic:
          $ref: '#/components/schemas/Traffic'
        method:
          example: CONNECT
          type: string
          enum:
          - OPTIONS
          - PATCH
          - TRACE
          - HEAD
          - POST
          - CONNECT
          - GET
          - PUT
        time:
          $ref: '#/components/schemas/ObservedTime'
        type:
          example: HTTPEvent
          type: string
          enum:
          - HTTPEvent
        host:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        query:
          example: string
          description: String with at most 5000 characters.
          type: string
        encrypted:
          example: true
          type: boolean
        url_port:
          example: 10
          type: integer
          format: int64
      additionalProperties: false
      required:
      - traffic
      - time
      - type
      - host
      - process_name
      - process_id
    Malware:
      example:
        description: string
        labels:
        - adware
        abstraction_level: family
        schema_version: 1.3.30
        revision: 10
        type: malware
        x_mitre_aliases:
        - string
        source: string
        external_ids:
        - string
        short_description: string
        title: string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        source_uri: string
        language: string
        id: string
        tlp: green
        kill_chain_phases:
        - kill_chain_name: string
          phase_name: string
        timestamp: '2016-01-01T01:01:01.000Z'
      description: Malware is a type of TTP that is also known as malicious code and malicious software, and refers to a program that is inserted into a system, usually covertly, with the intent of compromising the confidentiality, integrity, or availability of the victim's data, applications, or operating system (OS) or of otherwise annoying or disrupting the victim. Malware such as viruses and worms are usually designed to perform these nefarious functions in such a way that users are unaware of them, at least initially.
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        labels:
          example:
          - adware
          description: The type of malware being described.
          type: array
          items:
            type: string
        abstraction_level:
          example: family
          description: Malware abstraction level.
          type: string
          enum:
          - family
          - version
          - variant
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        type:
          example: malware
          type: string
          enum:
          - malware
        x_mitre_aliases:
          example:
          - string
          description: ATT&CK Software.aliases.
          type: array
          items:
            type: string
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        kill_chain_phases:
          example:
          - kill_chain_name: string
            phase_name: string
          description: The list of Kill Chain Phases for which this Malware can be used.
          type: array
          items:
            $ref: '#/components/schemas/KillChainPhase'
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
      additionalProperties: false
    RegistrySetType:
      example:
        process_guid: 10
        registry_data: string
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        type: RegistrySetEvent
        registry_data_length: 10
        registry_value: string
        registry_key: string
        process_name: string
        process_id: 10
        process_username: string
      type: object
      properties:
        process_guid:
          example: 10
          type: integer
          format: int64
        registry_data:
          example: string
          description: String with at most 5000 characters.
          type: string
        time:
          $ref: '#/components/schemas/ObservedTime'
        type:
          example: RegistrySetEvent
          type: string
          enum:
          - RegistrySetEvent
        registry_data_length:
          example: 10
          type: integer
          format: int64
        registry_value:
          example: string
          description: String with at most 2048 characters.
          type: string
        registry_key:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
      additionalProperties: false
      required:
      - time
      - type
      - registry_value
      - registry_key
      - process_name
      - process_id
    VulnerabilityImpact:
      example:
        cvss_v2:
          integrity_impact: complete
          target_distribution: not_defined
          availability_requirement: not_defined
          exploitability: not_defined
          access_complexity: low
          temporal_vector_string: string
          exploitability_score: 10.0
          impact_score: 10.0
          user_interaction_required: true
          environmental_vector_string: string
          obtain_other_privilege: true
          availability_impact: complete
          access_vector: network
          base_severity: High
          confidentiality_impact: complete
          confidentiality_requirement: not_defined
          report_confidence: not_defined
          authentication: none
          base_score: 10.0
          obtain_user_privilege: true
          obtain_all_privilege: true
          collateral_damage_potential: not_defined
          remediation_level: not_defined
          vector_string: string
          integrity_requirement: not_defined
        cvss_v3:
          integrity_impact: high
          modified_user_interaction: none
          modified_scope: not_defined
          availability_requirement: high
          user_interaction: none
          modified_integrity_impact: not_defined
          privileges_required: high
          exploitability_score: 10.0
          impact_score: 10.0
          environmental_severity: critical
          modified_availability_impact: not_defined
          availability_impact: high
          scope: changed
          exploit_code_maturity: functional
          modified_attack_complexity: not_defined
          base_severity: critical
          confidentiality_impact: high
          temporal_severity: critical
          modified_confidentiality_impact: not_defined
          confidentiality_requirement: high
          report_confidence: confirmed
          temporal_score: 10.0
          modified_privileges_required: not_defined
          modified_attack_vector: not_defined
          base_score: 10.0
          environmental_score: 10.0
          remediation_level: high
          vector_string: string
          integrity_requirement: high
          attack_vector: adjacent_network
          attack_complexity: high
      description: "Describes the potential impact of a vulnerability that is being tracked in the system. Provides information on the extent of damage that a vulnerability can cause and how serious the consequences could be if it is exploited. \n\nMay contain granular information about the vulnerability severity using the CVSS system, versions 2 and 3.\n\nCVSSv2 and CVSSv3 have different methods of calculating base scores, but both are designed to provide an indication of the level of risk that a vulnerability poses. The base score ranges from 0 to 10, with 10 being the most severe. Additionally, both CVSSv2 and CVSSv3 define severity levels, such as low, medium, high, and critical, based on the base score."
      type: object
      properties:
        cvss_v2:
          $ref: '#/components/schemas/CVSSv2'
        cvss_v3:
          $ref: '#/components/schemas/CVSSv3'
      additionalProperties: false
    SensorCoordinates:
      example:
        type: endpoint
        observables:
        - value: 1.2.3.4
          type: ip
        os: string
      description: Describes the device that made the sighting (sensor) and contains identifying observables for the sensor.
      type: object
      properties:
        type:
          example: endpoint
          description: The sensor/actuator name that best fits a device.
          type: string
        observables:
          example:
          - value: 1.2.3.4
            type: ip
          type: array
          items:
            $ref: '#/components/schemas/Observable'
        os:
          example: string
          type: string
      additionalProperties: false
      required:
      - type
      - observables
    ActuatorType:
      example:
        type: endpoint
        specifiers:
        - string
      type: object
      properties:
        type:
          example: endpoint
          type: string
          enum:
          - endpoint.sensor
          - process.network-scanner
          - network.switch
          - network.security_manager
          - process.vulnerability-scanner
          - network.hub
          - network.ids
          - network.firewall
          - process
          - network.sense_making
          - process.sandbox
          - network.modem
          - process.email-service
          - process.dns-server
          - network.vpn
          - process.connection-scanner
          - network.nic
          - endpoint.printer
          - network.gateway
          - process.reputation-service
          - process.remediation-service
          - network
          - process.virtualization-service
          - network.ips
          - endpoint.smart-meter
          - endpoint.digital-telephone-handset
          - endpoint.workstation
          - endpoint.server
          - network.wap
          - endpoint.laptop
          - process.aaa-server
          - process.directory-service
          - endpoint.pos-terminal
          - network.bridge
          - other
          - process.file-scanner
          - network.proxy
          - endpoint
          - process.location-service
          - network.sensor
          - endpoint.smart-phone
          - network.hips
          - process.anti-virus-scanner
          - endpoint.tablet
          - network.guard
          - network.router
        specifiers:
          example:
          - string
          description: List of additional properties describing the actuator.
          type: array
          items:
            type: string
      additionalProperties: false
      required:
      - type
    AssetProperty:
      example:
        name: string
        value: string
      type: object
      properties:
        name:
          example: string
          description: The properties are an open vocabulary.
          type: string
        value:
          example: string
          type: string
      additionalProperties: false
      required:
      - name
      - value
    IdentityAssertion:
      example:
        valid_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        identity:
          observables:
          - value: 1.2.3.4
            type: ip
        schema_version: 1.3.30
        revision: 10
        type: identity-assertion
        source: string
        external_ids:
        - string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        source_uri: string
        language: string
        id: string
        tlp: green
        timestamp: '2016-01-01T01:01:01.000Z'
        assertions:
        - name: cisco:ctr:ad:host_domain_name
          value: string
      description: "Context attributes about the target or any of its observables. \n   Providers could provide different types of assertions regarding a target depending on their own capabilities."
      type: object
      properties:
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        identity:
          $ref: '#/components/schemas/IdentityCoordinates'
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        type:
          example: identity-assertion
          type: string
          enum:
          - identity-assertion
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        assertions:
          example:
          - name: cisco:ctr:ad:host_domain_name
            value: string
          description: Any known context about the identity attributes.
          type: array
          items:
            $ref: '#/components/schemas/Assertion'
      additionalProperties: false
    OpenC2COA:
      example:
        type: structured_coa
        id: string
        action:
          type: alert
        target:
          type: acudid
          specifiers: string
        actuator:
          type: endpoint
          specifiers:
          - string
        modifiers:
          response: acknowledge
          method:
          - acl
          additional_properties:
            context: string
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          frequency: string
          duration: '2016-01-01T01:01:01.000Z'
          source: string
          search: cve
          option: string
          id: string
          location: internal
          delay: '2016-01-01T01:01:01.000Z'
          destination: copy-to
      type: object
      properties:
        type:
          example: structured_coa
          type: string
          enum:
          - structured_coa
        id:
          example: string
          description: String with at most 1024 characters.
          type: string
        action:
          $ref: '#/components/schemas/ActionType'
        target:
          $ref: '#/components/schemas/TargetType'
        actuator:
          $ref: '#/components/schemas/ActuatorType'
        modifiers:
          $ref: '#/components/schemas/ModifierType'
      additionalProperties: false
      required:
      - type
      - action
    CasebookBundleUpdate:
      description: A casebook Bundle operation
      type: object
      properties:
        operation:
          type: string
          enum:
          - remove
          - replace
          - add
        bundle:
          $ref: '#/components/schemas/CasebookBundleUpdateBundle'
      additionalProperties: false
      required:
      - operation
      - bundle
    IdentitySpecification:
      example:
        type: endpoint
        observables:
        - value: 1.2.3.4
          type: ip
        observed_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        os: string
      description: Describes the target of the sighting and contains identifying observables for the target.
      type: object
      properties:
        type:
          example: endpoint
          description: The sensor/actuator name that best fits a device.
          type: string
        observables:
          example:
          - value: 1.2.3.4
            type: ip
          type: array
          items:
            $ref: '#/components/schemas/Observable'
        observed_time:
          $ref: '#/components/schemas/ObservedTime'
        os:
          example: string
          type: string
      additionalProperties: false
      required:
      - type
      - observables
      - observed_time
    MetricResultData:
      type: object
      additionalProperties: {}
    KillChainPhase:
      example:
        kill_chain_name: string
        phase_name: string
      description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
      type: object
      properties:
        kill_chain_name:
          example: string
          description: The name of the kill chain.
          type: string
        phase_name:
          example: string
          description: The name of the phase in the kill chain.
          type: string
      additionalProperties: false
      required:
      - kill_chain_name
      - phase_name
    Paradigm:
      example:
        prevalence: Often
        name: string
      type: object
      properties:
        prevalence:
          example: Often
          description: Defines the different regularities that guide the applicability of platforms.
          type: string
          enum:
          - Undetermined
          - Sometimes
          - Often
          - Rarely
        name:
          example: string
          description: Paradigm name (Client Server, Mainframe)
          type: string
      additionalProperties: false
    MetricResult:
      type: object
      properties:
        data:
          $ref: '#/components/schemas/MetricResultData'
        type:
          type: string
          enum:
          - histogram
          - topn
          - avg
          - cardinality
        filters:
          $ref: '#/components/schemas/MetricResultFilters'
      additionalProperties: false
      required:
      - data
      - type
      - filters
    DetectionMethod:
      example:
        method: Architecture or Design Review
        description: string
        effectiveness: High
        effectiveness_notes: string
      type: object
      properties:
        method:
          example: Architecture or Design Review
          description: Identifies the particular detection method being described.
          type: string
        description:
          example: string
          description: Provides some context of how this method can be applied to a specific weakness.
          type: string
        effectiveness:
          example: High
          description: How effective the detection method may be in detecting the associated weakness.
