openapi: 3.2.0 info: title: Conure Investigation Creation API version: conure-218-1-ee422dee license: name: All Rights Reserved url: https://www.cisco.com contact: name: Cisco Security Business Group -- Advanced Threat email: cisco-intel-api-support@cisco.com description: XDR High Priority Incident and Investigation API x-provenance: method: harvested authored_by: Cisco XDR harvested_by: API Evangelist harvested_on: '2026-08-19' first_party: true provider_published: true source_host: visibility.amp.cisco.com note: Anonymously fetchable Swagger 2.0 for nine IROH services plus the CTIA threat-intelligence API. The host returns real 404s on invented paths, so the 200s are genuine. x-evidence: - type: source url: https://visibility.amp.cisco.com/iroh/iroh-int/swagger.json - type: source url: https://private.intel.amp.cisco.com/swagger.json tags: - name: Investigation Creation paths: /v2/investigation: post: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: type: object properties: investigation_id: type: string format: uuid required: - investigation_id application/transit+msgpack: schema: type: object properties: investigation_id: type: string format: uuid required: - investigation_id application/transit+json: schema: type: object properties: investigation_id: type: string format: uuid required: - investigation_id application/edn: schema: type: object properties: investigation_id: type: string format: uuid required: - investigation_id '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message tags: - Investigation Creation summary: Create Investigation security: - JWT-Bearer: [] - oauth2: [] requestBody: content: application/json: schema: type: object properties: observables: title: ObservablesList description: Observables that will be investigated type: array items: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. modules: title: Modules description: Module Ids that will be called during investigation for iroh-enrich. type: array items: type: string example: string description: String with at most 1024 characters. time_window: title: TimeWindow description: A window of start_time to end_time to filter returned sightings. type: object properties: start_time: title: StartTime description: Return events after this time. type: string format: date-time example: '2026-08-18T22:03:32.803876481Z' end_time: title: EndTime description: Will be used to filter Events that occurred before this time (defaults to now) type: string format: date-time example: '2026-08-18T22:03:32.803889681Z' required: - start_time source: title: InvestigationSource description: String with at most 1024 characters. type: string example: Cisco XDR Automated Question title: title: InvestigationTitle description: String with at most 1024 characters. type: string example: Which devices in my org was this sha seen on? description: title: InvestigationDescription description: String with at most 5000 characters. type: string example: 'For the following hashes: - sha256:defg...1234 - sha256:abcd..1234 Determine which devices in my org have instances of the file in the past 30 days' required: - observables application/transit+msgpack: schema: type: object properties: observables: title: ObservablesList description: Observables that will be investigated type: array items: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. modules: title: Modules description: Module Ids that will be called during investigation for iroh-enrich. type: array items: type: string example: string description: String with at most 1024 characters. time_window: title: TimeWindow description: A window of start_time to end_time to filter returned sightings. type: object properties: start_time: title: StartTime description: Return events after this time. type: string format: date-time example: '2026-08-18T22:03:32.803876481Z' end_time: title: EndTime description: Will be used to filter Events that occurred before this time (defaults to now) type: string format: date-time example: '2026-08-18T22:03:32.803889681Z' required: - start_time source: title: InvestigationSource description: String with at most 1024 characters. type: string example: Cisco XDR Automated Question title: title: InvestigationTitle description: String with at most 1024 characters. type: string example: Which devices in my org was this sha seen on? description: title: InvestigationDescription description: String with at most 5000 characters. type: string example: 'For the following hashes: - sha256:defg...1234 - sha256:abcd..1234 Determine which devices in my org have instances of the file in the past 30 days' required: - observables application/transit+json: schema: type: object properties: observables: title: ObservablesList description: Observables that will be investigated type: array items: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. modules: title: Modules description: Module Ids that will be called during investigation for iroh-enrich. type: array items: type: string example: string description: String with at most 1024 characters. time_window: title: TimeWindow description: A window of start_time to end_time to filter returned sightings. type: object properties: start_time: title: StartTime description: Return events after this time. type: string format: date-time example: '2026-08-18T22:03:32.803876481Z' end_time: title: EndTime description: Will be used to filter Events that occurred before this time (defaults to now) type: string format: date-time example: '2026-08-18T22:03:32.803889681Z' required: - start_time source: title: InvestigationSource description: String with at most 1024 characters. type: string example: Cisco XDR Automated Question title: title: InvestigationTitle description: String with at most 1024 characters. type: string example: Which devices in my org was this sha seen on? description: title: InvestigationDescription description: String with at most 5000 characters. type: string example: 'For the following hashes: - sha256:defg...1234 - sha256:abcd..1234 Determine which devices in my org have instances of the file in the past 30 days' required: - observables application/edn: schema: type: object properties: observables: title: ObservablesList description: Observables that will be investigated type: array items: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. modules: title: Modules description: Module Ids that will be called during investigation for iroh-enrich. type: array items: type: string example: string description: String with at most 1024 characters. time_window: title: TimeWindow description: A window of start_time to end_time to filter returned sightings. type: object properties: start_time: title: StartTime description: Return events after this time. type: string format: date-time example: '2026-08-18T22:03:32.803876481Z' end_time: title: EndTime description: Will be used to filter Events that occurred before this time (defaults to now) type: string format: date-time example: '2026-08-18T22:03:32.803889681Z' required: - start_time source: title: InvestigationSource description: String with at most 1024 characters. type: string example: Cisco XDR Automated Question title: title: InvestigationTitle description: String with at most 1024 characters. type: string example: Which devices in my org was this sha seen on? description: title: InvestigationDescription description: String with at most 5000 characters. type: string example: 'For the following hashes: - sha256:defg...1234 - sha256:abcd..1234 Determine which devices in my org have instances of the file in the past 30 days' required: - observables required: true operationId: postV2Investigation x-operation-id-source: derived /v2/investigation/bundle: post: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: type: object properties: investigation_id: type: string format: uuid created_threat_object_counts: type: object properties: sightings: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 indicators: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 verdicts: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 judgements: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 malwares: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 tools: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 attack_patterns: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 assets: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 required: - sightings - indicators - verdicts - judgements - malwares - tools - attack_patterns - assets required: - investigation_id - created_threat_object_counts application/transit+msgpack: schema: type: object properties: investigation_id: type: string format: uuid created_threat_object_counts: type: object properties: sightings: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 indicators: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 verdicts: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 judgements: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 malwares: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 tools: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 attack_patterns: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 assets: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 required: - sightings - indicators - verdicts - judgements - malwares - tools - attack_patterns - assets required: - investigation_id - created_threat_object_counts application/transit+json: schema: type: object properties: investigation_id: type: string format: uuid created_threat_object_counts: type: object properties: sightings: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 indicators: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 verdicts: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 judgements: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 malwares: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 tools: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 attack_patterns: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 assets: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 required: - sightings - indicators - verdicts - judgements - malwares - tools - attack_patterns - assets required: - investigation_id - created_threat_object_counts application/edn: schema: type: object properties: investigation_id: type: string format: uuid created_threat_object_counts: type: object properties: sightings: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 indicators: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 verdicts: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 judgements: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 malwares: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 tools: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 attack_patterns: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 assets: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 required: - sightings - indicators - verdicts - judgements - malwares - tools - attack_patterns - assets required: - investigation_id - created_threat_object_counts '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message tags: - Investigation Creation summary: Create Investigation from Snapshot security: - JWT-Bearer: [] - oauth2: [] requestBody: content: application/json: schema: type: object properties: bundle: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - bundle example: bundle description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. actors: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - actor example: actor description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Indicates the time span for which the information about the Actor is relevant, and after which it could become outdated. actor_types: type: array items: type: string example: Cyber Espionage Operations example: - Cyber Espionage Operations identity: type: object properties: description: type: string example: string description: Markdown string with at most 5000 characters. related_identities: type: array items: type: object properties: identity: type: string example: string description: The reference (URI) of the related Identity object. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: Specifies the level of confidence in the assertion of the relationship between the two objects. information_source: type: string example: string description: Specifies the source of the information about the relationship between the two components. relationship: type: string example: string required: - identity example: identity: string confidence: High information_source: string relationship: string description: Describes a related Identity example: - identity: string confidence: High information_source: string relationship: string description: Identifies other entity Identities related to this Identity. required: - description - related_identities example: description: string related_identities: - identity: string confidence: High information_source: string relationship: string description: Can contain information such as the name of the attacker, the group or organization they belong to, or any other identifier that can help in the attribution process. motivation: type: string example: Ego description: The reason or purpose behind the malicious activity attributed to this Actor. By understanding a threat actor's motivation, analysts can better predict the attacker's behavior and anticipate future malicious actions. sophistication: type: string enum: - Aspirant - Expert - Innovator - Novice - Practitioner example: Aspirant description: "Represents the level of expertise and skill that the threat actor has displayed in their malicious activities. Can help security analysts assess the potential impact of an attacker's TTPs and determine the potential attack surface. \n\nFor example, a threat actor with a low sophistication level may primarily rely on off-the-shelf malware and attack tools, while an attacker with high sophistication may use custom tools with advanced evasion techniques, zero-day exploits, and sophisticated methods for command and control of their malware. \n\nThe sophistication level of an attacker can also be inferred based on several factors such as the complexity of attacks, the attacker's knowledge of the targeted organization's systems, and the attacker's ability to remain undetected.\n\nIf an attacker shows a high level of sophistication in reconnaissances, social engineering, and phishing, then the attacker may have a good knowledge of the targeted organization and its employees. This means that the attacker may be more successful in infiltrating the organization's network and compromising its systems." intended_effect: type: string example: Account Takeover description: "Represents the desired outcome or impact the threat actor is trying to achieve through their malicious activities. \n\n Helps security analysts to understand the attacker's goals beyond the immediate impact of the attack. By understanding the intended effect, analysts can draw connections between seemingly unrelated attacks and build a more complete understanding of an attacker's long-term goals and motivations." planning_and_operational_support: type: string example: string description: "Provides information about the resources and capabilities of the attacker that could be used to assist in planning and operations related to the threat.\n\n It can be used to describe Infrastructure, Tools, Techniques, and Capabilities used by the threat actor." confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: 'This field can help analysts decide how much trust they can put in the information provided by the threat intelligence sources. For example, an Actor entity can have high confidence if the organization''s security researchers have been tracking it for a long time and have gathered a significant amount of intelligence about it through various sources, such as analysis of malware, network traffic, and human intelligence. In contrast, low confidence may indicate the organization has only seen limited or circumstantial evidence.' aliases: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: A list of other names that this Threat Actor is believed to use. required: - source - title - description - short_description example: description: string motivation: Ego valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' identity: description: string related_identities: - identity: string confidence: High information_source: string relationship: string sophistication: Aspirant schema_version: 1.3.30 revision: 10 planning_and_operational_support: string type: actor source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string intended_effect: Account Takeover language: string id: string tlp: green aliases: - string timestamp: '2016-01-01T01:01:01Z' confidence: High actor_types: - Cyber Espionage Operations description: Schema for submitting new Actors uniqueItems: true example: - description: string motivation: Ego valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' identity: description: string related_identities: - identity: string confidence: High information_source: string relationship: string sophistication: Aspirant schema_version: 1.3.30 revision: 10 planning_and_operational_support: string type: actor source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string intended_effect: Account Takeover language: string id: string tlp: green aliases: - string timestamp: '2016-01-01T01:01:01Z' confidence: High actor_types: - Cyber Espionage Operations description: a list of `NewActor`s. assets: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - asset example: asset description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: 'Specifies the time range during which the asset is considered valid or accurate. For example, if an asset entity represents a device, the `valid_time` field could be used to indicate the period during which the device''s configuration information is deemed accurate.' asset_type: type: string enum: - application - data - device - network - person example: application description: 'Type of the Asset: Device, Person, Application, etc.' required: - source - valid_time - asset_type example: description: string asset_type: application valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 type: asset source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' description: Schema for submitting new Assets uniqueItems: true example: - description: string asset_type: application valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 type: asset source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' description: a list of `NewAsset`s. asset_mappings: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - asset-mapping example: asset-mapping description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: For each asset, we allow for the assertion of time bound properties.This gives us both a record of the current state of the asset,as well as history. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: 'Level of confidence held in the characterization of this AssetMapping e.g.: is it susceptible to manipulation or translation?' specificity: type: string enum: - Low - Medium - Unique example: Low description: Denotes the level of how many assets potentially could have this same identifier. stability: type: string enum: - Managed - Physical - Temporary example: Managed description: Do we manage when it changes, or is it always a time bound assignment? observable: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: An AssetMapping is a record that a specific Observable maps to an Asset for an indicated period of time. asset_ref: type: string example: string description: URI that points to the mapped Asset. asset_type: type: string enum: - application - data - device - network - person example: application description: 'Type of the mapped Asset: Device, Person, Application, etc.' required: - source - valid_time - confidence - specificity - stability - observable - asset_ref - asset_type example: asset_type: application valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' stability: Managed schema_version: 1.3.30 revision: 10 observable: value: 1.2.3.4 type: ip asset_ref: string type: asset-mapping source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' specificity: Low confidence: High description: Schema for submitting new AssetMapping. uniqueItems: true example: - asset_type: application valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' stability: Managed schema_version: 1.3.30 revision: 10 observable: value: 1.2.3.4 type: ip asset_ref: string type: asset-mapping source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' specificity: Low confidence: High description: a list of `NewAssetMapping`s. asset_properties: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - asset-properties example: asset-properties description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time range during which the AssetProperties is considered valid. asset_ref: type: string example: string description: URI that points to the associated Asset. properties: type: array items: type: object properties: name: type: string example: string description: The properties are an open vocabulary. value: type: string example: string required: - name - value example: name: string value: string example: - name: string value: string required: - source - valid_time - asset_ref example: properties: - name: string value: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 asset_ref: string type: asset-properties source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' description: Schema for submitting new AssetProperties uniqueItems: true example: - properties: - name: string value: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 asset_ref: string type: asset-properties source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' description: a list of `NewAssetProperties`s. attack_patterns: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - attack-pattern example: attack-pattern description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. kill_chain_phases: type: array items: type: object properties: kill_chain_name: type: string example: string description: The name of the kill chain. phase_name: type: string example: string description: The name of the phase in the kill chain. required: - kill_chain_name - phase_name example: kill_chain_name: string phase_name: string description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives. example: - kill_chain_name: string phase_name: string description: A kill chain is a series of steps that an attacker must go through to successfully achieve their objective. The concept was originally developed by the military, but has been adapted to the cybersecurity field to describe the steps an attacker goes through to compromise a target system and achieve their goal. x_mitre_data_sources: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: ATT&CK Technique.Data Sources. x_mitre_platforms: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: ATT&CK Technique.Platforms. x_mitre_contributors: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: ATT&CK Technique.Contributors. abstraction_level: type: string enum: - aggregate - category - detailed - meta - standard example: aggregate description: The CAPEC abstraction level for patterns describing techniques to attack a system. required: - title - description - short_description example: description: string abstraction_level: aggregate schema_version: 1.3.30 revision: 10 type: attack-pattern source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string x_mitre_platforms: - string language: string id: string tlp: green x_mitre_data_sources: - string kill_chain_phases: - kill_chain_name: string phase_name: string x_mitre_contributors: - string timestamp: '2016-01-01T01:01:01Z' description: For submitting a new AttackPattern uniqueItems: true example: - description: string abstraction_level: aggregate schema_version: 1.3.30 revision: 10 type: attack-pattern source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string x_mitre_platforms: - string language: string id: string tlp: green x_mitre_data_sources: - string kill_chain_phases: - kill_chain_name: string phase_name: string x_mitre_contributors: - string timestamp: '2016-01-01T01:01:01Z' description: a list of `NewAttackPattern`s. campaigns: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - campaign example: campaign description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Timestamp for the definition of a specific version of a campaign. campaign_type: type: string example: string description: 'String value that describes the type of campaign. For example, a campaign type could be ''Ransomware'', ''Advanced Persistent Threat'', ''Business Email Compromise'', ''Phishing'', etc. ' names: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: Used to capture alternate names or aliases associated with the campaign. A cyberattack campaign may have multiple names or aliases depending on the group or actor(s) behind the attack, e.g., 'Wannacry' is also known as 'WannaCrypt', 'WCry', 'Wanna Decryptor', etc. intended_effect: type: array items: type: string example: Account Takeover example: - Account Takeover description: Characterizes the intended effect of this cyber threat campaign. status: type: string enum: - Future - Historic - Ongoing example: Future description: "Indicates current Status of the Campaign. \n\nCan have one of the following values: \n\n- Ongoing: Indicates that the campaign is currently active and ongoing. For example, a mass phishing campaign that is actively targeting users is considered 'ongoing'.\n\n- Historic: Campaign has already occurred and is now in the past.\n\n- Future: This indicates that a campaign is planned or expected to occur in the future. For example, a threat actor may announce their intention to launch a specific cyberattack campaign at a future date." confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: Level of confidence held in the characterization of this Campaign. activity: type: array items: type: object properties: date_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Specifies the date and time at which the activity occured. description: type: string example: string description: A description of the activity. required: - date_time - description example: date_time: '2016-01-01T01:01:01Z' description: string description: Captures the specific activities or tactics associated with the entity. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc. example: - date_time: '2016-01-01T01:01:01Z' description: string description: 'Used to capture specific activities or tactics associated with the campaign. The ''activity'' field is an array of objects, and each element represents a specific activity and time associated with the campaign. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc. By capturing these activities analysts can identify the specific tactics used by the threat actor(s) behind the campaign.' required: - title - description - short_description - campaign_type example: description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 type: campaign campaign_type: string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string activity: - date_time: '2016-01-01T01:01:01Z' description: string source_uri: string intended_effect: - Account Takeover status: Future language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' confidence: High names: - string description: Schema for submitting new Campaigns uniqueItems: true example: - description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 type: campaign campaign_type: string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string activity: - date_time: '2016-01-01T01:01:01Z' description: string source_uri: string intended_effect: - Account Takeover status: Future language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' confidence: High names: - string description: a list of `NewCampaign`s. coas: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - coa example: coa description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. stage: type: string enum: - Containment - Eradication - Identification - Lessons Learned - Preparation - Recovery - Remedy - Response example: Containment description: Specifies what stage in the cyber threat management lifecycle this Course Of Action is relevant to. coa_type: type: string enum: - Diplomatic Actions - Eradication - Hardening - Internal Blocking - Logical Access Restrictions - Monitoring - Other - Patching - Perimeter Blocking - Phase - Physical Access Restrictions - Playbook - Policy Actions - Public Disclosure - Rebuilding - Redirection - Redirection (Honey Pot) - Task - Training example: Diplomatic Actions description: The type of this COA objective: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: Characterizes the objective to provide guidance on how to mitigate a security incident that has been identified. impact: type: string example: string description: Characterizes the estimated impact of applying this course of action. cost: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: Characterizes the estimated cost for applying this course of action. efficacy: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: Effectiveness of this course of action in achieving its targeted objective. related_COAs: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string COA_id: type: string example: string description: A URI leading to a COA. required: - COA_id example: confidence: High source: string relationship: string COA_id: string example: - confidence: High source: string relationship: string COA_id: string description: Identifies or characterizes relationships to one or more related courses of action. structured_coa_type: type: string enum: - openc2 example: openc2 open_c2_coa: type: object properties: type: type: string enum: - structured_coa example: structured_coa id: type: string example: string description: String with at most 1024 characters. action: type: object properties: type: type: string enum: - alert - allow - augment - contain - delete - deny - detonate - distill - get - investigate - locate - mitigate - modify - move - notify - other - pause - query - redirect - remediate - report - response - restart - restore - resume - save - scan - set - snapshot - start - stop - substitute - sync - throttle - update example: alert required: - type example: type: alert target: type: object properties: type: type: string example: acudid specifiers: type: string example: string description: Observable types that can be acted upon. required: - type example: type: acudid specifiers: string actuator: type: object properties: type: type: string enum: - endpoint - endpoint.digital-telephone-handset - endpoint.laptop - endpoint.pos-terminal - endpoint.printer - endpoint.sensor - endpoint.server - endpoint.smart-meter - endpoint.smart-phone - endpoint.tablet - endpoint.workstation - network - network.bridge - network.firewall - network.gateway - network.guard - network.hips - network.hub - network.ids - network.ips - network.modem - network.nic - network.proxy - network.router - network.security_manager - network.sense_making - network.sensor - network.switch - network.vpn - network.wap - other - process - process.aaa-server - process.anti-virus-scanner - process.connection-scanner - process.directory-service - process.dns-server - process.email-service - process.file-scanner - process.location-service - process.network-scanner - process.remediation-service - process.reputation-service - process.sandbox - process.virtualization-service - process.vulnerability-scanner example: endpoint specifiers: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: List of additional properties describing the actuator. required: - type example: type: endpoint specifiers: - string modifiers: type: object properties: delay: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard. duration: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard. frequency: type: string example: string description: String with at most 1024 characters. id: type: string example: string description: String with at most 1024 characters. time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. response: type: string enum: - acknowledge - command-ref - query - status example: acknowledge source: type: string example: string description: String with at most 1024 characters. destination: type: string enum: - copy-to - modify-to - move-to - report-to - restore-point - save-to - set-to example: copy-to method: type: array items: type: string enum: - acl - authenticated - blackhole - blacklist - graceful - hibernate - honeypot - immediate - segmentation - spawn - suspend - unauthenticated - whitelist example: acl example: - acl search: type: string enum: - cve - patch - signature - vendor_bulletin example: cve location: type: string enum: - internal - perimeter example: internal option: type: string example: string description: String with at most 1024 characters. additional_properties: type: object properties: context: type: string example: string description: String with at most 1024 characters. required: - context example: context: string example: response: acknowledge method: - acl additional_properties: context: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' frequency: string duration: '2016-01-01T01:01:01Z' source: string search: cve option: string id: string location: internal delay: '2016-01-01T01:01:01Z' destination: copy-to required: - type - action example: type: structured_coa id: string action: type: alert target: type: acudid specifiers: string actuator: type: endpoint specifiers: - string modifiers: response: acknowledge method: - acl additional_properties: context: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' frequency: string duration: '2016-01-01T01:01:01Z' source: string search: cve option: string id: string location: internal delay: '2016-01-01T01:01:01Z' destination: copy-to example: description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' stage: Containment schema_version: 1.3.30 revision: 10 efficacy: High type: coa related_COAs: - confidence: High source: string relationship: string COA_id: string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string coa_type: Diplomatic Actions language: string id: string tlp: green objective: - string cost: High timestamp: '2016-01-01T01:01:01Z' open_c2_coa: type: structured_coa id: string action: type: alert target: type: acudid specifiers: string actuator: type: endpoint specifiers: - string modifiers: response: acknowledge method: - acl additional_properties: context: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' frequency: string duration: '2016-01-01T01:01:01Z' source: string search: cve option: string id: string location: internal delay: '2016-01-01T01:01:01Z' destination: copy-to structured_coa_type: openc2 impact: string description: Schema for submitting new COAs uniqueItems: true example: - description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' stage: Containment schema_version: 1.3.30 revision: 10 efficacy: High type: coa related_COAs: - confidence: High source: string relationship: string COA_id: string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string coa_type: Diplomatic Actions language: string id: string tlp: green objective: - string cost: High timestamp: '2016-01-01T01:01:01Z' open_c2_coa: type: structured_coa id: string action: type: alert target: type: acudid specifiers: string actuator: type: endpoint specifiers: - string modifiers: response: acknowledge method: - acl additional_properties: context: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' frequency: string duration: '2016-01-01T01:01:01Z' source: string search: cve option: string id: string location: internal delay: '2016-01-01T01:01:01Z' destination: copy-to structured_coa_type: openc2 impact: string description: a list of `NewCOA`s. feedbacks: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - feedback example: feedback description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. entity_id: type: string example: string description: A URI leading to an entity. feedback: type: integer enum: - -1 - 0 - 1 example: -1 reason: type: string example: string required: - entity_id - feedback - reason example: feedback: -1 schema_version: 1.3.30 revision: 10 type: feedback source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string reason: string source_uri: string language: string id: string tlp: green entity_id: string timestamp: '2016-01-01T01:01:01Z' description: Schema for submitting new Feedback. uniqueItems: true example: - feedback: -1 schema_version: 1.3.30 revision: 10 type: feedback source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string reason: string source_uri: string language: string id: string tlp: green entity_id: string timestamp: '2016-01-01T01:01:01Z' description: a list of `NewFeedback`s. incidents: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - incident example: incident description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: 'Represents the level of certainty or trustworthiness associated with the incident. It denotes the reliability of the intelligence associated with the incident. The `confidence` field can take on several values, including: - `info`: Indicates that the incident information is based on sources with no previous track record or there is no track record for the source reporting the incident. - `low`: Indicates that the incident information is based on sources with a questionable track record or there is limited information about the accuracy of the source. - `medium`: Indicates that the incident information is based on sources with a mixed track record or of uncertain reliability. - `high`: Indicates that the incident information is based on sources with a proven track record and high degree of reliability. The `confidence` field can be used to indicate the level of trust and confidence that can be attributed to the incident, and it may impact how the incident is prioritized, analyzed and addressed. It can also help in the decision-making process associated with the incident response activities. It is important to note that the `confidence` field is subjective and can be interpreted differently by different organizations or analysts. As such, it is often used in conjunction with other intelligence attributes, such as the `severity` field, to provide a more complete picture of the incident.' status: type: string enum: - Closed - 'Closed: Confirmed Threat' - 'Closed: False Positive' - 'Closed: Merged' - 'Closed: Near-Miss' - 'Closed: Other' - 'Closed: Suspected' - 'Closed: Under Review' - Containment Achieved - Hold - 'Hold: External' - 'Hold: Internal' - 'Hold: Legal' - Incident Reported - New - 'New: Presented' - 'New: Processing' - Open - 'Open: Contained' - 'Open: Investigating' - 'Open: Recovered' - 'Open: Reported' - Rejected - Restoration Achieved - Stalled example: Closed description: The `status` field represents the current state of an incident within the incident management process. Its values help in tracking and reporting the progress of the incident from its discovery to its resolution. incident_time: type: object properties: opened: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time the incident was first opened. discovered: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time the incident was first discovered. reported: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time the incident was first reported. remediated: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time that the remediation of the damage from the incident was completed. closed: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time that the incident was last closed. rejected: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time that the incident was first rejected. contained: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time that the incident was first contained. required: - opened example: opened: '2016-01-01T01:01:01Z' discovered: '2016-01-01T01:01:01Z' reported: '2016-01-01T01:01:01Z' remediated: '2016-01-01T01:01:01Z' closed: '2016-01-01T01:01:01Z' rejected: '2016-01-01T01:01:01Z' contained: '2016-01-01T01:01:01Z' description: Relevant time values associated with this Incident. meta: type: object additionalProperties: type: string example: string x-anyOf: - type: string example: string - type: number format: double example: 10.0 - type: string format: date-time example: '2016-01-01T01:01:01Z' - type: string example: keyword - type: boolean example: true example: keyword: string description: metadata associated to the incident. properties: {} scores: type: object additionalProperties: type: number format: double example: 10.0 description: A non-negative score number. example: asset: 10.0 description: Used to indicate the severity or impact score of the threat represented by the incident. properties: {} categories: type: array items: type: string example: Attrition example: - Attrition description: A set of categories for this incident. discovery_method: type: string example: Agent Disclosure description: Identifies how the incident was discovered. intended_effect: type: string example: Account Takeover description: Specifies the suspected intended effect of this incident assignees: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: A set of owners assigned to this incident. detection_sources: type: array items: type: string example: string description: String with at most 2048 characters. example: - string description: A set of sources that contributed threat detections to the incident. promotion_method: type: string enum: - Automated - Manual example: Automated description: Describes method for promoting an Incident, whether manually or automatically. An Incident may be created manually by a SOAR analyst or SOC operator, or through an automated correlation or aggregation rule or engine that matches a specific set of events or alerts, and promotes them to Incident(s). detection_status: type: string enum: - active - inactive_expired - inactive_merged - inactive_oversized - inactive_user_closed example: active description: Represents the state of an incident within the incident generation process, indicating whether the incident is actively receiving updates or is no longer being updated. severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown example: Critical description: "Represents the potential impact of an incident on an organization's security posture and business operations. It helps organizations prioritize and allocate resources for incident response based on the severity level of the incident \nIt helps analysts and incident handlers prioritize incidents by indicating the level of risk and potential impact associated with the incident. This enables organizations to allocate resources efficiently and address the most critical incidents first.\nCan also be used to generate reports and metrics for measuring the effectiveness of the incident response process and to identify trends and patterns in the threat landscape.\nIt is important to note that the `severity` field is subjective and can be interpreted differently by different organizations or analysts. Therefore, it should be used in conjunction with other intelligence attributes, such as the `confidence` field, to provide a more comprehensive view of the incident." tactics: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: Represents the offensive techniques, approaches, or procedures that an adversary may use to achieve their objectives during an attack. It helps in understanding the intent and capabilities of the adversary and can be used to identify indicators of attack (IoAs) or indicators of compromise (IoCs) that are associated with the adversary's tactics. techniques: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: Represents the specific methods or actions used by an attacker to carry out an offensive maneuver or achieve their goals. short_id: type: string example: string description: A human-readable, short identifier for the incident, unique within an organization. required: - confidence - status - incident_time example: description: string assignees: - string detection_sources: - string meta: keyword: string schema_version: 1.3.30 revision: 10 type: incident source: string external_ids: - string short_description: string title: string incident_time: opened: '2016-01-01T01:01:01Z' discovered: '2016-01-01T01:01:01Z' reported: '2016-01-01T01:01:01Z' remediated: '2016-01-01T01:01:01Z' closed: '2016-01-01T01:01:01Z' rejected: '2016-01-01T01:01:01Z' contained: '2016-01-01T01:01:01Z' external_references: - source_name: string description: string url: string hashes: - string external_id: string discovery_method: Agent Disclosure source_uri: string intended_effect: Account Takeover categories: - Attrition status: Closed language: string detection_status: active id: string promotion_method: Automated severity: Critical tlp: green scores: asset: 10.0 techniques: - string timestamp: '2016-01-01T01:01:01Z' confidence: High short_id: string tactics: - string description: For submitting a new Incident. uniqueItems: true example: - description: string assignees: - string detection_sources: - string meta: keyword: string schema_version: 1.3.30 revision: 10 type: incident source: string external_ids: - string short_description: string title: string incident_time: opened: '2016-01-01T01:01:01Z' discovered: '2016-01-01T01:01:01Z' reported: '2016-01-01T01:01:01Z' remediated: '2016-01-01T01:01:01Z' closed: '2016-01-01T01:01:01Z' rejected: '2016-01-01T01:01:01Z' contained: '2016-01-01T01:01:01Z' external_references: - source_name: string description: string url: string hashes: - string external_id: string discovery_method: Agent Disclosure source_uri: string intended_effect: Account Takeover categories: - Attrition status: Closed language: string detection_status: active id: string promotion_method: Automated severity: Critical tlp: green scores: asset: 10.0 techniques: - string timestamp: '2016-01-01T01:01:01Z' confidence: High short_id: string tactics: - string description: a list of `NewIncident`s. indicators: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - indicator example: indicator description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time range during which this Indicator is considered valid. producer: type: string example: string description: String with at most 1024 characters. severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown example: Critical negate: type: boolean example: true description: Specifies the absence of the pattern. indicator_type: type: array items: type: string enum: - Anonymization - C2 - Compromised PKI Certificate - Domain Watchlist - Exfiltration - File Hash Watchlist - Host Characteristics - IMEI Watchlist - IMSI Watchlist - IP Watchlist - Login Name - Malicious E-mail - Malware Artifacts - Private Threat Feed - URL Watchlist example: Anonymization example: - Anonymization description: Specifies the type or types for this Indicator. tags: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: Descriptors for this indicator. composite_indicator_expression: type: object properties: operator: type: string enum: - and - not - or example: and indicator_ids: type: array items: type: string example: string description: A URI leading to an indicator. example: - string required: - operator - indicator_ids example: operator: and indicator_ids: - string likely_impact: type: string example: string description: Likely potential impact within the relevant context if this Indicator were to occur. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: level of confidence held in the accuracy of this Indicator. kill_chain_phases: type: array items: type: object properties: kill_chain_name: type: string example: string description: The name of the kill chain. phase_name: type: string example: string description: The name of the phase in the kill chain. required: - kill_chain_name - phase_name example: kill_chain_name: string phase_name: string description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives. example: - kill_chain_name: string phase_name: string description: Relevant kill chain phases indicated by this Indicator. test_mechanisms: type: array items: type: string example: string description: String with at most 2048 characters. example: - string description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator. specification: type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. x-anyOf: - type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. - type: object properties: type: type: string enum: - ThreatBrain example: ThreatBrain query: type: string example: string variables: type: array items: type: string example: string example: - string required: - type - variables example: type: ThreatBrain query: string variables: - string description: An indicator which runs in threatbrain... - type: object properties: type: type: string enum: - Snort example: Snort snort_sig: type: string example: string required: - type - snort_sig example: type: Snort snort_sig: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - SIOC example: SIOC SIOC: type: string example: string required: - type - SIOC example: type: SIOC SIOC: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - OpenIOC example: OpenIOC open_IOC: type: string example: string required: - type - open_IOC example: type: OpenIOC open_IOC: string description: An indicator which contains an XML blob of an openIOC indicator. required: - producer example: description: string tags: - string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' producer: string schema_version: 1.3.30 revision: 10 type: indicator test_mechanisms: - string source: string external_ids: - string short_description: string composite_indicator_expression: operator: and indicator_ids: - string title: string likely_impact: string indicator_type: - Anonymization external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string severity: Critical tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string negate: true timestamp: '2016-01-01T01:01:01Z' confidence: High specification: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: For submitting a new Indicator uniqueItems: true example: - description: string tags: - string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' producer: string schema_version: 1.3.30 revision: 10 type: indicator test_mechanisms: - string source: string external_ids: - string short_description: string composite_indicator_expression: operator: and indicator_ids: - string title: string likely_impact: string indicator_type: - Anonymization external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string severity: Critical tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string negate: true timestamp: '2016-01-01T01:01:01Z' confidence: High specification: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: a list of `NewIndicator`s. judgements: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - judgement example: judgement description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. observable: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. disposition: type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Matches :disposition_name as in {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"} disposition_name: type: string enum: - Clean - Common - Malicious - Suspicious - Unknown example: Clean description: String verdict identifiers. priority: type: integer format: int64 example: 10 description: A value 0-100 that determine the priority of a judgement. Curated feeds of black/white lists, for example known good products within your organizations, should use a 95. All automated systems should use a priority of 90, or less. Human judgements should have a priority of 100, so that humans can always override machines. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown example: Critical valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. reason: type: string example: string description: String with at most 1024 characters. reason_uri: type: string example: string description: A URI required: - source - observable - priority - confidence - severity example: valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 observable: value: 1.2.3.4 type: ip reason_uri: string type: judgement source: string external_ids: - string disposition: 1 external_references: - source_name: string description: string url: string hashes: - string external_id: string reason: string source_uri: string disposition_name: Clean priority: 10 language: string id: string severity: Critical tlp: green timestamp: '2016-01-01T01:01:01Z' confidence: High description: Schema for submitting new Judgements. uniqueItems: true example: - valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 observable: value: 1.2.3.4 type: ip reason_uri: string type: judgement source: string external_ids: - string disposition: 1 external_references: - source_name: string description: string url: string hashes: - string external_id: string reason: string source_uri: string disposition_name: Clean priority: 10 language: string id: string severity: Critical tlp: green timestamp: '2016-01-01T01:01:01Z' confidence: High description: a list of `NewJudgement`s. malwares: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - malware example: malware description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. labels: type: array items: type: string example: adware description: Malware label is an open vocabulary that represents different types and functions of malware. Malware labels are not mutually exclusive; a malware instance can be both spyware and a screen capture tool. example: - adware description: The type of malware being described. kill_chain_phases: type: array items: type: object properties: kill_chain_name: type: string example: string description: The name of the kill chain. phase_name: type: string example: string description: The name of the phase in the kill chain. required: - kill_chain_name - phase_name example: kill_chain_name: string phase_name: string description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives. example: - kill_chain_name: string phase_name: string description: The list of Kill Chain Phases for which this Malware can be used. x_mitre_aliases: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: ATT&CK Software.aliases. abstraction_level: type: string enum: - family - variant - version example: family description: Malware abstraction level. required: - title - description - short_description - labels example: description: string labels: - adware abstraction_level: family schema_version: 1.3.30 revision: 10 type: malware x_mitre_aliases: - string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string timestamp: '2016-01-01T01:01:01Z' description: For submitting a new Malware. uniqueItems: true example: - description: string labels: - adware abstraction_level: family schema_version: 1.3.30 revision: 10 type: malware x_mitre_aliases: - string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string timestamp: '2016-01-01T01:01:01Z' description: a list of `NewMalware`s. notes: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - note example: note description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. note_class: type: string example: keyword content: type: string example: string description: Markdown string with at most 5000 characters. related_entities: type: array items: type: object properties: entity_type: type: string example: string entity_id: type: string example: string description: A URI leading to an entity. required: - entity_type - entity_id example: entity_type: string entity_id: string example: - entity_type: string entity_id: string author: type: string example: string required: - note_class - content - related_entities example: schema_version: 1.3.30 revision: 10 content: string note_class: keyword type: note source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string author: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' related_entities: - entity_type: string entity_id: string description: Schema for submitting Notes uniqueItems: true example: - schema_version: 1.3.30 revision: 10 content: string note_class: keyword type: note source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string author: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' related_entities: - entity_type: string entity_id: string description: a list of `NewNote`s. relationships: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - relationship example: relationship description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. relationship_type: type: string example: attributed-to source_ref: type: string example: string description: A URI leading to an entity. target_ref: type: string example: string description: A URI leading to an entity. required: - relationship_type - source_ref - target_ref example: description: string schema_version: 1.3.30 revision: 10 target_ref: string type: relationship source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string source_ref: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' relationship_type: attributed-to description: Schema for submitting new Relationships. uniqueItems: true example: - description: string schema_version: 1.3.30 revision: 10 target_ref: string type: relationship source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string source_ref: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' relationship_type: attributed-to description: a list of `NewRelationship`s. sightings: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - sighting example: sighting description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. observed_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High count: type: integer format: int64 example: 10 description: 'The number of times an indicator was observed within a certain period of time. For example, if an IP address associated with known malicious activity is observed once within a period of time, it may indicate a low-level threat. However, if the same IP address is observed multiple times within a short time frame, it may indicate a more severe and persistent threat. It can also be used to prioritize security alerts and indicate the urgency of a response. High counts indicate that an indicator is actively being used in a larger campaign, while low counts may indicate isolated incidents.' internal: type: boolean example: false description: "If `true`, indicates that the sighting was reported from internal sources, such as an organization's own internal security tools or SOC.\n Internal sightings are often considered more reliable and actionable than external sightings, which are reported from external sources and may have a lower level of trustworthiness. Internal sightings can provide more context and can help identify potential threats that are unique to a particular environment or organization.\n Internal sightings can also help organizations prioritize their security response efforts by identifying threats that are specific to their environment and may not yet be widely known." severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown example: Critical resolution: type: string example: detected description: Represents the disposition or actions taken on the associated threat intelligence. data: type: object properties: columns: type: array items: type: object properties: name: type: string example: string type: type: string enum: - integer - markdown - number - observable - string - url example: integer description: type: string example: string description: Markdown string with at most 5000 characters. required: type: boolean example: true description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`. short_description: type: string example: string required: - name - type example: name: string type: integer description: string required: true short_description: string example: - name: string type: integer description: string required: true short_description: string description: an ordered list of column definitions rows: type: array items: type: array items: example: anything example: - - anything description: an ordered list of rows row_count: type: integer format: int64 example: 10 description: The number of rows in the data table. required: - columns - rows example: columns: - name: string type: integer description: string required: true short_description: string rows: - - anything row_count: 10 description: An embedded data table for the Sighting. sensor: type: string example: endpoint description: The OpenC2 Actuator name that best fits the device that is creating this sighting (e.g. network.firewall) sensor_coordinates: type: object properties: type: type: string example: endpoint description: The sensor/actuator name that best fits a device. observables: type: array items: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. example: - value: 1.2.3.4 type: ip os: type: string example: string required: - type - observables example: type: endpoint observables: - value: 1.2.3.4 type: ip os: string description: Describes the device that made the sighting (sensor) and contains identifying observables for the sensor. targets: type: array items: type: object properties: type: type: string example: endpoint description: The sensor/actuator name that best fits a device. observables: type: array items: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. example: - value: 1.2.3.4 type: ip observed_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). os: type: string example: string required: - type - observables - observed_time example: type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string description: Describes the target of the sighting and contains identifying observables for the target. example: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string description: 'May include one or more targets that observed the associated indicator. Targets can include network devices, host devices, or other entities that are capable of detecting indicators of compromise. Can be used to assess the scope of potential threats, helping analysts understand which devices or components of the network may be vulnerable to attack. For example, if a particular malware strain is detected on several different systems within an organization, the `targets` field may indicate which systems are affected and which may need to be isolated or patched to prevent further spread.' observables: type: array items: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. example: - value: 1.2.3.4 type: ip description: The object(s) of interest. relations: type: array items: type: object properties: origin: type: string example: string origin_uri: type: string example: string description: A URI relation: type: string example: Allocated relation_info: type: object additionalProperties: example: anything example: keyword: anything properties: {} source: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. related: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. required: - origin - relation - source - related example: origin: string origin_uri: string relation: Allocated relation_info: keyword: anything source: value: 1.2.3.4 type: ip related: value: 1.2.3.4 type: ip description: A relation inside a Sighting. example: - origin: string origin_uri: string relation: Allocated relation_info: keyword: anything source: value: 1.2.3.4 type: ip related: value: 1.2.3.4 type: ip description: Provide any context we can about where the observable came from. context: type: object properties: process_create_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. type: type: string enum: - ProcessCreateEvent example: ProcessCreateEvent process_args: type: string example: string description: String with at most 2048 characters. process_hash: type: string example: string description: String with at most 2048 characters. process_size: type: integer format: int64 example: 10 process_disposition: type: string example: string description: String with at most 1024 characters. parent_creation_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard. parent_process_id: type: integer format: int64 example: 10 parent_process_guid: type: integer format: int64 example: 10 parent_process_name: type: string example: string description: String with at most 1024 characters. parent_process_args: type: string example: string description: String with at most 2048 characters. parent_process_username: type: string example: string description: String with at most 1024 characters. parent_process_hash: type: string example: string description: String with at most 2048 characters. parent_process_size: type: integer format: int64 example: 10 parent_process_disposition: type: string example: string description: String with at most 1024 characters. required: - time - process_id - process_name - type example: parent_process_name: string process_guid: 10 parent_process_guid: 10 process_disposition: string parent_process_size: 10 process_size: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_disposition: string type: ProcessCreateEvent parent_process_username: string parent_process_id: 10 parent_process_args: string process_name: string process_hash: string process_id: 10 parent_process_hash: string process_username: string parent_creation_time: '2016-01-01T01:01:01Z' process_args: string example: - parent_process_name: string process_guid: 10 parent_process_guid: 10 process_disposition: string parent_process_size: 10 process_size: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_disposition: string type: ProcessCreateEvent parent_process_username: string parent_process_id: 10 parent_process_args: string process_name: string process_hash: string process_id: 10 parent_process_hash: string process_username: string parent_creation_time: '2016-01-01T01:01:01Z' process_args: string description: a list of `ProcessCreate` library_load_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. type: type: string enum: - LibraryLoadEvent example: LibraryLoadEvent dll_library_name: type: string example: string description: String with at most 1024 characters. dll_library_path: type: string example: string description: String with at most 2048 characters. required: - time - process_id - process_name - type - dll_library_name - dll_library_path example: time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string type: LibraryLoadEvent dll_library_name: string dll_library_path: string example: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string type: LibraryLoadEvent dll_library_name: string dll_library_path: string description: a list of `LibraryLoadType` file_create_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. file_name: type: string example: string description: String with at most 1024 characters. file_path: type: string example: string description: String with at most 2048 characters. type: type: string enum: - FileCreateEvent example: FileCreateEvent failed: type: boolean example: false required: - time - process_id - process_name - file_name - file_path - type example: file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileCreateEvent file_path: string process_name: string process_id: 10 process_username: string failed: false example: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileCreateEvent file_path: string process_name: string process_id: 10 process_username: string failed: false description: a list of `FileCreateType` file_delete_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. file_name: type: string example: string description: String with at most 1024 characters. file_path: type: string example: string description: String with at most 2048 characters. type: type: string enum: - FileDeleteEvent example: FileDeleteEvent failed: type: boolean example: false required: - time - process_id - process_name - file_name - file_path - type example: file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileDeleteEvent file_path: string process_name: string process_id: 10 process_username: string failed: false example: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileDeleteEvent file_path: string process_name: string process_id: 10 process_username: string failed: false description: a list of `FileDeleteType` file_modify_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. file_name: type: string example: string description: String with at most 1024 characters. file_path: type: string example: string description: String with at most 2048 characters. type: type: string enum: - FileModifyEvent example: FileModifyEvent failed: type: boolean example: false required: - time - process_id - process_name - file_name - file_path - type example: file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileModifyEvent file_path: string process_name: string process_id: 10 process_username: string failed: false example: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileModifyEvent file_path: string process_name: string process_id: 10 process_username: string failed: false description: a list of `FileModifyType` file_move_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. file_name: type: string example: string description: String with at most 1024 characters. file_path: type: string example: string description: String with at most 2048 characters. type: type: string enum: - FileMoveEvent example: FileMoveEvent old_name: type: string example: string description: String with at most 1024 characters. new_name: type: string example: string description: String with at most 1024 characters. required: - time - process_id - process_name - file_name - file_path - type - old_name - new_name example: file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileMoveEvent old_name: string file_path: string process_name: string process_id: 10 process_username: string new_name: string example: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileMoveEvent old_name: string file_path: string process_name: string process_id: 10 process_username: string new_name: string description: a list of `FileMoveType` netflow_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. type: type: string enum: - NetflowEvent example: NetflowEvent traffic: type: object properties: protocol: type: integer format: int64 example: 10 description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml) source_ip: type: string example: string destination_ip: type: string example: string source_port: type: integer format: int64 example: 10 destination_port: type: integer format: int64 example: 10 direction: type: string enum: - incoming - outgoing example: incoming destination_host_name: type: string example: string source_subnet: type: string example: string destination_subnet: type: string example: string required: - protocol - source_ip - destination_ip - source_port - destination_port - direction example: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 process_path: type: string example: string description: String with at most 1024 characters. process_args: type: string example: string description: String with at most 1024 characters. process_hash: type: string example: string description: String with at most 1024 characters. process_account_type: type: string example: string description: String with at most 1024 characters. process_account: type: string example: string description: String with at most 1024 characters. parent_process_id: type: integer format: int64 example: 10 parent_process_name: type: string example: string description: String with at most 1024 characters. parent_process_path: type: string example: string description: String with at most 1024 characters. parent_process_args: type: string example: string description: String with at most 1024 characters. parent_process_hash: type: string example: string description: String with at most 1024 characters. parent_process_account: type: string example: string description: String with at most 1024 characters. parent_process_account_type: type: string example: string description: String with at most 1024 characters. flow_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard. byte_count_out: type: integer format: int64 example: 10 byte_count_in: type: integer format: int64 example: 10 required: - time - process_id - process_name - type - traffic example: parent_process_name: string byte_count_in: 10 process_guid: 10 process_path: string traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 flow_time: '2016-01-01T01:01:01Z' time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_account: string type: NetflowEvent process_account_type: string parent_process_path: string parent_process_id: 10 parent_process_args: string process_name: string process_account: string parent_process_account_type: string process_hash: string process_id: 10 parent_process_hash: string process_username: string byte_count_out: 10 process_args: string example: - parent_process_name: string byte_count_in: 10 process_guid: 10 process_path: string traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 flow_time: '2016-01-01T01:01:01Z' time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_account: string type: NetflowEvent process_account_type: string parent_process_path: string parent_process_id: 10 parent_process_args: string process_name: string process_account: string parent_process_account_type: string process_hash: string process_id: 10 parent_process_hash: string process_username: string byte_count_out: 10 process_args: string description: a list of `NetflowType` http_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. type: type: string enum: - HTTPEvent example: HTTPEvent host: type: string example: string description: String with at most 1024 characters. traffic: type: object properties: protocol: type: integer format: int64 example: 10 description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml) source_ip: type: string example: string destination_ip: type: string example: string source_port: type: integer format: int64 example: 10 destination_port: type: integer format: int64 example: 10 direction: type: string enum: - incoming - outgoing example: incoming destination_host_name: type: string example: string source_subnet: type: string example: string destination_subnet: type: string example: string required: - protocol - source_ip - destination_ip - source_port - destination_port - direction example: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 url_port: type: integer format: int64 example: 10 query: type: string example: string description: String with at most 5000 characters. encrypted: type: boolean example: true method: type: string enum: - CONNECT - GET - HEAD - OPTIONS - PATCH - POST - PUT - TRACE example: CONNECT required: - time - process_id - process_name - type - host - traffic example: process_guid: 10 traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 method: CONNECT time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: HTTPEvent host: string process_name: string process_id: 10 process_username: string query: string encrypted: true url_port: 10 example: - process_guid: 10 traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 method: CONNECT time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: HTTPEvent host: string process_name: string process_id: 10 process_username: string query: string encrypted: true url_port: 10 description: a list of `HTTPType` registry_create_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. registry_key: type: string example: string description: String with at most 1024 characters. type: type: string enum: - RegistryCreateEvent example: RegistryCreateEvent required: - time - process_id - process_name - registry_key - type example: time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryCreateEvent example: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryCreateEvent description: a list of `RegistryCreateType` registry_set_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. registry_key: type: string example: string description: String with at most 1024 characters. type: type: string enum: - RegistrySetEvent example: RegistrySetEvent registry_value: type: string example: string description: String with at most 2048 characters. registry_data_length: type: integer format: int64 example: 10 registry_data: type: string example: string description: String with at most 5000 characters. required: - time - process_id - process_name - registry_key - type - registry_value example: process_guid: 10 registry_data: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: RegistrySetEvent registry_data_length: 10 registry_value: string registry_key: string process_name: string process_id: 10 process_username: string example: - process_guid: 10 registry_data: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: RegistrySetEvent registry_data_length: 10 registry_value: string registry_key: string process_name: string process_id: 10 process_username: string description: a list of `RegistrySetType` registry_delete_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. registry_key: type: string example: string description: String with at most 1024 characters. type: type: string enum: - RegistryDeleteEvent example: RegistryDeleteEvent registry_value: type: string example: string description: String with at most 2048 characters. required: - time - process_id - process_name - registry_key - type example: time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryDeleteEvent registry_value: string example: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryDeleteEvent registry_value: string description: a list of `RegistryDeleteType` registry_rename_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. registry_key: type: string example: string description: String with at most 1024 characters. type: type: string enum: - RegistryRenameEvent example: RegistryRenameEvent registry_old_key: type: string example: string description: String with at most 1024 characters. required: - time - process_id - process_name - registry_key - type - registry_old_key example: time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryRenameEvent registry_old_key: string example: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryRenameEvent registry_old_key: string description: a list of `RegistryRenameType` example: http_events: - process_guid: 10 traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 method: CONNECT time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: HTTPEvent host: string process_name: string process_id: 10 process_username: string query: string encrypted: true url_port: 10 process_create_events: - parent_process_name: string process_guid: 10 parent_process_guid: 10 process_disposition: string parent_process_size: 10 process_size: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_disposition: string type: ProcessCreateEvent parent_process_username: string parent_process_id: 10 parent_process_args: string process_name: string process_hash: string process_id: 10 parent_process_hash: string process_username: string parent_creation_time: '2016-01-01T01:01:01Z' process_args: string registry_delete_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryDeleteEvent registry_value: string file_modify_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileModifyEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_set_events: - process_guid: 10 registry_data: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: RegistrySetEvent registry_data_length: 10 registry_value: string registry_key: string process_name: string process_id: 10 process_username: string file_create_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileCreateEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_create_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryCreateEvent library_load_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string type: LibraryLoadEvent dll_library_name: string dll_library_path: string file_move_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileMoveEvent old_name: string file_path: string process_name: string process_id: 10 process_username: string new_name: string file_delete_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileDeleteEvent file_path: string process_name: string process_id: 10 process_username: string failed: false netflow_events: - parent_process_name: string byte_count_in: 10 process_guid: 10 process_path: string traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 flow_time: '2016-01-01T01:01:01Z' time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_account: string type: NetflowEvent process_account_type: string parent_process_path: string parent_process_id: 10 parent_process_args: string process_name: string process_account: string parent_process_account_type: string process_hash: string process_id: 10 parent_process_hash: string process_username: string byte_count_out: 10 process_args: string registry_rename_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryRenameEvent registry_old_key: string description: Context including the event type that best fits the type of the sighting. activity_interval: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time interval during which the malicious activity occurred. For example, the time when a malware sample was executing, or the time range of a network intrusion. detection_interval: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time interval during which the malicious activity was detected by the source engine or security tool. This may differ from the activity_interval if detection occurred after the activity. modification_interval: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time interval during which the sighting record was created or last updated in the system. required: - observed_time example: description: string schema_version: 1.3.30 revision: 10 relations: - origin: string origin_uri: string relation: Allocated relation_info: keyword: anything source: value: 1.2.3.4 type: ip related: value: 1.2.3.4 type: ip sensor_coordinates: type: endpoint observables: - value: 1.2.3.4 type: ip os: string observables: - value: 1.2.3.4 type: ip type: sighting source: string external_ids: - string targets: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string short_description: string title: string resolution: detected internal: false external_references: - source_name: string description: string url: string hashes: - string external_id: string detection_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' source_uri: string activity_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' language: string id: string count: 10 severity: Critical tlp: green modification_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' context: http_events: - process_guid: 10 traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 method: CONNECT time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: HTTPEvent host: string process_name: string process_id: 10 process_username: string query: string encrypted: true url_port: 10 process_create_events: - parent_process_name: string process_guid: 10 parent_process_guid: 10 process_disposition: string parent_process_size: 10 process_size: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_disposition: string type: ProcessCreateEvent parent_process_username: string parent_process_id: 10 parent_process_args: string process_name: string process_hash: string process_id: 10 parent_process_hash: string process_username: string parent_creation_time: '2016-01-01T01:01:01Z' process_args: string registry_delete_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryDeleteEvent registry_value: string file_modify_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileModifyEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_set_events: - process_guid: 10 registry_data: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: RegistrySetEvent registry_data_length: 10 registry_value: string registry_key: string process_name: string process_id: 10 process_username: string file_create_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileCreateEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_create_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryCreateEvent library_load_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string type: LibraryLoadEvent dll_library_name: string dll_library_path: string file_move_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileMoveEvent old_name: string file_path: string process_name: string process_id: 10 process_username: string new_name: string file_delete_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileDeleteEvent file_path: string process_name: string process_id: 10 process_username: string failed: false netflow_events: - parent_process_name: string byte_count_in: 10 process_guid: 10 process_path: string traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 flow_time: '2016-01-01T01:01:01Z' time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_account: string type: NetflowEvent process_account_type: string parent_process_path: string parent_process_id: 10 parent_process_args: string process_name: string process_account: string parent_process_account_type: string process_hash: string process_id: 10 parent_process_hash: string process_username: string byte_count_out: 10 process_args: string registry_rename_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryRenameEvent registry_old_key: string timestamp: '2016-01-01T01:01:01Z' confidence: High observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' sensor: endpoint data: columns: - name: string type: integer description: string required: true short_description: string rows: - - anything row_count: 10 description: For submitting a new Sighting. uniqueItems: true example: - description: string schema_version: 1.3.30 revision: 10 relations: - origin: string origin_uri: string relation: Allocated relation_info: keyword: anything source: value: 1.2.3.4 type: ip related: value: 1.2.3.4 type: ip sensor_coordinates: type: endpoint observables: - value: 1.2.3.4 type: ip os: string observables: - value: 1.2.3.4 type: ip type: sighting source: string external_ids: - string targets: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string short_description: string title: string resolution: detected internal: false external_references: - source_name: string description: string url: string hashes: - string external_id: string detection_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' source_uri: string activity_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' language: string id: string count: 10 severity: Critical tlp: green modification_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' context: http_events: - process_guid: 10 traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 method: CONNECT time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: HTTPEvent host: string process_name: string process_id: 10 process_username: string query: string encrypted: true url_port: 10 process_create_events: - parent_process_name: string process_guid: 10 parent_process_guid: 10 process_disposition: string parent_process_size: 10 process_size: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_disposition: string type: ProcessCreateEvent parent_process_username: string parent_process_id: 10 parent_process_args: string process_name: string process_hash: string process_id: 10 parent_process_hash: string process_username: string parent_creation_time: '2016-01-01T01:01:01Z' process_args: string registry_delete_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryDeleteEvent registry_value: string file_modify_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileModifyEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_set_events: - process_guid: 10 registry_data: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: RegistrySetEvent registry_data_length: 10 registry_value: string registry_key: string process_name: string process_id: 10 process_username: string file_create_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileCreateEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_create_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryCreateEvent library_load_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string type: LibraryLoadEvent dll_library_name: string dll_library_path: string file_move_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileMoveEvent old_name: string file_path: string process_name: string process_id: 10 process_username: string new_name: string file_delete_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileDeleteEvent file_path: string process_name: string process_id: 10 process_username: string failed: false netflow_events: - parent_process_name: string byte_count_in: 10 process_guid: 10 process_path: string traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 flow_time: '2016-01-01T01:01:01Z' time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_account: string type: NetflowEvent process_account_type: string parent_process_path: string parent_process_id: 10 parent_process_args: string process_name: string process_account: string parent_process_account_type: string process_hash: string process_id: 10 parent_process_hash: string process_username: string byte_count_out: 10 process_args: string registry_rename_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryRenameEvent registry_old_key: string timestamp: '2016-01-01T01:01:01Z' confidence: High observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' sensor: endpoint data: columns: - name: string type: integer description: string required: true short_description: string rows: - - anything row_count: 10 description: a list of `NewSighting`s. identity_assertions: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - identity-assertion example: identity-assertion description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. identity: type: object properties: observables: type: array items: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. example: - value: 1.2.3.4 type: ip required: - observables example: observables: - value: 1.2.3.4 type: ip description: Attributes for which the assertion is being made. assertions: type: array items: type: object properties: name: type: string example: cisco:ctr:ad:host_domain_name description: An open vocabulary containing well known assertion types value: type: string example: string required: - name - value example: name: cisco:ctr:ad:host_domain_name value: string example: - name: cisco:ctr:ad:host_domain_name value: string description: Any known context about the identity attributes. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. required: - identity - assertions example: valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' identity: observables: - value: 1.2.3.4 type: ip schema_version: 1.3.30 revision: 10 type: identity-assertion source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' assertions: - name: cisco:ctr:ad:host_domain_name value: string description: For submitting a new IdentityAssertion. uniqueItems: true example: - valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' identity: observables: - value: 1.2.3.4 type: ip schema_version: 1.3.30 revision: 10 type: identity-assertion source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' assertions: - name: cisco:ctr:ad:host_domain_name value: string description: a list of `NewIdentityAssertion`s. target_records: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - target-record example: target-record description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. targets: type: array items: type: object properties: type: type: string example: endpoint description: The sensor/actuator name that best fits a device. observables: type: array items: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. example: - value: 1.2.3.4 type: ip observed_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). os: type: string example: string description: Source Operating System where TargetRecord was originated. internal: type: boolean example: false description: Is it internal to our network? sensor: type: string example: string description: 'The OpenC2 Actuator name that best fits the device that is creating this TargetRecord (e.g.: network.firewall, etc.)' source_uri: type: string example: string description: A URI required: - type - observables - observed_time example: type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string internal: false sensor: string source_uri: string description: Schema for TargetRecord Targets example: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string internal: false sensor: string source_uri: string required: - source - targets example: description: string schema_version: 1.3.30 revision: 10 type: target-record source: string external_ids: - string targets: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string internal: false sensor: string source_uri: string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' description: Schema for submitting new TargetRecord. uniqueItems: true example: - description: string schema_version: 1.3.30 revision: 10 type: target-record source: string external_ids: - string targets: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string internal: false sensor: string source_uri: string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' description: a list of `NewTargetRecord`s. tools: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - tool example: tool description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. labels: type: array items: type: string example: credential-exploitation description: Tool labels describe the categories of tools that can be used to perform attacks. example: - credential-exploitation description: The kind(s) of tool(s) being described. kill_chain_phases: type: array items: type: object properties: kill_chain_name: type: string example: string description: The name of the kill chain. phase_name: type: string example: string description: The name of the phase in the kill chain. required: - kill_chain_name - phase_name example: kill_chain_name: string phase_name: string description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives. example: - kill_chain_name: string phase_name: string description: The list of kill chain phases for which this Tool can be used. tool_version: type: string example: string description: The version identifier associated with the Tool. x_mitre_aliases: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: ATT&CK Software.aliases. required: - title - description - short_description - labels example: description: string labels: - credential-exploitation schema_version: 1.3.30 revision: 10 type: tool x_mitre_aliases: - string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tool_version: string tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string timestamp: '2016-01-01T01:01:01Z' description: For submitting a new Tool. uniqueItems: true example: - description: string labels: - credential-exploitation schema_version: 1.3.30 revision: 10 type: tool x_mitre_aliases: - string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tool_version: string tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string timestamp: '2016-01-01T01:01:01Z' description: a list of `NewTool`s. verdicts: type: array items: type: object properties: type: type: string enum: - verdict example: verdict disposition: type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Numeric verdict identifiers. observable: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. judgement_id: type: string example: string description: A URI leading to a judgement. disposition_name: type: string enum: - Clean - Common - Malicious - Suspicious - Unknown example: Clean description: 'The disposition_name field is optional, but is intended to be shown to a user. Applications must therefore remember the mapping of numbers to human words, as in: {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}' valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. required: - type - disposition - observable - valid_time example: type: verdict disposition: 1 observable: value: 1.2.3.4 type: ip judgement_id: string disposition_name: Clean valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: "A Verdict is chosen from all of the Judgements on that Observable which have not yet expired. The highest priority Judgement becomes the active verdict. If there is more than one Judgement with that priority, then Clean disposition has priority over all others, then Malicious disposition, and so on down to Unknown.