          type: string
        effectiveness_notes:
          example: string
          description: Provides additional discussion of the strengths and shortcomings of this detection method.
          type: string
      additionalProperties: false
    FileDeleteType:
      example:
        file_name: string
        process_guid: 10
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        type: FileDeleteEvent
        file_path: string
        process_name: string
        process_id: 10
        process_username: string
        failed: false
      type: object
      properties:
        file_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        time:
          $ref: '#/components/schemas/ObservedTime'
        type:
          example: FileDeleteEvent
          type: string
          enum:
          - FileDeleteEvent
        file_path:
          example: string
          description: String with at most 2048 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        failed:
          example: false
          type: boolean
      additionalProperties: false
      required:
      - file_name
      - time
      - type
      - file_path
      - process_name
      - process_id
    RegistryCreateType:
      example:
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        process_id: 10
        process_name: string
        process_guid: 10
        process_username: string
        registry_key: string
        type: RegistryCreateEvent
      type: object
      properties:
        time:
          $ref: '#/components/schemas/ObservedTime'
        process_id:
          example: 10
          type: integer
          format: int64
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        registry_key:
          example: string
          description: String with at most 1024 characters.
          type: string
        type:
          example: RegistryCreateEvent
          type: string
          enum:
          - RegistryCreateEvent
      additionalProperties: false
      required:
      - time
      - process_id
      - process_name
      - registry_key
      - type
    DataTable:
      example:
        description: string
        valid_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        schema_version: 1.3.30
        revision: 10
        columns:
        - name: string
          type: integer
          description: string
          required: true
          short_description: string
        type: data-table
        source: string
        external_ids:
        - string
        short_description: string
        title: string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        rows:
        - - anything
        source_uri: string
        language: string
        id: string
        tlp: green
        row_count: 10
        timestamp: '2016-01-01T01:01:01.000Z'
      description: "A generic table of data, consisting of types and documented\n  columns, and 1 or more rows of data."
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        columns:
          example:
          - name: string
            type: integer
            description: string
            required: true
            short_description: string
          description: An ordered list of column definitions.
          type: array
          items:
            $ref: '#/components/schemas/ColumnDefinition'
        type:
          example: data-table
          type: string
          enum:
          - data-table
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        rows:
          example:
          - - anything
          description: An ordered list of rows
          type: array
          items:
            type: array
            items: {}
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        row_count:
          example: 10
          description: The number of rows in the data table.
          type: integer
          format: int64
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
      additionalProperties: false
    Indicator:
      example:
        description: string
        tags:
        - string
        valid_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        producer: string
        schema_version: 1.3.30
        revision: 10
        type: indicator
        test_mechanisms:
        - string
        source: string
        external_ids:
        - string
        short_description: string
        composite_indicator_expression:
          operator: and
          indicator_ids:
          - string
        title: string
        likely_impact: string
        indicator_type:
        - Anonymization
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        source_uri: string
        language: string
        id: string
        severity: Critical
        tlp: green
        kill_chain_phases:
        - kill_chain_name: string
          phase_name: string
        negate: true
        timestamp: '2016-01-01T01:01:01.000Z'
        confidence: High
        specification: anything
      description: 'An indicator is a test, or a collection of judgements that define

        criteria for identifying the activity, or presence of malware, or

        other unwanted software.


        We follow the

        [STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/)

        closely, with the exception of not including observables within the

        indicator, and preferring a _specification_ object encoded in JSON as

        opposed to an opaque _implementation_ block.


        Additional, you will want to either define judgements against

        Observables that are linked to this indicator, with the ID in the

        _indicators_ field of those Judgements, or you can provide a

        _specification_ value.'
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        tags:
          example:
          - string
          description: Descriptors for this indicator.
          type: array
          items:
            type: string
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        producer:
          example: string
          description: String with at most 1024 characters.
          type: string
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        type:
          example: indicator
          description: The fixed value indicator
          type: string
          enum:
          - indicator
        test_mechanisms:
          example:
          - string
          description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator.
          type: array
          items:
            type: string
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        composite_indicator_expression:
          $ref: '#/components/schemas/CompositeIndicatorExpression'
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        likely_impact:
          example: string
          description: Likely potential impact within the relevant context if this Indicator were to occur.
          type: string
        indicator_type:
          example:
          - Anonymization
          description: Specifies the type or types for this Indicator.
          type: array
          items:
            type: string
            enum:
            - File Hash Watchlist
            - Private Threat Feed
            - IMEI Watchlist
            - Malicious E-mail
            - Exfiltration
            - C2
            - URL Watchlist
            - IMSI Watchlist
            - Malware Artifacts
            - Domain Watchlist
            - Anonymization
            - Host Characteristics
            - IP Watchlist
            - Compromised PKI Certificate
            - Login Name
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        severity:
          example: Critical
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Critical
          - Low
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        kill_chain_phases:
          example:
          - kill_chain_name: string
            phase_name: string
          description: Relevant kill chain phases indicated by this Indicator.
          type: array
          items:
            $ref: '#/components/schemas/KillChainPhase'
        negate:
          example: true
          description: Specifies the absence of the pattern.
          type: boolean
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        confidence:
          example: High
          description: level of confidence held in the accuracy of this Indicator.
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        specification:
          example: anything
          description: Simplified conditional branch
      additionalProperties: false
    COA:
      example:
        description: string
        valid_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        stage: Containment
        schema_version: 1.3.30
        revision: 10
        efficacy: High
        type: coa
        related_COAs:
        - confidence: High
          source: string
          relationship: string
          COA_id: string
        source: string
        external_ids:
        - string
        short_description: string
        title: string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        source_uri: string
        coa_type: Diplomatic Actions
        language: string
        id: string
        tlp: green
        objective:
        - string
        cost: High
        timestamp: '2016-01-01T01:01:01.000Z'
        open_c2_coa:
          type: structured_coa
          id: string
          action:
            type: alert
          target:
            type: acudid
            specifiers: string
          actuator:
            type: endpoint
            specifiers:
            - string
          modifiers:
            response: acknowledge
            method:
            - acl
            additional_properties:
              context: string
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            frequency: string
            duration: '2016-01-01T01:01:01.000Z'
            source: string
            search: cve
            option: string
            id: string
            location: internal
            delay: '2016-01-01T01:01:01.000Z'
            destination: copy-to
        structured_coa_type: openc2
        impact: string
      description: Course of Action. A corrective or preventative action to be taken in response to a threat.
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        stage:
          example: Containment
          description: Specifies what stage in the cyber threat management lifecycle this Course Of Action is relevant to.
          type: string
          enum:
          - Identification
          - Lessons Learned
          - Remedy
          - Preparation
          - Containment
          - Response
          - Eradication
          - Recovery
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        efficacy:
          example: High
          description: Effectiveness of this course of action in achieving its targeted objective.
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        type:
          example: coa
          type: string
          enum:
          - coa
        related_COAs:
          example:
          - confidence: High
            source: string
            relationship: string
            COA_id: string
          description: Identifies or characterizes relationships to one or more related courses of action.
          type: array
          items:
            $ref: '#/components/schemas/RelatedCOA'
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        coa_type:
          example: Diplomatic Actions
          description: The type of this COA
          type: string
          enum:
          - Diplomatic Actions
          - Physical Access Restrictions
          - Policy Actions
          - Internal Blocking
          - Playbook
          - Redirection
          - Phase
          - Eradication
          - Public Disclosure
          - Monitoring
          - Patching
          - Logical Access Restrictions
          - Redirection (Honey Pot)
          - Rebuilding
          - Perimeter Blocking
          - Hardening
          - Other
          - Training
          - Task
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        objective:
          example:
          - string
          description: Characterizes the objective to provide guidance on how to mitigate a security incident that has been identified.
          type: array
          items:
            type: string
        cost:
          example: High
          description: Characterizes the estimated cost for applying this course of action.
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        open_c2_coa:
          $ref: '#/components/schemas/OpenC2COA'
        structured_coa_type:
          example: openc2
          type: string
          enum:
          - openc2
        impact:
          example: string
          description: Characterizes the estimated impact of applying this course of action.
          type: string
      additionalProperties: false
    Casebook:
      example:
        description: string
        schema_version: 1.3.30
        revision: 10
        texts:
        - type: string
          text: string
        bundle:
          description: string
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          asset_mapping_refs:
          - string
          note_refs:
          - string
          data_table_refs:
          - string
          attack_pattern_refs:
          - string
          sighting_refs:
          - string
          schema_version: 1.3.30
          revision: 10
          assets:
          - description: string
            asset_type: application
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            type: asset
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
          weakness_refs:
          - string
          tool_refs:
          - string
          target_record_refs:
          - string
          asset_refs:
          - string
          tools:
          - description: string
            labels:
            - credential-exploitation
            schema_version: 1.3.30
            revision: 10
            type: tool
            x_mitre_aliases:
            - string
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tool_version: string
            tlp: green
            kill_chain_phases:
            - kill_chain_name: string
              phase_name: string
            timestamp: '2016-01-01T01:01:01.000Z'
          indicators:
          - description: string
            tags:
            - string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            producer: string
            schema_version: 1.3.30
            revision: 10
            type: indicator
            test_mechanisms:
            - string
            source: string
            external_ids:
            - string
            short_description: string
            composite_indicator_expression:
              operator: and
              indicator_ids:
              - string
            title: string
            likely_impact: string
            indicator_type:
            - Anonymization
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            severity: Critical
            tlp: green
            kill_chain_phases:
            - kill_chain_name: string
              phase_name: string
            negate: true
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            specification: anything
          attack_patterns:
          - description: string
            abstraction_level: aggregate
            schema_version: 1.3.30
            revision: 10
            type: attack-pattern
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            x_mitre_platforms:
            - string
            language: string
            id: string
            tlp: green
            x_mitre_data_sources:
            - string
            kill_chain_phases:
            - kill_chain_name: string
              phase_name: string
            x_mitre_contributors:
            - string
            timestamp: '2016-01-01T01:01:01.000Z'
          type: bundle
          weaknesses:
          - description: string
            background_details: string
            paradigms:
            - prevalence: Often
              name: string
            abstraction_level: Base
            architectures:
            - prevalence: Often
              name: string
              class: Embedded
            schema_version: 1.3.30
            revision: 10
            alternate_terms:
            - term: string
              description: string
            likelihood: High
            type: weakness
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            functional_areas:
            - Authentication
            source_uri: string
            modes_of_introduction:
            - phase: Architecture and Design
              note: string
            structure: Chain
            language: string
            id: string
            notes:
            - type: Applicable Platform
              note: string
            common_consequences:
            - scopes:
              - Access Control
              impacts:
              - Alter Execution Logic
              likelihood: High
              note: string
            tlp: green
            detection_methods:
            - method: Architecture or Design Review
              description: string
              effectiveness: High
              effectiveness_notes: string
            operating_systems:
            - prevalence: Often
              name: string
              version: string
              cpe_id: string
              class: Android
            affected_resources:
            - CPU
            languages:
            - prevalence: Often
              name: string
              class: Assembly
            timestamp: '2016-01-01T01:01:01.000Z'
            potential_mitigations:
            - description: string
              phases:
              - Architecture and Design
              strategy: Attack Surface Reduction
              effectiveness: Defense in Depth
              effectiveness_notes: string
            technologies:
            - prevalence: Often
              name: string
          source: string
          external_ids:
          - string
          feedback_refs:
          - string
          asset_properties:
          - properties:
            - name: string
              value: string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            asset_ref: string
            type: asset-properties
            source: string
            external_ids:
            - string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
          short_description: string
          feedbacks:
          - feedback: -1
            schema_version: 1.3.30
            revision: 10
            type: feedback
            source: string
            external_ids:
            - string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            reason: string
            source_uri: string
            language: string
            id: string
            tlp: green
            entity_id: string
            timestamp: '2016-01-01T01:01:01.000Z'
          judgement_refs:
          - string
          title: string
          coa_refs:
          - string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          verdicts:
          - type: verdict
            disposition: 1
            observable:
              value: 1.2.3.4
              type: ip
            judgement_id: string
            disposition_name: Clean
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
          campaigns:
          - description: string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            type: campaign
            campaign_type: string
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            activity:
            - date_time: '2016-01-01T01:01:01.000Z'
              description: string
            source_uri: string
            intended_effect:
            - Account Takeover
            status: Future
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            names:
            - string
          source_uri: string
          actors:
          - description: string
            motivation: Ego
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            identity:
              description: string
              related_identities:
              - identity: string
                confidence: High
                information_source: string
                relationship: string
            sophistication: Aspirant
            schema_version: 1.3.30
            revision: 10
            planning_and_operational_support: string
            type: actor
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            intended_effect: Account Takeover
            language: string
            id: string
            tlp: green
            aliases:
            - string
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            actor_types:
            - Cyber Espionage Operations
          indicator_refs:
          - string
          actor_refs:
          - string
          language: string
          data_tables:
          - description: string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            columns:
            - name: string
              type: integer
              description: string
              required: true
              short_description: string
            type: data-table
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            rows:
            - - anything
            source_uri: string
            language: string
            id: string
            tlp: green
            row_count: 10
            timestamp: '2016-01-01T01:01:01.000Z'
          id: string
          notes:
          - schema_version: 1.3.30
            revision: 10
            content: string
            note_class: keyword
            type: note
            source: string
            external_ids:
            - string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            author: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            related_entities:
            - entity_type: string
              entity_id: string
          identity_assertions:
          - valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            identity:
              observables:
              - value: 1.2.3.4
                type: ip
            schema_version: 1.3.30
            revision: 10
            type: identity-assertion
            source: string
            external_ids:
            - string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            assertions:
            - name: cisco:ctr:ad:host_domain_name
              value: string
          judgements:
          - valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            observable:
              value: 1.2.3.4
              type: ip
            reason_uri: string
            type: judgement
            source: string
            external_ids:
            - string
            disposition: 1
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            reason: string
            source_uri: string
            disposition_name: Clean
            priority: 10
            language: string
            id: string
            severity: Critical
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
          malwares:
          - description: string
            labels:
            - adware
            abstraction_level: family
            schema_version: 1.3.30
            revision: 10
            type: malware
            x_mitre_aliases:
            - string
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            kill_chain_phases:
            - kill_chain_name: string
              phase_name: string
            timestamp: '2016-01-01T01:01:01.000Z'
          target_records:
          - description: string
            schema_version: 1.3.30
            revision: 10
            type: target-record
            source: string
            external_ids:
            - string
            targets:
            - type: endpoint
              observables:
              - value: 1.2.3.4
                type: ip
              observed_time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              os: string
              internal: false
              sensor: string
              source_uri: string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
          asset_mappings:
          - asset_type: application
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            stability: Managed
            schema_version: 1.3.30
            revision: 10
            observable:
              value: 1.2.3.4
              type: ip
            asset_ref: string
            type: asset-mapping
            source: string
            external_ids:
            - string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            specificity: Low
            confidence: High
          relationship_refs:
          - string
          tlp: green
          incidents:
          - description: string
            assignees:
            - string
            detection_sources:
            - string
            meta:
              keyword: anything
            schema_version: 1.3.30
            revision: 10
            type: incident
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            incident_time:
              opened: '2016-01-01T01:01:01.000Z'
              discovered: '2016-01-01T01:01:01.000Z'
              reported: '2016-01-01T01:01:01.000Z'
              remediated: '2016-01-01T01:01:01.000Z'
              closed: '2016-01-01T01:01:01.000Z'
              rejected: '2016-01-01T01:01:01.000Z'
              contained: '2016-01-01T01:01:01.000Z'
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            discovery_method: Agent Disclosure
            source_uri: string
            intended_effect: Account Takeover
            categories:
            - Attrition
            status: Closed
            language: string
            detection_status: active
            id: string
            promotion_method: Automated
            severity: Critical
            tlp: green
            scores:
              asset: 10.0
            techniques:
            - string
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            short_id: string
            tactics:
            - string
          identity_assertion_refs:
          - string
          sightings:
          - description: string
            schema_version: 1.3.30
            revision: 10
            relations:
            - origin: string
              origin_uri: string
              relation: Allocated
              relation_info:
                keyword: anything
              source:
                value: 1.2.3.4
                type: ip
              related:
                value: 1.2.3.4
                type: ip
            sensor_coordinates:
              type: endpoint
              observables:
              - value: 1.2.3.4
                type: ip
              os: string
            observables:
            - value: 1.2.3.4
              type: ip
            type: sighting
            source: string
            external_ids:
            - string
            targets:
            - type: endpoint
              observables:
              - value: 1.2.3.4
                type: ip
              observed_time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              os: string
            short_description: string
            title: string
            resolution: detected
            internal: false
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            detection_interval:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            source_uri: string
            activity_interval:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            language: string
            id: string
            count: 10
            severity: Critical
            tlp: green
            modification_interval:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            context:
              http_events:
              - process_guid: 10
                traffic:
                  destination_host_name: string
                  protocol: 10
                  source_ip: string
                  destination_subnet: string
                  destination_ip: string
                  source_subnet: string
                  destination_port: 10
                  direction: incoming
                  source_port: 10
                method: CONNECT
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: HTTPEvent
                host: string
                process_name: string
                process_id: 10
                process_username: string
                query: string
                encrypted: true
                url_port: 10
              process_create_events:
              - parent_process_name: string
                process_guid: 10
                parent_process_guid: 10
                process_disposition: string
                parent_process_size: 10
                process_size: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                parent_process_disposition: string
                type: ProcessCreateEvent
                parent_process_username: string
                parent_process_id: 10
                parent_process_args: string
                process_name: string
                process_hash: string
                process_id: 10
                parent_process_hash: string
                process_username: string
                parent_creation_time: '2016-01-01T01:01:01.000Z'
                process_args: string
              registry_delete_events:
              - time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                process_id: 10
                process_name: string
                process_guid: 10
                process_username: string
                registry_key: string
                type: RegistryDeleteEvent
                registry_value: string
              file_modify_events:
              - file_name: string
                process_guid: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: FileModifyEvent
                file_path: string
                process_name: string
                process_id: 10
                process_username: string
                failed: false
              registry_set_events:
              - process_guid: 10
                registry_data: string
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: RegistrySetEvent
                registry_data_length: 10
                registry_value: string
                registry_key: string
                process_name: string
                process_id: 10
                process_username: string
              file_create_events:
              - file_name: string
                process_guid: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: FileCreateEvent
                file_path: string
                process_name: string
                process_id: 10
                process_username: string
                failed: false
              registry_create_events:
              - time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                process_id: 10
                process_name: string
                process_guid: 10
                process_username: string
                registry_key: string
                type: RegistryCreateEvent
              library_load_events:
              - time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                process_id: 10
                process_name: string
                process_guid: 10
                process_username: string
                type: LibraryLoadEvent
                dll_library_name: string
                dll_library_path: string
              file_move_events:
              - file_name: string
                process_guid: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: FileMoveEvent
                old_name: string
                file_path: string
                process_name: string
                process_id: 10
                process_username: string
                new_name: string
              file_delete_events:
              - file_name: string
                process_guid: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: FileDeleteEvent
                file_path: string
                process_name: string
                process_id: 10
                process_username: string
                failed: false
              netflow_events:
              - parent_process_name: string
                byte_count_in: 10
                process_guid: 10
                process_path: string
                traffic:
                  destination_host_name: string
                  protocol: 10
                  source_ip: string
                  destination_subnet: string
                  destination_ip: string
                  source_subnet: string
                  destination_port: 10
                  direction: incoming
                  source_port: 10
                flow_time: '2016-01-01T01:01:01.000Z'
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                parent_process_account: string
                type: NetflowEvent
                process_account_type: string
                parent_process_path: string
                parent_process_id: 10
                parent_process_args: string
                process_name: string
                process_account: string
                parent_process_account_type: string
                process_hash: string
                process_id: 10
                parent_process_hash: string
                process_username: string
                byte_count_out: 10
                process_args: string
              registry_rename_events:
              - time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                process_id: 10
                process_name: string
                process_guid: 10
                process_username: string
                registry_key: string
                type: RegistryRenameEvent
                registry_old_key: string
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            observed_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            sensor: endpoint
            data:
              columns:
              - name: string
                type: integer
                description: string
                required: true
                short_description: string
              rows:
              - - anything
              row_count: 10
          campaign_refs:
          - string
          vulnerability_refs:
          - string
          asset_properties_refs:
          - string
          relationships:
          - description: string
            schema_version: 1.3.30
            revision: 10
            target_ref: string
            type: relationship
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            source_ref: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            relationship_type: attributed-to
          timestamp: '2016-01-01T01:01:01.000Z'
          verdict_refs:
          - string
          malware_refs:
          - string
          incident_refs:
          - string
          vulnerabilities:
          - description: string
            schema_version: 1.3.30
            revision: 10
            published_date: '2016-01-01T01:01:01.000Z'
            cve:
              cve_data_meta:
                id: string
                assigner: string
            configurations:
              CVE_data_version: string
              nodes:
              - operator: AND
                cpe_match:
                - vulnerable: true
                  cpe23Uri: string
                  versionStartIncluding: string
                  versionEndIncluding: string
                  versionStartExcluding: string
                  versionEndExcluding: string
                children:
                - operator: AND
                  cpe_match:
                  - vulnerable: true
                    cpe23Uri: string
                    versionStartIncluding: string
                    versionEndIncluding: string
                    versionStartExcluding: string
                    versionEndExcluding: string
                  negate: true
                negate: true
            type: vulnerability
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            last_modified_date: '2016-01-01T01:01:01.000Z'
            impact:
              cvss_v2:
                integrity_impact: complete
                target_distribution: not_defined
                availability_requirement: not_defined
                exploitability: not_defined
                access_complexity: low
                temporal_vector_string: string
                exploitability_score: 10.0
                impact_score: 10.0
                user_interaction_required: true
                environmental_vector_string: string
                obtain_other_privilege: true
                availability_impact: complete
                access_vector: network
                base_severity: High
                confidentiality_impact: complete
                confidentiality_requirement: not_defined
                report_confidence: not_defined
                authentication: none
                base_score: 10.0
                obtain_user_privilege: true
                obtain_all_privilege: true
                collateral_damage_potential: not_defined
                remediation_level: not_defined
                vector_string: string
                integrity_requirement: not_defined
              cvss_v3:
                integrity_impact: high
                modified_user_interaction: none
                modified_scope: not_defined
                availability_requirement: high
                user_interaction: none
                modified_integrity_impact: not_defined
                privileges_required: high
                exploitability_score: 10.0
                impact_score: 10.0
                environmental_severity: critical
                modified_availability_impact: not_defined
                availability_impact: high
                scope: changed
                exploit_code_maturity: functional
                modified_attack_complexity: not_defined
                base_severity: critical
                confidentiality_impact: high
                temporal_severity: critical
                modified_confidentiality_impact: not_defined
                confidentiality_requirement: high
                report_confidence: confirmed
                temporal_score: 10.0
                modified_privileges_required: not_defined
                modified_attack_vector: not_defined
                base_score: 10.0
                environmental_score: 10.0
                remediation_level: high
                vector_string: string
                integrity_requirement: high
                attack_vector: adjacent_network
                attack_complexity: high
          coas:
          - description: string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            stage: Containment
            schema_version: 1.3.30
            revision: 10
            efficacy: High
            type: coa
            related_COAs:
            - confidence: High
              source: string
              relationship: string
              COA_id: string
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            coa_type: Diplomatic Actions
            language: string
            id: string
            tlp: green
            objective:
            - string
            cost: High
            timestamp: '2016-01-01T01:01:01.000Z'
            open_c2_coa:
              type: structured_coa
              id: string
              action:
                type: alert
              target:
                type: acudid
                specifiers: string
              actuator:
                type: endpoint
                specifiers:
                - string
              modifiers:
                response: acknowledge
                method:
                - acl
                additional_properties:
                  context: string
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                frequency: string
                duration: '2016-01-01T01:01:01.000Z'
                source: string
                search: cve
                option: string
                id: string
                location: internal
                delay: '2016-01-01T01:01:01.000Z'
                destination: copy-to
            structured_coa_type: openc2
            impact: string
        observables:
        - value: 1.2.3.4
          type: ip
        type: casebook
        source: string
        external_ids:
        - string
        short_description: string
        title: string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        source_uri: string
        language: string
        id: string
        tlp: green
        timestamp: '2016-01-01T01:01:01.000Z'
      description: Allows to gather and group observables and related analyst notes in one place from across multiple products for easy retrieval and further actions. Through Casebook, analysts can collaborate, share information, track progress, and take necessary actions to mitigate the incident.