\n\n The ID of a verdict is a a str of the form \"observable.type:observable.value\" for example, \"ip:1.1.1.1\"" uniqueItems: true example: - type: verdict disposition: 1 observable: value: 1.2.3.4 type: ip judgement_id: string disposition_name: Clean valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: a list of `Verdict`s. data_tables: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - data-table example: data-table description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. columns: type: array items: type: object properties: name: type: string example: string type: type: string enum: - integer - markdown - number - observable - string - url example: integer description: type: string example: string description: Markdown string with at most 5000 characters. required: type: boolean example: true description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`. short_description: type: string example: string required: - name - type example: name: string type: integer description: string required: true short_description: string example: - name: string type: integer description: string required: true short_description: string description: An ordered list of column definitions. rows: type: array items: type: array items: example: anything example: - - anything description: An ordered list of rows valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. row_count: type: integer format: int64 example: 10 description: The number of rows in the data table. required: - columns - rows example: description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 columns: - name: string type: integer description: string required: true short_description: string type: data-table source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string rows: - - anything source_uri: string language: string id: string tlp: green row_count: 10 timestamp: '2016-01-01T01:01:01Z' description: Schema for submitting a NewDataTable record. uniqueItems: true example: - description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 columns: - name: string type: integer description: string required: true short_description: string type: data-table source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string rows: - - anything source_uri: string language: string id: string tlp: green row_count: 10 timestamp: '2016-01-01T01:01:01Z' description: a list of `NewDataTable`s. weaknesses: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - weakness example: weakness description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: Should be short and limited to the key points that define this weakness. short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. structure: type: string enum: - Chain - Composite - Simple example: Chain description: Defines the structural nature of the weakness. languages: type: array items: type: object properties: prevalence: type: string enum: - Often - Rarely - Sometimes - Undetermined example: Often description: Defines the different regularities that guide the applicability of platforms. name: type: string example: string description: Language name (Clojure, Java, ...) class: type: string example: Assembly description: Class of language. required: - prevalence example: prevalence: Often name: string class: Assembly example: - prevalence: Often name: string class: Assembly description: Applicable Languages. operating_systems: type: array items: type: object properties: prevalence: type: string enum: - Often - Rarely - Sometimes - Undetermined example: Often description: Defines the different regularities that guide the applicability of platforms. name: type: string example: string description: String with at most 1024 characters. version: type: string example: string description: String with at most 1024 characters. cpe_id: type: string example: string description: String with at most 1024 characters. class: type: string example: Android description: Class of Operating System. required: - prevalence example: prevalence: Often name: string version: string cpe_id: string class: Android example: - prevalence: Often name: string version: string cpe_id: string class: Android description: Applicable operating systems. architectures: type: array items: type: object properties: prevalence: type: string enum: - Often - Rarely - Sometimes - Undetermined example: Often description: Defines the different regularities that guide the applicability of platforms. name: type: string example: string description: Architecture name (ARM, x86, ...) class: type: string example: Embedded description: Class of architecture required: - prevalence example: prevalence: Often name: string class: Embedded example: - prevalence: Often name: string class: Embedded description: Applicable architectures. paradigms: type: array items: type: object properties: prevalence: type: string enum: - Often - Rarely - Sometimes - Undetermined example: Often description: Defines the different regularities that guide the applicability of platforms. name: type: string example: string description: Paradigm name (Client Server, Mainframe) required: - prevalence example: prevalence: Often name: string example: - prevalence: Often name: string description: Applicable paradigms. technologies: type: array items: type: object properties: prevalence: type: string enum: - Often - Rarely - Sometimes - Undetermined example: Often description: Defines the different regularities that guide the applicability of platforms. name: type: string example: string description: Technology name (Web Server, Web Client) required: - prevalence example: prevalence: Often name: string example: - prevalence: Often name: string description: Applicable technologies. background_details: type: string example: string description: Information that is relevant but not related to the nature of the weakness itself. alternate_terms: type: array items: type: object properties: term: type: string example: string description: The actual alternate term. description: type: string example: string description: Provides context for the alternate term by which this weakness may be known. required: - term example: term: string description: string example: - term: string description: string description: Indicates one or more other names used to describe this weakness. modes_of_introduction: type: array items: type: object properties: phase: type: string example: Architecture and Design description: Identifies the point in the software life cycle at which the weakness may be introduced. note: type: string example: string description: Provides a typical scenario related to introduction during the given phase. required: - phase example: phase: Architecture and Design note: string example: - phase: Architecture and Design note: string description: Information about how and when a given weakness may be introduced. likelihood: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: Likelihood of exploit. common_consequences: type: array items: type: object properties: scopes: type: array items: type: string example: Access Control description: Defines the different areas of software security that can be affected by exploiting a weakness. example: - Access Control description: Identifies the security property that is violated. impacts: type: array items: type: string example: Alter Execution Logic example: - Alter Execution Logic description: Describes the technical impact that arises if an adversary succeeds in exploiting this weakness. likelihood: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: How likely the specific consequence is expected to be seen relative to the other consequences. note: type: string example: string description: Additional commentary about a consequence. required: - scopes example: scopes: - Access Control impacts: - Alter Execution Logic likelihood: High note: string example: - scopes: - Access Control impacts: - Alter Execution Logic likelihood: High note: string description: Refers to the typical or expected negative effects that can result from exploiting the weakness. This could include anything from unauthorized access to data, denial of service, system crashes or other things. detection_methods: type: array items: type: object properties: method: type: string example: Architecture or Design Review description: Identifies the particular detection method being described. description: type: string example: string description: Provides some context of how this method can be applied to a specific weakness. effectiveness: type: string example: High description: How effective the detection method may be in detecting the associated weakness. effectiveness_notes: type: string example: string description: Provides additional discussion of the strengths and shortcomings of this detection method. required: - method - description example: method: Architecture or Design Review description: string effectiveness: High effectiveness_notes: string example: - method: Architecture or Design Review description: string effectiveness: High effectiveness_notes: string description: Identifies methods that may be employed to detect this weakness, including their strengths and limitations. potential_mitigations: type: array items: type: object properties: description: type: string example: string description: A description of this individual mitigation including any strengths and shortcomings of this mitigation for the weakness. phases: type: array items: type: string example: Architecture and Design description: Defines the different regularities that guide the applicability of platforms. example: - Architecture and Design description: Indicates the development life cycle phase during which this particular mitigation may be applied. strategy: type: string example: Attack Surface Reduction description: A general strategy for protecting a system to which this mitigation contributes. effectiveness: type: string example: Defense in Depth description: Summarizes how effective the mitigation may be in preventing the weakness. effectiveness_notes: type: string example: string description: Markdown string with at most 5000 characters. required: - description example: description: string phases: - Architecture and Design strategy: Attack Surface Reduction effectiveness: Defense in Depth effectiveness_notes: string example: - description: string phases: - Architecture and Design strategy: Attack Surface Reduction effectiveness: Defense in Depth effectiveness_notes: string description: Describes potential mitigations associated with a weakness. functional_areas: type: array items: type: string example: Authentication description: Defines the different functional areas of software in which the weakness may appear. example: - Authentication description: Identifies the functional area of the software in which the weakness is most likely to occur. affected_resources: type: array items: type: string example: CPU description: Defines a resource of a system. example: - CPU description: Identifies system resources that can be affected by an exploit of this weakness. notes: type: array items: type: object properties: type: type: string example: Applicable Platform description: Defines the different types of notes that can be associated with a weakness. note: type: string example: string description: Markdown string with at most 5000 characters. required: - type - note example: type: Applicable Platform note: string example: - type: Applicable Platform note: string description: Provides any additional comments about the weakness. abstraction_level: type: string enum: - Base - Class - Compound - Variant example: Base description: Refers to the level of abstraction or granularity used to describe the weakness. It helps to categorize the vulnerability based on the level of detail provided. required: - description example: description: string background_details: string paradigms: - prevalence: Often name: string abstraction_level: Base architectures: - prevalence: Often name: string class: Embedded schema_version: 1.3.30 revision: 10 alternate_terms: - term: string description: string likelihood: High type: weakness source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string functional_areas: - Authentication source_uri: string modes_of_introduction: - phase: Architecture and Design note: string structure: Chain language: string id: string notes: - type: Applicable Platform note: string common_consequences: - scopes: - Access Control impacts: - Alter Execution Logic likelihood: High note: string tlp: green detection_methods: - method: Architecture or Design Review description: string effectiveness: High effectiveness_notes: string operating_systems: - prevalence: Often name: string version: string cpe_id: string class: Android affected_resources: - CPU languages: - prevalence: Often name: string class: Assembly timestamp: '2016-01-01T01:01:01Z' potential_mitigations: - description: string phases: - Architecture and Design strategy: Attack Surface Reduction effectiveness: Defense in Depth effectiveness_notes: string technologies: - prevalence: Often name: string description: For submitting a new weakness. uniqueItems: true example: - description: string background_details: string paradigms: - prevalence: Often name: string abstraction_level: Base architectures: - prevalence: Often name: string class: Embedded schema_version: 1.3.30 revision: 10 alternate_terms: - term: string description: string likelihood: High type: weakness source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string functional_areas: - Authentication source_uri: string modes_of_introduction: - phase: Architecture and Design note: string structure: Chain language: string id: string notes: - type: Applicable Platform note: string common_consequences: - scopes: - Access Control impacts: - Alter Execution Logic likelihood: High note: string tlp: green detection_methods: - method: Architecture or Design Review description: string effectiveness: High effectiveness_notes: string operating_systems: - prevalence: Often name: string version: string cpe_id: string class: Android affected_resources: - CPU languages: - prevalence: Often name: string class: Assembly timestamp: '2016-01-01T01:01:01Z' potential_mitigations: - description: string phases: - Architecture and Design strategy: Attack Surface Reduction effectiveness: Defense in Depth effectiveness_notes: string technologies: - prevalence: Often name: string description: a list of `NewWeakness`s. vulnerabilities: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - vulnerability example: vulnerability description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: "Various sources of vulnerability information can be used, including third-party resources like the National Vulnerability Database (NVD) and the Common Vulnerabilities and Exposures (CVE) database. The platform then analyzes this data and provides the user with relevant details such as the severity of the vulnerability, the affected systems, and remediation recommendations. \n\n Based on this information, the user can prioritize patching and other mitigation strategies to reduce the risk of potential attacks." short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. cve: type: object properties: cve_data_meta: type: object properties: id: type: string example: string description: String with at most 1024 characters. assigner: type: string example: string description: String with at most 1024 characters. example: id: string assigner: string required: - cve_data_meta example: cve_data_meta: id: string assigner: string impact: type: object properties: cvss_v2: type: object properties: vector_string: type: string example: string description: a text representation of a set of CVSSv2 metrics. It is commonly used to record or transfer CVSSv2 metric information in a concise form base_score: type: number format: double example: 10.0 description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v2/guide' base_severity: type: string enum: - High - Info - Low - Medium - None - Unknown example: High impact_score: type: number format: double example: 10.0 description: a Score number from 0 to 10 exploitability_score: type: number format: double example: 10.0 description: a Score number from 0 to 10 access_vector: type: string enum: - adjacent network - local - network example: network description: This metric reflects how the vulnerability is exploited.The more remote an attacker can be to attack a host, the greater the vulnerability score. access_complexity: type: string enum: - high - low - medium example: low description: 'This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system. For example, consider a buffer overflow in an Internet service: once the target system is located, the attacker can launch an exploit at will.' authentication: type: string enum: - multiple - none - single example: none description: This metric measures the number of times an attacker must authenticate to a target in order to exploit a vulnerability. This metric does not gauge the strength or complexity of the authentication process, only that an attacker is required to provide credentials before an exploit may occur. The fewer authentication instances that are required, the higher the vulnerability score. confidentiality_impact: type: string enum: - complete - none - partial example: complete description: This metric measures the impact on confidentiality of a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. Increasedconfidentiality impact increases the vulnerability score. integrity_impact: type: string enum: - complete - none - partial example: complete description: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and guaranteed veracity of information. Increased integrity impact increases the vulnerability score. availability_impact: type: string enum: - complete - none - partial example: complete description: This metric measures the impact to availability of a successfully exploited vulnerability. Availability refers to the accessibility of information resources. Attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system. Increased availability impact increases the vulnerability score. exploitability: type: string enum: - functional - high - not_defined - proof_of_concept - unproven example: not_defined description: This metric measures the current state of exploit techniques or code availability. Public availability of easy-to-use exploit code increases the number of potential attackers by including those who are unskilled thereby increasing the severity of the vulnerability. remediation_level: type: string enum: - not_defined - official_fix - temporary_fix - unavailable - workaround example: not_defined description: The remediation level of a vulnerability is an important factor for prioritization. The typical vulnerability is unpatched when initially published. Workarounds or hotfixes may offer interim remediation until an official patch or upgrade is issued. Each of these respective stages adjusts the temporal score downwards, reflecting the decreasing urgency as remediation becomes final. The less official and permanent a fix, the higher the vulnerability score is. report_confidence: type: string enum: - confirmed - not_defined - unconfirmed - uncorroborated example: not_defined description: This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details. Sometimes, only the existence of vulnerabilities are publicized, but without specific details. The vulnerability may later be corroborated and then confirmed through acknowledgement by the author or vendor of the affected technology. The urgency of a vulnerability is higher when a vulnerability is known to exist with certainty. This metric also suggests the level of technical knowledge available to would-be attackers. The more a vulnerability is validated by the vendor or other reputable sources, the higher the score. temporal_vector_string: type: string example: string description: A text representation of a set of CVSSv2 temporal metrics. Temporal metrics allow analysists to calculate threat severity based on temporal factors such as reliability of vulnerability reports, availability of mitigations, and the ease or difficulty of conducting the exploit. It is commonly used to record or transfer CVSSv2 metric information in a concise form collateral_damage_potential: type: string enum: - high - low - low_medium - medium_high - none - not_defined example: not_defined description: This metric measures the potential for loss of life or physical assets through damage or theft of property or equipment. The metric may also measure economic loss of productivity or revenue. Naturally, the greater the damage potential, the higher the vulnerability score. target_distribution: type: string enum: - high - low - medium - none - not_defined example: not_defined description: This metric measures the proportion of vulnerable systems. It is meant as an environment-specific indicator in order to approximate the percentage of systems that could be affected by the vulnerability. The greater the proportion of vulnerable systems, the higher the score. confidentiality_requirement: type: string enum: - high - low - medium - not_defined example: not_defined description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.' integrity_requirement: type: string enum: - high - low - medium - not_defined example: not_defined description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.' availability_requirement: type: string enum: - high - low - medium - not_defined example: not_defined description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.' environmental_vector_string: type: string example: string description: A text representation of a set of CVSSv2 environmental metrics. Environmental metrics allow analysists to calculate threat scores in relation to environmental security requirements, collateral damage potential, and target availability. It is commonly used to record or transfer CVSSv2 metric information in a concise form obtain_all_privilege: type: boolean example: true obtain_user_privilege: type: boolean example: true obtain_other_privilege: type: boolean example: true user_interaction_required: type: boolean example: true required: - vector_string - base_score - base_severity example: integrity_impact: complete target_distribution: not_defined availability_requirement: not_defined exploitability: not_defined access_complexity: low temporal_vector_string: string exploitability_score: 10.0 impact_score: 10.0 user_interaction_required: true environmental_vector_string: string obtain_other_privilege: true availability_impact: complete access_vector: network base_severity: High confidentiality_impact: complete confidentiality_requirement: not_defined report_confidence: not_defined authentication: none base_score: 10.0 obtain_user_privilege: true obtain_all_privilege: true collateral_damage_potential: not_defined remediation_level: not_defined vector_string: string integrity_requirement: not_defined cvss_v3: type: object properties: vector_string: type: string example: string description: a text representation of a set of CVSSv3 metrics. It is commonly used to record or transfer CVSSv3 metric information in a concise form base_score: type: number format: double example: 10.0 description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v3-1' base_severity: type: string enum: - critical - high - low - medium - none example: critical impact_score: type: number format: double example: 10.0 description: a Score number from 0 to 10 exploitability_score: type: number format: double example: 10.0 description: a Score number from 0 to 10 attack_vector: type: string enum: - adjacent_network - local - network - physical example: adjacent_network description: Reflects the context by which vulnerability exploitation is possible modified_attack_vector: type: string enum: - adjacent_network - local - network - not_defined - physical example: not_defined description: modified attack vector attack_complexity: type: string enum: - high - low example: high description: describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability modified_attack_complexity: type: string enum: - high - low - not_defined example: not_defined description: modified attack complexity privileges_required: type: string enum: - high - low - none example: high description: describes the level of privileges an attacker must possess before successfully exploiting the vulnerability modified_privileges_required: type: string enum: - high - low - none - not_defined example: not_defined description: modified privileges required user_interaction: type: string enum: - none - required example: none description: captures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerable component modified_user_interaction: type: string enum: - none - not_defined - required example: none description: modified user interaction scope: type: string enum: - changed - unchanged example: changed description: the ability for a vulnerability in one software component to impact resources beyond its means, or privileges modified_scope: type: string enum: - changed - not_defined - unchanged example: not_defined description: modified scope confidentiality_impact: type: string enum: - high - low - none example: high description: measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability modified_confidentiality_impact: type: string enum: - high - low - none - not_defined example: not_defined description: modified confidentiality impact integrity_impact: type: string enum: - high - low - none example: high description: measures the impact to integrity of a successfully exploited vulnerability modified_integrity_impact: type: string enum: - high - low - none - not_defined example: not_defined description: modified integrity impact availability_impact: type: string enum: - high - low - none example: high description: measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability modified_availability_impact: type: string enum: - high - low - none - not_defined example: not_defined description: modified availability impact exploit_code_maturity: type: string enum: - functional - high - not_defined - proof_of_concept - unproven example: functional description: measures the likelihood of the vulnerability being attacked remediation_level: type: string enum: - high - not_defined - offical_fix - temporary_fix - unavailable - workaround example: high description: Remediation Level of a vulnerability is an important factor for prioritization report_confidence: type: string enum: - confirmed - reasonable - unknown example: confirmed description: measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details temporal_score: type: number format: double example: 10.0 description: Round up(CVSSv3BaseScore × CVSSv3ExploitCodeMaturity × CVSSv3RemediationLevel × CVSSv3ReportConfidence) temporal_severity: type: string enum: - critical - high - low - medium - none example: critical description: temporal severity availability_requirement: type: string enum: - high - low - none - not_defined example: high description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).' confidentiality_requirement: type: string enum: - high - low - none - not_defined example: high description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).' integrity_requirement: type: string enum: - high - low - none - not_defined example: high description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).' environmental_score: type: number format: double example: 10.0 description: a Score number from 0 to 10 environmental_severity: type: string enum: - critical - high - low - medium - none example: critical required: - vector_string - base_score - base_severity example: integrity_impact: high modified_user_interaction: none modified_scope: not_defined availability_requirement: high user_interaction: none modified_integrity_impact: not_defined privileges_required: high exploitability_score: 10.0 impact_score: 10.0 environmental_severity: critical modified_availability_impact: not_defined availability_impact: high scope: changed exploit_code_maturity: functional modified_attack_complexity: not_defined base_severity: critical confidentiality_impact: high temporal_severity: critical modified_confidentiality_impact: not_defined confidentiality_requirement: high report_confidence: confirmed temporal_score: 10.0 modified_privileges_required: not_defined modified_attack_vector: not_defined base_score: 10.0 environmental_score: 10.0 remediation_level: high vector_string: string integrity_requirement: high attack_vector: adjacent_network attack_complexity: high example: cvss_v2: integrity_impact: complete target_distribution: not_defined availability_requirement: not_defined exploitability: not_defined access_complexity: low temporal_vector_string: string exploitability_score: 10.0 impact_score: 10.0 user_interaction_required: true environmental_vector_string: string obtain_other_privilege: true availability_impact: complete access_vector: network base_severity: High confidentiality_impact: complete confidentiality_requirement: not_defined report_confidence: not_defined authentication: none base_score: 10.0 obtain_user_privilege: true obtain_all_privilege: true collateral_damage_potential: not_defined remediation_level: not_defined vector_string: string integrity_requirement: not_defined cvss_v3: integrity_impact: high modified_user_interaction: none modified_scope: not_defined availability_requirement: high user_interaction: none modified_integrity_impact: not_defined privileges_required: high exploitability_score: 10.0 impact_score: 10.0 environmental_severity: critical modified_availability_impact: not_defined availability_impact: high scope: changed exploit_code_maturity: functional modified_attack_complexity: not_defined base_severity: critical confidentiality_impact: high temporal_severity: critical modified_confidentiality_impact: not_defined confidentiality_requirement: high report_confidence: confirmed temporal_score: 10.0 modified_privileges_required: not_defined modified_attack_vector: not_defined base_score: 10.0 environmental_score: 10.0 remediation_level: high vector_string: string integrity_requirement: high attack_vector: adjacent_network attack_complexity: high description: "Describes the potential impact of a vulnerability that is being tracked in the system. Provides information on the extent of damage that a vulnerability can cause and how serious the consequences could be if it is exploited. \n\nMay contain granular information about the vulnerability severity using the CVSS system, versions 2 and 3.\n\nCVSSv2 and CVSSv3 have different methods of calculating base scores, but both are designed to provide an indication of the level of risk that a vulnerability poses. The base score ranges from 0 to 10, with 10 being the most severe. Additionally, both CVSSv2 and CVSSv3 define severity levels, such as low, medium, high, and critical, based on the base score." configurations: type: object properties: CVE_data_version: type: string example: string description: Specifies the version of the CVE (Common Vulnerabilities and Exposures) dictionary used by the vulnerability information provider. nodes: type: array items: type: object properties: operator: type: string enum: - AND - OR example: AND description: The operator string influences how seqs of cpe matches are related to one another. cpe_match: type: array items: type: object properties: vulnerable: type: boolean example: true cpe23Uri: type: string example: string description: A text representation of a software or hardware platform. versionStartIncluding: type: string example: string description: A string representing the lower bound(inclusive) of version in the CPE. versionEndIncluding: type: string example: string description: A string representing the upper bound(inclusive) of version in the CPE. versionStartExcluding: type: string example: string description: A string representing the lower bound(exclusive) of version in the CPE. versionEndExcluding: type: string example: string description: A string representing the upper bound(exclusive) of version in the CPE. required: - vulnerable - cpe23Uri example: vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string example: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string children: type: array items: type: object properties: operator: type: string enum: - AND - OR example: AND description: The operator string influences how seqs of cpe matches are related to one another. cpe_match: type: array items: type: object properties: vulnerable: type: boolean example: true cpe23Uri: type: string example: string description: A text representation of a software or hardware platform. versionStartIncluding: type: string example: string description: A string representing the lower bound(inclusive) of version in the CPE. versionEndIncluding: type: string example: string description: A string representing the upper bound(inclusive) of version in the CPE. versionStartExcluding: type: string example: string description: A string representing the lower bound(exclusive) of version in the CPE. versionEndExcluding: type: string example: string description: A string representing the upper bound(exclusive) of version in the CPE. required: - vulnerable - cpe23Uri example: vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string example: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: type: boolean example: true description: Negates operator when true. required: - operator - cpe_match example: operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true example: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true negate: type: boolean example: true description: Negates operator when true. required: - operator example: operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string children: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true negate: true example: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string children: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true negate: true description: Each `node` in the CTIM standard configuration includes information such as the `operator` (such as "less than", or "greater than or equal to"), and the `cpe` (Common Platform Enumeration) string which identifies the specific software, `CPE` is a structured naming scheme for IT systems, platforms, and software packages, and it is instrumental in enabling data exchange between different systems. required: - CVE_data_version - nodes example: CVE_data_version: string nodes: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string children: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true negate: true description: "Represents a list of affected versions or configurations of a software component that is impacted by a vulnerability. \nBy tracking the affected software components and versions, defenders can identify which systems are potentially exposed to an attack, and apply appropriate mitigations." published_date: type: string format: date-time example: '2016-01-01T01:01:01Z' description: "Represents the date when a vulnerability was publicly disclosed or made available to the general public. \n\nImportant for tracking the age of a vulnerability, as well as for determining when a particular vulnerability was first introduced into a system. The published date can be used to identify the time window during which a system may have been vulnerable to a particular exploit.\n\nFor example, if an organization discovers that a vulnerability was published before their system's installation date, but they did not apply the necessary security updates in a timely manner, it can be concluded that their system was vulnerable for the period between the installation date and the date when the necessary security updates were applied." last_modified_date: type: string format: date-time example: '2016-01-01T01:01:01Z' description: 'Represents the date when the vulnerability metadata was last updated in the internal database. It can be used to track the freshness of the vulnerability information. If the `last_modified_date` is more recent than the `published_date`, it can indicate that there has been some new information or updates related to the vulnerability, such as new patch releases or changes in the severity or impact rating.' required: - description example: description: string schema_version: 1.3.30 revision: 10 published_date: '2016-01-01T01:01:01Z' cve: cve_data_meta: id: string assigner: string configurations: CVE_data_version: string nodes: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string children: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true negate: true type: vulnerability source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' last_modified_date: '2016-01-01T01:01:01Z' impact: cvss_v2: integrity_impact: complete target_distribution: not_defined availability_requirement: not_defined exploitability: not_defined access_complexity: low temporal_vector_string: string exploitability_score: 10.0 impact_score: 10.0 user_interaction_required: true environmental_vector_string: string obtain_other_privilege: true availability_impact: complete access_vector: network base_severity: High confidentiality_impact: complete confidentiality_requirement: not_defined report_confidence: not_defined authentication: none base_score: 10.0 obtain_user_privilege: true obtain_all_privilege: true collateral_damage_potential: not_defined remediation_level: not_defined vector_string: string integrity_requirement: not_defined cvss_v3: integrity_impact: high modified_user_interaction: none modified_scope: not_defined availability_requirement: high user_interaction: none modified_integrity_impact: not_defined privileges_required: high exploitability_score: 10.0 impact_score: 10.0 environmental_severity: critical modified_availability_impact: not_defined availability_impact: high scope: changed exploit_code_maturity: functional modified_attack_complexity: not_defined base_severity: critical confidentiality_impact: high temporal_severity: critical modified_confidentiality_impact: not_defined confidentiality_requirement: high report_confidence: confirmed temporal_score: 10.0 modified_privileges_required: not_defined modified_attack_vector: not_defined base_score: 10.0 environmental_score: 10.0 remediation_level: high vector_string: string integrity_requirement: high attack_vector: adjacent_network attack_complexity: high description: For submitting a new vulnerability. uniqueItems: true example: - description: string schema_version: 1.3.30 revision: 10 published_date: '2016-01-01T01:01:01Z' cve: cve_data_meta: id: string assigner: string configurations: CVE_data_version: string nodes: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string children: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true negate: true type: vulnerability source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' last_modified_date: '2016-01-01T01:01:01Z' impact: cvss_v2: integrity_impact: complete target_distribution: not_defined availability_requirement: not_defined exploitability: not_defined access_complexity: low temporal_vector_string: string exploitability_score: 10.0 impact_score: 10.0 user_interaction_required: true environmental_vector_string: string obtain_other_privilege: true availability_impact: complete access_vector: network base_severity: High confidentiality_impact: complete confidentiality_requirement: not_defined report_confidence: not_defined authentication: none base_score: 10.0 obtain_user_privilege: true obtain_all_privilege: true collateral_damage_potential: not_defined remediation_level: not_defined vector_string: string integrity_requirement: not_defined cvss_v3: integrity_impact: high modified_user_interaction: none modified_scope: not_defined availability_requirement: high user_interaction: none modified_integrity_impact: not_defined privileges_required: high exploitability_score: 10.0 impact_score: 10.0 environmental_severity: critical modified_availability_impact: not_defined availability_impact: high scope: changed exploit_code_maturity: functional modified_attack_complexity: not_defined base_severity: critical confidentiality_impact: high temporal_severity: critical modified_confidentiality_impact: not_defined confidentiality_requirement: high report_confidence: confirmed temporal_score: 10.0 modified_privileges_required: not_defined modified_attack_vector: not_defined base_score: 10.0 environmental_score: 10.0 remediation_level: high vector_string: string integrity_requirement: high attack_vector: adjacent_network attack_complexity: high description: a list of `NewVulnerability`s. actor_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string asset_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string asset_mapping_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string asset_properties_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string attack_pattern_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string campaign_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string coa_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string feedback_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string identity_assertion_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string incident_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string indicator_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string judgement_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string malware_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string note_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string relationship_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string sighting_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string target_record_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string tool_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string verdict_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string data_table_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string weakness_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string vulnerability_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. required: - source example: description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' asset_mapping_refs: - string note_refs: - string data_table_refs: - string attack_pattern_refs: - string sighting_refs: - string schema_version: 1.3.30 revision: 10 assets: - description: string asset_type: application valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 type: asset source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' weakness_refs: - string tool_refs: - string target_record_refs: - string asset_refs: - string tools: - description: string labels: - credential-exploitation schema_version: 1.3.30 revision: 10 type: tool x_mitre_aliases: - string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tool_version: string tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string timestamp: '2016-01-01T01:01:01Z' indicators: - description: string tags: - string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' producer: string schema_version: 1.3.30 revision: 10 type: indicator test_mechanisms: - string source: string external_ids: - string short_description: string composite_indicator_expression: operator: and indicator_ids: - string title: string likely_impact: string indicator_type: - Anonymization external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string severity: Critical tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string negate: true timestamp: '2016-01-01T01:01:01Z' confidence: High specification: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string attack_patterns: - description: string abstraction_level: aggregate schema_version: 1.3.30 revision: 10 type: attack-pattern source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string x_mitre_platforms: - string language: string id: string tlp: green x_mitre_data_sources: - string kill_chain_phases: - kill_chain_name: string phase_name: string x_mitre_contributors: - string timestamp: '2016-01-01T01:01:01Z' type: bundle weaknesses: - description: string background_details: string paradigms: - prevalence: Often name: string abstraction_level: Base architectures: - prevalence: Often name: string class: Embedded schema_version: 1.3.30 revision: 10 alternate_terms: - term: string description: string likelihood: High type: weakness source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string functional_areas: - Authentication source_uri: string modes_of_introduction: - phase: Architecture and Design note: string structure: Chain language: string id: string notes: - type: Applicable Platform note: string common_consequences: - scopes: - Access Control impacts: - Alter Execution Logic likelihood: High note: string tlp: green detection_methods: - method: Architecture or Design Review description: string effectiveness: High effectiveness_notes: string operating_systems: - prevalence: Often name: string version: string cpe_id: string class: Android affected_resources: - CPU languages: - prevalence: Often name: string class: Assembly timestamp: '2016-01-01T01:01:01Z' potential_mitigations: - description: string phases: - Architecture and Design strategy: Attack Surface Reduction effectiveness: Defense in Depth effectiveness_notes: string technologies: - prevalence: Often name: string source: string external_ids: - string feedback_refs: - string asset_properties: - properties: - name: string value: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 asset_ref: string type: asset-properties source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' short_description: string feedbacks: - feedback: -1 schema_version: 1.3.30 revision: 10 type: feedback source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string reason: string source_uri: string language: string id: string tlp: green entity_id: string timestamp: '2016-01-01T01:01:01Z' judgement_refs: - string title: string coa_refs: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string verdicts: - type: verdict disposition: 1 observable: value: 1.2.3.4 type: ip judgement_id: string disposition_name: Clean valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' campaigns: - description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 type: campaign campaign_type: string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string activity: - date_time: '2016-01-01T01:01:01Z' description: string source_uri: string intended_effect: - Account Takeover status: Future language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' confidence: High names: - string source_uri: string actors: - description: string motivation: Ego valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' identity: description: string related_identities: - identity: string confidence: High information_source: string relationship: string sophistication: Aspirant schema_version: 1.3.30 revision: 10 planning_and_operational_support: string type: actor source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string intended_effect: Account Takeover language: string id: string tlp: green aliases: - string timestamp: '2016-01-01T01:01:01Z' confidence: High actor_types: - Cyber Espionage Operations indicator_refs: - string actor_refs: - string language: string data_tables: - description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 columns: - name: string type: integer description: string required: true short_description: string type: data-table source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string rows: - - anything source_uri: string language: string id: string tlp: green row_count: 10 timestamp: '2016-01-01T01:01:01Z' id: string notes: - schema_version: 1.3.30 revision: 10 content: string note_class: keyword type: note source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string author: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' related_entities: - entity_type: string entity_id: string identity_assertions: - valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' identity: observables: - value: 1.2.3.4 type: ip schema_version: 1.3.30 revision: 10 type: identity-assertion source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' assertions: - name: cisco:ctr:ad:host_domain_name value: string judgements: - valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 observable: value: 1.2.3.4 type: ip reason_uri: string type: judgement source: string external_ids: - string disposition: 1 external_references: - source_name: string description: string url: string hashes: - string external_id: string reason: string source_uri: string disposition_name: Clean priority: 10 language: string id: string severity: Critical tlp: green timestamp: '2016-01-01T01:01:01Z' confidence: High malwares: - description: string labels: - adware abstraction_level: family schema_version: 1.3.30 revision: 10 type: malware x_mitre_aliases: - string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string timestamp: '2016-01-01T01:01:01Z' target_records: - description: string schema_version: 1.3.30 revision: 10 type: target-record source: string external_ids: - string