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        authorized_groups:
          type: array
          items:
            type: string
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        texts:
          example:
          - type: string
            text: string
          type: array
          items:
            $ref: '#/components/schemas/Text'
        bundle:
          $ref: '#/components/schemas/Bundle'
        observables:
          example:
          - value: 1.2.3.4
            type: ip
          type: array
          items:
            $ref: '#/components/schemas/Observable'
        authorized_users:
          type: array
          items:
            type: string
        type:
          example: casebook
          type: string
          enum:
          - casebook
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        client_id:
          type: string
        groups:
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        owner:
          type: string
      additionalProperties: false
      required:
      - type
      - id
    CVEDataMeta:
      example:
        id: string
        assigner: string
      type: object
      properties:
        id:
          example: string
          description: String with at most 1024 characters.
          type: string
        assigner:
          example: string
          description: String with at most 1024 characters.
          type: string
      additionalProperties: false
    AlternateTerm:
      example:
        term: string
        description: string
      type: object
      properties:
        term:
          example: string
          description: The actual alternate term.
          type: string
        description:
          example: string
          description: Provides context for the alternate term by which this weakness may be known.
          type: string
      additionalProperties: false
    Consequence:
      example:
        scopes:
        - Access Control
        impacts:
        - Alter Execution Logic
        likelihood: High
        note: string
      type: object
      properties:
        scopes:
          example:
          - Access Control
          description: Identifies the security property that is violated.
          type: array
          items:
            type: string
        impacts:
          example:
          - Alter Execution Logic
          description: Describes the technical impact that arises if an adversary succeeds in exploiting this weakness.
          type: array
          items:
            type: string
        likelihood:
          example: High
          description: How likely the specific consequence is expected to be seen relative to the other consequences.
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        note:
          example: string
          description: Additional commentary about a consequence.
          type: string
      additionalProperties: false
    SightingDataTable:
      example:
        columns:
        - name: string
          type: integer
          description: string
          required: true
          short_description: string
        rows:
        - - anything
        row_count: 10
      description: An embedded data table for the Sighting.
      type: object
      properties:
        columns:
          example:
          - name: string
            type: integer
            description: string
            required: true
            short_description: string
          description: an ordered list of column definitions
          type: array
          items:
            $ref: '#/components/schemas/ColumnDefinition'
        rows:
          example:
          - - anything
          description: an ordered list of rows
          type: array
          items:
            type: array
            items: {}
        row_count:
          example: 10
          description: The number of rows in the data table.
          type: integer
          format: int64
      additionalProperties: false
      required:
      - columns
      - rows
    CasebookTextsUpdate:
      description: A casebook Texts operation
      type: object
      properties:
        operation:
          type: string
          enum:
          - remove
          - replace
          - add
        texts:
          example:
          - type: string
            text: string
          type: array
          items:
            $ref: '#/components/schemas/Text'
      additionalProperties: false
      required:
      - operation
    AssetProperties:
      example:
        properties:
        - name: string
          value: string
        valid_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        schema_version: 1.3.30
        revision: 10
        asset_ref: string
        type: asset-properties
        source: string
        external_ids:
        - string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        source_uri: string
        language: string
        id: string
        tlp: green
        timestamp: '2016-01-01T01:01:01.000Z'
      description: Assets do not have any product specific properties, those are represented in AssetProperties - which is a record that asserts one or more properties of an Asset for a specific time.
      type: object
      properties:
        properties:
          example:
          - name: string
            value: string
          type: array
          items:
            $ref: '#/components/schemas/AssetProperty'
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        asset_ref:
          example: string
          description: URI that points to the associated Asset.
          type: string
        type:
          example: asset-properties
          type: string
          enum:
          - asset-properties
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
      additionalProperties: false
    ProcessCreateType:
      example:
        parent_process_name: string
        process_guid: 10
        parent_process_guid: 10
        process_disposition: string
        parent_process_size: 10
        process_size: 10
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        parent_process_disposition: string
        type: ProcessCreateEvent
        parent_process_username: string
        parent_process_id: 10
        parent_process_args: string
        process_name: string
        process_hash: string
        process_id: 10
        parent_process_hash: string
        process_username: string
        parent_creation_time: '2016-01-01T01:01:01.000Z'
        process_args: string
      type: object
      properties:
        parent_process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        parent_process_guid:
          example: 10
          type: integer
          format: int64
        process_disposition:
          example: string
          description: String with at most 1024 characters.
          type: string
        parent_process_size:
          example: 10
          type: integer
          format: int64
        process_size:
          example: 10
          type: integer
          format: int64
        time:
          $ref: '#/components/schemas/ObservedTime'
        parent_process_disposition:
          example: string
          description: String with at most 1024 characters.
          type: string
        type:
          example: ProcessCreateEvent
          type: string
          enum:
          - ProcessCreateEvent
        parent_process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        parent_process_id:
          example: 10
          type: integer
          format: int64
        parent_process_args:
          example: string
          description: String with at most 2048 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_hash:
          example: string
          description: String with at most 2048 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        parent_process_hash:
          example: string
          description: String with at most 2048 characters.
          type: string
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        parent_creation_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Schema definition for all date or timestamp values.  Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
          type: string
          format: date-time
        process_args:
          example: string
          description: String with at most 2048 characters.
          type: string
      additionalProperties: false
      required:
      - time
      - type
      - process_name
      - process_id
    Verdict:
      example:
        type: verdict
        disposition: 1
        observable:
          value: 1.2.3.4
          type: ip
        judgement_id: string
        disposition_name: Clean
        valid_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
      description: "A Verdict is chosen from all of the Judgements on that Observable which have not yet expired.  The highest priority Judgement becomes the active verdict.  If there is more than one Judgement with that priority, then Clean disposition has priority over all others, then Malicious disposition, and so on down to Unknown.\n\n The ID of a verdict is a a str of the form \"observable.type:observable.value\" for example, \"ip:1.1.1.1\""
      type: object
      properties:
        type:
          example: verdict
          type: string
          enum:
          - verdict
        disposition:
          example: 1
          description: Numeric verdict identifiers.
          type: integer
          format: int64
          enum:
          - 1
          - 4
          - 3
          - 2
          - 5
        observable:
          $ref: '#/components/schemas/Observable'
        judgement_id:
          example: string
          description: A URI leading to a judgement.
          type: string
        disposition_name:
          example: Clean
          description: 'The disposition_name field is optional, but is intended to be shown to a user.  Applications must therefore remember the mapping of numbers to human words, as in: {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}'
          type: string
          enum:
          - Common
          - Unknown
          - Suspicious
          - Malicious
          - Clean
        valid_time:
          $ref: '#/components/schemas/ValidTime'
      additionalProperties: false
    Observable:
      example:
        value: 1.2.3.4
        type: ip
      description: An AssetMapping is a record that a specific Observable maps to an Asset for an indicated period of time.
      type: object
      properties:
        value:
          example: 1.2.3.4
          description: The value of the observable.
          type: string
        type:
          example: ip
          description: The type of observable.
          type: string
          enum:
          - file_path
          - mac_address
          - trend_micro_id
          - cybereason_id
          - process_args
          - s1_agent_id
          - device
          - hostname
          - certificate_common_name
          - serial_number
          - meraki_network_id
          - url
          - jamf_management_id
          - certificate_serial
          - intune_id
          - meraki_org_id
          - cisco_cm_id
          - registry_key
          - process_path
          - darktrace_id
          - process_username
          - cortex_agent_id
          - orbital_node_id
          - process_uid
          - ngfw_name
          - user
          - certificate_issuer
          - ipv6
          - email
          - cisco_uc_id
          - cvm_id
          - sha256
          - crowdstrike_id
          - google_cloud_id
          - google_chromebook_id
          - acudid
          - sha1
          - registry_name
          - md5
          - service_now_id
          - ip
          - domain
          - email_subject
          - imei
          - ngfw_id
          - amp_computer_guid
          - ms_machine_id
          - secure_access_id
          - mutex
          - processor_id
          - swc_device_id
          - registry_path
          - odns_identity
          - odns_identity_label
          - cisco_mid
          - process_name
          - pki_serial
          - meraki_node_sn
          - email_messageid
          - imsi
          - user_agent
          - process_hash
          - file_name
      additionalProperties: false
      required:
      - value
      - type
    Judgement:
      example:
        valid_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        schema_version: 1.3.30
        revision: 10
        observable:
          value: 1.2.3.4
          type: ip
        reason_uri: string
        type: judgement
        source: string
        external_ids:
        - string
        disposition: 1
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        reason: string
        source_uri: string
        disposition_name: Clean
        priority: 10
        language: string
        id: string
        severity: Critical
        tlp: green
        timestamp: '2016-01-01T01:01:01.000Z'
        confidence: High
      description: "A judgement about the intent or nature of an observable.  For\n  example, is it malicious, meaning is is malware and subverts system\n  operations?  It could also be clean and be from a known benign, or\n  trusted source.  It could also be common, something so widespread\n  that it's not likely to be malicious.\n\n  Since a core goal of the CTIA is to provide a simple verdict service,\n  these judgements are the basis for the returned verdicts.  These are\n  also the primary means by which users of the CTIA go from\n  observables on their system, to the indicators and threat\n  intelligence data in CTIA."
      type: object
      properties:
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        observable:
          $ref: '#/components/schemas/Observable'
        reason_uri:
          example: string
          description: A URI
          type: string
        type:
          example: judgement
          type: string
          enum:
          - judgement
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        disposition:
          example: 1
          description: Matches :disposition_name as in {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}
          type: integer
          format: int64
          enum:
          - 1
          - 4
          - 3
          - 2
          - 5
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        reason:
          example: string
          description: String with at most 1024 characters.
          type: string
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        disposition_name:
          example: Clean
          description: String verdict identifiers.
          type: string
          enum:
          - Common
          - Unknown
          - Suspicious
          - Malicious
          - Clean
        priority:
          example: 10
          description: A value 0-100 that determine the priority of a judgement. Curated feeds of black/white lists, for example known good products within your organizations, should use a 95. All automated systems should use a priority of 90, or less.  Human judgements should have a priority of 100, so that humans can always override machines.
          type: integer
          format: int64
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        severity:
          example: Critical
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Critical
          - Low
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        confidence:
          example: High
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
      additionalProperties: false
    NoteRelatedEntity:
      example:
        entity_type: string
        entity_id: string
      type: object
      properties:
        entity_type:
          example: string
          type: string
        entity_id:
          example: string
          description: A URI leading to an entity.
          type: string
      additionalProperties: false
      required:
      - entity_type
      - entity_id
    CPENode:
      example:
        operator: AND
        cpe_match:
        - vulnerable: true
          cpe23Uri: string
          versionStartIncluding: string
          versionEndIncluding: string
          versionStartExcluding: string
          versionEndExcluding: string
        children:
        - operator: AND
          cpe_match:
          - vulnerable: true
            cpe23Uri: string
            versionStartIncluding: string
            versionEndIncluding: string
            versionStartExcluding: string
            versionEndExcluding: string
          negate: true
        negate: true
      type: object
      properties:
        operator:
          example: AND
          description: The operator string influences how seqs of cpe matches are related to one another.
          type: string
          enum:
          - AND
          - OR
        cpe_match:
          example:
          - vulnerable: true
            cpe23Uri: string
            versionStartIncluding: string
            versionEndIncluding: string
            versionStartExcluding: string
            versionEndExcluding: string
          type: array
          items:
            $ref: '#/components/schemas/CPEMatch'
        children:
          example:
          - operator: AND
            cpe_match:
            - vulnerable: true
              cpe23Uri: string
              versionStartIncluding: string
              versionEndIncluding: string
              versionStartExcluding: string
              versionEndExcluding: string
            negate: true
          type: array
          items:
            $ref: '#/components/schemas/CPELeafNode'
        negate:
          example: true
          description: Negates operator when true.
          type: boolean
      additionalProperties: false
      required:
      - operator
    RelatedIdentity:
      example:
        identity: string
        confidence: High
        information_source: string
        relationship: string
      description: Describes a related Identity
      type: object
      properties:
        identity:
          example: string
          description: The reference (URI) of the related Identity object.
          type: string
        confidence:
          example: High
          description: Specifies the level of confidence in the assertion of the relationship between the two objects.
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        information_source:
          example: string
          description: Specifies the source of the information about the relationship between the two components.
          type: string
        relationship:
          example: string
          type: string
      additionalProperties: false
    Bundle:
      example:
        description: string
        valid_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        asset_mapping_refs:
        - string
        note_refs:
        - string
        data_table_refs:
        - string
        attack_pattern_refs:
        - string
        sighting_refs:
        - string
        schema_version: 1.3.30
        revision: 10
        assets:
        - description: string
          asset_type: application
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          schema_version: 1.3.30
          revision: 10
          type: asset
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
        weakness_refs:
        - string
        tool_refs:
        - string
        target_record_refs:
        - string
        asset_refs:
        - string
        tools:
        - description: string
          labels:
          - credential-exploitation
          schema_version: 1.3.30
          revision: 10
          type: tool
          x_mitre_aliases:
          - string
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tool_version: string
          tlp: green
          kill_chain_phases:
          - kill_chain_name: string
            phase_name: string
          timestamp: '2016-01-01T01:01:01.000Z'
        indicators:
        - description: string
          tags:
          - string
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          producer: string
          schema_version: 1.3.30
          revision: 10
          type: indicator
          test_mechanisms:
          - string
          source: string
          external_ids:
          - string
          short_description: string
          composite_indicator_expression:
            operator: and
            indicator_ids:
            - string
          title: string
          likely_impact: string
          indicator_type:
          - Anonymization
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          severity: Critical
          tlp: green
          kill_chain_phases:
          - kill_chain_name: string
            phase_name: string
          negate: true
          timestamp: '2016-01-01T01:01:01.000Z'
          confidence: High
          specification: anything
        attack_patterns:
        - description: string
          abstraction_level: aggregate
          schema_version: 1.3.30
          revision: 10
          type: attack-pattern
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          x_mitre_platforms:
          - string
          language: string
          id: string
          tlp: green
          x_mitre_data_sources:
          - string
          kill_chain_phases:
          - kill_chain_name: string
            phase_name: string
          x_mitre_contributors:
          - string
          timestamp: '2016-01-01T01:01:01.000Z'
        type: bundle
        weaknesses:
        - description: string
          background_details: string
          paradigms:
          - prevalence: Often
            name: string
          abstraction_level: Base
          architectures:
          - prevalence: Often
            name: string
            class: Embedded
          schema_version: 1.3.30
          revision: 10
          alternate_terms:
          - term: string
            description: string
          likelihood: High
          type: weakness
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          functional_areas:
          - Authentication
          source_uri: string
          modes_of_introduction:
          - phase: Architecture and Design
            note: string
          structure: Chain
          language: string
          id: string
          notes:
          - type: Applicable Platform
            note: string
          common_consequences:
          - scopes:
            - Access Control
            impacts:
            - Alter Execution Logic
            likelihood: High
            note: string
          tlp: green
          detection_methods:
          - method: Architecture or Design Review
            description: string
            effectiveness: High
            effectiveness_notes: string
          operating_systems:
          - prevalence: Often
            name: string
            version: string
            cpe_id: string
            class: Android
          affected_resources:
          - CPU
          languages:
          - prevalence: Often
            name: string
            class: Assembly
          timestamp: '2016-01-01T01:01:01.000Z'
          potential_mitigations:
          - description: string
            phases:
            - Architecture and Design
            strategy: Attack Surface Reduction
            effectiveness: Defense in Depth
            effectiveness_notes: string
          technologies:
          - prevalence: Often
            name: string
        source: string
        external_ids:
        - string
        feedback_refs:
        - string
        asset_properties:
        - properties:
          - name: string
            value: string
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          schema_version: 1.3.30
          revision: 10
          asset_ref: string
          type: asset-properties
          source: string
          external_ids:
          - string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
        short_description: string
        feedbacks:
        - feedback: -1
          schema_version: 1.3.30
          revision: 10
          type: feedback
          source: string
          external_ids:
          - string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          reason: string
          source_uri: string
          language: string
          id: string
          tlp: green
          entity_id: string
          timestamp: '2016-01-01T01:01:01.000Z'
        judgement_refs:
        - string
        title: string
        coa_refs:
        - string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        verdicts:
        - type: verdict
          disposition: 1
          observable:
            value: 1.2.3.4
            type: ip
          judgement_id: string
          disposition_name: Clean
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
        campaigns:
        - description: string
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          schema_version: 1.3.30
          revision: 10
          type: campaign
          campaign_type: string
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          activity:
          - date_time: '2016-01-01T01:01:01.000Z'
            description: string
          source_uri: string
          intended_effect:
          - Account Takeover
          status: Future
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
          confidence: High
          names:
          - string
        source_uri: string
        actors:
        - description: string
          motivation: Ego
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          identity:
            description: string
            related_identities:
            - identity: string
              confidence: High
              information_source: string
              relationship: string
          sophistication: Aspirant
          schema_version: 1.3.30
          revision: 10
          planning_and_operational_support: string
          type: actor
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          intended_effect: Account Takeover
          language: string
          id: string
          tlp: green
          aliases:
          - string
          timestamp: '2016-01-01T01:01:01.000Z'
          confidence: High
          actor_types:
          - Cyber Espionage Operations
        indicator_refs:
        - string
        actor_refs:
        - string
        language: string
        data_tables:
        - description: string
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          schema_version: 1.3.30
          revision: 10
          columns:
          - name: string
            type: integer
            description: string
            required: true
            short_description: string
          type: data-table
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          rows:
          - - anything
          source_uri: string
          language: string
          id: string
          tlp: green
          row_count: 10
          timestamp: '2016-01-01T01:01:01.000Z'
        id: string
        notes:
        - schema_version: 1.3.30
          revision: 10
          content: string
          note_class: keyword
          type: note
          source: string
          external_ids:
          - string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          author: string
          source_uri: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
          related_entities:
          - entity_type: string
            entity_id: string
        identity_assertions:
        - valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          identity:
            observables:
            - value: 1.2.3.4
              type: ip
          schema_version: 1.3.30
          revision: 10
          type: identity-assertion
          source: string
          external_ids:
          - string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
          assertions:
          - name: cisco:ctr:ad:host_domain_name
            value: string
        judgements:
        - valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          schema_version: 1.3.30
          revision: 10
          observable:
            value: 1.2.3.4
            type: ip
          reason_uri: string
          type: judgement
          source: string
          external_ids:
          - string
          disposition: 1
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          reason: string
          source_uri: string
          disposition_name: Clean
          priority: 10
          language: string
          id: string
          severity: Critical
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
          confidence: High
        malwares:
        - description: string
          labels:
          - adware
          abstraction_level: family
          schema_version: 1.3.30
          revision: 10
          type: malware
          x_mitre_aliases:
          - string
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tlp: green
          kill_chain_phases:
          - kill_chain_name: string
            phase_name: string
          timestamp: '2016-01-01T01:01:01.000Z'
        target_records:
        - description: string
          schema_version: 1.3.30
          revision: 10
          type: target-record
          source: string
          external_ids:
          - string
          targets:
          - type: endpoint
            observables:
            - value: 1.2.3.4
              type: ip
            observed_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            os: string
            internal: false
            sensor: string
            source_uri: string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
        asset_mappings:
        - asset_type: application
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          stability: Managed
          schema_version: 1.3.30
          revision: 10
          observable:
            value: 1.2.3.4
            type: ip
          asset_ref: string
          type: asset-mapping
          source: string
          external_ids:
          - string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
          specificity: Low
          confidence: High
        relationship_refs:
        - string
        tlp: green
        incidents:
        - description: string
          assignees:
          - string
          detection_sources:
          - string
          meta:
            keyword: anything
          schema_version: 1.3.30
          revision: 10
          type: incident
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          incident_time:
            opened: '2016-01-01T01:01:01.000Z'
            discovered: '2016-01-01T01:01:01.000Z'
            reported: '2016-01-01T01:01:01.000Z'
            remediated: '2016-01-01T01:01:01.000Z'
            closed: '2016-01-01T01:01:01.000Z'
            rejected: '2016-01-01T01:01:01.000Z'
            contained: '2016-01-01T01:01:01.000Z'
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          discovery_method: Agent Disclosure
          source_uri: string
          intended_effect: Account Takeover
          categories:
          - Attrition
          status: Closed
          language: string
          detection_status: active
          id: string
          promotion_method: Automated
          severity: Critical
          tlp: green
          scores:
            asset: 10.0
          techniques:
          - string
          timestamp: '2016-01-01T01:01:01.000Z'
          confidence: High
          short_id: string
          tactics:
          - string
        identity_assertion_refs:
        - string
        sightings:
        - description: string
          schema_version: 1.3.30
          revision: 10
          relations:
          - origin: string
            origin_uri: string
            relation: Allocated
            relation_info:
              keyword: anything
            source:
              value: 1.2.3.4
              type: ip
            related:
              value: 1.2.3.4
              type: ip
          sensor_coordinates:
            type: endpoint
            observables:
            - value: 1.2.3.4
              type: ip
            os: string
          observables:
          - value: 1.2.3.4
            type: ip
          type: sighting
          source: string
          external_ids:
          - string
          targets:
          - type: endpoint
            observables:
            - value: 1.2.3.4
              type: ip
            observed_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            os: string
          short_description: string
          title: string
          resolution: detected
          internal: false
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          detection_interval:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          source_uri: string
          activity_interval:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          language: string
          id: string
          count: 10
          severity: Critical
          tlp: green
          modification_interval:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          context:
            http_events:
            - process_guid: 10
              traffic:
                destination_host_name: string
                protocol: 10
                source_ip: string
                destination_subnet: string
                destination_ip: string
                source_subnet: string
                destination_port: 10
                direction: incoming
                source_port: 10
              method: CONNECT
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              type: HTTPEvent
              host: string
              process_name: string
              process_id: 10
              process_username: string
              query: string
              encrypted: true
              url_port: 10
            process_create_events:
            - parent_process_name: string
              process_guid: 10
              parent_process_guid: 10
              process_disposition: string
              parent_process_size: 10
              process_size: 10
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              parent_process_disposition: string
              type: ProcessCreateEvent
              parent_process_username: string
              parent_process_id: 10
              parent_process_args: string
              process_name: string
              process_hash: string
              process_id: 10
              parent_process_hash: string
              process_username: string
              parent_creation_time: '2016-01-01T01:01:01.000Z'
              process_args: string
            registry_delete_events:
            - time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              process_id: 10
              process_name: string
              process_guid: 10
              process_username: string
              registry_key: string
              type: RegistryDeleteEvent
              registry_value: string
            file_modify_events:
            - file_name: string
              process_guid: 10
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              type: FileModifyEvent
              file_path: string
              process_name: string
              process_id: 10
              process_username: string
              failed: false
            registry_set_events:
            - process_guid: 10
              registry_data: string
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              type: RegistrySetEvent
              registry_data_length: 10
              registry_value: string
              registry_key: string
              process_name: string
              process_id: 10
              process_username: string
            file_create_events:
            - file_name: string
              process_guid: 10
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              type: FileCreateEvent
              file_path: string
              process_name: string
              process_id: 10
              process_username: string
              failed: false
            registry_create_events:
            - time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              process_id: 10
              process_name: string
              process_guid: 10
              process_username: string
              registry_key: string
              type: RegistryCreateEvent
            library_load_events:
            - time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              process_id: 10
              process_name: string
              process_guid: 10
              process_username: string
              type: LibraryLoadEvent
              dll_library_name: string
              dll_library_path: string
            file_move_events:
            - file_name: string
              process_guid: 10
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              type: FileMoveEvent
              old_name: string
              file_path: string
              process_name: string
              process_id: 10
              process_username: string
              new_name: string
            file_delete_events:
            - file_name: string
              process_guid: 10
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              type: FileDeleteEvent
              file_path: string
              process_name: string
              process_id: 10
              process_username: string
              failed: false
            netflow_events:
            - parent_process_name: string
              byte_count_in: 10
              process_guid: 10
              process_path: string
              traffic:
                destination_host_name: string
                protocol: 10
                source_ip: string
                destination_subnet: string
                destination_ip: string
                source_subnet: string
                destination_port: 10
                direction: incoming
                source_port: 10
              flow_time: '2016-01-01T01:01:01.000Z'
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              parent_process_account: string
              type: NetflowEvent
              process_account_type: string
              parent_process_path: string
              parent_process_id: 10
              parent_process_args: string