targets: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string internal: false sensor: string source_uri: string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' asset_mappings: - asset_type: application valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' stability: Managed schema_version: 1.3.30 revision: 10 observable: value: 1.2.3.4 type: ip asset_ref: string type: asset-mapping source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' specificity: Low confidence: High relationship_refs: - string tlp: green incidents: - description: string assignees: - string detection_sources: - string meta: keyword: string schema_version: 1.3.30 revision: 10 type: incident source: string external_ids: - string short_description: string title: string incident_time: opened: '2016-01-01T01:01:01Z' discovered: '2016-01-01T01:01:01Z' reported: '2016-01-01T01:01:01Z' remediated: '2016-01-01T01:01:01Z' closed: '2016-01-01T01:01:01Z' rejected: '2016-01-01T01:01:01Z' contained: '2016-01-01T01:01:01Z' external_references: - source_name: string description: string url: string hashes: - string external_id: string discovery_method: Agent Disclosure source_uri: string intended_effect: Account Takeover categories: - Attrition status: Closed language: string detection_status: active id: string promotion_method: Automated severity: Critical tlp: green scores: asset: 10.0 techniques: - string timestamp: '2016-01-01T01:01:01Z' confidence: High short_id: string tactics: - string identity_assertion_refs: - string sightings: - description: string schema_version: 1.3.30 revision: 10 relations: - origin: string origin_uri: string relation: Allocated relation_info: keyword: anything source: value: 1.2.3.4 type: ip related: value: 1.2.3.4 type: ip sensor_coordinates: type: endpoint observables: - value: 1.2.3.4 type: ip os: string observables: - value: 1.2.3.4 type: ip type: sighting source: string external_ids: - string targets: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string short_description: string title: string resolution: detected internal: false external_references: - source_name: string description: string url: string hashes: - string external_id: string detection_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' source_uri: string activity_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' language: string id: string count: 10 severity: Critical tlp: green modification_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' context: http_events: - process_guid: 10 traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 method: CONNECT time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: HTTPEvent host: string process_name: string process_id: 10 process_username: string query: string encrypted: true url_port: 10 process_create_events: - parent_process_name: string process_guid: 10 parent_process_guid: 10 process_disposition: string parent_process_size: 10 process_size: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_disposition: string type: ProcessCreateEvent parent_process_username: string parent_process_id: 10 parent_process_args: string process_name: string process_hash: string process_id: 10 parent_process_hash: string process_username: string parent_creation_time: '2016-01-01T01:01:01Z' process_args: string registry_delete_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryDeleteEvent registry_value: string file_modify_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileModifyEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_set_events: - process_guid: 10 registry_data: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: RegistrySetEvent registry_data_length: 10 registry_value: string registry_key: string process_name: string process_id: 10 process_username: string file_create_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileCreateEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_create_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryCreateEvent library_load_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string type: LibraryLoadEvent dll_library_name: string dll_library_path: string file_move_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileMoveEvent old_name: string file_path: string process_name: string process_id: 10 process_username: string new_name: string file_delete_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileDeleteEvent file_path: string process_name: string process_id: 10 process_username: string failed: false netflow_events: - parent_process_name: string byte_count_in: 10 process_guid: 10 process_path: string traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 flow_time: '2016-01-01T01:01:01Z' time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_account: string type: NetflowEvent process_account_type: string parent_process_path: string parent_process_id: 10 parent_process_args: string process_name: string process_account: string parent_process_account_type: string process_hash: string process_id: 10 parent_process_hash: string process_username: string byte_count_out: 10 process_args: string registry_rename_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryRenameEvent registry_old_key: string timestamp: '2016-01-01T01:01:01Z' confidence: High observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' sensor: endpoint data: columns: - name: string type: integer description: string required: true short_description: string rows: - - anything row_count: 10 campaign_refs: - string vulnerability_refs: - string asset_properties_refs: - string relationships: - description: string schema_version: 1.3.30 revision: 10 target_ref: string type: relationship source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string source_ref: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' relationship_type: attributed-to timestamp: '2016-01-01T01:01:01Z' verdict_refs: - string malware_refs: - string incident_refs: - string vulnerabilities: - description: string schema_version: 1.3.30 revision: 10 published_date: '2016-01-01T01:01:01Z' cve: cve_data_meta: id: string assigner: string configurations: CVE_data_version: string nodes: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string children: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true negate: true type: vulnerability source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' last_modified_date: '2016-01-01T01:01:01Z' impact: cvss_v2: integrity_impact: complete target_distribution: not_defined availability_requirement: not_defined exploitability: not_defined access_complexity: low temporal_vector_string: string exploitability_score: 10.0 impact_score: 10.0 user_interaction_required: true environmental_vector_string: string obtain_other_privilege: true availability_impact: complete access_vector: network base_severity: High confidentiality_impact: complete confidentiality_requirement: not_defined report_confidence: not_defined authentication: none base_score: 10.0 obtain_user_privilege: true obtain_all_privilege: true collateral_damage_potential: not_defined remediation_level: not_defined vector_string: string integrity_requirement: not_defined cvss_v3: integrity_impact: high modified_user_interaction: none modified_scope: not_defined availability_requirement: high user_interaction: none modified_integrity_impact: not_defined privileges_required: high exploitability_score: 10.0 impact_score: 10.0 environmental_severity: critical modified_availability_impact: not_defined availability_impact: high scope: changed exploit_code_maturity: functional modified_attack_complexity: not_defined base_severity: critical confidentiality_impact: high temporal_severity: critical modified_confidentiality_impact: not_defined confidentiality_requirement: high report_confidence: confirmed temporal_score: 10.0 modified_privileges_required: not_defined modified_attack_vector: not_defined base_score: 10.0 environmental_score: 10.0 remediation_level: high vector_string: string integrity_requirement: high attack_vector: adjacent_network attack_complexity: high coas: - description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' stage: Containment schema_version: 1.3.30 revision: 10 efficacy: High type: coa related_COAs: - confidence: High source: string relationship: string COA_id: string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string coa_type: Diplomatic Actions language: string id: string tlp: green objective: - string cost: High timestamp: '2016-01-01T01:01:01Z' open_c2_coa: type: structured_coa id: string action: type: alert target: type: acudid specifiers: string actuator: type: endpoint specifiers: - string modifiers: response: acknowledge method: - acl additional_properties: context: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' frequency: string duration: '2016-01-01T01:01:01Z' source: string search: cve option: string id: string location: internal delay: '2016-01-01T01:01:01Z' destination: copy-to structured_coa_type: openc2 impact: string description: Describes a Bundle of any set of CTIM entities. investigated_observables: type: array items: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. source: title: InvestigationSource description: String with at most 1024 characters. type: string example: Cisco XDR Automated Question title: title: InvestigationTitle description: String with at most 1024 characters. type: string example: Which devices in my org was this sha seen on? description: title: InvestigationDescription description: String with at most 5000 characters. type: string example: 'For the following hashes: - sha256:defg...1234 - sha256:abcd..1234 Determine which devices in my org have instances of the file in the past 30 days' required: - bundle application/transit+msgpack: schema: type: object properties: bundle: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - bundle example: bundle description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. actors: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - actor example: actor description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Indicates the time span for which the information about the Actor is relevant, and after which it could become outdated. actor_types: type: array items: type: string example: Cyber Espionage Operations example: - Cyber Espionage Operations identity: type: object properties: description: type: string example: string description: Markdown string with at most 5000 characters. related_identities: type: array items: type: object properties: identity: type: string example: string description: The reference (URI) of the related Identity object. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: Specifies the level of confidence in the assertion of the relationship between the two objects. information_source: type: string example: string description: Specifies the source of the information about the relationship between the two components. relationship: type: string example: string required: - identity example: identity: string confidence: High information_source: string relationship: string description: Describes a related Identity example: - identity: string confidence: High information_source: string relationship: string description: Identifies other entity Identities related to this Identity. required: - description - related_identities example: description: string related_identities: - identity: string confidence: High information_source: string relationship: string description: Can contain information such as the name of the attacker, the group or organization they belong to, or any other identifier that can help in the attribution process. motivation: type: string example: Ego description: The reason or purpose behind the malicious activity attributed to this Actor. By understanding a threat actor's motivation, analysts can better predict the attacker's behavior and anticipate future malicious actions. sophistication: type: string enum: - Aspirant - Expert - Innovator - Novice - Practitioner example: Aspirant description: "Represents the level of expertise and skill that the threat actor has displayed in their malicious activities. Can help security analysts assess the potential impact of an attacker's TTPs and determine the potential attack surface. \n\nFor example, a threat actor with a low sophistication level may primarily rely on off-the-shelf malware and attack tools, while an attacker with high sophistication may use custom tools with advanced evasion techniques, zero-day exploits, and sophisticated methods for command and control of their malware. \n\nThe sophistication level of an attacker can also be inferred based on several factors such as the complexity of attacks, the attacker's knowledge of the targeted organization's systems, and the attacker's ability to remain undetected.\n\nIf an attacker shows a high level of sophistication in reconnaissances, social engineering, and phishing, then the attacker may have a good knowledge of the targeted organization and its employees. This means that the attacker may be more successful in infiltrating the organization's network and compromising its systems." intended_effect: type: string example: Account Takeover description: "Represents the desired outcome or impact the threat actor is trying to achieve through their malicious activities. \n\n Helps security analysts to understand the attacker's goals beyond the immediate impact of the attack. By understanding the intended effect, analysts can draw connections between seemingly unrelated attacks and build a more complete understanding of an attacker's long-term goals and motivations." planning_and_operational_support: type: string example: string description: "Provides information about the resources and capabilities of the attacker that could be used to assist in planning and operations related to the threat.\n\n It can be used to describe Infrastructure, Tools, Techniques, and Capabilities used by the threat actor." confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: 'This field can help analysts decide how much trust they can put in the information provided by the threat intelligence sources. For example, an Actor entity can have high confidence if the organization''s security researchers have been tracking it for a long time and have gathered a significant amount of intelligence about it through various sources, such as analysis of malware, network traffic, and human intelligence. In contrast, low confidence may indicate the organization has only seen limited or circumstantial evidence.' aliases: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: A list of other names that this Threat Actor is believed to use. required: - source - title - description - short_description example: description: string motivation: Ego valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' identity: description: string related_identities: - identity: string confidence: High information_source: string relationship: string sophistication: Aspirant schema_version: 1.3.30 revision: 10 planning_and_operational_support: string type: actor source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string intended_effect: Account Takeover language: string id: string tlp: green aliases: - string timestamp: '2016-01-01T01:01:01Z' confidence: High actor_types: - Cyber Espionage Operations description: Schema for submitting new Actors uniqueItems: true example: - description: string motivation: Ego valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' identity: description: string related_identities: - identity: string confidence: High information_source: string relationship: string sophistication: Aspirant schema_version: 1.3.30 revision: 10 planning_and_operational_support: string type: actor source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string intended_effect: Account Takeover language: string id: string tlp: green aliases: - string timestamp: '2016-01-01T01:01:01Z' confidence: High actor_types: - Cyber Espionage Operations description: a list of `NewActor`s. assets: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - asset example: asset description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: 'Specifies the time range during which the asset is considered valid or accurate. For example, if an asset entity represents a device, the `valid_time` field could be used to indicate the period during which the device''s configuration information is deemed accurate.' asset_type: type: string enum: - application - data - device - network - person example: application description: 'Type of the Asset: Device, Person, Application, etc.' required: - source - valid_time - asset_type example: description: string asset_type: application valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 type: asset source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' description: Schema for submitting new Assets uniqueItems: true example: - description: string asset_type: application valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 type: asset source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' description: a list of `NewAsset`s. asset_mappings: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - asset-mapping example: asset-mapping description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: For each asset, we allow for the assertion of time bound properties.This gives us both a record of the current state of the asset,as well as history. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: 'Level of confidence held in the characterization of this AssetMapping e.g.: is it susceptible to manipulation or translation?' specificity: type: string enum: - Low - Medium - Unique example: Low description: Denotes the level of how many assets potentially could have this same identifier. stability: type: string enum: - Managed - Physical - Temporary example: Managed description: Do we manage when it changes, or is it always a time bound assignment? observable: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: An AssetMapping is a record that a specific Observable maps to an Asset for an indicated period of time. asset_ref: type: string example: string description: URI that points to the mapped Asset. asset_type: type: string enum: - application - data - device - network - person example: application description: 'Type of the mapped Asset: Device, Person, Application, etc.' required: - source - valid_time - confidence - specificity - stability - observable - asset_ref - asset_type example: asset_type: application valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' stability: Managed schema_version: 1.3.30 revision: 10 observable: value: 1.2.3.4 type: ip asset_ref: string type: asset-mapping source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' specificity: Low confidence: High description: Schema for submitting new AssetMapping. uniqueItems: true example: - asset_type: application valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' stability: Managed schema_version: 1.3.30 revision: 10 observable: value: 1.2.3.4 type: ip asset_ref: string type: asset-mapping source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' specificity: Low confidence: High description: a list of `NewAssetMapping`s. asset_properties: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - asset-properties example: asset-properties description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time range during which the AssetProperties is considered valid. asset_ref: type: string example: string description: URI that points to the associated Asset. properties: type: array items: type: object properties: name: type: string example: string description: The properties are an open vocabulary. value: type: string example: string required: - name - value example: name: string value: string example: - name: string value: string required: - source - valid_time - asset_ref example: properties: - name: string value: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 asset_ref: string type: asset-properties source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' description: Schema for submitting new AssetProperties uniqueItems: true example: - properties: - name: string value: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 asset_ref: string type: asset-properties source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' description: a list of `NewAssetProperties`s. attack_patterns: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - attack-pattern example: attack-pattern description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. kill_chain_phases: type: array items: type: object properties: kill_chain_name: type: string example: string description: The name of the kill chain. phase_name: type: string example: string description: The name of the phase in the kill chain. required: - kill_chain_name - phase_name example: kill_chain_name: string phase_name: string description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives. example: - kill_chain_name: string phase_name: string description: A kill chain is a series of steps that an attacker must go through to successfully achieve their objective. The concept was originally developed by the military, but has been adapted to the cybersecurity field to describe the steps an attacker goes through to compromise a target system and achieve their goal. x_mitre_data_sources: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: ATT&CK Technique.Data Sources. x_mitre_platforms: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: ATT&CK Technique.Platforms. x_mitre_contributors: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: ATT&CK Technique.Contributors. abstraction_level: type: string enum: - aggregate - category - detailed - meta - standard example: aggregate description: The CAPEC abstraction level for patterns describing techniques to attack a system. required: - title - description - short_description example: description: string abstraction_level: aggregate schema_version: 1.3.30 revision: 10 type: attack-pattern source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string x_mitre_platforms: - string language: string id: string tlp: green x_mitre_data_sources: - string kill_chain_phases: - kill_chain_name: string phase_name: string x_mitre_contributors: - string timestamp: '2016-01-01T01:01:01Z' description: For submitting a new AttackPattern uniqueItems: true example: - description: string abstraction_level: aggregate schema_version: 1.3.30 revision: 10 type: attack-pattern source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string x_mitre_platforms: - string language: string id: string tlp: green x_mitre_data_sources: - string kill_chain_phases: - kill_chain_name: string phase_name: string x_mitre_contributors: - string timestamp: '2016-01-01T01:01:01Z' description: a list of `NewAttackPattern`s. campaigns: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - campaign example: campaign description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Timestamp for the definition of a specific version of a campaign. campaign_type: type: string example: string description: 'String value that describes the type of campaign. For example, a campaign type could be ''Ransomware'', ''Advanced Persistent Threat'', ''Business Email Compromise'', ''Phishing'', etc. ' names: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: Used to capture alternate names or aliases associated with the campaign. A cyberattack campaign may have multiple names or aliases depending on the group or actor(s) behind the attack, e.g., 'Wannacry' is also known as 'WannaCrypt', 'WCry', 'Wanna Decryptor', etc. intended_effect: type: array items: type: string example: Account Takeover example: - Account Takeover description: Characterizes the intended effect of this cyber threat campaign. status: type: string enum: - Future - Historic - Ongoing example: Future description: "Indicates current Status of the Campaign. \n\nCan have one of the following values: \n\n- Ongoing: Indicates that the campaign is currently active and ongoing. For example, a mass phishing campaign that is actively targeting users is considered 'ongoing'.\n\n- Historic: Campaign has already occurred and is now in the past.\n\n- Future: This indicates that a campaign is planned or expected to occur in the future. For example, a threat actor may announce their intention to launch a specific cyberattack campaign at a future date." confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: Level of confidence held in the characterization of this Campaign. activity: type: array items: type: object properties: date_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Specifies the date and time at which the activity occured. description: type: string example: string description: A description of the activity. required: - date_time - description example: date_time: '2016-01-01T01:01:01Z' description: string description: Captures the specific activities or tactics associated with the entity. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc. example: - date_time: '2016-01-01T01:01:01Z' description: string description: 'Used to capture specific activities or tactics associated with the campaign. The ''activity'' field is an array of objects, and each element represents a specific activity and time associated with the campaign. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc. By capturing these activities analysts can identify the specific tactics used by the threat actor(s) behind the campaign.' required: - title - description - short_description - campaign_type example: description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 type: campaign campaign_type: string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string activity: - date_time: '2016-01-01T01:01:01Z' description: string source_uri: string intended_effect: - Account Takeover status: Future language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' confidence: High names: - string description: Schema for submitting new Campaigns uniqueItems: true example: - description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 type: campaign campaign_type: string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string activity: - date_time: '2016-01-01T01:01:01Z' description: string source_uri: string intended_effect: - Account Takeover status: Future language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' confidence: High names: - string description: a list of `NewCampaign`s. coas: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - coa example: coa description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. stage: type: string enum: - Containment - Eradication - Identification - Lessons Learned - Preparation - Recovery - Remedy - Response example: Containment description: Specifies what stage in the cyber threat management lifecycle this Course Of Action is relevant to. coa_type: type: string enum: - Diplomatic Actions - Eradication - Hardening - Internal Blocking - Logical Access Restrictions - Monitoring - Other - Patching - Perimeter Blocking - Phase - Physical Access Restrictions - Playbook - Policy Actions - Public Disclosure - Rebuilding - Redirection - Redirection (Honey Pot) - Task - Training example: Diplomatic Actions description: The type of this COA objective: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: Characterizes the objective to provide guidance on how to mitigate a security incident that has been identified. impact: type: string example: string description: Characterizes the estimated impact of applying this course of action. cost: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: Characterizes the estimated cost for applying this course of action. efficacy: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: Effectiveness of this course of action in achieving its targeted objective. related_COAs: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string COA_id: type: string example: string description: A URI leading to a COA. required: - COA_id example: confidence: High source: string relationship: string COA_id: string example: - confidence: High source: string relationship: string COA_id: string description: Identifies or characterizes relationships to one or more related courses of action. structured_coa_type: type: string enum: - openc2 example: openc2 open_c2_coa: type: object properties: type: type: string enum: - structured_coa example: structured_coa id: type: string example: string description: String with at most 1024 characters. action: type: object properties: type: type: string enum: - alert - allow - augment - contain - delete - deny - detonate - distill - get - investigate - locate - mitigate - modify - move - notify - other - pause - query - redirect - remediate - report - response - restart - restore - resume - save - scan - set - snapshot - start - stop - substitute - sync - throttle - update example: alert required: - type example: type: alert target: type: object properties: type: type: string example: acudid specifiers: type: string example: string description: Observable types that can be acted upon. required: - type example: type: acudid specifiers: string actuator: type: object properties: type: type: string enum: - endpoint - endpoint.digital-telephone-handset - endpoint.laptop - endpoint.pos-terminal - endpoint.printer - endpoint.sensor - endpoint.server - endpoint.smart-meter - endpoint.smart-phone - endpoint.tablet - endpoint.workstation - network - network.bridge - network.firewall - network.gateway - network.guard - network.hips - network.hub - network.ids - network.ips - network.modem - network.nic - network.proxy - network.router - network.security_manager - network.sense_making - network.sensor - network.switch - network.vpn - network.wap - other - process - process.aaa-server - process.anti-virus-scanner - process.connection-scanner - process.directory-service - process.dns-server - process.email-service - process.file-scanner - process.location-service - process.network-scanner - process.remediation-service - process.reputation-service - process.sandbox - process.virtualization-service - process.vulnerability-scanner example: endpoint specifiers: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: List of additional properties describing the actuator. required: - type example: type: endpoint specifiers: - string modifiers: type: object properties: delay: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard. duration: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard. frequency: type: string example: string description: String with at most 1024 characters. id: type: string example: string description: String with at most 1024 characters. time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. response: type: string enum: - acknowledge - command-ref - query - status example: acknowledge source: type: string example: string description: String with at most 1024 characters. destination: type: string enum: - copy-to - modify-to - move-to - report-to - restore-point - save-to - set-to example: copy-to method: type: array items: type: string enum: - acl - authenticated - blackhole - blacklist - graceful - hibernate - honeypot - immediate - segmentation - spawn - suspend - unauthenticated - whitelist example: acl example: - acl search: type: string enum: - cve - patch - signature - vendor_bulletin example: cve location: type: string enum: - internal - perimeter example: internal option: type: string example: string description: String with at most 1024 characters. additional_properties: type: object properties: context: type: string example: string description: String with at most 1024 characters. required: - context example: context: string example: response: acknowledge method: - acl additional_properties: context: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' frequency: string duration: '2016-01-01T01:01:01Z' source: string search: cve option: string id: string location: internal delay: '2016-01-01T01:01:01Z' destination: copy-to required: - type - action example: type: structured_coa id: string action: type: alert target: type: acudid specifiers: string actuator: type: endpoint specifiers: - string modifiers: response: acknowledge method: - acl additional_properties: context: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' frequency: string duration: '2016-01-01T01:01:01Z' source: string search: cve option: string id: string location: internal delay: '2016-01-01T01:01:01Z' destination: copy-to example: description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' stage: Containment schema_version: 1.3.30 revision: 10 efficacy: High type: coa related_COAs: - confidence: High source: string relationship: string COA_id: string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string coa_type: Diplomatic Actions language: string id: string tlp: green objective: - string cost: High timestamp: '2016-01-01T01:01:01Z' open_c2_coa: type: structured_coa id: string action: type: alert target: type: acudid specifiers: string actuator: type: endpoint specifiers: - string modifiers: response: acknowledge method: - acl additional_properties: context: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' frequency: string duration: '2016-01-01T01:01:01Z' source: string search: cve option: string id: string location: internal delay: '2016-01-01T01:01:01Z' destination: copy-to structured_coa_type: openc2 impact: string description: Schema for submitting new COAs uniqueItems: true example: - description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' stage: Containment schema_version: 1.3.30 revision: 10 efficacy: High type: coa related_COAs: - confidence: High source: string relationship: string COA_id: string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string coa_type: Diplomatic Actions language: string id: string tlp: green objective: - string cost: High timestamp: '2016-01-01T01:01:01Z' open_c2_coa: type: structured_coa id: string action: type: alert target: type: acudid specifiers: string actuator: type: endpoint specifiers: - string modifiers: response: acknowledge method: - acl additional_properties: context: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' frequency: string duration: '2016-01-01T01:01:01Z' source: string search: cve option: string id: string location: internal delay: '2016-01-01T01:01:01Z' destination: copy-to structured_coa_type: openc2 impact: string description: a list of `NewCOA`s. feedbacks: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - feedback example: feedback description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. entity_id: type: string example: string description: A URI leading to an entity. feedback: type: integer enum: - -1 - 0 - 1 example: -1 reason: type: string example: string required: - entity_id - feedback - reason example: feedback: -1 schema_version: 1.3.30 revision: 10 type: feedback source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string reason: string source_uri: string language: string id: string tlp: green entity_id: string timestamp: '2016-01-01T01:01:01Z' description: Schema for submitting new Feedback. uniqueItems: true example: - feedback: -1 schema_version: 1.3.30 revision: 10 type: feedback source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string reason: string source_uri: string language: string id: string tlp: green entity_id: string timestamp: '2016-01-01T01:01:01Z' description: a list of `NewFeedback`s. incidents: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - incident example: incident description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: 'Represents the level of certainty or trustworthiness associated with the incident. It denotes the reliability of the intelligence associated with the incident. The `confidence` field can take on several values, including: - `info`: Indicates that the incident information is based on sources with no previous track record or there is no track record for the source reporting the incident. - `low`: Indicates that the incident information is based on sources with a questionable track record or there is limited information about the accuracy of the source. - `medium`: Indicates that the incident information is based on sources with a mixed track record or of uncertain reliability. - `high`: Indicates that the incident information is based on sources with a proven track record and high degree of reliability. The `confidence` field can be used to indicate the level of trust and confidence that can be attributed to the incident, and it may impact how the incident is prioritized, analyzed and addressed. It can also help in the decision-making process associated with the incident response activities. It is important to note that the `confidence` field is subjective and can be interpreted differently by different organizations or analysts. As such, it is often used in conjunction with other intelligence attributes, such as the `severity` field, to provide a more complete picture of the incident.' status: type: string enum: - Closed - 'Closed: Confirmed Threat' - 'Closed: False Positive' - 'Closed: Merged' - 'Closed: Near-Miss' - 'Closed: Other' - 'Closed: Suspected' - 'Closed: Under Review' - Containment Achieved - Hold - 'Hold: External' - 'Hold: Internal' - 'Hold: Legal' - Incident Reported - New - 'New: Presented' - 'New: Processing' - Open - 'Open: Contained' - 'Open: Investigating' - 'Open: Recovered' - 'Open: Reported' - Rejected - Restoration Achieved - Stalled example: Closed description: The `status` field represents the current state of an incident within the incident management process. Its values help in tracking and reporting the progress of the incident from its discovery to its resolution. incident_time: type: object properties: opened: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time the incident was first opened. discovered: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time the incident was first discovered. reported: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time the incident was first reported. remediated: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time that the remediation of the damage from the incident was completed. closed: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time that the incident was last closed. rejected: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time that the incident was first rejected. contained: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time that the incident was first contained. required: - opened example: opened: '2016-01-01T01:01:01Z' discovered: '2016-01-01T01:01:01Z' reported: '2016-01-01T01:01:01Z' remediated: '2016-01-01T01:01:01Z' closed: '2016-01-01T01:01:01Z' rejected: '2016-01-01T01:01:01Z' contained: '2016-01-01T01:01:01Z' description: Relevant time values associated with this Incident. meta: type: object additionalProperties: type: string example: string x-anyOf: - type: string example: string - type: number format: double example: 10.0 - type: string format: date-time example: '2016-01-01T01:01:01Z' - type: string example: keyword - type: boolean example: true example: keyword: string description: metadata associated to the incident. properties: {} scores: type: object additionalProperties: type: number format: double example: 10.0 description: A non-negative score number. example: asset: 10.0 description: Used to indicate the severity or impact score of the threat represented by the incident. properties: {} categories: type: array items: type: string example: Attrition example: - Attrition description: A set of categories for this incident. discovery_method: type: string example: Agent Disclosure description: Identifies how the incident was discovered. intended_effect: type: string example: Account Takeover description: Specifies the suspected intended effect of this incident assignees: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: A set of owners assigned to this incident. detection_sources: type: array items: type: string example: string description: String with at most 2048 characters. example: - string description: A set of sources that contributed threat detections to the incident. promotion_method: type: string enum: - Automated - Manual example: Automated description: Describes method for promoting an Incident, whether manually or automatically. An Incident may be created manually by a SOAR analyst or SOC operator, or through an automated correlation or aggregation rule or engine that matches a specific set of events or alerts, and promotes them to Incident(s). detection_status: type: string enum: - active - inactive_expired - inactive_merged - inactive_oversized - inactive_user_closed example: active description: Represents the state of an incident within the incident generation process, indicating whether the incident is actively receiving updates or is no longer being updated. severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown example: Critical description: "Represents the potential impact of an incident on an organization's security posture and business operations. It helps organizations prioritize and allocate resources for incident response based on the severity level of the incident \nIt helps analysts and incident handlers prioritize incidents by indicating the level of risk and potential impact associated with the incident. This enables organizations to allocate resources efficiently and address the most critical incidents first.\nCan also be used to generate reports and metrics for measuring the effectiveness of the incident response process and to identify trends and patterns in the threat landscape.\nIt is important to note that the `severity` field is subjective and can be interpreted differently by different organizations or analysts. Therefore, it should be used in conjunction with other intelligence attributes, such as the `confidence` field, to provide a more comprehensive view of the incident." tactics: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: Represents the offensive techniques, approaches, or procedures that an adversary may use to achieve their objectives during an attack. It helps in understanding the intent and capabilities of the adversary and can be used to identify indicators of attack (IoAs) or indicators of compromise (IoCs) that are associated with the adversary's tactics. techniques: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: Represents the specific methods or actions used by an attacker to carry out an offensive maneuver or achieve their goals. short_id: type: string example: string description: A human-readable, short identifier for the incident, unique within an organization. required: - confidence - status - incident_time example: description: string assignees: - string detection_sources: - string meta: keyword: string schema_version: 1.3.30 revision: 10 type: incident source: string external_ids: - string short_description: string title: string incident_time: opened: '2016-01-01T01:01:01Z' discovered: '2016-01-01T01:01:01Z' reported: '2016-01-01T01:01:01Z' remediated: '2016-01-01T01:01:01Z' closed: '2016-01-01T01:01:01Z' rejected: '2016-01-01T01:01:01Z' contained: '2016-01-01T01:01:01Z' external_references: - source_name: string description: string url: string hashes: - string external_id: string discovery_method: Agent Disclosure source_uri: string intended_effect: Account Takeover categories: - Attrition status: Closed language: string detection_status: active id: string promotion_method: Automated severity: Critical tlp: green scores: asset: 10.0 techniques: - string timestamp: '2016-01-01T01:01:01Z' confidence: High short_id: string tactics: - string description: For submitting a new Incident. uniqueItems: true example: - description: string assignees: - string detection_sources: - string meta: keyword: string schema_version: 1.3.30 revision: 10 type: incident source: string external_ids: - string short_description: string title: string incident_time: opened: '2016-01-01T01:01:01Z' discovered: '2016-01-01T01:01:01Z' reported: '2016-01-01T01:01:01Z' remediated: '2016-01-01T01:01:01Z' closed: '2016-01-01T01:01:01Z' rejected: '2016-01-01T01:01:01Z' contained: '2016-01-01T01:01:01Z' external_references: - source_name: string description: string url: string hashes: - string external_id: string discovery_method: Agent Disclosure source_uri: string intended_effect: Account Takeover categories: - Attrition status: Closed language: string detection_status: active id: string promotion_method: Automated severity: Critical tlp: green scores: asset: 10.0 techniques: - string timestamp: '2016-01-01T01:01:01Z' confidence: High short_id: string tactics: - string description: a list of `NewIncident`s. indicators: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - indicator example: indicator description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time range during which this Indicator is considered valid. producer: type: string example: string description: String with at most 1024 characters. severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown example: Critical negate: type: boolean example: true description: Specifies the absence of the pattern. indicator_type: type: array items: type: string enum: - Anonymization - C2 - Compromised PKI Certificate - Domain Watchlist - Exfiltration - File Hash Watchlist - Host Characteristics - IMEI Watchlist - IMSI Watchlist - IP Watchlist - Login Name - Malicious E-mail - Malware Artifacts - Private Threat Feed - URL Watchlist example: Anonymization example: - Anonymization description: Specifies the type or types for this Indicator. tags: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: Descriptors for this indicator. composite_indicator_expression: type: object properties: operator: type: string enum: - and - not - or example: and indicator_ids: type: array items: type: string example: string description: A URI leading to an indicator. example: - string required: - operator - indicator_ids example: operator: and indicator_ids: - string likely_impact: type: string example: string description: Likely potential impact within the relevant context if this Indicator were to occur. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: level of confidence held in the accuracy of this Indicator. kill_chain_phases: type: array items: type: object properties: kill_chain_name: type: string example: string description: The name of the kill chain. phase_name: type: string example: string description: The name of the phase in the kill chain. required: - kill_chain_name - phase_name example: kill_chain_name: string phase_name: string description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives. example: - kill_chain_name: string phase_name: string description: Relevant kill chain phases indicated by this Indicator. test_mechanisms: type: array items: type: string example: string description: String with at most 2048 characters. example: - string description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator. specification: type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. x-anyOf: - type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. - type: object properties: type: type: string enum: - ThreatBrain example: ThreatBrain query: type: string example: string variables: type: array items: type: string example: string example: - string required: - type - variables example: type: ThreatBrain query: string variables: - string description: An indicator which runs in threatbrain... - type: object properties: type: type: string enum: - Snort example: Snort snort_sig: type: string example: string required: - type - snort_sig example: type: Snort snort_sig: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - SIOC example: SIOC SIOC: type: string example: string required: - type - SIOC example: type: SIOC SIOC: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - OpenIOC example: OpenIOC open_IOC: type: string example: string required: - type - open_IOC example: type: OpenIOC open_IOC: string description: An indicator which contains an XML blob of an openIOC indicator. required: - producer example: description: string tags: - string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' producer: string schema_version: 1.3.30 revision: 10 type: indicator test_mechanisms: - string source: string external_ids: - string short_description: string composite_indicator_expression: operator: and indicator_ids: - string title: string likely_impact: string indicator_type: - Anonymization external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string severity: Critical tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string negate: true timestamp: '2016-01-01T01:01:01Z' confidence: High specification: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: For submitting a new Indicator uniqueItems: true example: - description: string tags: - string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' producer: string schema_version: 1.3.30 revision: 10 type: indicator test_mechanisms: - string source: string external_ids: - string short_description: string composite_indicator_expression: operator: and indicator_ids: - string title: string likely_impact: string indicator_type: - Anonymization external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string severity: Critical tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string negate: true timestamp: '2016-01-01T01:01:01Z' confidence: High specification: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: a list of `NewIndicator`s. judgements: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - judgement example: judgement description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. observable: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. disposition: type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Matches :disposition_name as in {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"} disposition_name: type: string enum: - Clean - Common - Malicious - Suspicious - Unknown example: Clean description: String verdict identifiers. priority: type: integer format: int64 example: 10 description: A value 0-100 that determine the priority of a judgement. Curated feeds of black/white lists, for example known good products within your organizations, should use a 95. All automated systems should use a priority of 90, or less. Human judgements should have a priority of 100, so that humans can always override machines. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown example: Critical valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. reason: type: string example: string description: String with at most 1024 characters. reason_uri: type: string example: string description: A URI required: - source - observable - priority - confidence - severity example: valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 observable: value: 1.2.3.4 type: ip reason_uri: string type: judgement source: string external_ids: - string disposition: 1 external_references: - source_name: string description: string url: string hashes: - string external_id: string reason: string source_uri: string disposition_name: Clean priority: 10 language: string id: string severity: Critical tlp: green timestamp: '2016-01-01T01:01:01Z' confidence: High description: Schema for submitting new Judgements. uniqueItems: true example: - valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 observable: value: 1.2.3.4 type: ip reason_uri: string type: judgement source: string external_ids: - string disposition: 1 external_references: - source_name: string description: string url: string hashes: - string external_id: string reason: string source_uri: string disposition_name: Clean priority: 10 language: string id: string severity: Critical tlp: green timestamp: '2016-01-01T01:01:01Z' confidence: High description: a list of `NewJudgement`s. malwares: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - malware example: malware description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. labels: type: array items: type: string example: adware description: Malware label is an open vocabulary that represents different types and functions of malware. Malware labels are not mutually exclusive; a malware instance can be both spyware and a screen capture tool. example: - adware description: The type of malware being described. kill_chain_phases: type: array items: type: object properties: kill_chain_name: type: string example: string description: The name of the kill chain. phase_name: type: string example: string description: The name of the phase in the kill chain. required: - kill_chain_name - phase_name example: kill_chain_name: string phase_name: string description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives. example: - kill_chain_name: string phase_name: string description: The list of Kill Chain Phases for which this Malware can be used. x_mitre_aliases: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: ATT&CK Software.aliases. abstraction_level: type: string enum: - family - variant - version example: family description: Malware abstraction level. required: - title - description - short_description - labels example: description: string labels: - adware abstraction_level: family schema_version: 1.3.30 revision: 10 type: malware x_mitre_aliases: - string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string timestamp: '2016-01-01T01:01:01Z' description: For submitting a new Malware. uniqueItems: true example: - description: string labels: - adware abstraction_level: family schema_version: 1.3.30 revision: 10 type: malware x_mitre_aliases: - string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string timestamp: '2016-01-01T01:01:01Z' description: a list of `NewMalware`s. notes: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - note example: note description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. note_class: type: string example: keyword content: type: string example: string description: Markdown string with at most 5000 characters. related_entities: type: array items: type: object properties: entity_type: type: string example: string entity_id: type: string example: string description: A URI leading to an entity. required: - entity_type - entity_id example: entity_type: string entity_id: string example: - entity_type: string entity_id: string author: type: string example: string required: - note_class - content - related_entities example: schema_version: 1.3.30 revision: 10 content: string note_class: keyword type: note source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string author: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' related_entities: - entity_type: string entity_id: string description: Schema for submitting Notes uniqueItems: true example: - schema_version: 1.3.30 revision: 10 content: string note_class: keyword type: note source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string author: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' related_entities: - entity_type: string entity_id: string description: a list of `NewNote`s. relationships: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - relationship example: relationship description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. relationship_type: type: string example: attributed-to source_ref: type: string example: string description: A URI leading to an entity. target_ref: type: string example: string description: A URI leading to an entity. required: - relationship_type - source_ref - target_ref example: description: string schema_version: 1.3.30 revision: 10 target_ref: string type: relationship source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string source_ref: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' relationship_type: attributed-to description: Schema for submitting new Relationships. uniqueItems: true example: - description: string schema_version: 1.3.30 revision: 10 target_ref: string type: relationship source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string source_ref: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' relationship_type: attributed-to description: a list of `NewRelationship`s. sightings: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - sighting example: sighting description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. observed_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High count: type: integer format: int64 example: 10 description: 'The number of times an indicator was observed within a certain period of time. For example, if an IP address associated with known malicious activity is observed once within a period of time, it may indicate a low-level threat. However, if the same IP address is observed multiple times within a short time frame, it may indicate a more severe and persistent threat. It can also be used to prioritize security alerts and indicate the urgency of a response. High counts indicate that an indicator is actively being used in a larger campaign, while low counts may indicate isolated incidents.' internal: type: boolean example: false description: "If `true`, indicates that the sighting was reported from internal sources, such as an organization's own internal security tools or SOC.\n Internal sightings are often considered more reliable and actionable than external sightings, which are reported from external sources and may have a lower level of trustworthiness. Internal sightings can provide more context and can help identify potential threats that are unique to a particular environment or organization.\n Internal sightings can also help organizations prioritize their security response efforts by identifying threats that are specific to their environment and may not yet be widely known." severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown example: Critical resolution: type: string example: detected description: Represents the disposition or actions taken on the associated threat intelligence. data: type: object properties: columns: type: array items: type: object properties: name: type: string example: string type: type: string enum: - integer - markdown - number - observable - string - url example: integer description: type: string example: string description: Markdown string with at most 5000 characters. required: type: boolean example: true description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`. short_description: type: string example: string required: - name - type example: name: string type: integer description: string required: true short_description: string example: - name: string type: integer description: string required: true short_description: string description: an ordered list of column definitions rows: type: array items: type: array items: example: anything example: - - anything description: an ordered list of rows row_count: type: integer format: int64 example: 10 description: The number of rows in the data table. required: - columns - rows example: columns: - name: string type: integer description: string required: true short_description: string rows: - - anything row_count: 10 description: An embedded data table for the Sighting. sensor: type: string example: endpoint description: The OpenC2 Actuator name that best fits the device that is creating this sighting (e.g. network.firewall) sensor_coordinates: type: object properties: type: type: string example: endpoint description: The sensor/actuator name that best fits a device. observables: type: array items: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. example: - value: 1.2.3.4 type: ip os: type: string example: string required: - type - observables example: type: endpoint observables: - value: 1.2.3.4 type: ip os: string description: Describes the device that made the sighting (sensor) and contains identifying observables for the sensor. targets: type: array items: type: object properties: type: type: string example: endpoint description: The sensor/actuator name that best fits a device. observables: type: array items: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. example: - value: 1.2.3.4 type: ip observed_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). os: type: string example: string required: - type - observables - observed_time example: type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string description: Describes the target of the sighting and contains identifying observables for the target. example: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string description: 'May include one or more targets that observed the associated indicator. Targets can include network devices, host devices, or other entities that are capable of detecting indicators of compromise. Can be used to assess the scope of potential threats, helping analysts understand which devices or components of the network may be vulnerable to attack. For example, if a particular malware strain is detected on several different systems within an organization, the `targets` field may indicate which systems are affected and which may need to be isolated or patched to prevent further spread.' observables: type: array items: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. example: - value: 1.2.3.4 type: ip description: The object(s) of interest. relations: type: array items: type: object properties: origin: type: string example: string origin_uri: type: string example: string description: A URI relation: type: string example: Allocated relation_info: type: object additionalProperties: example: anything example: keyword: anything properties: {} source: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. related: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. required: - origin - relation - source - related example: origin: string origin_uri: string relation: Allocated relation_info: keyword: anything source: value: 1.2.3.4 type: ip related: value: 1.2.3.4 type: ip description: A relation inside a Sighting. example: - origin: string origin_uri: string relation: Allocated relation_info: keyword: anything source: value: 1.2.3.4 type: ip related: value: 1.2.3.4 type: ip description: Provide any context we can about where the observable came from. context: type: object properties: process_create_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. type: type: string enum: - ProcessCreateEvent example: ProcessCreateEvent process_args: type: string example: string description: String with at most 2048 characters. process_hash: type: string example: string description: String with at most 2048 characters. process_size: type: integer format: int64 example: 10 process_disposition: type: string example: string description: String with at most 1024 characters. parent_creation_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard. parent_process_id: type: integer format: int64 example: 10 parent_process_guid: type: integer format: int64 example: 10 parent_process_name: type: string example: string description: String with at most 1024 characters. parent_process_args: type: string example: string description: String with at most 2048 characters. parent_process_username: type: string example: string description: String with at most 1024 characters. parent_process_hash: type: string example: string description: String with at most 2048 characters. parent_process_size: type: integer format: int64 example: 10 parent_process_disposition: type: string example: string description: String with at most 1024 characters. required: - time - process_id - process_name - type example: parent_process_name: string process_guid: 10 parent_process_guid: 10 process_disposition: string parent_process_size: 10 process_size: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_disposition: string type: ProcessCreateEvent parent_process_username: string parent_process_id: 10 parent_process_args: string process_name: string process_hash: string process_id: 10 parent_process_hash: string process_username: string parent_creation_time: '2016-01-01T01:01:01Z' process_args: string example: - parent_process_name: string process_guid: 10 parent_process_guid: 10 process_disposition: string parent_process_size: 10 process_size: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_disposition: string type: ProcessCreateEvent parent_process_username: string parent_process_id: 10 parent_process_args: string process_name: string process_hash: string process_id: 10 parent_process_hash: string process_username: string parent_creation_time: '2016-01-01T01:01:01Z' process_args: string description: a list of `ProcessCreate` library_load_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. type: type: string enum: - LibraryLoadEvent example: LibraryLoadEvent dll_library_name: type: string example: string description: String with at most 1024 characters. dll_library_path: type: string example: string description: String with at most 2048 characters. required: - time - process_id - process_name - type - dll_library_name - dll_library_path example: time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string type: LibraryLoadEvent dll_library_name: string dll_library_path: string example: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string type: LibraryLoadEvent dll_library_name: string dll_library_path: string description: a list of `LibraryLoadType` file_create_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. file_name: type: string example: string description: String with at most 1024 characters. file_path: type: string example: string description: String with at most 2048 characters. type: type: string enum: - FileCreateEvent example: FileCreateEvent failed: type: boolean example: false required: - time - process_id - process_name - file_name - file_path - type example: file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileCreateEvent file_path: string process_name: string process_id: 10 process_username: string failed: false example: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileCreateEvent file_path: string process_name: string process_id: 10 process_username: string failed: false description: a list of `FileCreateType` file_delete_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. file_name: type: string example: string description: String with at most 1024 characters. file_path: type: string example: string description: String with at most 2048 characters. type: type: string enum: - FileDeleteEvent example: FileDeleteEvent failed: type: boolean example: false required: - time - process_id - process_name - file_name - file_path - type example: file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileDeleteEvent file_path: string process_name: string process_id: 10 process_username: string failed: false example: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileDeleteEvent file_path: string process_name: string process_id: 10 process_username: string failed: false description: a list of `FileDeleteType` file_modify_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. file_name: type: string example: string description: String with at most 1024 characters. file_path: type: string example: string description: String with at most 2048 characters. type: type: string enum: - FileModifyEvent example: FileModifyEvent failed: type: boolean example: false required: - time - process_id - process_name - file_name - file_path - type example: file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileModifyEvent file_path: string process_name: string process_id: 10 process_username: string failed: false example: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileModifyEvent file_path: string process_name: string process_id: 10 process_username: string failed: false description: a list of `FileModifyType` file_move_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. file_name: type: string example: string description: String with at most 1024 characters. file_path: type: string example: string description: String with at most 2048 characters. type: type: string enum: - FileMoveEvent example: FileMoveEvent old_name: type: string example: string description: String with at most 1024 characters. new_name: type: string example: string description: String with at most 1024 characters. required: - time - process_id - process_name - file_name - file_path - type - old_name - new_name example: file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileMoveEvent old_name: string file_path: string process_name: string process_id: 10 process_username: string new_name: string example: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileMoveEvent old_name: string file_path: string process_name: string process_id: 10 process_username: string new_name: string description: a list of `FileMoveType` netflow_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. type: type: string enum: - NetflowEvent example: NetflowEvent traffic: type: object properties: protocol: type: integer format: int64 example: 10 description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml) source_ip: type: string example: string destination_ip: type: string example: string source_port: type: integer format: int64 example: 10 destination_port: type: integer format: int64 example: 10 direction: type: string enum: - incoming - outgoing example: incoming destination_host_name: type: string example: string source_subnet: type: string example: string destination_subnet: type: string example: string required: - protocol - source_ip - destination_ip - source_port - destination_port - direction example: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 process_path: type: string example: string description: String with at most 1024 characters. process_args: type: string example: string description: String with at most 1024 characters. process_hash: type: string example: string description: String with at most 1024 characters. process_account_type: type: string example: string description: String with at most 1024 characters. process_account: type: string example: string description: String with at most 1024 characters. parent_process_id: type: integer format: int64 example: 10 parent_process_name: type: string example: string description: String with at most 1024 characters. parent_process_path: type: string example: string description: String with at most 1024 characters. parent_process_args: type: string example: string description: String with at most 1024 characters. parent_process_hash: type: string example: string description: String with at most 1024 characters. parent_process_account: type: string example: string description: String with at most 1024 characters. parent_process_account_type: type: string example: string description: String with at most 1024 characters. flow_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard. byte_count_out: type: integer format: int64 example: 10 byte_count_in: type: integer format: int64 example: 10 required: - time - process_id - process_name - type - traffic example: parent_process_name: string byte_count_in: 10 process_guid: 10 process_path: string traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 flow_time: '2016-01-01T01:01:01Z' time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_account: string type: NetflowEvent process_account_type: string parent_process_path: string parent_process_id: 10 parent_process_args: string process_name: string process_account: string parent_process_account_type: string process_hash: string process_id: 10 parent_process_hash: string process_username: string byte_count_out: 10 process_args: string example: - parent_process_name: string byte_count_in: 10 process_guid: 10 process_path: string traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 flow_time: '2016-01-01T01:01:01Z' time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_account: string type: NetflowEvent process_account_type: string parent_process_path: string parent_process_id: 10 parent_process_args: string process_name: string process_account: string parent_process_account_type: string process_hash: string process_id: 10 parent_process_hash: string process_username: string byte_count_out: 10 process_args: string description: a list of `NetflowType` http_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. type: type: string enum: - HTTPEvent example: HTTPEvent host: type: string example: string description: String with at most 1024 characters. traffic: type: object properties: protocol: type: integer format: int64 example: 10 description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml) source_ip: type: string example: string destination_ip: type: string example: string source_port: type: integer format: int64 example: 10 destination_port: type: integer format: int64 example: 10 direction: type: string enum: - incoming - outgoing example: incoming destination_host_name: type: string example: string source_subnet: type: string example: string destination_subnet: type: string example: string required: - protocol - source_ip - destination_ip - source_port - destination_port - direction example: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 url_port: type: integer format: int64 example: 10 query: type: string example: string description: String with at most 5000 characters. encrypted: type: boolean example: true method: type: string enum: - CONNECT - GET - HEAD - OPTIONS - PATCH - POST - PUT - TRACE example: CONNECT required: - time - process_id - process_name - type - host - traffic example: process_guid: 10 traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 method: CONNECT time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: HTTPEvent host: string process_name: string process_id: 10 process_username: string query: string encrypted: true url_port: 10 example: - process_guid: 10 traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 method: CONNECT time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: HTTPEvent host: string process_name: string process_id: 10 process_username: string query: string encrypted: true url_port: 10 description: a list of `HTTPType` registry_create_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. registry_key: type: string example: string description: String with at most 1024 characters. type: type: string enum: - RegistryCreateEvent example: RegistryCreateEvent required: - time - process_id - process_name - registry_key - type example: time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryCreateEvent example: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryCreateEvent description: a list of `RegistryCreateType` registry_set_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. registry_key: type: string example: string description: String with at most 1024 characters. type: type: string enum: - RegistrySetEvent example: RegistrySetEvent registry_value: type: string example: string description: String with at most 2048 characters. registry_data_length: type: integer format: int64 example: 10 registry_data: type: string example: string description: String with at most 5000 characters. required: - time - process_id - process_name - registry_key - type - registry_value example: process_guid: 10 registry_data: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: RegistrySetEvent registry_data_length: 10 registry_value: string registry_key: string process_name: string process_id: 10 process_username: string example: - process_guid: 10 registry_data: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: RegistrySetEvent registry_data_length: 10 registry_value: string registry_key: string process_name: string process_id: 10 process_username: string description: a list of `RegistrySetType` registry_delete_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. registry_key: type: string example: string description: String with at most 1024 characters. type: type: string enum: - RegistryDeleteEvent example: RegistryDeleteEvent registry_value: type: string example: string description: String with at most 2048 characters. required: - time - process_id - process_name - registry_key - type example: time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryDeleteEvent registry_value: string example: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryDeleteEvent registry_value: string description: a list of `RegistryDeleteType` registry_rename_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. registry_key: type: string example: string description: String with at most 1024 characters. type: type: string enum: - RegistryRenameEvent example: RegistryRenameEvent registry_old_key: type: string example: string description: String with at most 1024 characters. required: - time - process_id - process_name - registry_key - type - registry_old_key example: time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryRenameEvent registry_old_key: string example: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryRenameEvent registry_old_key: string description: a list of `RegistryRenameType` example: http_events: - process_guid: 10 traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 method: CONNECT time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: HTTPEvent host: string process_name: string process_id: 10 process_username: string query: string encrypted: true url_port: 10 process_create_events: - parent_process_name: string process_guid: 10 parent_process_guid: 10 process_disposition: string parent_process_size: 10 process_size: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_disposition: string type: ProcessCreateEvent parent_process_username: string parent_process_id: 10 parent_process_args: string process_name: string process_hash: string process_id: 10 parent_process_hash: string process_username: string parent_creation_time: '2016-01-01T01:01:01Z' process_args: string registry_delete_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryDeleteEvent registry_value: string file_modify_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileModifyEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_set_events: - process_guid: 10 registry_data: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: RegistrySetEvent registry_data_length: 10 registry_value: string registry_key: string process_name: string process_id: 10 process_username: string file_create_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileCreateEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_create_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryCreateEvent library_load_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string type: LibraryLoadEvent dll_library_name: string dll_library_path: string file_move_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileMoveEvent old_name: string file_path: string process_name: string process_id: 10 process_username: string new_name: string file_delete_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileDeleteEvent file_path: string process_name: string process_id: 10 process_username: string failed: false netflow_events: - parent_process_name: string byte_count_in: 10 process_guid: 10 process_path: string traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 flow_time: '2016-01-01T01:01:01Z' time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_account: string type: NetflowEvent process_account_type: string parent_process_path: string parent_process_id: 10 parent_process_args: string process_name: string process_account: string parent_process_account_type: string process_hash: string process_id: 10 parent_process_hash: string process_username: string byte_count_out: 10 process_args: string registry_rename_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryRenameEvent registry_old_key: string description: Context including the event type that best fits the type of the sighting. activity_interval: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time interval during which the malicious activity occurred. For example, the time when a malware sample was executing, or the time range of a network intrusion. detection_interval: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time interval during which the malicious activity was detected by the source engine or security tool. This may differ from the activity_interval if detection occurred after the activity. modification_interval: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time interval during which the sighting record was created or last updated in the system. required: - observed_time example: description: string schema_version: 1.3.30 revision: 10 relations: - origin: string origin_uri: string relation: Allocated relation_info: keyword: anything source: value: 1.2.3.4 type: ip related: value: 1.2.3.4 type: ip sensor_coordinates: type: endpoint observables: - value: 1.2.3.4 type: ip os: string observables: - value: 1.2.3.4 type: ip type: sighting source: string external_ids: - string targets: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string short_description: string title: string resolution: detected internal: false external_references: - source_name: string description: string url: string hashes: - string external_id: string detection_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' source_uri: string activity_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' language: string id: string count: 10 severity: Critical tlp: green modification_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' context: http_events: - process_guid: 10 traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 method: CONNECT time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: HTTPEvent host: string process_name: string process_id: 10 process_username: string query: string encrypted: true url_port: 10 process_create_events: - parent_process_name: string process_guid: 10 parent_process_guid: 10 process_disposition: string parent_process_size: 10 process_size: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_disposition: string type: ProcessCreateEvent parent_process_username: string parent_process_id: 10 parent_process_args: string process_name: string process_hash: string process_id: 10 parent_process_hash: string process_username: string parent_creation_time: '2016-01-01T01:01:01Z' process_args: string registry_delete_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryDeleteEvent registry_value: string file_modify_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileModifyEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_set_events: - process_guid: 10 registry_data: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: RegistrySetEvent registry_data_length: 10 registry_value: string registry_key: string process_name: string process_id: 10 process_username: string file_create_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileCreateEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_create_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryCreateEvent library_load_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string type: LibraryLoadEvent dll_library_name: string dll_library_path: string file_move_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileMoveEvent old_name: string file_path: string process_name: string process_id: 10 process_username: string new_name: string file_delete_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileDeleteEvent file_path: string process_name: string process_id: 10 process_username: string failed: false netflow_events: - parent_process_name: string byte_count_in: 10 process_guid: 10 process_path: string traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 flow_time: '2016-01-01T01:01:01Z' time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_account: string type: NetflowEvent process_account_type: string parent_process_path: string parent_process_id: 10 parent_process_args: string process_name: string process_account: string parent_process_account_type: string process_hash: string process_id: 10 parent_process_hash: string process_username: string byte_count_out: 10 process_args: string registry_rename_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryRenameEvent registry_old_key: string timestamp: '2016-01-01T01:01:01Z' confidence: High observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' sensor: endpoint data: columns: - name: string type: integer description: string required: true short_description: string rows: - - anything row_count: 10 description: For submitting a new Sighting. uniqueItems: true example: - description: string schema_version: 1.3.30 revision: 10 relations: - origin: string origin_uri: string relation: Allocated relation_info: keyword: anything source: value: 1.2.3.4 type: ip related: value: 1.2.3.4 type: ip sensor_coordinates: type: endpoint observables: - value: 1.2.3.4 type: ip os: string observables: - value: 1.2.3.4 type: ip type: sighting source: string external_ids: - string targets: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string short_description: string title: string resolution: detected internal: false external_references: - source_name: string description: string url: string hashes: - string external_id: string detection_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' source_uri: string activity_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' language: string id: string count: 10 severity: Critical tlp: green modification_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' context: http_events: - process_guid: 10 traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 method: CONNECT time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: HTTPEvent host: string process_name: string process_id: 10 process_username: string query: string encrypted: true url_port: 10 process_create_events: - parent_process_name: string process_guid: 10 parent_process_guid: 10 process_disposition: string parent_process_size: 10 process_size: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_disposition: string type: ProcessCreateEvent parent_process_username: string parent_process_id: 10 parent_process_args: string process_name: string process_hash: string process_id: 10 parent_process_hash: string process_username: string parent_creation_time: '2016-01-01T01:01:01Z' process_args: string registry_delete_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryDeleteEvent registry_value: string file_modify_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileModifyEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_set_events: - process_guid: 10 registry_data: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: RegistrySetEvent registry_data_length: 10 registry_value: string registry_key: string process_name: string process_id: 10 process_username: string file_create_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileCreateEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_create_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryCreateEvent library_load_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string type: LibraryLoadEvent dll_library_name: string dll_library_path: string file_move_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileMoveEvent old_name: string file_path: string process_name: string process_id: 10 process_username: string new_name: string file_delete_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileDeleteEvent file_path: string process_name: string process_id: 10 process_username: string failed: false netflow_events: - parent_process_name: string byte_count_in: 10 process_guid: 10 process_path: string traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 flow_time: '2016-01-01T01:01:01Z' time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_account: string type: NetflowEvent process_account_type: string parent_process_path: string parent_process_id: 10 parent_process_args: string process_name: string process_account: string parent_process_account_type: string process_hash: string process_id: 10 parent_process_hash: string process_username: string byte_count_out: 10 process_args: string registry_rename_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryRenameEvent registry_old_key: string timestamp: '2016-01-01T01:01:01Z' confidence: High observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' sensor: endpoint data: columns: - name: string type: integer description: string required: true short_description: string rows: - - anything row_count: 10 description: a list of `NewSighting`s. identity_assertions: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - identity-assertion example: identity-assertion description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. identity: type: object properties: observables: type: array items: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. example: - value: 1.2.3.4 type: ip required: - observables example: observables: - value: 1.2.3.4 type: ip description: Attributes for which the assertion is being made. assertions: type: array items: type: object properties: name: type: string example: cisco:ctr:ad:host_domain_name description: An open vocabulary containing well known assertion types value: type: string example: string required: - name - value example: name: cisco:ctr:ad:host_domain_name value: string example: - name: cisco:ctr:ad:host_domain_name value: string description: Any known context about the identity attributes. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. required: - identity - assertions example: valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' identity: observables: - value: 1.2.3.4 type: ip schema_version: 1.3.30 revision: 10 type: identity-assertion source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' assertions: - name: cisco:ctr:ad:host_domain_name value: string description: For submitting a new IdentityAssertion. uniqueItems: true example: - valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' identity: observables: - value: 1.2.3.4 type: ip schema_version: 1.3.30 revision: 10 type: identity-assertion source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' assertions: - name: cisco:ctr:ad:host_domain_name value: string description: a list of `NewIdentityAssertion`s. target_records: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - target-record example: target-record description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. targets: type: array items: type: object properties: type: type: string example: endpoint description: The sensor/actuator name that best fits a device. observables: type: array items: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. example: - value: 1.2.3.4 type: ip observed_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). os: type: string example: string description: Source Operating System where TargetRecord was originated. internal: type: boolean example: false description: Is it internal to our network? sensor: type: string example: string description: 'The OpenC2 Actuator name that best fits the device that is creating this TargetRecord (e.g.: network.firewall, etc.)' source_uri: type: string example: string description: A URI required: - type - observables - observed_time example: type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string internal: false sensor: string source_uri: string description: Schema for TargetRecord Targets example: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string internal: false sensor: string source_uri: string required: - source - targets example: description: string schema_version: 1.3.30 revision: 10 type: target-record source: string external_ids: - string targets: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string internal: false sensor: string source_uri: string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' description: Schema for submitting new TargetRecord. uniqueItems: true example: - description: string schema_version: 1.3.30 revision: 10 type: target-record source: string external_ids: - string targets: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string internal: false sensor: string source_uri: string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' description: a list of `NewTargetRecord`s. tools: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - tool example: tool description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. labels: type: array items: type: string example: credential-exploitation description: Tool labels describe the categories of tools that can be used to perform attacks. example: - credential-exploitation description: The kind(s) of tool(s) being described. kill_chain_phases: type: array items: type: object properties: kill_chain_name: type: string example: string description: The name of the kill chain. phase_name: type: string example: string description: The name of the phase in the kill chain. required: - kill_chain_name - phase_name example: kill_chain_name: string phase_name: string description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives. example: - kill_chain_name: string phase_name: string description: The list of kill chain phases for which this Tool can be used. tool_version: type: string example: string description: The version identifier associated with the Tool. x_mitre_aliases: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: ATT&CK Software.aliases. required: - title - description - short_description - labels example: description: string labels: - credential-exploitation schema_version: 1.3.30 revision: 10 type: tool x_mitre_aliases: - string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tool_version: string tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string timestamp: '2016-01-01T01:01:01Z' description: For submitting a new Tool. uniqueItems: true example: - description: string labels: - credential-exploitation schema_version: 1.3.30 revision: 10 type: tool x_mitre_aliases: - string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tool_version: string tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string timestamp: '2016-01-01T01:01:01Z' description: a list of `NewTool`s. verdicts: type: array items: type: object properties: type: type: string enum: - verdict example: verdict disposition: type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Numeric verdict identifiers. observable: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. judgement_id: type: string example: string description: A URI leading to a judgement. disposition_name: type: string enum: - Clean - Common - Malicious - Suspicious - Unknown example: Clean description: 'The disposition_name field is optional, but is intended to be shown to a user. Applications must therefore remember the mapping of numbers to human words, as in: {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}' valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. required: - type - disposition - observable - valid_time example: type: verdict disposition: 1 observable: value: 1.2.3.4 type: ip judgement_id: string disposition_name: Clean valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: "A Verdict is chosen from all of the Judgements on that Observable which have not yet expired. The highest priority Judgement becomes the active verdict. If there is more than one Judgement with that priority, then Clean disposition has priority over all others, then Malicious disposition, and so on down to Unknown.