              process_name: string
              process_account: string
              parent_process_account_type: string
              process_hash: string
              process_id: 10
              parent_process_hash: string
              process_username: string
              byte_count_out: 10
              process_args: string
            registry_rename_events:
            - time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              process_id: 10
              process_name: string
              process_guid: 10
              process_username: string
              registry_key: string
              type: RegistryRenameEvent
              registry_old_key: string
          timestamp: '2016-01-01T01:01:01.000Z'
          confidence: High
          observed_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          sensor: endpoint
          data:
            columns:
            - name: string
              type: integer
              description: string
              required: true
              short_description: string
            rows:
            - - anything
            row_count: 10
        campaign_refs:
        - string
        vulnerability_refs:
        - string
        asset_properties_refs:
        - string
        relationships:
        - description: string
          schema_version: 1.3.30
          revision: 10
          target_ref: string
          type: relationship
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          source_ref: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
          relationship_type: attributed-to
        timestamp: '2016-01-01T01:01:01.000Z'
        verdict_refs:
        - string
        malware_refs:
        - string
        incident_refs:
        - string
        vulnerabilities:
        - description: string
          schema_version: 1.3.30
          revision: 10
          published_date: '2016-01-01T01:01:01.000Z'
          cve:
            cve_data_meta:
              id: string
              assigner: string
          configurations:
            CVE_data_version: string
            nodes:
            - operator: AND
              cpe_match:
              - vulnerable: true
                cpe23Uri: string
                versionStartIncluding: string
                versionEndIncluding: string
                versionStartExcluding: string
                versionEndExcluding: string
              children:
              - operator: AND
                cpe_match:
                - vulnerable: true
                  cpe23Uri: string
                  versionStartIncluding: string
                  versionEndIncluding: string
                  versionStartExcluding: string
                  versionEndExcluding: string
                negate: true
              negate: true
          type: vulnerability
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          language: string
          id: string
          tlp: green
          timestamp: '2016-01-01T01:01:01.000Z'
          last_modified_date: '2016-01-01T01:01:01.000Z'
          impact:
            cvss_v2:
              integrity_impact: complete
              target_distribution: not_defined
              availability_requirement: not_defined
              exploitability: not_defined
              access_complexity: low
              temporal_vector_string: string
              exploitability_score: 10.0
              impact_score: 10.0
              user_interaction_required: true
              environmental_vector_string: string
              obtain_other_privilege: true
              availability_impact: complete
              access_vector: network
              base_severity: High
              confidentiality_impact: complete
              confidentiality_requirement: not_defined
              report_confidence: not_defined
              authentication: none
              base_score: 10.0
              obtain_user_privilege: true
              obtain_all_privilege: true
              collateral_damage_potential: not_defined
              remediation_level: not_defined
              vector_string: string
              integrity_requirement: not_defined
            cvss_v3:
              integrity_impact: high
              modified_user_interaction: none
              modified_scope: not_defined
              availability_requirement: high
              user_interaction: none
              modified_integrity_impact: not_defined
              privileges_required: high
              exploitability_score: 10.0
              impact_score: 10.0
              environmental_severity: critical
              modified_availability_impact: not_defined
              availability_impact: high
              scope: changed
              exploit_code_maturity: functional
              modified_attack_complexity: not_defined
              base_severity: critical
              confidentiality_impact: high
              temporal_severity: critical
              modified_confidentiality_impact: not_defined
              confidentiality_requirement: high
              report_confidence: confirmed
              temporal_score: 10.0
              modified_privileges_required: not_defined
              modified_attack_vector: not_defined
              base_score: 10.0
              environmental_score: 10.0
              remediation_level: high
              vector_string: string
              integrity_requirement: high
              attack_vector: adjacent_network
              attack_complexity: high
        coas:
        - description: string
          valid_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          stage: Containment
          schema_version: 1.3.30
          revision: 10
          efficacy: High
          type: coa
          related_COAs:
          - confidence: High
            source: string
            relationship: string
            COA_id: string
          source: string
          external_ids:
          - string
          short_description: string
          title: string
          external_references:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          source_uri: string
          coa_type: Diplomatic Actions
          language: string
          id: string
          tlp: green
          objective:
          - string
          cost: High
          timestamp: '2016-01-01T01:01:01.000Z'
          open_c2_coa:
            type: structured_coa
            id: string
            action:
              type: alert
            target:
              type: acudid
              specifiers: string
            actuator:
              type: endpoint
              specifiers:
              - string
            modifiers:
              response: acknowledge
              method:
              - acl
              additional_properties:
                context: string
              time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              frequency: string
              duration: '2016-01-01T01:01:01.000Z'
              source: string
              search: cve
              option: string
              id: string
              location: internal
              delay: '2016-01-01T01:01:01.000Z'
              destination: copy-to
          structured_coa_type: openc2
          impact: string
      description: Describes a Bundle of any set of CTIM entities.
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        asset_mapping_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        note_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        data_table_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        attack_pattern_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        sighting_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        assets:
          example:
          - description: string
            asset_type: application
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            type: asset
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `Asset`s.
          type: array
          items:
            $ref: '#/components/schemas/Asset'
          uniqueItems: true
        weakness_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        tool_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        target_record_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        asset_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        tools:
          example:
          - description: string
            labels:
            - credential-exploitation
            schema_version: 1.3.30
            revision: 10
            type: tool
            x_mitre_aliases:
            - string
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tool_version: string
            tlp: green
            kill_chain_phases:
            - kill_chain_name: string
              phase_name: string
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `Tool`s.
          type: array
          items:
            $ref: '#/components/schemas/Tool'
          uniqueItems: true
        indicators:
          example:
          - description: string
            tags:
            - string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            producer: string
            schema_version: 1.3.30
            revision: 10
            type: indicator
            test_mechanisms:
            - string
            source: string
            external_ids:
            - string
            short_description: string
            composite_indicator_expression:
              operator: and
              indicator_ids:
              - string
            title: string
            likely_impact: string
            indicator_type:
            - Anonymization
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            severity: Critical
            tlp: green
            kill_chain_phases:
            - kill_chain_name: string
              phase_name: string
            negate: true
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            specification: anything
          description: a list of `Indicator`s.
          type: array
          items:
            $ref: '#/components/schemas/Indicator'
          uniqueItems: true
        attack_patterns:
          example:
          - description: string
            abstraction_level: aggregate
            schema_version: 1.3.30
            revision: 10
            type: attack-pattern
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            x_mitre_platforms:
            - string
            language: string
            id: string
            tlp: green
            x_mitre_data_sources:
            - string
            kill_chain_phases:
            - kill_chain_name: string
              phase_name: string
            x_mitre_contributors:
            - string
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `AttackPattern`s.
          type: array
          items:
            $ref: '#/components/schemas/AttackPattern'
          uniqueItems: true
        type:
          example: bundle
          type: string
          enum:
          - bundle
        weaknesses:
          example:
          - description: string
            background_details: string
            paradigms:
            - prevalence: Often
              name: string
            abstraction_level: Base
            architectures:
            - prevalence: Often
              name: string
              class: Embedded
            schema_version: 1.3.30
            revision: 10
            alternate_terms:
            - term: string
              description: string
            likelihood: High
            type: weakness
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            functional_areas:
            - Authentication
            source_uri: string
            modes_of_introduction:
            - phase: Architecture and Design
              note: string
            structure: Chain
            language: string
            id: string
            notes:
            - type: Applicable Platform
              note: string
            common_consequences:
            - scopes:
              - Access Control
              impacts:
              - Alter Execution Logic
              likelihood: High
              note: string
            tlp: green
            detection_methods:
            - method: Architecture or Design Review
              description: string
              effectiveness: High
              effectiveness_notes: string
            operating_systems:
            - prevalence: Often
              name: string
              version: string
              cpe_id: string
              class: Android
            affected_resources:
            - CPU
            languages:
            - prevalence: Often
              name: string
              class: Assembly
            timestamp: '2016-01-01T01:01:01.000Z'
            potential_mitigations:
            - description: string
              phases:
              - Architecture and Design
              strategy: Attack Surface Reduction
              effectiveness: Defense in Depth
              effectiveness_notes: string
            technologies:
            - prevalence: Often
              name: string
          description: a list of `Weakness`s.
          type: array
          items:
            $ref: '#/components/schemas/Weakness'
          uniqueItems: true
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        feedback_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        asset_properties:
          example:
          - properties:
            - name: string
              value: string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            asset_ref: string
            type: asset-properties
            source: string
            external_ids:
            - string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `AssetProperties`.
          type: array
          items:
            $ref: '#/components/schemas/AssetProperties'
          uniqueItems: true
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        feedbacks:
          example:
          - feedback: -1
            schema_version: 1.3.30
            revision: 10
            type: feedback
            source: string
            external_ids:
            - string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            reason: string
            source_uri: string
            language: string
            id: string
            tlp: green
            entity_id: string
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `Feedback`s.
          type: array
          items:
            $ref: '#/components/schemas/Feedback'
          uniqueItems: true
        judgement_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        coa_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        verdicts:
          example:
          - type: verdict
            disposition: 1
            observable:
              value: 1.2.3.4
              type: ip
            judgement_id: string
            disposition_name: Clean
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
          description: a list of `Verdict`s.
          type: array
          items:
            $ref: '#/components/schemas/Verdict'
          uniqueItems: true
        campaigns:
          example:
          - description: string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            type: campaign
            campaign_type: string
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            activity:
            - date_time: '2016-01-01T01:01:01.000Z'
              description: string
            source_uri: string
            intended_effect:
            - Account Takeover
            status: Future
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            names:
            - string
          description: a list of `Campaign`s.
          type: array
          items:
            $ref: '#/components/schemas/Campaign'
          uniqueItems: true
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        actors:
          example:
          - description: string
            motivation: Ego
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            identity:
              description: string
              related_identities:
              - identity: string
                confidence: High
                information_source: string
                relationship: string
            sophistication: Aspirant
            schema_version: 1.3.30
            revision: 10
            planning_and_operational_support: string
            type: actor
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            intended_effect: Account Takeover
            language: string
            id: string
            tlp: green
            aliases:
            - string
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            actor_types:
            - Cyber Espionage Operations
          description: a list of `Actor`s.
          type: array
          items:
            $ref: '#/components/schemas/Actor'
          uniqueItems: true
        indicator_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        actor_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        data_tables:
          example:
          - description: string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            columns:
            - name: string
              type: integer
              description: string
              required: true
              short_description: string
            type: data-table
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            rows:
            - - anything
            source_uri: string
            language: string
            id: string
            tlp: green
            row_count: 10
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `DataTable`s.
          type: array
          items:
            $ref: '#/components/schemas/DataTable'
          uniqueItems: true
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        notes:
          example:
          - schema_version: 1.3.30
            revision: 10
            content: string
            note_class: keyword
            type: note
            source: string
            external_ids:
            - string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            author: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            related_entities:
            - entity_type: string
              entity_id: string
          description: a list of `Note`s.
          type: array
          items:
            $ref: '#/components/schemas/Note'
          uniqueItems: true
        identity_assertions:
          example:
          - valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            identity:
              observables:
              - value: 1.2.3.4
                type: ip
            schema_version: 1.3.30
            revision: 10
            type: identity-assertion
            source: string
            external_ids:
            - string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            assertions:
            - name: cisco:ctr:ad:host_domain_name
              value: string
          description: a list of `IdentityAssertion`s.
          type: array
          items:
            $ref: '#/components/schemas/IdentityAssertion'
          uniqueItems: true
        judgements:
          example:
          - valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            schema_version: 1.3.30
            revision: 10
            observable:
              value: 1.2.3.4
              type: ip
            reason_uri: string
            type: judgement
            source: string
            external_ids:
            - string
            disposition: 1
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            reason: string
            source_uri: string
            disposition_name: Clean
            priority: 10
            language: string
            id: string
            severity: Critical
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
          description: a list of `Judgement`s.
          type: array
          items:
            $ref: '#/components/schemas/Judgement'
          uniqueItems: true
        malwares:
          example:
          - description: string
            labels:
            - adware
            abstraction_level: family
            schema_version: 1.3.30
            revision: 10
            type: malware
            x_mitre_aliases:
            - string
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            kill_chain_phases:
            - kill_chain_name: string
              phase_name: string
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `Malware`s.
          type: array
          items:
            $ref: '#/components/schemas/Malware'
          uniqueItems: true
        target_records:
          example:
          - description: string
            schema_version: 1.3.30
            revision: 10
            type: target-record
            source: string
            external_ids:
            - string
            targets:
            - type: endpoint
              observables:
              - value: 1.2.3.4
                type: ip
              observed_time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              os: string
              internal: false
              sensor: string
              source_uri: string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
          description: a list of `TargetRecord`s.
          type: array
          items:
            $ref: '#/components/schemas/TargetRecord'
          uniqueItems: true
        asset_mappings:
          example:
          - asset_type: application
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            stability: Managed
            schema_version: 1.3.30
            revision: 10
            observable:
              value: 1.2.3.4
              type: ip
            asset_ref: string
            type: asset-mapping
            source: string
            external_ids:
            - string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            specificity: Low
            confidence: High
          description: a list of `AssetMapping`s.
          type: array
          items:
            $ref: '#/components/schemas/AssetMapping'
          uniqueItems: true
        relationship_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        incidents:
          example:
          - description: string
            assignees:
            - string
            detection_sources:
            - string
            meta:
              keyword: anything
            schema_version: 1.3.30
            revision: 10
            type: incident
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            incident_time:
              opened: '2016-01-01T01:01:01.000Z'
              discovered: '2016-01-01T01:01:01.000Z'
              reported: '2016-01-01T01:01:01.000Z'
              remediated: '2016-01-01T01:01:01.000Z'
              closed: '2016-01-01T01:01:01.000Z'
              rejected: '2016-01-01T01:01:01.000Z'
              contained: '2016-01-01T01:01:01.000Z'
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            discovery_method: Agent Disclosure
            source_uri: string
            intended_effect: Account Takeover
            categories:
            - Attrition
            status: Closed
            language: string
            detection_status: active
            id: string
            promotion_method: Automated
            severity: Critical
            tlp: green
            scores:
              asset: 10.0
            techniques:
            - string
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            short_id: string
            tactics:
            - string
          description: a list of `Incident`s.
          type: array
          items:
            $ref: '#/components/schemas/Incident'
          uniqueItems: true
        identity_assertion_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        sightings:
          example:
          - description: string
            schema_version: 1.3.30
            revision: 10
            relations:
            - origin: string
              origin_uri: string
              relation: Allocated
              relation_info:
                keyword: anything
              source:
                value: 1.2.3.4
                type: ip
              related:
                value: 1.2.3.4
                type: ip
            sensor_coordinates:
              type: endpoint
              observables:
              - value: 1.2.3.4
                type: ip
              os: string
            observables:
            - value: 1.2.3.4
              type: ip
            type: sighting
            source: string
            external_ids:
            - string
            targets:
            - type: endpoint
              observables:
              - value: 1.2.3.4
                type: ip
              observed_time:
                start_time: '2016-01-01T01:01:01.000Z'
                end_time: '2016-01-01T01:01:01.000Z'
              os: string
            short_description: string
            title: string
            resolution: detected
            internal: false
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            detection_interval:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            source_uri: string
            activity_interval:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            language: string
            id: string
            count: 10
            severity: Critical
            tlp: green
            modification_interval:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            context:
              http_events:
              - process_guid: 10
                traffic:
                  destination_host_name: string
                  protocol: 10
                  source_ip: string
                  destination_subnet: string
                  destination_ip: string
                  source_subnet: string
                  destination_port: 10
                  direction: incoming
                  source_port: 10
                method: CONNECT
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: HTTPEvent
                host: string
                process_name: string
                process_id: 10
                process_username: string
                query: string
                encrypted: true
                url_port: 10
              process_create_events:
              - parent_process_name: string
                process_guid: 10
                parent_process_guid: 10
                process_disposition: string
                parent_process_size: 10
                process_size: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                parent_process_disposition: string
                type: ProcessCreateEvent
                parent_process_username: string
                parent_process_id: 10
                parent_process_args: string
                process_name: string
                process_hash: string
                process_id: 10
                parent_process_hash: string
                process_username: string
                parent_creation_time: '2016-01-01T01:01:01.000Z'
                process_args: string
              registry_delete_events:
              - time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                process_id: 10
                process_name: string
                process_guid: 10
                process_username: string
                registry_key: string
                type: RegistryDeleteEvent
                registry_value: string
              file_modify_events:
              - file_name: string
                process_guid: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: FileModifyEvent
                file_path: string
                process_name: string
                process_id: 10
                process_username: string
                failed: false
              registry_set_events:
              - process_guid: 10
                registry_data: string
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: RegistrySetEvent
                registry_data_length: 10
                registry_value: string
                registry_key: string
                process_name: string
                process_id: 10
                process_username: string
              file_create_events:
              - file_name: string
                process_guid: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: FileCreateEvent
                file_path: string
                process_name: string
                process_id: 10
                process_username: string
                failed: false
              registry_create_events:
              - time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                process_id: 10
                process_name: string
                process_guid: 10
                process_username: string
                registry_key: string
                type: RegistryCreateEvent
              library_load_events:
              - time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                process_id: 10
                process_name: string
                process_guid: 10
                process_username: string
                type: LibraryLoadEvent
                dll_library_name: string
                dll_library_path: string
              file_move_events:
              - file_name: string
                process_guid: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: FileMoveEvent
                old_name: string
                file_path: string
                process_name: string
                process_id: 10
                process_username: string
                new_name: string
              file_delete_events:
              - file_name: string
                process_guid: 10
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                type: FileDeleteEvent
                file_path: string
                process_name: string
                process_id: 10
                process_username: string
                failed: false
              netflow_events:
              - parent_process_name: string
                byte_count_in: 10
                process_guid: 10
                process_path: string
                traffic:
                  destination_host_name: string
                  protocol: 10
                  source_ip: string
                  destination_subnet: string
                  destination_ip: string
                  source_subnet: string
                  destination_port: 10
                  direction: incoming
                  source_port: 10
                flow_time: '2016-01-01T01:01:01.000Z'
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                parent_process_account: string
                type: NetflowEvent
                process_account_type: string
                parent_process_path: string
                parent_process_id: 10
                parent_process_args: string
                process_name: string
                process_account: string
                parent_process_account_type: string
                process_hash: string
                process_id: 10
                parent_process_hash: string
                process_username: string
                byte_count_out: 10
                process_args: string
              registry_rename_events:
              - time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                process_id: 10
                process_name: string
                process_guid: 10
                process_username: string
                registry_key: string
                type: RegistryRenameEvent
                registry_old_key: string
            timestamp: '2016-01-01T01:01:01.000Z'
            confidence: High
            observed_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            sensor: endpoint
            data:
              columns:
              - name: string
                type: integer
                description: string
                required: true
                short_description: string
              rows:
              - - anything
              row_count: 10
          description: a list of `Sighting`s.
          type: array
          items:
            $ref: '#/components/schemas/Sighting'
          uniqueItems: true
        campaign_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        vulnerability_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        asset_properties_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        relationships:
          example:
          - description: string
            schema_version: 1.3.30
            revision: 10
            target_ref: string
            type: relationship
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            source_ref: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            relationship_type: attributed-to
          description: a list of `Relationship`s.
          type: array
          items:
            $ref: '#/components/schemas/Relationship'
          uniqueItems: true
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        verdict_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        malware_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        incident_refs:
          example:
          - string
          type: array
          items:
            type: string
          uniqueItems: true
        vulnerabilities:
          example:
          - description: string
            schema_version: 1.3.30
            revision: 10
            published_date: '2016-01-01T01:01:01.000Z'
            cve:
              cve_data_meta:
                id: string
                assigner: string
            configurations:
              CVE_data_version: string
              nodes:
              - operator: AND
                cpe_match:
                - vulnerable: true
                  cpe23Uri: string
                  versionStartIncluding: string
                  versionEndIncluding: string
                  versionStartExcluding: string
                  versionEndExcluding: string
                children:
                - operator: AND
                  cpe_match:
                  - vulnerable: true
                    cpe23Uri: string
                    versionStartIncluding: string
                    versionEndIncluding: string
                    versionStartExcluding: string
                    versionEndExcluding: string
                  negate: true
                negate: true
            type: vulnerability
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            language: string
            id: string
            tlp: green
            timestamp: '2016-01-01T01:01:01.000Z'
            last_modified_date: '2016-01-01T01:01:01.000Z'
            impact:
              cvss_v2:
                integrity_impact: complete
                target_distribution: not_defined
                availability_requirement: not_defined
                exploitability: not_defined
                access_complexity: low
                temporal_vector_string: string
                exploitability_score: 10.0
                impact_score: 10.0
                user_interaction_required: true
                environmental_vector_string: string
                obtain_other_privilege: true
                availability_impact: complete
                access_vector: network
                base_severity: High
                confidentiality_impact: complete
                confidentiality_requirement: not_defined
                report_confidence: not_defined
                authentication: none
                base_score: 10.0
                obtain_user_privilege: true
                obtain_all_privilege: true
                collateral_damage_potential: not_defined
                remediation_level: not_defined
                vector_string: string
                integrity_requirement: not_defined
              cvss_v3:
                integrity_impact: high
                modified_user_interaction: none
                modified_scope: not_defined
                availability_requirement: high
                user_interaction: none
                modified_integrity_impact: not_defined
                privileges_required: high
                exploitability_score: 10.0
                impact_score: 10.0
                environmental_severity: critical
                modified_availability_impact: not_defined
                availability_impact: high
                scope: changed
                exploit_code_maturity: functional
                modified_attack_complexity: not_defined
                base_severity: critical
                confidentiality_impact: high
                temporal_severity: critical
                modified_confidentiality_impact: not_defined
                confidentiality_requirement: high
                report_confidence: confirmed
                temporal_score: 10.0
                modified_privileges_required: not_defined
                modified_attack_vector: not_defined
                base_score: 10.0
                environmental_score: 10.0
                remediation_level: high
                vector_string: string
                integrity_requirement: high
                attack_vector: adjacent_network
                attack_complexity: high
          description: a list of `Vulnerability`s.
          type: array
          items:
            $ref: '#/components/schemas/Vulnerability'
          uniqueItems: true
        coas:
          example:
          - description: string
            valid_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            stage: Containment
            schema_version: 1.3.30
            revision: 10
            efficacy: High
            type: coa
            related_COAs:
            - confidence: High
              source: string
              relationship: string
              COA_id: string
            source: string
            external_ids:
            - string
            short_description: string
            title: string
            external_references:
            - source_name: string
              description: string
              url: string
              hashes:
              - string
              external_id: string
            source_uri: string
            coa_type: Diplomatic Actions
            language: string
            id: string
            tlp: green
            objective:
            - string
            cost: High
            timestamp: '2016-01-01T01:01:01.000Z'
            open_c2_coa:
              type: structured_coa
              id: string
              action:
                type: alert
              target:
                type: acudid
                specifiers: string
              actuator:
                type: endpoint
                specifiers:
                - string
              modifiers:
                response: acknowledge
                method:
                - acl
                additional_properties:
                  context: string
                time:
                  start_time: '2016-01-01T01:01:01.000Z'
                  end_time: '2016-01-01T01:01:01.000Z'
                frequency: string
                duration: '2016-01-01T01:01:01.000Z'
                source: string
                search: cve
                option: string
                id: string
                location: internal
                delay: '2016-01-01T01:01:01.000Z'
                destination: copy-to
            structured_coa_type: openc2
            impact: string
          description: a list of `COA`s.
          type: array
          items:
            $ref: '#/components/schemas/COA'
          uniqueItems: true
      additionalProperties: false
    TargetRecord:
      example:
        description: string
        schema_version: 1.3.30
        revision: 10
        type: target-record
        source: string
        external_ids:
        - string
        targets:
        - type: endpoint
          observables:
          - value: 1.2.3.4
            type: ip
          observed_time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          os: string
          internal: false
          sensor: string
          source_uri: string
        short_description: string
        title: string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        source_uri: string
        language: string
        id: string
        tlp: green
        timestamp: '2016-01-01T01:01:01.000Z'
      description: "A TargetRecord is a Sighting that has no threat or observables associated\n  with it, it's a way of saying they saw a set of observables together as a Target."
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        type:
          example: target-record
          type: string
          enum:
          - target-record
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        targets:
          example:
          - type: endpoint
            observables:
            - value: 1.2.3.4
              type: ip
            observed_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            os: string
            internal: false
            sensor: string
            source_uri: string
          type: array
          items:
            $ref: '#/components/schemas/Target'
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
      additionalProperties: false
    Identity:
      example:
        description: string
        related_identities:
        - identity: string
          confidence: High
          information_source: string
          relationship: string
      description: Can contain information such as the name of the attacker, the group or organization they belong to, or any other identifier that can help in the attribution process.
      type: object
      properties:
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        related_identities:
          example:
          - identity: string
            confidence: High
            information_source: string
            relationship: string
          description: Identifies other entity Identities related to this Identity.
          type: array
          items:
            $ref: '#/components/schemas/RelatedIdentity'
      additionalProperties: false
    RelatedCOA:
      example:
        confidence: High
        source: string
        relationship: string
        COA_id: string
      type: object
      properties:
        confidence:
          example: High
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        source:
          example: string
          type: string
        relationship:
          example: string
          type: string
        COA_id:
          example: string
          description: A URI leading to a COA.
          type: string
      additionalProperties: false
      required:
      - COA_id
    CVSSv3:
      example:
        integrity_impact: high
        modified_user_interaction: none
        modified_scope: not_defined
        availability_requirement: high
        user_interaction: none
        modified_integrity_impact: not_defined
        privileges_required: high
        exploitability_score: 10.0
        impact_score: 10.0
        environmental_severity: critical
        modified_availability_impact: not_defined
        availability_impact: high
        scope: changed
        exploit_code_maturity: functional
        modified_attack_complexity: not_defined
        base_severity: critical
        confidentiality_impact: high
        temporal_severity: critical
        modified_confidentiality_impact: not_defined
        confidentiality_requirement: high
        report_confidence: confirmed
        temporal_score: 10.0
        modified_privileges_required: not_defined
        modified_attack_vector: not_defined
        base_score: 10.0
        environmental_score: 10.0
        remediation_level: high
        vector_string: string
        integrity_requirement: high
        attack_vector: adjacent_network
        attack_complexity: high
      type: object
      properties:
        integrity_impact:
          example: high
          description: measures the impact to integrity of a successfully exploited vulnerability
          type: string
          enum:
          - low
          - none
          - high
        modified_user_interaction:
          example: none
          description: modified user interaction
          type: string
          enum:
          - none
          - required
          - not_defined
        modified_scope:
          example: not_defined
          description: modified scope
          type: string
          enum:
          - changed
          - unchanged
          - not_defined
        availability_requirement:
          example: high
          description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
          type: string
          enum:
          - low
          - none
          - high
          - not_defined
        user_interaction:
          example: none
          description: captures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerable component
          type: string
          enum:
          - none
          - required
        modified_integrity_impact:
          example: not_defined
          description: modified integrity impact
          type: string
          enum:
          - low
          - none
          - high
          - not_defined
        privileges_required:
          example: high
          description: describes the level of privileges an attacker must possess before successfully exploiting the vulnerability
          type: string
          enum:
          - low
          - none
          - high
        exploitability_score:
          example: 10.0
          description: a Score number from 0 to 10
          type: number
          format: double
        impact_score:
          example: 10.0
          description: a Score number from 0 to 10
          type: number
          format: double
        environmental_severity:
          example: critical
          type: string
          enum:
          - low
          - none
          - high
          - medium
          - critical
        modified_availability_impact:
          example: not_defined
          description: modified availability impact
          type: string
          enum:
          - low
          - none
          - high
          - not_defined
        availability_impact:
          example: high
          description: measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability
          type: string
          enum:
          - low
          - none
          - high
        scope:
          example: changed
          description: the ability for a vulnerability in one software component to impact resources beyond its means, or privileges
          type: string
          enum:
          - changed
          - unchanged
        exploit_code_maturity:
          example: functional
          description: measures the likelihood of the vulnerability being attacked
          type: string
          enum:
          - high
          - unproven
          - functional
          - proof_of_concept
          - not_defined
        modified_attack_complexity:
          example: not_defined
          description: modified attack complexity
          type: string
          enum:
          - low
          - high
          - not_defined
        base_severity:
          example: critical
          type: string
          enum:
          - low
          - none
          - high
          - medium
          - critical
        confidentiality_impact:
          example: high
          description: measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability
          type: string
          enum:
          - low
          - none
          - high
        temporal_severity:
          example: critical
          description: temporal severity
          type: string
          enum:
          - low
          - none
          - high
          - medium
          - critical
        modified_confidentiality_impact:
          example: not_defined
          description: modified confidentiality impact
          type: string
          enum:
          - low
          - none
          - high
          - not_defined
        confidentiality_requirement:
          example: high
          description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
          type: string
          enum:
          - low
          - none
          - high
          - not_defined
        report_confidence:
          example: confirmed
          description: measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details
          type: string
          enum:
          - unknown
          - reasonable
          - confirmed
        temporal_score:
          example: 10.0
          description: Round up(CVSSv3BaseScore × CVSSv3ExploitCodeMaturity × CVSSv3RemediationLevel × CVSSv3ReportConfidence)
          type: number
          format: double
        modified_privileges_required:
          example: not_defined
          description: modified privileges required
          type: string
          enum:
          - low
          - none
          - high
          - not_defined
        modified_attack_vector:
          example: not_defined
          description: modified attack vector
          type: string
          enum:
          - network
          - adjacent_network
          - local
          - physical
          - not_defined
        base_score:
          example: 10.0
          description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v3-1'
          type: number
          format: double
        environmental_score:
          example: 10.0
          description: a Score number from 0 to 10
          type: number
          format: double
        remediation_level:
          example: high
          description: Remediation Level of a vulnerability is an important factor for prioritization
          type: string
          enum:
          - temporary_fix
          - offical_fix
          - high
          - workaround
          - unavailable
          - not_defined
        vector_string:
          example: string
          description: a text representation of a set of CVSSv3 metrics. It is commonly used to record or transfer CVSSv3 metric information in a concise form
          type: string
        integrity_requirement:
          example: high
          description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
          type: string
          enum:
          - low
          - none
          - high
          - not_defined
        attack_vector:
          example: adjacent_network
          description: Reflects the context by which vulnerability exploitation is possible
          type: string
          enum:
          - network
          - adjacent_network
          - local
          - physical
        attack_complexity:
          example: high
          description: describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability
          type: string
          enum:
          - low
          - high
      additionalProperties: false
      required:
      - base_severity
      - base_score
      - vector_string
    Architecture:
      example:
        prevalence: Often
        name: string
        class: Embedded
      type: object
      properties:
        prevalence:
          example: Often
          description: Defines the different regularities that guide the applicability of platforms.
          type: string
          enum:
          - Undetermined
          - Sometimes
          - Often
          - Rarely
        name:
          example: string
          description: Architecture name (ARM, x86, ...)
          type: string
        class:
          example: Embedded
          description: Class of architecture
          type: string
      additionalProperties: false
    Note:
      example:
        schema_version: 1.3.30
        revision: 10
        content: string
        note_class: keyword
        type: note
        source: string
        external_ids:
        - string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        author: string
        source_uri: string
        language: string
        id: string
        tlp: green
        timestamp: '2016-01-01T01:01:01.000Z'
        related_entities:
        - entity_type: string
          entity_id: string
      description: 'A Note is intended to convey informative text to provide further context and/or to provide additional analysis not contained in the Objects, assigning Text/content to the Object the Note relates to Notes can be created by anyone (not just the original object creator).

        For example, an analyst may add a Note to a Campaign object created by another organization indicating that they''ve seen posts related to that Campaign on a hacker forum.'
      type: object
      properties:
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        content:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        note_class:
          example: keyword
          type: string
        type:
          example: note
          type: string
          enum:
          - note
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        author:
          example: string
          type: string
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        related_entities:
          example:
          - entity_type: string
            entity_id: string
          type: array
          items:
            $ref: '#/components/schemas/NoteRelatedEntity'
      additionalProperties: false
    ExternalReference:
      example:
        source_name: string
        description: string
        url: string
        hashes:
        - string
        external_id: string
      description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
      type: object
      properties:
        source_name:
          example: string
          description: The source within which the external-reference is defined (system, registry, organization, etc.)
          type: string
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        url:
          example: string
          description: A URL reference to an external resource.
          type: string
        hashes:
          example:
          - string
          description: Specifies a dictionary of hashes for the contents of the url.
          type: array
          items:
            type: string
        external_id:
          example: string
          description: An identifier for the external reference content.
          type: string
      additionalProperties: false
      required:
      - source_name
    Campaign:
      example:
        description: string
        valid_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        schema_version: 1.3.30
        revision: 10
        type: campaign
        campaign_type: string
        source: string
        external_ids:
        - string
        short_description: string
        title: string
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        activity:
        - date_time: '2016-01-01T01:01:01.000Z'
          description: string
        source_uri: string
        intended_effect:
        - Account Takeover
        status: Future
        language: string
        id: string
        tlp: green
        timestamp: '2016-01-01T01:01:01.000Z'
        confidence: High
        names:
        - string
      description: Represents a campaign by an [actor](actor.md) pursing an intent.
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        type:
          example: campaign
          type: string
          enum:
          - campaign
        campaign_type:
          example: string
          description: 'String value that describes the type of campaign. For example, a campaign type could be ''Ransomware'', ''Advanced Persistent Threat'', ''Business Email Compromise'', ''Phishing'', etc. '
          type: string
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        activity:
          example:
          - date_time: '2016-01-01T01:01:01.000Z'
            description: string
          description: 'Used to capture specific activities or tactics associated with the campaign.

            The ''activity'' field is an array of objects, and each element represents a specific activity and time associated with the campaign. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc. By capturing these activities analysts can identify the specific tactics used by the threat actor(s) behind the campaign.'
          type: array
          items:
            $ref: '#/components/schemas/Activity'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        intended_effect:
          example:
          - Account Takeover
          description: Characterizes the intended effect of this cyber threat campaign.
          type: array
          items:
            type: string
        status:
          example: Future
          description: "Indicates current Status of the Campaign. \n\nCan have one of the following values: \n\n- Ongoing: Indicates that the campaign is currently active and ongoing. For   example, a mass phishing campaign that is actively targeting users is   considered 'ongoing'.\n\n- Historic: Campaign has already occurred and is now in the past.\n\n- Future: This indicates that a campaign is planned or expected to occur in the   future. For example, a threat actor may announce their intention to launch a   specific cyberattack campaign at a future date."
          type: string
          enum:
          - Historic
          - Future
          - Ongoing
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        confidence:
          example: High
          description: Level of confidence held in the characterization of this Campaign.
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        names:
          example:
          - string
          description: Used to capture alternate names or aliases associated with the campaign. A cyberattack campaign may have multiple names or aliases depending on the group or actor(s) behind the attack, e.g., 'Wannacry' is also known as 'WannaCrypt', 'WCry', 'Wanna Decryptor', etc.
          type: array
          items:
            type: string
      additionalProperties: false
  securitySchemes:
    JWT:
      type: apiKey
      in: header
      name: Authorization
      description: 'Ex: Bearer \<token\>'
    oauth2:
      type: oauth2
      flows:
        authorizationCode:
          scopes:
            private-intel: Private Intelligence Full Access
            private-intel:read: Private Intelligence Read Access
            private-intel:write: Private Intelligence Write Access
            casebook: Casebook Full Access
            casebook:read: Casebook Read Access
            casebook:write: Casebook Write Access
          authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
          tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token