\n\n The ID of a verdict is a a str of the form \"observable.type:observable.value\" for example, \"ip:1.1.1.1\"" uniqueItems: true example: - type: verdict disposition: 1 observable: value: 1.2.3.4 type: ip judgement_id: string disposition_name: Clean valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: a list of `Verdict`s. data_tables: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - data-table example: data-table description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. columns: type: array items: type: object properties: name: type: string example: string type: type: string enum: - integer - markdown - number - observable - string - url example: integer description: type: string example: string description: Markdown string with at most 5000 characters. required: type: boolean example: true description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`. short_description: type: string example: string required: - name - type example: name: string type: integer description: string required: true short_description: string example: - name: string type: integer description: string required: true short_description: string description: An ordered list of column definitions. rows: type: array items: type: array items: example: anything example: - - anything description: An ordered list of rows valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. row_count: type: integer format: int64 example: 10 description: The number of rows in the data table. required: - columns - rows example: description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 columns: - name: string type: integer description: string required: true short_description: string type: data-table source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string rows: - - anything source_uri: string language: string id: string tlp: green row_count: 10 timestamp: '2016-01-01T01:01:01Z' description: Schema for submitting a NewDataTable record. uniqueItems: true example: - description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 columns: - name: string type: integer description: string required: true short_description: string type: data-table source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string rows: - - anything source_uri: string language: string id: string tlp: green row_count: 10 timestamp: '2016-01-01T01:01:01Z' description: a list of `NewDataTable`s. weaknesses: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - weakness example: weakness description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: Should be short and limited to the key points that define this weakness. short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. structure: type: string enum: - Chain - Composite - Simple example: Chain description: Defines the structural nature of the weakness. languages: type: array items: type: object properties: prevalence: type: string enum: - Often - Rarely - Sometimes - Undetermined example: Often description: Defines the different regularities that guide the applicability of platforms. name: type: string example: string description: Language name (Clojure, Java, ...) class: type: string example: Assembly description: Class of language. required: - prevalence example: prevalence: Often name: string class: Assembly example: - prevalence: Often name: string class: Assembly description: Applicable Languages. operating_systems: type: array items: type: object properties: prevalence: type: string enum: - Often - Rarely - Sometimes - Undetermined example: Often description: Defines the different regularities that guide the applicability of platforms. name: type: string example: string description: String with at most 1024 characters. version: type: string example: string description: String with at most 1024 characters. cpe_id: type: string example: string description: String with at most 1024 characters. class: type: string example: Android description: Class of Operating System. required: - prevalence example: prevalence: Often name: string version: string cpe_id: string class: Android example: - prevalence: Often name: string version: string cpe_id: string class: Android description: Applicable operating systems. architectures: type: array items: type: object properties: prevalence: type: string enum: - Often - Rarely - Sometimes - Undetermined example: Often description: Defines the different regularities that guide the applicability of platforms. name: type: string example: string description: Architecture name (ARM, x86, ...) class: type: string example: Embedded description: Class of architecture required: - prevalence example: prevalence: Often name: string class: Embedded example: - prevalence: Often name: string class: Embedded description: Applicable architectures. paradigms: type: array items: type: object properties: prevalence: type: string enum: - Often - Rarely - Sometimes - Undetermined example: Often description: Defines the different regularities that guide the applicability of platforms. name: type: string example: string description: Paradigm name (Client Server, Mainframe) required: - prevalence example: prevalence: Often name: string example: - prevalence: Often name: string description: Applicable paradigms. technologies: type: array items: type: object properties: prevalence: type: string enum: - Often - Rarely - Sometimes - Undetermined example: Often description: Defines the different regularities that guide the applicability of platforms. name: type: string example: string description: Technology name (Web Server, Web Client) required: - prevalence example: prevalence: Often name: string example: - prevalence: Often name: string description: Applicable technologies. background_details: type: string example: string description: Information that is relevant but not related to the nature of the weakness itself. alternate_terms: type: array items: type: object properties: term: type: string example: string description: The actual alternate term. description: type: string example: string description: Provides context for the alternate term by which this weakness may be known. required: - term example: term: string description: string example: - term: string description: string description: Indicates one or more other names used to describe this weakness. modes_of_introduction: type: array items: type: object properties: phase: type: string example: Architecture and Design description: Identifies the point in the software life cycle at which the weakness may be introduced. note: type: string example: string description: Provides a typical scenario related to introduction during the given phase. required: - phase example: phase: Architecture and Design note: string example: - phase: Architecture and Design note: string description: Information about how and when a given weakness may be introduced. likelihood: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: Likelihood of exploit. common_consequences: type: array items: type: object properties: scopes: type: array items: type: string example: Access Control description: Defines the different areas of software security that can be affected by exploiting a weakness. example: - Access Control description: Identifies the security property that is violated. impacts: type: array items: type: string example: Alter Execution Logic example: - Alter Execution Logic description: Describes the technical impact that arises if an adversary succeeds in exploiting this weakness. likelihood: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: How likely the specific consequence is expected to be seen relative to the other consequences. note: type: string example: string description: Additional commentary about a consequence. required: - scopes example: scopes: - Access Control impacts: - Alter Execution Logic likelihood: High note: string example: - scopes: - Access Control impacts: - Alter Execution Logic likelihood: High note: string description: Refers to the typical or expected negative effects that can result from exploiting the weakness. This could include anything from unauthorized access to data, denial of service, system crashes or other things. detection_methods: type: array items: type: object properties: method: type: string example: Architecture or Design Review description: Identifies the particular detection method being described. description: type: string example: string description: Provides some context of how this method can be applied to a specific weakness. effectiveness: type: string example: High description: How effective the detection method may be in detecting the associated weakness. effectiveness_notes: type: string example: string description: Provides additional discussion of the strengths and shortcomings of this detection method. required: - method - description example: method: Architecture or Design Review description: string effectiveness: High effectiveness_notes: string example: - method: Architecture or Design Review description: string effectiveness: High effectiveness_notes: string description: Identifies methods that may be employed to detect this weakness, including their strengths and limitations. potential_mitigations: type: array items: type: object properties: description: type: string example: string description: A description of this individual mitigation including any strengths and shortcomings of this mitigation for the weakness. phases: type: array items: type: string example: Architecture and Design description: Defines the different regularities that guide the applicability of platforms. example: - Architecture and Design description: Indicates the development life cycle phase during which this particular mitigation may be applied. strategy: type: string example: Attack Surface Reduction description: A general strategy for protecting a system to which this mitigation contributes. effectiveness: type: string example: Defense in Depth description: Summarizes how effective the mitigation may be in preventing the weakness. effectiveness_notes: type: string example: string description: Markdown string with at most 5000 characters. required: - description example: description: string phases: - Architecture and Design strategy: Attack Surface Reduction effectiveness: Defense in Depth effectiveness_notes: string example: - description: string phases: - Architecture and Design strategy: Attack Surface Reduction effectiveness: Defense in Depth effectiveness_notes: string description: Describes potential mitigations associated with a weakness. functional_areas: type: array items: type: string example: Authentication description: Defines the different functional areas of software in which the weakness may appear. example: - Authentication description: Identifies the functional area of the software in which the weakness is most likely to occur. affected_resources: type: array items: type: string example: CPU description: Defines a resource of a system. example: - CPU description: Identifies system resources that can be affected by an exploit of this weakness. notes: type: array items: type: object properties: type: type: string example: Applicable Platform description: Defines the different types of notes that can be associated with a weakness. note: type: string example: string description: Markdown string with at most 5000 characters. required: - type - note example: type: Applicable Platform note: string example: - type: Applicable Platform note: string description: Provides any additional comments about the weakness. abstraction_level: type: string enum: - Base - Class - Compound - Variant example: Base description: Refers to the level of abstraction or granularity used to describe the weakness. It helps to categorize the vulnerability based on the level of detail provided. required: - description example: description: string background_details: string paradigms: - prevalence: Often name: string abstraction_level: Base architectures: - prevalence: Often name: string class: Embedded schema_version: 1.3.30 revision: 10 alternate_terms: - term: string description: string likelihood: High type: weakness source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string functional_areas: - Authentication source_uri: string modes_of_introduction: - phase: Architecture and Design note: string structure: Chain language: string id: string notes: - type: Applicable Platform note: string common_consequences: - scopes: - Access Control impacts: - Alter Execution Logic likelihood: High note: string tlp: green detection_methods: - method: Architecture or Design Review description: string effectiveness: High effectiveness_notes: string operating_systems: - prevalence: Often name: string version: string cpe_id: string class: Android affected_resources: - CPU languages: - prevalence: Often name: string class: Assembly timestamp: '2016-01-01T01:01:01Z' potential_mitigations: - description: string phases: - Architecture and Design strategy: Attack Surface Reduction effectiveness: Defense in Depth effectiveness_notes: string technologies: - prevalence: Often name: string description: For submitting a new weakness. uniqueItems: true example: - description: string background_details: string paradigms: - prevalence: Often name: string abstraction_level: Base architectures: - prevalence: Often name: string class: Embedded schema_version: 1.3.30 revision: 10 alternate_terms: - term: string description: string likelihood: High type: weakness source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string functional_areas: - Authentication source_uri: string modes_of_introduction: - phase: Architecture and Design note: string structure: Chain language: string id: string notes: - type: Applicable Platform note: string common_consequences: - scopes: - Access Control impacts: - Alter Execution Logic likelihood: High note: string tlp: green detection_methods: - method: Architecture or Design Review description: string effectiveness: High effectiveness_notes: string operating_systems: - prevalence: Often name: string version: string cpe_id: string class: Android affected_resources: - CPU languages: - prevalence: Often name: string class: Assembly timestamp: '2016-01-01T01:01:01Z' potential_mitigations: - description: string phases: - Architecture and Design strategy: Attack Surface Reduction effectiveness: Defense in Depth effectiveness_notes: string technologies: - prevalence: Often name: string description: a list of `NewWeakness`s. vulnerabilities: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - vulnerability example: vulnerability description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: "Various sources of vulnerability information can be used, including third-party resources like the National Vulnerability Database (NVD) and the Common Vulnerabilities and Exposures (CVE) database. The platform then analyzes this data and provides the user with relevant details such as the severity of the vulnerability, the affected systems, and remediation recommendations. \n\n Based on this information, the user can prioritize patching and other mitigation strategies to reduce the risk of potential attacks." short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. cve: type: object properties: cve_data_meta: type: object properties: id: type: string example: string description: String with at most 1024 characters. assigner: type: string example: string description: String with at most 1024 characters. example: id: string assigner: string required: - cve_data_meta example: cve_data_meta: id: string assigner: string impact: type: object properties: cvss_v2: type: object properties: vector_string: type: string example: string description: a text representation of a set of CVSSv2 metrics. It is commonly used to record or transfer CVSSv2 metric information in a concise form base_score: type: number format: double example: 10.0 description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v2/guide' base_severity: type: string enum: - High - Info - Low - Medium - None - Unknown example: High impact_score: type: number format: double example: 10.0 description: a Score number from 0 to 10 exploitability_score: type: number format: double example: 10.0 description: a Score number from 0 to 10 access_vector: type: string enum: - adjacent network - local - network example: network description: This metric reflects how the vulnerability is exploited.The more remote an attacker can be to attack a host, the greater the vulnerability score. access_complexity: type: string enum: - high - low - medium example: low description: 'This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system. For example, consider a buffer overflow in an Internet service: once the target system is located, the attacker can launch an exploit at will.' authentication: type: string enum: - multiple - none - single example: none description: This metric measures the number of times an attacker must authenticate to a target in order to exploit a vulnerability. This metric does not gauge the strength or complexity of the authentication process, only that an attacker is required to provide credentials before an exploit may occur. The fewer authentication instances that are required, the higher the vulnerability score. confidentiality_impact: type: string enum: - complete - none - partial example: complete description: This metric measures the impact on confidentiality of a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. Increasedconfidentiality impact increases the vulnerability score. integrity_impact: type: string enum: - complete - none - partial example: complete description: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and guaranteed veracity of information. Increased integrity impact increases the vulnerability score. availability_impact: type: string enum: - complete - none - partial example: complete description: This metric measures the impact to availability of a successfully exploited vulnerability. Availability refers to the accessibility of information resources. Attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system. Increased availability impact increases the vulnerability score. exploitability: type: string enum: - functional - high - not_defined - proof_of_concept - unproven example: not_defined description: This metric measures the current state of exploit techniques or code availability. Public availability of easy-to-use exploit code increases the number of potential attackers by including those who are unskilled thereby increasing the severity of the vulnerability. remediation_level: type: string enum: - not_defined - official_fix - temporary_fix - unavailable - workaround example: not_defined description: The remediation level of a vulnerability is an important factor for prioritization. The typical vulnerability is unpatched when initially published. Workarounds or hotfixes may offer interim remediation until an official patch or upgrade is issued. Each of these respective stages adjusts the temporal score downwards, reflecting the decreasing urgency as remediation becomes final. The less official and permanent a fix, the higher the vulnerability score is. report_confidence: type: string enum: - confirmed - not_defined - unconfirmed - uncorroborated example: not_defined description: This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details. Sometimes, only the existence of vulnerabilities are publicized, but without specific details. The vulnerability may later be corroborated and then confirmed through acknowledgement by the author or vendor of the affected technology. The urgency of a vulnerability is higher when a vulnerability is known to exist with certainty. This metric also suggests the level of technical knowledge available to would-be attackers. The more a vulnerability is validated by the vendor or other reputable sources, the higher the score. temporal_vector_string: type: string example: string description: A text representation of a set of CVSSv2 temporal metrics. Temporal metrics allow analysists to calculate threat severity based on temporal factors such as reliability of vulnerability reports, availability of mitigations, and the ease or difficulty of conducting the exploit. It is commonly used to record or transfer CVSSv2 metric information in a concise form collateral_damage_potential: type: string enum: - high - low - low_medium - medium_high - none - not_defined example: not_defined description: This metric measures the potential for loss of life or physical assets through damage or theft of property or equipment. The metric may also measure economic loss of productivity or revenue. Naturally, the greater the damage potential, the higher the vulnerability score. target_distribution: type: string enum: - high - low - medium - none - not_defined example: not_defined description: This metric measures the proportion of vulnerable systems. It is meant as an environment-specific indicator in order to approximate the percentage of systems that could be affected by the vulnerability. The greater the proportion of vulnerable systems, the higher the score. confidentiality_requirement: type: string enum: - high - low - medium - not_defined example: not_defined description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.' integrity_requirement: type: string enum: - high - low - medium - not_defined example: not_defined description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.' availability_requirement: type: string enum: - high - low - medium - not_defined example: not_defined description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.' environmental_vector_string: type: string example: string description: A text representation of a set of CVSSv2 environmental metrics. Environmental metrics allow analysists to calculate threat scores in relation to environmental security requirements, collateral damage potential, and target availability. It is commonly used to record or transfer CVSSv2 metric information in a concise form obtain_all_privilege: type: boolean example: true obtain_user_privilege: type: boolean example: true obtain_other_privilege: type: boolean example: true user_interaction_required: type: boolean example: true required: - vector_string - base_score - base_severity example: integrity_impact: complete target_distribution: not_defined availability_requirement: not_defined exploitability: not_defined access_complexity: low temporal_vector_string: string exploitability_score: 10.0 impact_score: 10.0 user_interaction_required: true environmental_vector_string: string obtain_other_privilege: true availability_impact: complete access_vector: network base_severity: High confidentiality_impact: complete confidentiality_requirement: not_defined report_confidence: not_defined authentication: none base_score: 10.0 obtain_user_privilege: true obtain_all_privilege: true collateral_damage_potential: not_defined remediation_level: not_defined vector_string: string integrity_requirement: not_defined cvss_v3: type: object properties: vector_string: type: string example: string description: a text representation of a set of CVSSv3 metrics. It is commonly used to record or transfer CVSSv3 metric information in a concise form base_score: type: number format: double example: 10.0 description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v3-1' base_severity: type: string enum: - critical - high - low - medium - none example: critical impact_score: type: number format: double example: 10.0 description: a Score number from 0 to 10 exploitability_score: type: number format: double example: 10.0 description: a Score number from 0 to 10 attack_vector: type: string enum: - adjacent_network - local - network - physical example: adjacent_network description: Reflects the context by which vulnerability exploitation is possible modified_attack_vector: type: string enum: - adjacent_network - local - network - not_defined - physical example: not_defined description: modified attack vector attack_complexity: type: string enum: - high - low example: high description: describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability modified_attack_complexity: type: string enum: - high - low - not_defined example: not_defined description: modified attack complexity privileges_required: type: string enum: - high - low - none example: high description: describes the level of privileges an attacker must possess before successfully exploiting the vulnerability modified_privileges_required: type: string enum: - high - low - none - not_defined example: not_defined description: modified privileges required user_interaction: type: string enum: - none - required example: none description: captures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerable component modified_user_interaction: type: string enum: - none - not_defined - required example: none description: modified user interaction scope: type: string enum: - changed - unchanged example: changed description: the ability for a vulnerability in one software component to impact resources beyond its means, or privileges modified_scope: type: string enum: - changed - not_defined - unchanged example: not_defined description: modified scope confidentiality_impact: type: string enum: - high - low - none example: high description: measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability modified_confidentiality_impact: type: string enum: - high - low - none - not_defined example: not_defined description: modified confidentiality impact integrity_impact: type: string enum: - high - low - none example: high description: measures the impact to integrity of a successfully exploited vulnerability modified_integrity_impact: type: string enum: - high - low - none - not_defined example: not_defined description: modified integrity impact availability_impact: type: string enum: - high - low - none example: high description: measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability modified_availability_impact: type: string enum: - high - low - none - not_defined example: not_defined description: modified availability impact exploit_code_maturity: type: string enum: - functional - high - not_defined - proof_of_concept - unproven example: functional description: measures the likelihood of the vulnerability being attacked remediation_level: type: string enum: - high - not_defined - offical_fix - temporary_fix - unavailable - workaround example: high description: Remediation Level of a vulnerability is an important factor for prioritization report_confidence: type: string enum: - confirmed - reasonable - unknown example: confirmed description: measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details temporal_score: type: number format: double example: 10.0 description: Round up(CVSSv3BaseScore × CVSSv3ExploitCodeMaturity × CVSSv3RemediationLevel × CVSSv3ReportConfidence) temporal_severity: type: string enum: - critical - high - low - medium - none example: critical description: temporal severity availability_requirement: type: string enum: - high - low - none - not_defined example: high description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).' confidentiality_requirement: type: string enum: - high - low - none - not_defined example: high description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).' integrity_requirement: type: string enum: - high - low - none - not_defined example: high description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).' environmental_score: type: number format: double example: 10.0 description: a Score number from 0 to 10 environmental_severity: type: string enum: - critical - high - low - medium - none example: critical required: - vector_string - base_score - base_severity example: integrity_impact: high modified_user_interaction: none modified_scope: not_defined availability_requirement: high user_interaction: none modified_integrity_impact: not_defined privileges_required: high exploitability_score: 10.0 impact_score: 10.0 environmental_severity: critical modified_availability_impact: not_defined availability_impact: high scope: changed exploit_code_maturity: functional modified_attack_complexity: not_defined base_severity: critical confidentiality_impact: high temporal_severity: critical modified_confidentiality_impact: not_defined confidentiality_requirement: high report_confidence: confirmed temporal_score: 10.0 modified_privileges_required: not_defined modified_attack_vector: not_defined base_score: 10.0 environmental_score: 10.0 remediation_level: high vector_string: string integrity_requirement: high attack_vector: adjacent_network attack_complexity: high example: cvss_v2: integrity_impact: complete target_distribution: not_defined availability_requirement: not_defined exploitability: not_defined access_complexity: low temporal_vector_string: string exploitability_score: 10.0 impact_score: 10.0 user_interaction_required: true environmental_vector_string: string obtain_other_privilege: true availability_impact: complete access_vector: network base_severity: High confidentiality_impact: complete confidentiality_requirement: not_defined report_confidence: not_defined authentication: none base_score: 10.0 obtain_user_privilege: true obtain_all_privilege: true collateral_damage_potential: not_defined remediation_level: not_defined vector_string: string integrity_requirement: not_defined cvss_v3: integrity_impact: high modified_user_interaction: none modified_scope: not_defined availability_requirement: high user_interaction: none modified_integrity_impact: not_defined privileges_required: high exploitability_score: 10.0 impact_score: 10.0 environmental_severity: critical modified_availability_impact: not_defined availability_impact: high scope: changed exploit_code_maturity: functional modified_attack_complexity: not_defined base_severity: critical confidentiality_impact: high temporal_severity: critical modified_confidentiality_impact: not_defined confidentiality_requirement: high report_confidence: confirmed temporal_score: 10.0 modified_privileges_required: not_defined modified_attack_vector: not_defined base_score: 10.0 environmental_score: 10.0 remediation_level: high vector_string: string integrity_requirement: high attack_vector: adjacent_network attack_complexity: high description: "Describes the potential impact of a vulnerability that is being tracked in the system. Provides information on the extent of damage that a vulnerability can cause and how serious the consequences could be if it is exploited. \n\nMay contain granular information about the vulnerability severity using the CVSS system, versions 2 and 3.\n\nCVSSv2 and CVSSv3 have different methods of calculating base scores, but both are designed to provide an indication of the level of risk that a vulnerability poses. The base score ranges from 0 to 10, with 10 being the most severe. Additionally, both CVSSv2 and CVSSv3 define severity levels, such as low, medium, high, and critical, based on the base score." configurations: type: object properties: CVE_data_version: type: string example: string description: Specifies the version of the CVE (Common Vulnerabilities and Exposures) dictionary used by the vulnerability information provider. nodes: type: array items: type: object properties: operator: type: string enum: - AND - OR example: AND description: The operator string influences how seqs of cpe matches are related to one another. cpe_match: type: array items: type: object properties: vulnerable: type: boolean example: true cpe23Uri: type: string example: string description: A text representation of a software or hardware platform. versionStartIncluding: type: string example: string description: A string representing the lower bound(inclusive) of version in the CPE. versionEndIncluding: type: string example: string description: A string representing the upper bound(inclusive) of version in the CPE. versionStartExcluding: type: string example: string description: A string representing the lower bound(exclusive) of version in the CPE. versionEndExcluding: type: string example: string description: A string representing the upper bound(exclusive) of version in the CPE. required: - vulnerable - cpe23Uri example: vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string example: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string children: type: array items: type: object properties: operator: type: string enum: - AND - OR example: AND description: The operator string influences how seqs of cpe matches are related to one another. cpe_match: type: array items: type: object properties: vulnerable: type: boolean example: true cpe23Uri: type: string example: string description: A text representation of a software or hardware platform. versionStartIncluding: type: string example: string description: A string representing the lower bound(inclusive) of version in the CPE. versionEndIncluding: type: string example: string description: A string representing the upper bound(inclusive) of version in the CPE. versionStartExcluding: type: string example: string description: A string representing the lower bound(exclusive) of version in the CPE. versionEndExcluding: type: string example: string description: A string representing the upper bound(exclusive) of version in the CPE. required: - vulnerable - cpe23Uri example: vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string example: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: type: boolean example: true description: Negates operator when true. required: - operator - cpe_match example: operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true example: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true negate: type: boolean example: true description: Negates operator when true. required: - operator example: operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string children: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true negate: true example: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string children: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true negate: true description: Each `node` in the CTIM standard configuration includes information such as the `operator` (such as "less than", or "greater than or equal to"), and the `cpe` (Common Platform Enumeration) string which identifies the specific software, `CPE` is a structured naming scheme for IT systems, platforms, and software packages, and it is instrumental in enabling data exchange between different systems. required: - CVE_data_version - nodes example: CVE_data_version: string nodes: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string children: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true negate: true description: "Represents a list of affected versions or configurations of a software component that is impacted by a vulnerability. \nBy tracking the affected software components and versions, defenders can identify which systems are potentially exposed to an attack, and apply appropriate mitigations." published_date: type: string format: date-time example: '2016-01-01T01:01:01Z' description: "Represents the date when a vulnerability was publicly disclosed or made available to the general public. \n\nImportant for tracking the age of a vulnerability, as well as for determining when a particular vulnerability was first introduced into a system. The published date can be used to identify the time window during which a system may have been vulnerable to a particular exploit.\n\nFor example, if an organization discovers that a vulnerability was published before their system's installation date, but they did not apply the necessary security updates in a timely manner, it can be concluded that their system was vulnerable for the period between the installation date and the date when the necessary security updates were applied." last_modified_date: type: string format: date-time example: '2016-01-01T01:01:01Z' description: 'Represents the date when the vulnerability metadata was last updated in the internal database. It can be used to track the freshness of the vulnerability information. If the `last_modified_date` is more recent than the `published_date`, it can indicate that there has been some new information or updates related to the vulnerability, such as new patch releases or changes in the severity or impact rating.' required: - description example: description: string schema_version: 1.3.30 revision: 10 published_date: '2016-01-01T01:01:01Z' cve: cve_data_meta: id: string assigner: string configurations: CVE_data_version: string nodes: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string children: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true negate: true type: vulnerability source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' last_modified_date: '2016-01-01T01:01:01Z' impact: cvss_v2: integrity_impact: complete target_distribution: not_defined availability_requirement: not_defined exploitability: not_defined access_complexity: low temporal_vector_string: string exploitability_score: 10.0 impact_score: 10.0 user_interaction_required: true environmental_vector_string: string obtain_other_privilege: true availability_impact: complete access_vector: network base_severity: High confidentiality_impact: complete confidentiality_requirement: not_defined report_confidence: not_defined authentication: none base_score: 10.0 obtain_user_privilege: true obtain_all_privilege: true collateral_damage_potential: not_defined remediation_level: not_defined vector_string: string integrity_requirement: not_defined cvss_v3: integrity_impact: high modified_user_interaction: none modified_scope: not_defined availability_requirement: high user_interaction: none modified_integrity_impact: not_defined privileges_required: high exploitability_score: 10.0 impact_score: 10.0 environmental_severity: critical modified_availability_impact: not_defined availability_impact: high scope: changed exploit_code_maturity: functional modified_attack_complexity: not_defined base_severity: critical confidentiality_impact: high temporal_severity: critical modified_confidentiality_impact: not_defined confidentiality_requirement: high report_confidence: confirmed temporal_score: 10.0 modified_privileges_required: not_defined modified_attack_vector: not_defined base_score: 10.0 environmental_score: 10.0 remediation_level: high vector_string: string integrity_requirement: high attack_vector: adjacent_network attack_complexity: high description: For submitting a new vulnerability. uniqueItems: true example: - description: string schema_version: 1.3.30 revision: 10 published_date: '2016-01-01T01:01:01Z' cve: cve_data_meta: id: string assigner: string configurations: CVE_data_version: string nodes: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string children: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true negate: true type: vulnerability source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' last_modified_date: '2016-01-01T01:01:01Z' impact: cvss_v2: integrity_impact: complete target_distribution: not_defined availability_requirement: not_defined exploitability: not_defined access_complexity: low temporal_vector_string: string exploitability_score: 10.0 impact_score: 10.0 user_interaction_required: true environmental_vector_string: string obtain_other_privilege: true availability_impact: complete access_vector: network base_severity: High confidentiality_impact: complete confidentiality_requirement: not_defined report_confidence: not_defined authentication: none base_score: 10.0 obtain_user_privilege: true obtain_all_privilege: true collateral_damage_potential: not_defined remediation_level: not_defined vector_string: string integrity_requirement: not_defined cvss_v3: integrity_impact: high modified_user_interaction: none modified_scope: not_defined availability_requirement: high user_interaction: none modified_integrity_impact: not_defined privileges_required: high exploitability_score: 10.0 impact_score: 10.0 environmental_severity: critical modified_availability_impact: not_defined availability_impact: high scope: changed exploit_code_maturity: functional modified_attack_complexity: not_defined base_severity: critical confidentiality_impact: high temporal_severity: critical modified_confidentiality_impact: not_defined confidentiality_requirement: high report_confidence: confirmed temporal_score: 10.0 modified_privileges_required: not_defined modified_attack_vector: not_defined base_score: 10.0 environmental_score: 10.0 remediation_level: high vector_string: string integrity_requirement: high attack_vector: adjacent_network attack_complexity: high description: a list of `NewVulnerability`s. actor_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string asset_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string asset_mapping_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string asset_properties_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string attack_pattern_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string campaign_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string coa_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string feedback_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string identity_assertion_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string incident_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string indicator_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string judgement_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string malware_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string note_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string relationship_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string sighting_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string target_record_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string tool_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string verdict_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string data_table_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string weakness_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string vulnerability_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. required: - source example: description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' asset_mapping_refs: - string note_refs: - string data_table_refs: - string attack_pattern_refs: - string sighting_refs: - string schema_version: 1.3.30 revision: 10 assets: - description: string asset_type: application valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 type: asset source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' weakness_refs: - string tool_refs: - string target_record_refs: - string asset_refs: - string tools: - description: string labels: - credential-exploitation schema_version: 1.3.30 revision: 10 type: tool x_mitre_aliases: - string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tool_version: string tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string timestamp: '2016-01-01T01:01:01Z' indicators: - description: string tags: - string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' producer: string schema_version: 1.3.30 revision: 10 type: indicator test_mechanisms: - string source: string external_ids: - string short_description: string composite_indicator_expression: operator: and indicator_ids: - string title: string likely_impact: string indicator_type: - Anonymization external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string severity: Critical tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string negate: true timestamp: '2016-01-01T01:01:01Z' confidence: High specification: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string attack_patterns: - description: string abstraction_level: aggregate schema_version: 1.3.30 revision: 10 type: attack-pattern source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string x_mitre_platforms: - string language: string id: string tlp: green x_mitre_data_sources: - string kill_chain_phases: - kill_chain_name: string phase_name: string x_mitre_contributors: - string timestamp: '2016-01-01T01:01:01Z' type: bundle weaknesses: - description: string background_details: string paradigms: - prevalence: Often name: string abstraction_level: Base architectures: - prevalence: Often name: string class: Embedded schema_version: 1.3.30 revision: 10 alternate_terms: - term: string description: string likelihood: High type: weakness source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string functional_areas: - Authentication source_uri: string modes_of_introduction: - phase: Architecture and Design note: string structure: Chain language: string id: string notes: - type: Applicable Platform note: string common_consequences: - scopes: - Access Control impacts: - Alter Execution Logic likelihood: High note: string tlp: green detection_methods: - method: Architecture or Design Review description: string effectiveness: High effectiveness_notes: string operating_systems: - prevalence: Often name: string version: string cpe_id: string class: Android affected_resources: - CPU languages: - prevalence: Often name: string class: Assembly timestamp: '2016-01-01T01:01:01Z' potential_mitigations: - description: string phases: - Architecture and Design strategy: Attack Surface Reduction effectiveness: Defense in Depth effectiveness_notes: string technologies: - prevalence: Often name: string source: string external_ids: - string feedback_refs: - string asset_properties: - properties: - name: string value: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 asset_ref: string type: asset-properties source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' short_description: string feedbacks: - feedback: -1 schema_version: 1.3.30 revision: 10 type: feedback source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string reason: string source_uri: string language: string id: string tlp: green entity_id: string timestamp: '2016-01-01T01:01:01Z' judgement_refs: - string title: string coa_refs: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string verdicts: - type: verdict disposition: 1 observable: value: 1.2.3.4 type: ip judgement_id: string disposition_name: Clean valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' campaigns: - description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 type: campaign campaign_type: string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string activity: - date_time: '2016-01-01T01:01:01Z' description: string source_uri: string intended_effect: - Account Takeover status: Future language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' confidence: High names: - string source_uri: string actors: - description: string motivation: Ego valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' identity: description: string related_identities: - identity: string confidence: High information_source: string relationship: string sophistication: Aspirant schema_version: 1.3.30 revision: 10 planning_and_operational_support: string type: actor source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string intended_effect: Account Takeover language: string id: string tlp: green aliases: - string timestamp: '2016-01-01T01:01:01Z' confidence: High actor_types: - Cyber Espionage Operations indicator_refs: - string actor_refs: - string language: string data_tables: - description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 columns: - name: string type: integer description: string required: true short_description: string type: data-table source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string rows: - - anything source_uri: string language: string id: string tlp: green row_count: 10 timestamp: '2016-01-01T01:01:01Z' id: string notes: - schema_version: 1.3.30 revision: 10 content: string note_class: keyword type: note source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string author: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' related_entities: - entity_type: string entity_id: string identity_assertions: - valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' identity: observables: - value: 1.2.3.4 type: ip schema_version: 1.3.30 revision: 10 type: identity-assertion source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' assertions: - name: cisco:ctr:ad:host_domain_name value: string judgements: - valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 observable: value: 1.2.3.4 type: ip reason_uri: string type: judgement source: string external_ids: - string disposition: 1 external_references: - source_name: string description: string url: string hashes: - string external_id: string reason: string source_uri: string disposition_name: Clean priority: 10 language: string id: string severity: Critical tlp: green timestamp: '2016-01-01T01:01:01Z' confidence: High malwares: - description: string labels: - adware abstraction_level: family schema_version: 1.3.30 revision: 10 type: malware x_mitre_aliases: - string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string timestamp: '2016-01-01T01:01:01Z' target_records: - description: string schema_version: 1.3.30 revision: 10 type: target-record source: string external_ids: - string targets: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string internal: false sensor: string source_uri: string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' asset_mappings: - asset_type: application valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' stability: Managed schema_version: 1.3.30 revision: 10 observable: value: 1.2.3.4 type: ip asset_ref: string type: asset-mapping source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' specificity: Low confidence: High relationship_refs: - string tlp: green incidents: - description: string assignees: - string detection_sources: - string meta: keyword: string schema_version: 1.3.30 revision: 10 type: incident source: string external_ids: - string short_description: string title: string incident_time: opened: '2016-01-01T01:01:01Z' discovered: '2016-01-01T01:01:01Z' reported: '2016-01-01T01:01:01Z' remediated: '2016-01-01T01:01:01Z' closed: '2016-01-01T01:01:01Z' rejected: '2016-01-01T01:01:01Z' contained: '2016-01-01T01:01:01Z' external_references: - source_name: string description: string url: string hashes: - string external_id: string discovery_method: Agent Disclosure source_uri: string intended_effect: Account Takeover categories: - Attrition status: Closed language: string detection_status: active id: string promotion_method: Automated severity: Critical tlp: green scores: asset: 10.0 techniques: - string timestamp: '2016-01-01T01:01:01Z' confidence: High short_id: string tactics: - string identity_assertion_refs: - string sightings: - description: string schema_version: 1.3.30 revision: 10 relations: - origin: string origin_uri: string relation: Allocated relation_info: keyword: anything source: value: 1.2.3.4 type: ip related: value: 1.2.3.4 type: ip sensor_coordinates: type: endpoint observables: - value: 1.2.3.4 type: ip os: string observables: - value: 1.2.3.4 type: ip type: sighting source: string external_ids: - string targets: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string short_description: string title: string resolution: detected internal: false external_references: - source_name: string description: string url: string hashes: - string external_id: string detection_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' source_uri: string activity_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' language: string id: string count: 10 severity: Critical tlp: green modification_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' context: http_events: - process_guid: 10 traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 method: CONNECT time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: HTTPEvent host: string process_name: string process_id: 10 process_username: string query: string encrypted: true url_port: 10 process_create_events: - parent_process_name: string process_guid: 10 parent_process_guid: 10 process_disposition: string parent_process_size: 10 process_size: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_disposition: string type: ProcessCreateEvent parent_process_username: string parent_process_id: 10 parent_process_args: string process_name: string process_hash: string process_id: 10 parent_process_hash: string process_username: string parent_creation_time: '2016-01-01T01:01:01Z' process_args: string registry_delete_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryDeleteEvent registry_value: string file_modify_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileModifyEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_set_events: - process_guid: 10 registry_data: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: RegistrySetEvent registry_data_length: 10 registry_value: string registry_key: string process_name: string process_id: 10 process_username: string file_create_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileCreateEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_create_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryCreateEvent library_load_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string type: LibraryLoadEvent dll_library_name: string dll_library_path: string file_move_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileMoveEvent old_name: string file_path: string process_name: string process_id: 10 process_username: string new_name: string file_delete_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileDeleteEvent file_path: string process_name: string process_id: 10 process_username: string failed: false netflow_events: - parent_process_name: string byte_count_in: 10 process_guid: 10 process_path: string traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 flow_time: '2016-01-01T01:01:01Z' time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_account: string type: NetflowEvent process_account_type: string parent_process_path: string parent_process_id: 10 parent_process_args: string process_name: string process_account: string parent_process_account_type: string process_hash: string process_id: 10 parent_process_hash: string process_username: string byte_count_out: 10 process_args: string registry_rename_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryRenameEvent registry_old_key: string timestamp: '2016-01-01T01:01:01Z' confidence: High observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' sensor: endpoint data: columns: - name: string type: integer description: string required: true short_description: string rows: - - anything row_count: 10 campaign_refs: - string vulnerability_refs: - string asset_properties_refs: - string relationships: - description: string schema_version: 1.3.30 revision: 10 target_ref: string type: relationship source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string source_ref: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' relationship_type: attributed-to timestamp: '2016-01-01T01:01:01Z' verdict_refs: - string malware_refs: - string incident_refs: - string vulnerabilities: - description: string schema_version: 1.3.30 revision: 10 published_date: '2016-01-01T01:01:01Z' cve: cve_data_meta: id: string assigner: string configurations: CVE_data_version: string nodes: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string children: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true negate: true type: vulnerability source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' last_modified_date: '2016-01-01T01:01:01Z' impact: cvss_v2: integrity_impact: complete target_distribution: not_defined availability_requirement: not_defined exploitability: not_defined access_complexity: low temporal_vector_string: string exploitability_score: 10.0 impact_score: 10.0 user_interaction_required: true environmental_vector_string: string obtain_other_privilege: true availability_impact: complete access_vector: network base_severity: High confidentiality_impact: complete confidentiality_requirement: not_defined report_confidence: not_defined authentication: none base_score: 10.0 obtain_user_privilege: true obtain_all_privilege: true collateral_damage_potential: not_defined remediation_level: not_defined vector_string: string integrity_requirement: not_defined cvss_v3: integrity_impact: high modified_user_interaction: none modified_scope: not_defined availability_requirement: high user_interaction: none modified_integrity_impact: not_defined privileges_required: high exploitability_score: 10.0 impact_score: 10.0 environmental_severity: critical modified_availability_impact: not_defined availability_impact: high scope: changed exploit_code_maturity: functional modified_attack_complexity: not_defined base_severity: critical confidentiality_impact: high temporal_severity: critical modified_confidentiality_impact: not_defined confidentiality_requirement: high report_confidence: confirmed temporal_score: 10.0 modified_privileges_required: not_defined modified_attack_vector: not_defined base_score: 10.0 environmental_score: 10.0 remediation_level: high vector_string: string integrity_requirement: high attack_vector: adjacent_network attack_complexity: high coas: - description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' stage: Containment schema_version: 1.3.30 revision: 10 efficacy: High type: coa related_COAs: - confidence: High source: string relationship: string COA_id: string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string coa_type: Diplomatic Actions language: string id: string tlp: green objective: - string cost: High timestamp: '2016-01-01T01:01:01Z' open_c2_coa: type: structured_coa id: string action: type: alert target: type: acudid specifiers: string actuator: type: endpoint specifiers: - string modifiers: response: acknowledge method: - acl additional_properties: context: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' frequency: string duration: '2016-01-01T01:01:01Z' source: string search: cve option: string id: string location: internal delay: '2016-01-01T01:01:01Z' destination: copy-to structured_coa_type: openc2 impact: string description: Describes a Bundle of any set of CTIM entities. investigated_observables: type: array items: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. source: title: InvestigationSource description: String with at most 1024 characters. type: string example: Cisco XDR Automated Question title: title: InvestigationTitle description: String with at most 1024 characters. type: string example: Which devices in my org was this sha seen on? description: title: InvestigationDescription description: String with at most 5000 characters. type: string example: 'For the following hashes: - sha256:defg...1234 - sha256:abcd..1234 Determine which devices in my org have instances of the file in the past 30 days' required: - bundle application/transit+json: schema: type: object properties: bundle: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - bundle example: bundle description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. actors: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - actor example: actor description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Indicates the time span for which the information about the Actor is relevant, and after which it could become outdated. actor_types: type: array items: type: string example: Cyber Espionage Operations example: - Cyber Espionage Operations identity: type: object properties: description: type: string example: string description: Markdown string with at most 5000 characters. related_identities: type: array items: type: object properties: identity: type: string example: string description: The reference (URI) of the related Identity object. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: Specifies the level of confidence in the assertion of the relationship between the two objects. information_source: type: string example: string description: Specifies the source of the information about the relationship between the two components. relationship: type: string example: string required: - identity example: identity: string confidence: High information_source: string relationship: string description: Describes a related Identity example: - identity: string confidence: High information_source: string relationship: string description: Identifies other entity Identities related to this Identity. required: - description - related_identities example: description: string related_identities: - identity: string confidence: High information_source: string relationship: string description: Can contain information such as the name of the attacker, the group or organization they belong to, or any other identifier that can help in the attribution process. motivation: type: string example: Ego description: The reason or purpose behind the malicious activity attributed to this Actor. By understanding a threat actor's motivation, analysts can better predict the attacker's behavior and anticipate future malicious actions. sophistication: type: string enum: - Aspirant - Expert - Innovator - Novice - Practitioner example: Aspirant description: "Represents the level of expertise and skill that the threat actor has displayed in their malicious activities. Can help security analysts assess the potential impact of an attacker's TTPs and determine the potential attack surface. \n\nFor example, a threat actor with a low sophistication level may primarily rely on off-the-shelf malware and attack tools, while an attacker with high sophistication may use custom tools with advanced evasion techniques, zero-day exploits, and sophisticated methods for command and control of their malware. \n\nThe sophistication level of an attacker can also be inferred based on several factors such as the complexity of attacks, the attacker's knowledge of the targeted organization's systems, and the attacker's ability to remain undetected.\n\nIf an attacker shows a high level of sophistication in reconnaissances, social engineering, and phishing, then the attacker may have a good knowledge of the targeted organization and its employees. This means that the attacker may be more successful in infiltrating the organization's network and compromising its systems." intended_effect: type: string example: Account Takeover description: "Represents the desired outcome or impact the threat actor is trying to achieve through their malicious activities. \n\n Helps security analysts to understand the attacker's goals beyond the immediate impact of the attack. By understanding the intended effect, analysts can draw connections between seemingly unrelated attacks and build a more complete understanding of an attacker's long-term goals and motivations." planning_and_operational_support: type: string example: string description: "Provides information about the resources and capabilities of the attacker that could be used to assist in planning and operations related to the threat.\n\n It can be used to describe Infrastructure, Tools, Techniques, and Capabilities used by the threat actor." confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: 'This field can help analysts decide how much trust they can put in the information provided by the threat intelligence sources. For example, an Actor entity can have high confidence if the organization''s security researchers have been tracking it for a long time and have gathered a significant amount of intelligence about it through various sources, such as analysis of malware, network traffic, and human intelligence. In contrast, low confidence may indicate the organization has only seen limited or circumstantial evidence.' aliases: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: A list of other names that this Threat Actor is believed to use. required: - source - title - description - short_description example: description: string motivation: Ego valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' identity: description: string related_identities: - identity: string confidence: High information_source: string relationship: string sophistication: Aspirant schema_version: 1.3.30 revision: 10 planning_and_operational_support: string type: actor source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string intended_effect: Account Takeover language: string id: string tlp: green aliases: - string timestamp: '2016-01-01T01:01:01Z' confidence: High actor_types: - Cyber Espionage Operations description: Schema for submitting new Actors uniqueItems: true example: - description: string motivation: Ego valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' identity: description: string related_identities: - identity: string confidence: High information_source: string relationship: string sophistication: Aspirant schema_version: 1.3.30 revision: 10 planning_and_operational_support: string type: actor source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string intended_effect: Account Takeover language: string id: string tlp: green aliases: - string timestamp: '2016-01-01T01:01:01Z' confidence: High actor_types: - Cyber Espionage Operations description: a list of `NewActor`s. assets: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - asset example: asset description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: 'Specifies the time range during which the asset is considered valid or accurate. For example, if an asset entity represents a device, the `valid_time` field could be used to indicate the period during which the device''s configuration information is deemed accurate.' asset_type: type: string enum: - application - data - device - network - person example: application description: 'Type of the Asset: Device, Person, Application, etc.' required: - source - valid_time - asset_type example: description: string asset_type: application valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 type: asset source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' description: Schema for submitting new Assets uniqueItems: true example: - description: string asset_type: application valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 type: asset source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' description: a list of `NewAsset`s. asset_mappings: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - asset-mapping example: asset-mapping description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: For each asset, we allow for the assertion of time bound properties.This gives us both a record of the current state of the asset,as well as history. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: 'Level of confidence held in the characterization of this AssetMapping e.g.: is it susceptible to manipulation or translation?' specificity: type: string enum: - Low - Medium - Unique example: Low description: Denotes the level of how many assets potentially could have this same identifier. stability: type: string enum: - Managed - Physical - Temporary example: Managed description: Do we manage when it changes, or is it always a time bound assignment? observable: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: An AssetMapping is a record that a specific Observable maps to an Asset for an indicated period of time. asset_ref: type: string example: string description: URI that points to the mapped Asset. asset_type: type: string enum: - application - data - device - network - person example: application description: 'Type of the mapped Asset: Device, Person, Application, etc.' required: - source - valid_time - confidence - specificity - stability - observable - asset_ref - asset_type example: asset_type: application valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' stability: Managed schema_version: 1.3.30 revision: 10 observable: value: 1.2.3.4 type: ip asset_ref: string type: asset-mapping source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' specificity: Low confidence: High description: Schema for submitting new AssetMapping. uniqueItems: true example: - asset_type: application valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' stability: Managed schema_version: 1.3.30 revision: 10 observable: value: 1.2.3.4 type: ip asset_ref: string type: asset-mapping source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' specificity: Low confidence: High description: a list of `NewAssetMapping`s. asset_properties: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - asset-properties example: asset-properties description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time range during which the AssetProperties is considered valid. asset_ref: type: string example: string description: URI that points to the associated Asset. properties: type: array items: type: object properties: name: type: string example: string description: The properties are an open vocabulary. value: type: string example: string required: - name - value example: name: string value: string example: - name: string value: string required: - source - valid_time - asset_ref example: properties: - name: string value: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 asset_ref: string type: asset-properties source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' description: Schema for submitting new AssetProperties uniqueItems: true example: - properties: - name: string value: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 asset_ref: string type: asset-properties source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' description: a list of `NewAssetProperties`s. attack_patterns: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - attack-pattern example: attack-pattern description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. kill_chain_phases: type: array items: type: object properties: kill_chain_name: type: string example: string description: The name of the kill chain. phase_name: type: string example: string description: The name of the phase in the kill chain. required: - kill_chain_name - phase_name example: kill_chain_name: string phase_name: string description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives. example: - kill_chain_name: string phase_name: string description: A kill chain is a series of steps that an attacker must go through to successfully achieve their objective. The concept was originally developed by the military, but has been adapted to the cybersecurity field to describe the steps an attacker goes through to compromise a target system and achieve their goal. x_mitre_data_sources: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: ATT&CK Technique.Data Sources. x_mitre_platforms: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: ATT&CK Technique.Platforms. x_mitre_contributors: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: ATT&CK Technique.Contributors. abstraction_level: type: string enum: - aggregate - category - detailed - meta - standard example: aggregate description: The CAPEC abstraction level for patterns describing techniques to attack a system. required: - title - description - short_description example: description: string abstraction_level: aggregate schema_version: 1.3.30 revision: 10 type: attack-pattern source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string x_mitre_platforms: - string language: string id: string tlp: green x_mitre_data_sources: - string kill_chain_phases: - kill_chain_name: string phase_name: string x_mitre_contributors: - string timestamp: '2016-01-01T01:01:01Z' description: For submitting a new AttackPattern uniqueItems: true example: - description: string abstraction_level: aggregate schema_version: 1.3.30 revision: 10 type: attack-pattern source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string x_mitre_platforms: - string language: string id: string tlp: green x_mitre_data_sources: - string kill_chain_phases: - kill_chain_name: string phase_name: string x_mitre_contributors: - string timestamp: '2016-01-01T01:01:01Z' description: a list of `NewAttackPattern`s. campaigns: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - campaign example: campaign description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Timestamp for the definition of a specific version of a campaign. campaign_type: type: string example: string description: 'String value that describes the type of campaign. For example, a campaign type could be ''Ransomware'', ''Advanced Persistent Threat'', ''Business Email Compromise'', ''Phishing'', etc. ' names: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: Used to capture alternate names or aliases associated with the campaign. A cyberattack campaign may have multiple names or aliases depending on the group or actor(s) behind the attack, e.g., 'Wannacry' is also known as 'WannaCrypt', 'WCry', 'Wanna Decryptor', etc. intended_effect: type: array items: type: string example: Account Takeover example: - Account Takeover description: Characterizes the intended effect of this cyber threat campaign. status: type: string enum: - Future - Historic - Ongoing example: Future description: "Indicates current Status of the Campaign. \n\nCan have one of the following values: \n\n- Ongoing: Indicates that the campaign is currently active and ongoing. For example, a mass phishing campaign that is actively targeting users is considered 'ongoing'.\n\n- Historic: Campaign has already occurred and is now in the past.\n\n- Future: This indicates that a campaign is planned or expected to occur in the future. For example, a threat actor may announce their intention to launch a specific cyberattack campaign at a future date." confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: Level of confidence held in the characterization of this Campaign. activity: type: array items: type: object properties: date_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Specifies the date and time at which the activity occured. description: type: string example: string description: A description of the activity. required: - date_time - description example: date_time: '2016-01-01T01:01:01Z' description: string description: Captures the specific activities or tactics associated with the entity. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc. example: - date_time: '2016-01-01T01:01:01Z' description: string description: 'Used to capture specific activities or tactics associated with the campaign. The ''activity'' field is an array of objects, and each element represents a specific activity and time associated with the campaign. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc. By capturing these activities analysts can identify the specific tactics used by the threat actor(s) behind the campaign.' required: - title - description - short_description - campaign_type example: description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 type: campaign campaign_type: string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string activity: - date_time: '2016-01-01T01:01:01Z' description: string source_uri: string intended_effect: - Account Takeover status: Future language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' confidence: High names: - string description: Schema for submitting new Campaigns uniqueItems: true example: - description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 type: campaign campaign_type: string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string activity: - date_time: '2016-01-01T01:01:01Z' description: string source_uri: string intended_effect: - Account Takeover status: Future language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' confidence: High names: - string description: a list of `NewCampaign`s. coas: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - coa example: coa description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. stage: type: string enum: - Containment - Eradication - Identification - Lessons Learned - Preparation - Recovery - Remedy - Response example: Containment description: Specifies what stage in the cyber threat management lifecycle this Course Of Action is relevant to. coa_type: type: string enum: - Diplomatic Actions - Eradication - Hardening - Internal Blocking - Logical Access Restrictions - Monitoring - Other - Patching - Perimeter Blocking - Phase - Physical Access Restrictions - Playbook - Policy Actions - Public Disclosure - Rebuilding - Redirection - Redirection (Honey Pot) - Task - Training example: Diplomatic Actions description: The type of this COA objective: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: Characterizes the objective to provide guidance on how to mitigate a security incident that has been identified. impact: type: string example: string description: Characterizes the estimated impact of applying this course of action. cost: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: Characterizes the estimated cost for applying this course of action. efficacy: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: Effectiveness of this course of action in achieving its targeted objective. related_COAs: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string COA_id: type: string example: string description: A URI leading to a COA. required: - COA_id example: confidence: High source: string relationship: string COA_id: string example: - confidence: High source: string relationship: string COA_id: string description: Identifies or characterizes relationships to one or more related courses of action. structured_coa_type: type: string enum: - openc2 example: openc2 open_c2_coa: type: object properties: type: type: string enum: - structured_coa example: structured_coa id: type: string example: string description: String with at most 1024 characters. action: type: object properties: type: type: string enum: - alert - allow - augment - contain - delete - deny - detonate - distill - get - investigate - locate - mitigate - modify - move - notify - other - pause - query - redirect - remediate - report - response - restart - restore - resume - save - scan - set - snapshot - start - stop - substitute - sync - throttle - update example: alert required: - type example: type: alert target: type: object properties: type: type: string example: acudid specifiers: type: string example: string description: Observable types that can be acted upon. required: - type example: type: acudid specifiers: string actuator: type: object properties: type: type: string enum: - endpoint - endpoint.digital-telephone-handset - endpoint.laptop - endpoint.pos-terminal - endpoint.printer - endpoint.sensor - endpoint.server - endpoint.smart-meter - endpoint.smart-phone - endpoint.tablet - endpoint.workstation - network - network.bridge - network.firewall - network.gateway - network.guard - network.hips - network.hub - network.ids - network.ips - network.modem - network.nic - network.proxy - network.router - network.security_manager - network.sense_making - network.sensor - network.switch - network.vpn - network.wap - other - process - process.aaa-server - process.anti-virus-scanner - process.connection-scanner - process.directory-service - process.dns-server - process.email-service - process.file-scanner - process.location-service - process.network-scanner - process.remediation-service - process.reputation-service - process.sandbox - process.virtualization-service - process.vulnerability-scanner example: endpoint specifiers: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: List of additional properties describing the actuator. required: - type example: type: endpoint specifiers: - string modifiers: type: object properties: delay: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard. duration: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard. frequency: type: string example: string description: String with at most 1024 characters. id: type: string example: string description: String with at most 1024 characters. time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. response: type: string enum: - acknowledge - command-ref - query - status example: acknowledge source: type: string example: string description: String with at most 1024 characters. destination: type: string enum: - copy-to - modify-to - move-to - report-to - restore-point - save-to - set-to example: copy-to method: type: array items: type: string enum: - acl - authenticated - blackhole - blacklist - graceful - hibernate - honeypot - immediate - segmentation - spawn - suspend - unauthenticated - whitelist example: acl example: - acl search: type: string enum: - cve - patch - signature - vendor_bulletin example: cve location: type: string enum: - internal - perimeter example: internal option: type: string example: string description: String with at most 1024 characters. additional_properties: type: object properties: context: type: string example: string description: String with at most 1024 characters. required: - context example: context: string example: response: acknowledge method: - acl additional_properties: context: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' frequency: string duration: '2016-01-01T01:01:01Z' source: string search: cve option: string id: string location: internal delay: '2016-01-01T01:01:01Z' destination: copy-to required: - type - action example: type: structured_coa id: string action: type: alert target: type: acudid specifiers: string actuator: type: endpoint specifiers: - string modifiers: response: acknowledge method: - acl additional_properties: context: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' frequency: string duration: '2016-01-01T01:01:01Z' source: string search: cve option: string id: string location: internal delay: '2016-01-01T01:01:01Z' destination: copy-to example: description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' stage: Containment schema_version: 1.3.30 revision: 10 efficacy: High type: coa related_COAs: - confidence: High source: string relationship: string COA_id: string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string coa_type: Diplomatic Actions language: string id: string tlp: green objective: - string cost: High timestamp: '2016-01-01T01:01:01Z' open_c2_coa: type: structured_coa id: string action: type: alert target: type: acudid specifiers: string actuator: type: endpoint specifiers: - string modifiers: response: acknowledge method: - acl additional_properties: context: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' frequency: string duration: '2016-01-01T01:01:01Z' source: string search: cve option: string id: string location: internal delay: '2016-01-01T01:01:01Z' destination: copy-to structured_coa_type: openc2 impact: string description: Schema for submitting new COAs uniqueItems: true example: - description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' stage: Containment schema_version: 1.3.30 revision: 10 efficacy: High type: coa related_COAs: - confidence: High source: string relationship: string COA_id: string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string coa_type: Diplomatic Actions language: string id: string tlp: green objective: - string cost: High timestamp: '2016-01-01T01:01:01Z' open_c2_coa: type: structured_coa id: string action: type: alert target: type: acudid specifiers: string actuator: type: endpoint specifiers: - string modifiers: response: acknowledge method: - acl additional_properties: context: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' frequency: string duration: '2016-01-01T01:01:01Z' source: string search: cve option: string id: string location: internal delay: '2016-01-01T01:01:01Z' destination: copy-to structured_coa_type: openc2 impact: string description: a list of `NewCOA`s. feedbacks: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - feedback example: feedback description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. entity_id: type: string example: string description: A URI leading to an entity. feedback: type: integer enum: - -1 - 0 - 1 example: -1 reason: type: string example: string required: - entity_id - feedback - reason example: feedback: -1 schema_version: 1.3.30 revision: 10 type: feedback source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string reason: string source_uri: string language: string id: string tlp: green entity_id: string timestamp: '2016-01-01T01:01:01Z' description: Schema for submitting new Feedback. uniqueItems: true example: - feedback: -1 schema_version: 1.3.30 revision: 10 type: feedback source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string reason: string source_uri: string language: string id: string tlp: green entity_id: string timestamp: '2016-01-01T01:01:01Z' description: a list of `NewFeedback`s. incidents: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - incident example: incident description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: 'Represents the level of certainty or trustworthiness associated with the incident. It denotes the reliability of the intelligence associated with the incident. The `confidence` field can take on several values, including: - `info`: Indicates that the incident information is based on sources with no previous track record or there is no track record for the source reporting the incident. - `low`: Indicates that the incident information is based on sources with a questionable track record or there is limited information about the accuracy of the source. - `medium`: Indicates that the incident information is based on sources with a mixed track record or of uncertain reliability. - `high`: Indicates that the incident information is based on sources with a proven track record and high degree of reliability. The `confidence` field can be used to indicate the level of trust and confidence that can be attributed to the incident, and it may impact how the incident is prioritized, analyzed and addressed. It can also help in the decision-making process associated with the incident response activities. It is important to note that the `confidence` field is subjective and can be interpreted differently by different organizations or analysts. As such, it is often used in conjunction with other intelligence attributes, such as the `severity` field, to provide a more complete picture of the incident.' status: type: string enum: - Closed - 'Closed: Confirmed Threat' - 'Closed: False Positive' - 'Closed: Merged' - 'Closed: Near-Miss' - 'Closed: Other' - 'Closed: Suspected' - 'Closed: Under Review' - Containment Achieved - Hold - 'Hold: External' - 'Hold: Internal' - 'Hold: Legal' - Incident Reported - New - 'New: Presented' - 'New: Processing' - Open - 'Open: Contained' - 'Open: Investigating' - 'Open: Recovered' - 'Open: Reported' - Rejected - Restoration Achieved - Stalled example: Closed description: The `status` field represents the current state of an incident within the incident management process. Its values help in tracking and reporting the progress of the incident from its discovery to its resolution. incident_time: type: object properties: opened: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time the incident was first opened. discovered: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time the incident was first discovered. reported: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time the incident was first reported. remediated: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time that the remediation of the damage from the incident was completed. closed: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time that the incident was last closed. rejected: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time that the incident was first rejected. contained: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time that the incident was first contained. required: - opened example: opened: '2016-01-01T01:01:01Z' discovered: '2016-01-01T01:01:01Z' reported: '2016-01-01T01:01:01Z' remediated: '2016-01-01T01:01:01Z' closed: '2016-01-01T01:01:01Z' rejected: '2016-01-01T01:01:01Z' contained: '2016-01-01T01:01:01Z' description: Relevant time values associated with this Incident. meta: type: object additionalProperties: type: string example: string x-anyOf: - type: string example: string - type: number format: double example: 10.0 - type: string format: date-time example: '2016-01-01T01:01:01Z' - type: string example: keyword - type: boolean example: true example: keyword: string description: metadata associated to the incident. properties: {} scores: type: object additionalProperties: type: number format: double example: 10.0 description: A non-negative score number. example: asset: 10.0 description: Used to indicate the severity or impact score of the threat represented by the incident. properties: {} categories: type: array items: type: string example: Attrition example: - Attrition description: A set of categories for this incident. discovery_method: type: string example: Agent Disclosure description: Identifies how the incident was discovered. intended_effect: type: string example: Account Takeover description: Specifies the suspected intended effect of this incident assignees: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: A set of owners assigned to this incident. detection_sources: type: array items: type: string example: string description: String with at most 2048 characters. example: - string description: A set of sources that contributed threat detections to the incident. promotion_method: type: string enum: - Automated - Manual example: Automated description: Describes method for promoting an Incident, whether manually or automatically. An Incident may be created manually by a SOAR analyst or SOC operator, or through an automated correlation or aggregation rule or engine that matches a specific set of events or alerts, and promotes them to Incident(s). detection_status: type: string enum: - active - inactive_expired - inactive_merged - inactive_oversized - inactive_user_closed example: active description: Represents the state of an incident within the incident generation process, indicating whether the incident is actively receiving updates or is no longer being updated. severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown example: Critical description: "Represents the potential impact of an incident on an organization's security posture and business operations. It helps organizations prioritize and allocate resources for incident response based on the severity level of the incident \nIt helps analysts and incident handlers prioritize incidents by indicating the level of risk and potential impact associated with the incident. This enables organizations to allocate resources efficiently and address the most critical incidents first.\nCan also be used to generate reports and metrics for measuring the effectiveness of the incident response process and to identify trends and patterns in the threat landscape.\nIt is important to note that the `severity` field is subjective and can be interpreted differently by different organizations or analysts. Therefore, it should be used in conjunction with other intelligence attributes, such as the `confidence` field, to provide a more comprehensive view of the incident." tactics: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: Represents the offensive techniques, approaches, or procedures that an adversary may use to achieve their objectives during an attack. It helps in understanding the intent and capabilities of the adversary and can be used to identify indicators of attack (IoAs) or indicators of compromise (IoCs) that are associated with the adversary's tactics. techniques: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: Represents the specific methods or actions used by an attacker to carry out an offensive maneuver or achieve their goals. short_id: type: string example: string description: A human-readable, short identifier for the incident, unique within an organization. required: - confidence - status - incident_time example: description: string assignees: - string detection_sources: - string meta: keyword: string schema_version: 1.3.30 revision: 10 type: incident source: string external_ids: - string short_description: string title: string incident_time: opened: '2016-01-01T01:01:01Z' discovered: '2016-01-01T01:01:01Z' reported: '2016-01-01T01:01:01Z' remediated: '2016-01-01T01:01:01Z' closed: '2016-01-01T01:01:01Z' rejected: '2016-01-01T01:01:01Z' contained: '2016-01-01T01:01:01Z' external_references: - source_name: string description: string url: string hashes: - string external_id: string discovery_method: Agent Disclosure source_uri: string intended_effect: Account Takeover categories: - Attrition status: Closed language: string detection_status: active id: string promotion_method: Automated severity: Critical tlp: green scores: asset: 10.0 techniques: - string timestamp: '2016-01-01T01:01:01Z' confidence: High short_id: string tactics: - string description: For submitting a new Incident. uniqueItems: true example: - description: string assignees: - string detection_sources: - string meta: keyword: string schema_version: 1.3.30 revision: 10 type: incident source: string external_ids: - string short_description: string title: string incident_time: opened: '2016-01-01T01:01:01Z' discovered: '2016-01-01T01:01:01Z' reported: '2016-01-01T01:01:01Z' remediated: '2016-01-01T01:01:01Z' closed: '2016-01-01T01:01:01Z' rejected: '2016-01-01T01:01:01Z' contained: '2016-01-01T01:01:01Z' external_references: - source_name: string description: string url: string hashes: - string external_id: string discovery_method: Agent Disclosure source_uri: string intended_effect: Account Takeover categories: - Attrition status: Closed language: string detection_status: active id: string promotion_method: Automated severity: Critical tlp: green scores: asset: 10.0 techniques: - string timestamp: '2016-01-01T01:01:01Z' confidence: High short_id: string tactics: - string description: a list of `NewIncident`s. indicators: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - indicator example: indicator description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time range during which this Indicator is considered valid. producer: type: string example: string description: String with at most 1024 characters. severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown example: Critical negate: type: boolean example: true description: Specifies the absence of the pattern. indicator_type: type: array items: type: string enum: - Anonymization - C2 - Compromised PKI Certificate - Domain Watchlist - Exfiltration - File Hash Watchlist - Host Characteristics - IMEI Watchlist - IMSI Watchlist - IP Watchlist - Login Name - Malicious E-mail - Malware Artifacts - Private Threat Feed - URL Watchlist example: Anonymization example: - Anonymization description: Specifies the type or types for this Indicator. tags: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: Descriptors for this indicator. composite_indicator_expression: type: object properties: operator: type: string enum: - and - not - or example: and indicator_ids: type: array items: type: string example: string description: A URI leading to an indicator. example: - string required: - operator - indicator_ids example: operator: and indicator_ids: - string likely_impact: type: string example: string description: Likely potential impact within the relevant context if this Indicator were to occur. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: level of confidence held in the accuracy of this Indicator. kill_chain_phases: type: array items: type: object properties: kill_chain_name: type: string example: string description: The name of the kill chain. phase_name: type: string example: string description: The name of the phase in the kill chain. required: - kill_chain_name - phase_name example: kill_chain_name: string phase_name: string description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives. example: - kill_chain_name: string phase_name: string description: Relevant kill chain phases indicated by this Indicator. test_mechanisms: type: array items: type: string example: string description: String with at most 2048 characters. example: - string description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator. specification: type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. x-anyOf: - type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. - type: object properties: type: type: string enum: - ThreatBrain example: ThreatBrain query: type: string example: string variables: type: array items: type: string example: string example: - string required: - type - variables example: type: ThreatBrain query: string variables: - string description: An indicator which runs in threatbrain... - type: object properties: type: type: string enum: - Snort example: Snort snort_sig: type: string example: string required: - type - snort_sig example: type: Snort snort_sig: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - SIOC example: SIOC SIOC: type: string example: string required: - type - SIOC example: type: SIOC SIOC: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - OpenIOC example: OpenIOC open_IOC: type: string example: string required: - type - open_IOC example: type: OpenIOC open_IOC: string description: An indicator which contains an XML blob of an openIOC indicator. required: - producer example: description: string tags: - string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' producer: string schema_version: 1.3.30 revision: 10 type: indicator test_mechanisms: - string source: string external_ids: - string short_description: string composite_indicator_expression: operator: and indicator_ids: - string title: string likely_impact: string indicator_type: - Anonymization external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string severity: Critical tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string negate: true timestamp: '2016-01-01T01:01:01Z' confidence: High specification: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: For submitting a new Indicator uniqueItems: true example: - description: string tags: - string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' producer: string schema_version: 1.3.30 revision: 10 type: indicator test_mechanisms: - string source: string external_ids: - string short_description: string composite_indicator_expression: operator: and indicator_ids: - string title: string likely_impact: string indicator_type: - Anonymization external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string severity: Critical tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string negate: true timestamp: '2016-01-01T01:01:01Z' confidence: High specification: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: a list of `NewIndicator`s. judgements: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - judgement example: judgement description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. observable: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. disposition: type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Matches :disposition_name as in {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"} disposition_name: type: string enum: - Clean - Common - Malicious - Suspicious - Unknown example: Clean description: String verdict identifiers. priority: type: integer format: int64 example: 10 description: A value 0-100 that determine the priority of a judgement. Curated feeds of black/white lists, for example known good products within your organizations, should use a 95. All automated systems should use a priority of 90, or less. Human judgements should have a priority of 100, so that humans can always override machines. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown example: Critical valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. reason: type: string example: string description: String with at most 1024 characters. reason_uri: type: string example: string description: A URI required: - source - observable - priority - confidence - severity example: valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 observable: value: 1.2.3.4 type: ip reason_uri: string type: judgement source: string external_ids: - string disposition: 1 external_references: - source_name: string description: string url: string hashes: - string external_id: string reason: string source_uri: string disposition_name: Clean priority: 10 language: string id: string severity: Critical tlp: green timestamp: '2016-01-01T01:01:01Z' confidence: High description: Schema for submitting new Judgements. uniqueItems: true example: - valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 observable: value: 1.2.3.4 type: ip reason_uri: string type: judgement source: string external_ids: - string disposition: 1 external_references: - source_name: string description: string url: string hashes: - string external_id: string reason: string source_uri: string disposition_name: Clean priority: 10 language: string id: string severity: Critical tlp: green timestamp: '2016-01-01T01:01:01Z' confidence: High description: a list of `NewJudgement`s. malwares: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - malware example: malware description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. labels: type: array items: type: string example: adware description: Malware label is an open vocabulary that represents different types and functions of malware. Malware labels are not mutually exclusive; a malware instance can be both spyware and a screen capture tool. example: - adware description: The type of malware being described. kill_chain_phases: type: array items: type: object properties: kill_chain_name: type: string example: string description: The name of the kill chain. phase_name: type: string example: string description: The name of the phase in the kill chain. required: - kill_chain_name - phase_name example: kill_chain_name: string phase_name: string description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives. example: - kill_chain_name: string phase_name: string description: The list of Kill Chain Phases for which this Malware can be used. x_mitre_aliases: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: ATT&CK Software.aliases. abstraction_level: type: string enum: - family - variant - version example: family description: Malware abstraction level. required: - title - description - short_description - labels example: description: string labels: - adware abstraction_level: family schema_version: 1.3.30 revision: 10 type: malware x_mitre_aliases: - string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string timestamp: '2016-01-01T01:01:01Z' description: For submitting a new Malware. uniqueItems: true example: - description: string labels: - adware abstraction_level: family schema_version: 1.3.30 revision: 10 type: malware x_mitre_aliases: - string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string timestamp: '2016-01-01T01:01:01Z' description: a list of `NewMalware`s. notes: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - note example: note description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. note_class: type: string example: keyword content: type: string example: string description: Markdown string with at most 5000 characters. related_entities: type: array items: type: object properties: entity_type: type: string example: string entity_id: type: string example: string description: A URI leading to an entity. required: - entity_type - entity_id example: entity_type: string entity_id: string example: - entity_type: string entity_id: string author: type: string example: string required: - note_class - content - related_entities example: schema_version: 1.3.30 revision: 10 content: string note_class: keyword type: note source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string author: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' related_entities: - entity_type: string entity_id: string description: Schema for submitting Notes uniqueItems: true example: - schema_version: 1.3.30 revision: 10 content: string note_class: keyword type: note source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string author: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' related_entities: - entity_type: string entity_id: string description: a list of `NewNote`s. relationships: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - relationship example: relationship description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. relationship_type: type: string example: attributed-to source_ref: type: string example: string description: A URI leading to an entity. target_ref: type: string example: string description: A URI leading to an entity. required: - relationship_type - source_ref - target_ref example: description: string schema_version: 1.3.30 revision: 10 target_ref: string type: relationship source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string source_ref: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' relationship_type: attributed-to description: Schema for submitting new Relationships. uniqueItems: true example: - description: string schema_version: 1.3.30 revision: 10 target_ref: string type: relationship source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string source_ref: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' relationship_type: attributed-to description: a list of `NewRelationship`s. sightings: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - sighting example: sighting description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. observed_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High count: type: integer format: int64 example: 10 description: 'The number of times an indicator was observed within a certain period of time. For example, if an IP address associated with known malicious activity is observed once within a period of time, it may indicate a low-level threat. However, if the same IP address is observed multiple times within a short time frame, it may indicate a more severe and persistent threat. It can also be used to prioritize security alerts and indicate the urgency of a response. High counts indicate that an indicator is actively being used in a larger campaign, while low counts may indicate isolated incidents.' internal: type: boolean example: false description: "If `true`, indicates that the sighting was reported from internal sources, such as an organization's own internal security tools or SOC.\n Internal sightings are often considered more reliable and actionable than external sightings, which are reported from external sources and may have a lower level of trustworthiness. Internal sightings can provide more context and can help identify potential threats that are unique to a particular environment or organization.\n Internal sightings can also help organizations prioritize their security response efforts by identifying threats that are specific to their environment and may not yet be widely known." severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown example: Critical resolution: type: string example: detected description: Represents the disposition or actions taken on the associated threat intelligence. data: type: object properties: columns: type: array items: type: object properties: name: type: string example: string type: type: string enum: - integer - markdown - number - observable - string - url example: integer description: type: string example: string description: Markdown string with at most 5000 characters. required: type: boolean example: true description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`. short_description: type: string example: string required: - name - type example: name: string type: integer description: string required: true short_description: string example: - name: string type: integer description: string required: true short_description: string description: an ordered list of column definitions rows: type: array items: type: array items: example: anything example: - - anything description: an ordered list of rows row_count: type: integer format: int64 example: 10 description: The number of rows in the data table. required: - columns - rows example: columns: - name: string type: integer description: string required: true short_description: string rows: - - anything row_count: 10 description: An embedded data table for the Sighting. sensor: type: string example: endpoint description: The OpenC2 Actuator name that best fits the device that is creating this sighting (e.g. network.firewall) sensor_coordinates: type: object properties: type: type: string example: endpoint description: The sensor/actuator name that best fits a device. observables: type: array items: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. example: - value: 1.2.3.4 type: ip os: type: string example: string required: - type - observables example: type: endpoint observables: - value: 1.2.3.4 type: ip os: string description: Describes the device that made the sighting (sensor) and contains identifying observables for the sensor. targets: type: array items: type: object properties: type: type: string example: endpoint description: The sensor/actuator name that best fits a device. observables: type: array items: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. example: - value: 1.2.3.4 type: ip observed_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). os: type: string example: string required: - type - observables - observed_time example: type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string description: Describes the target of the sighting and contains identifying observables for the target. example: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string description: 'May include one or more targets that observed the associated indicator. Targets can include network devices, host devices, or other entities that are capable of detecting indicators of compromise. Can be used to assess the scope of potential threats, helping analysts understand which devices or components of the network may be vulnerable to attack. For example, if a particular malware strain is detected on several different systems within an organization, the `targets` field may indicate which systems are affected and which may need to be isolated or patched to prevent further spread.' observables: type: array items: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. example: - value: 1.2.3.4 type: ip description: The object(s) of interest. relations: type: array items: type: object properties: origin: type: string example: string origin_uri: type: string example: string description: A URI relation: type: string example: Allocated relation_info: type: object additionalProperties: example: anything example: keyword: anything properties: {} source: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. related: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. required: - origin - relation - source - related example: origin: string origin_uri: string relation: Allocated relation_info: keyword: anything source: value: 1.2.3.4 type: ip related: value: 1.2.3.4 type: ip description: A relation inside a Sighting. example: - origin: string origin_uri: string relation: Allocated relation_info: keyword: anything source: value: 1.2.3.4 type: ip related: value: 1.2.3.4 type: ip description: Provide any context we can about where the observable came from. context: type: object properties: process_create_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. type: type: string enum: - ProcessCreateEvent example: ProcessCreateEvent process_args: type: string example: string description: String with at most 2048 characters. process_hash: type: string example: string description: String with at most 2048 characters. process_size: type: integer format: int64 example: 10 process_disposition: type: string example: string description: String with at most 1024 characters. parent_creation_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard. parent_process_id: type: integer format: int64 example: 10 parent_process_guid: type: integer format: int64 example: 10 parent_process_name: type: string example: string description: String with at most 1024 characters. parent_process_args: type: string example: string description: String with at most 2048 characters. parent_process_username: type: string example: string description: String with at most 1024 characters. parent_process_hash: type: string example: string description: String with at most 2048 characters. parent_process_size: type: integer format: int64 example: 10 parent_process_disposition: type: string example: string description: String with at most 1024 characters. required: - time - process_id - process_name - type example: parent_process_name: string process_guid: 10 parent_process_guid: 10 process_disposition: string parent_process_size: 10 process_size: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_disposition: string type: ProcessCreateEvent parent_process_username: string parent_process_id: 10 parent_process_args: string process_name: string process_hash: string process_id: 10 parent_process_hash: string process_username: string parent_creation_time: '2016-01-01T01:01:01Z' process_args: string example: - parent_process_name: string process_guid: 10 parent_process_guid: 10 process_disposition: string parent_process_size: 10 process_size: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_disposition: string type: ProcessCreateEvent parent_process_username: string parent_process_id: 10 parent_process_args: string process_name: string process_hash: string process_id: 10 parent_process_hash: string process_username: string parent_creation_time: '2016-01-01T01:01:01Z' process_args: string description: a list of `ProcessCreate` library_load_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. type: type: string enum: - LibraryLoadEvent example: LibraryLoadEvent dll_library_name: type: string example: string description: String with at most 1024 characters. dll_library_path: type: string example: string description: String with at most 2048 characters. required: - time - process_id - process_name - type - dll_library_name - dll_library_path example: time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string type: LibraryLoadEvent dll_library_name: string dll_library_path: string example: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string type: LibraryLoadEvent dll_library_name: string dll_library_path: string description: a list of `LibraryLoadType` file_create_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. file_name: type: string example: string description: String with at most 1024 characters. file_path: type: string example: string description: String with at most 2048 characters. type: type: string enum: - FileCreateEvent example: FileCreateEvent failed: type: boolean example: false required: - time - process_id - process_name - file_name - file_path - type example: file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileCreateEvent file_path: string process_name: string process_id: 10 process_username: string failed: false example: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileCreateEvent file_path: string process_name: string process_id: 10 process_username: string failed: false description: a list of `FileCreateType` file_delete_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. file_name: type: string example: string description: String with at most 1024 characters. file_path: type: string example: string description: String with at most 2048 characters. type: type: string enum: - FileDeleteEvent example: FileDeleteEvent failed: type: boolean example: false required: - time - process_id - process_name - file_name - file_path - type example: file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileDeleteEvent file_path: string process_name: string process_id: 10 process_username: string failed: false example: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileDeleteEvent file_path: string process_name: string process_id: 10 process_username: string failed: false description: a list of `FileDeleteType` file_modify_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. file_name: type: string example: string description: String with at most 1024 characters. file_path: type: string example: string description: String with at most 2048 characters. type: type: string enum: - FileModifyEvent example: FileModifyEvent failed: type: boolean example: false required: - time - process_id - process_name - file_name - file_path - type example: file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileModifyEvent file_path: string process_name: string process_id: 10 process_username: string failed: false example: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileModifyEvent file_path: string process_name: string process_id: 10 process_username: string failed: false description: a list of `FileModifyType` file_move_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. file_name: type: string example: string description: String with at most 1024 characters. file_path: type: string example: string description: String with at most 2048 characters. type: type: string enum: - FileMoveEvent example: FileMoveEvent old_name: type: string example: string description: String with at most 1024 characters. new_name: type: string example: string description: String with at most 1024 characters. required: - time - process_id - process_name - file_name - file_path - type - old_name - new_name example: file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileMoveEvent old_name: string file_path: string process_name: string process_id: 10 process_username: string new_name: string example: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileMoveEvent old_name: string file_path: string process_name: string process_id: 10 process_username: string new_name: string description: a list of `FileMoveType` netflow_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. type: type: string enum: - NetflowEvent example: NetflowEvent traffic: type: object properties: protocol: type: integer format: int64 example: 10 description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml) source_ip: type: string example: string destination_ip: type: string example: string source_port: type: integer format: int64 example: 10 destination_port: type: integer format: int64 example: 10 direction: type: string enum: - incoming - outgoing example: incoming destination_host_name: type: string example: string source_subnet: type: string example: string destination_subnet: type: string example: string required: - protocol - source_ip - destination_ip - source_port - destination_port - direction example: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 process_path: type: string example: string description: String with at most 1024 characters. process_args: type: string example: string description: String with at most 1024 characters. process_hash: type: string example: string description: String with at most 1024 characters. process_account_type: type: string example: string description: String with at most 1024 characters. process_account: type: string example: string description: String with at most 1024 characters. parent_process_id: type: integer format: int64 example: 10 parent_process_name: type: string example: string description: String with at most 1024 characters. parent_process_path: type: string example: string description: String with at most 1024 characters. parent_process_args: type: string example: string description: String with at most 1024 characters. parent_process_hash: type: string example: string description: String with at most 1024 characters. parent_process_account: type: string example: string description: String with at most 1024 characters. parent_process_account_type: type: string example: string description: String with at most 1024 characters. flow_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard. byte_count_out: type: integer format: int64 example: 10 byte_count_in: type: integer format: int64 example: 10 required: - time - process_id - process_name - type - traffic example: parent_process_name: string byte_count_in: 10 process_guid: 10 process_path: string traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 flow_time: '2016-01-01T01:01:01Z' time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_account: string type: NetflowEvent process_account_type: string parent_process_path: string parent_process_id: 10 parent_process_args: string process_name: string process_account: string parent_process_account_type: string process_hash: string process_id: 10 parent_process_hash: string process_username: string byte_count_out: 10 process_args: string example: - parent_process_name: string byte_count_in: 10 process_guid: 10 process_path: string traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 flow_time: '2016-01-01T01:01:01Z' time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_account: string type: NetflowEvent process_account_type: string parent_process_path: string parent_process_id: 10 parent_process_args: string process_name: string process_account: string parent_process_account_type: string process_hash: string process_id: 10 parent_process_hash: string process_username: string byte_count_out: 10 process_args: string description: a list of `NetflowType` http_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. type: type: string enum: - HTTPEvent example: HTTPEvent host: type: string example: string description: String with at most 1024 characters. traffic: type: object properties: protocol: type: integer format: int64 example: 10 description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml) source_ip: type: string example: string destination_ip: type: string example: string source_port: type: integer format: int64 example: 10 destination_port: type: integer format: int64 example: 10 direction: type: string enum: - incoming - outgoing example: incoming destination_host_name: type: string example: string source_subnet: type: string example: string destination_subnet: type: string example: string required: - protocol - source_ip - destination_ip - source_port - destination_port - direction example: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 url_port: type: integer format: int64 example: 10 query: type: string example: string description: String with at most 5000 characters. encrypted: type: boolean example: true method: type: string enum: - CONNECT - GET - HEAD - OPTIONS - PATCH - POST - PUT - TRACE example: CONNECT required: - time - process_id - process_name - type - host - traffic example: process_guid: 10 traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 method: CONNECT time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: HTTPEvent host: string process_name: string process_id: 10 process_username: string query: string encrypted: true url_port: 10 example: - process_guid: 10 traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 method: CONNECT time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: HTTPEvent host: string process_name: string process_id: 10 process_username: string query: string encrypted: true url_port: 10 description: a list of `HTTPType` registry_create_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. registry_key: type: string example: string description: String with at most 1024 characters. type: type: string enum: - RegistryCreateEvent example: RegistryCreateEvent required: - time - process_id - process_name - registry_key - type example: time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryCreateEvent example: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryCreateEvent description: a list of `RegistryCreateType` registry_set_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. registry_key: type: string example: string description: String with at most 1024 characters. type: type: string enum: - RegistrySetEvent example: RegistrySetEvent registry_value: type: string example: string description: String with at most 2048 characters. registry_data_length: type: integer format: int64 example: 10 registry_data: type: string example: string description: String with at most 5000 characters. required: - time - process_id - process_name - registry_key - type - registry_value example: process_guid: 10 registry_data: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: RegistrySetEvent registry_data_length: 10 registry_value: string registry_key: string process_name: string process_id: 10 process_username: string example: - process_guid: 10 registry_data: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: RegistrySetEvent registry_data_length: 10 registry_value: string registry_key: string process_name: string process_id: 10 process_username: string description: a list of `RegistrySetType` registry_delete_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. registry_key: type: string example: string description: String with at most 1024 characters. type: type: string enum: - RegistryDeleteEvent example: RegistryDeleteEvent registry_value: type: string example: string description: String with at most 2048 characters. required: - time - process_id - process_name - registry_key - type example: time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryDeleteEvent registry_value: string example: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryDeleteEvent registry_value: string description: a list of `RegistryDeleteType` registry_rename_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. registry_key: type: string example: string description: String with at most 1024 characters. type: type: string enum: - RegistryRenameEvent example: RegistryRenameEvent registry_old_key: type: string example: string description: String with at most 1024 characters. required: - time - process_id - process_name - registry_key - type - registry_old_key example: time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryRenameEvent registry_old_key: string example: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryRenameEvent registry_old_key: string description: a list of `RegistryRenameType` example: http_events: - process_guid: 10 traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 method: CONNECT time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: HTTPEvent host: string process_name: string process_id: 10 process_username: string query: string encrypted: true url_port: 10 process_create_events: - parent_process_name: string process_guid: 10 parent_process_guid: 10 process_disposition: string parent_process_size: 10 process_size: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_disposition: string type: ProcessCreateEvent parent_process_username: string parent_process_id: 10 parent_process_args: string process_name: string process_hash: string process_id: 10 parent_process_hash: string process_username: string parent_creation_time: '2016-01-01T01:01:01Z' process_args: string registry_delete_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryDeleteEvent registry_value: string file_modify_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileModifyEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_set_events: - process_guid: 10 registry_data: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: RegistrySetEvent registry_data_length: 10 registry_value: string registry_key: string process_name: string process_id: 10 process_username: string file_create_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileCreateEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_create_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryCreateEvent library_load_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string type: LibraryLoadEvent dll_library_name: string dll_library_path: string file_move_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileMoveEvent old_name: string file_path: string process_name: string process_id: 10 process_username: string new_name: string file_delete_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileDeleteEvent file_path: string process_name: string process_id: 10 process_username: string failed: false netflow_events: - parent_process_name: string byte_count_in: 10 process_guid: 10 process_path: string traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 flow_time: '2016-01-01T01:01:01Z' time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_account: string type: NetflowEvent process_account_type: string parent_process_path: string parent_process_id: 10 parent_process_args: string process_name: string process_account: string parent_process_account_type: string process_hash: string process_id: 10 parent_process_hash: string process_username: string byte_count_out: 10 process_args: string registry_rename_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryRenameEvent registry_old_key: string description: Context including the event type that best fits the type of the sighting. activity_interval: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time interval during which the malicious activity occurred. For example, the time when a malware sample was executing, or the time range of a network intrusion. detection_interval: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time interval during which the malicious activity was detected by the source engine or security tool. This may differ from the activity_interval if detection occurred after the activity. modification_interval: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time interval during which the sighting record was created or last updated in the system. required: - observed_time example: description: string schema_version: 1.3.30 revision: 10 relations: - origin: string origin_uri: string relation: Allocated relation_info: keyword: anything source: value: 1.2.3.4 type: ip related: value: 1.2.3.4 type: ip sensor_coordinates: type: endpoint observables: - value: 1.2.3.4 type: ip os: string observables: - value: 1.2.3.4 type: ip type: sighting source: string external_ids: - string targets: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string short_description: string title: string resolution: detected internal: false external_references: - source_name: string description: string url: string hashes: - string external_id: string detection_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' source_uri: string activity_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' language: string id: string count: 10 severity: Critical tlp: green modification_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' context: http_events: - process_guid: 10 traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 method: CONNECT time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: HTTPEvent host: string process_name: string process_id: 10 process_username: string query: string encrypted: true url_port: 10 process_create_events: - parent_process_name: string process_guid: 10 parent_process_guid: 10 process_disposition: string parent_process_size: 10 process_size: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_disposition: string type: ProcessCreateEvent parent_process_username: string parent_process_id: 10 parent_process_args: string process_name: string process_hash: string process_id: 10 parent_process_hash: string process_username: string parent_creation_time: '2016-01-01T01:01:01Z' process_args: string registry_delete_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryDeleteEvent registry_value: string file_modify_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileModifyEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_set_events: - process_guid: 10 registry_data: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: RegistrySetEvent registry_data_length: 10 registry_value: string registry_key: string process_name: string process_id: 10 process_username: string file_create_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileCreateEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_create_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryCreateEvent library_load_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string type: LibraryLoadEvent dll_library_name: string dll_library_path: string file_move_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileMoveEvent old_name: string file_path: string process_name: string process_id: 10 process_username: string new_name: string file_delete_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileDeleteEvent file_path: string process_name: string process_id: 10 process_username: string failed: false netflow_events: - parent_process_name: string byte_count_in: 10 process_guid: 10 process_path: string traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 flow_time: '2016-01-01T01:01:01Z' time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_account: string type: NetflowEvent process_account_type: string parent_process_path: string parent_process_id: 10 parent_process_args: string process_name: string process_account: string parent_process_account_type: string process_hash: string process_id: 10 parent_process_hash: string process_username: string byte_count_out: 10 process_args: string registry_rename_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryRenameEvent registry_old_key: string timestamp: '2016-01-01T01:01:01Z' confidence: High observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' sensor: endpoint data: columns: - name: string type: integer description: string required: true short_description: string rows: - - anything row_count: 10 description: For submitting a new Sighting. uniqueItems: true example: - description: string schema_version: 1.3.30 revision: 10 relations: - origin: string origin_uri: string relation: Allocated relation_info: keyword: anything source: value: 1.2.3.4 type: ip related: value: 1.2.3.4 type: ip sensor_coordinates: type: endpoint observables: - value: 1.2.3.4 type: ip os: string observables: - value: 1.2.3.4 type: ip type: sighting source: string external_ids: - string targets: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string short_description: string title: string resolution: detected internal: false external_references: - source_name: string description: string url: string hashes: - string external_id: string detection_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' source_uri: string activity_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' language: string id: string count: 10 severity: Critical tlp: green modification_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' context: http_events: - process_guid: 10 traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 method: CONNECT time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: HTTPEvent host: string process_name: string process_id: 10 process_username: string query: string encrypted: true url_port: 10 process_create_events: - parent_process_name: string process_guid: 10 parent_process_guid: 10 process_disposition: string parent_process_size: 10 process_size: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_disposition: string type: ProcessCreateEvent parent_process_username: string parent_process_id: 10 parent_process_args: string process_name: string process_hash: string process_id: 10 parent_process_hash: string process_username: string parent_creation_time: '2016-01-01T01:01:01Z' process_args: string registry_delete_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryDeleteEvent registry_value: string file_modify_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileModifyEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_set_events: - process_guid: 10 registry_data: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: RegistrySetEvent registry_data_length: 10 registry_value: string registry_key: string process_name: string process_id: 10 process_username: string file_create_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileCreateEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_create_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryCreateEvent library_load_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string type: LibraryLoadEvent dll_library_name: string dll_library_path: string file_move_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileMoveEvent old_name: string file_path: string process_name: string process_id: 10 process_username: string new_name: string file_delete_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileDeleteEvent file_path: string process_name: string process_id: 10 process_username: string failed: false netflow_events: - parent_process_name: string byte_count_in: 10 process_guid: 10 process_path: string traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 flow_time: '2016-01-01T01:01:01Z' time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_account: string type: NetflowEvent process_account_type: string parent_process_path: string parent_process_id: 10 parent_process_args: string process_name: string process_account: string parent_process_account_type: string process_hash: string process_id: 10 parent_process_hash: string process_username: string byte_count_out: 10 process_args: string registry_rename_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryRenameEvent registry_old_key: string timestamp: '2016-01-01T01:01:01Z' confidence: High observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' sensor: endpoint data: columns: - name: string type: integer description: string required: true short_description: string rows: - - anything row_count: 10 description: a list of `NewSighting`s. identity_assertions: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - identity-assertion example: identity-assertion description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. identity: type: object properties: observables: type: array items: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. example: - value: 1.2.3.4 type: ip required: - observables example: observables: - value: 1.2.3.4 type: ip description: Attributes for which the assertion is being made. assertions: type: array items: type: object properties: name: type: string example: cisco:ctr:ad:host_domain_name description: An open vocabulary containing well known assertion types value: type: string example: string required: - name - value example: name: cisco:ctr:ad:host_domain_name value: string example: - name: cisco:ctr:ad:host_domain_name value: string description: Any known context about the identity attributes. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. required: - identity - assertions example: valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' identity: observables: - value: 1.2.3.4 type: ip schema_version: 1.3.30 revision: 10 type: identity-assertion source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' assertions: - name: cisco:ctr:ad:host_domain_name value: string description: For submitting a new IdentityAssertion. uniqueItems: true example: - valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' identity: observables: - value: 1.2.3.4 type: ip schema_version: 1.3.30 revision: 10 type: identity-assertion source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' assertions: - name: cisco:ctr:ad:host_domain_name value: string description: a list of `NewIdentityAssertion`s. target_records: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - target-record example: target-record description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. targets: type: array items: type: object properties: type: type: string example: endpoint description: The sensor/actuator name that best fits a device. observables: type: array items: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. example: - value: 1.2.3.4 type: ip observed_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). os: type: string example: string description: Source Operating System where TargetRecord was originated. internal: type: boolean example: false description: Is it internal to our network? sensor: type: string example: string description: 'The OpenC2 Actuator name that best fits the device that is creating this TargetRecord (e.g.: network.firewall, etc.)' source_uri: type: string example: string description: A URI required: - type - observables - observed_time example: type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string internal: false sensor: string source_uri: string description: Schema for TargetRecord Targets example: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string internal: false sensor: string source_uri: string required: - source - targets example: description: string schema_version: 1.3.30 revision: 10 type: target-record source: string external_ids: - string targets: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string internal: false sensor: string source_uri: string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' description: Schema for submitting new TargetRecord. uniqueItems: true example: - description: string schema_version: 1.3.30 revision: 10 type: target-record source: string external_ids: - string targets: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string internal: false sensor: string source_uri: string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' description: a list of `NewTargetRecord`s. tools: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - tool example: tool description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. labels: type: array items: type: string example: credential-exploitation description: Tool labels describe the categories of tools that can be used to perform attacks. example: - credential-exploitation description: The kind(s) of tool(s) being described. kill_chain_phases: type: array items: type: object properties: kill_chain_name: type: string example: string description: The name of the kill chain. phase_name: type: string example: string description: The name of the phase in the kill chain. required: - kill_chain_name - phase_name example: kill_chain_name: string phase_name: string description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives. example: - kill_chain_name: string phase_name: string description: The list of kill chain phases for which this Tool can be used. tool_version: type: string example: string description: The version identifier associated with the Tool. x_mitre_aliases: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: ATT&CK Software.aliases. required: - title - description - short_description - labels example: description: string labels: - credential-exploitation schema_version: 1.3.30 revision: 10 type: tool x_mitre_aliases: - string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tool_version: string tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string timestamp: '2016-01-01T01:01:01Z' description: For submitting a new Tool. uniqueItems: true example: - description: string labels: - credential-exploitation schema_version: 1.3.30 revision: 10 type: tool x_mitre_aliases: - string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tool_version: string tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string timestamp: '2016-01-01T01:01:01Z' description: a list of `NewTool`s. verdicts: type: array items: type: object properties: type: type: string enum: - verdict example: verdict disposition: type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Numeric verdict identifiers. observable: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. judgement_id: type: string example: string description: A URI leading to a judgement. disposition_name: type: string enum: - Clean - Common - Malicious - Suspicious - Unknown example: Clean description: 'The disposition_name field is optional, but is intended to be shown to a user. Applications must therefore remember the mapping of numbers to human words, as in: {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}' valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. required: - type - disposition - observable - valid_time example: type: verdict disposition: 1 observable: value: 1.2.3.4 type: ip judgement_id: string disposition_name: Clean valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: "A Verdict is chosen from all of the Judgements on that Observable which have not yet expired. The highest priority Judgement becomes the active verdict. If there is more than one Judgement with that priority, then Clean disposition has priority over all others, then Malicious disposition, and so on down to Unknown.\n\n The ID of a verdict is a a str of the form \"observable.type:observable.value\" for example, \"ip:1.1.1.1\"" uniqueItems: true example: - type: verdict disposition: 1 observable: value: 1.2.3.4 type: ip judgement_id: string disposition_name: Clean valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: a list of `Verdict`s. data_tables: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - data-table example: data-table description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. columns: type: array items: type: object properties: name: type: string example: string type: type: string enum: - integer - markdown - number - observable - string - url example: integer description: type: string example: string description: Markdown string with at most 5000 characters. required: type: boolean example: true description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`. short_description: type: string example: string required: - name - type example: name: string type: integer description: string required: true short_description: string example: - name: string type: integer description: string required: true short_description: string description: An ordered list of column definitions. rows: type: array items: type: array items: example: anything example: - - anything description: An ordered list of rows valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. row_count: type: integer format: int64 example: 10 description: The number of rows in the data table. required: - columns - rows example: description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 columns: - name: string type: integer description: string required: true short_description: string type: data-table source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string rows: - - anything source_uri: string language: string id: string tlp: green row_count: 10 timestamp: '2016-01-01T01:01:01Z' description: Schema for submitting a NewDataTable record. uniqueItems: true example: - description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 columns: - name: string type: integer description: string required: true short_description: string type: data-table source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string rows: - - anything source_uri: string language: string id: string tlp: green row_count: 10 timestamp: '2016-01-01T01:01:01Z' description: a list of `NewDataTable`s. weaknesses: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - weakness example: weakness description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: Should be short and limited to the key points that define this weakness. short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. structure: type: string enum: - Chain - Composite - Simple example: Chain description: Defines the structural nature of the weakness. languages: type: array items: type: object properties: prevalence: type: string enum: - Often - Rarely - Sometimes - Undetermined example: Often description: Defines the different regularities that guide the applicability of platforms. name: type: string example: string description: Language name (Clojure, Java, ...) class: type: string example: Assembly description: Class of language. required: - prevalence example: prevalence: Often name: string class: Assembly example: - prevalence: Often name: string class: Assembly description: Applicable Languages. operating_systems: type: array items: type: object properties: prevalence: type: string enum: - Often - Rarely - Sometimes - Undetermined example: Often description: Defines the different regularities that guide the applicability of platforms. name: type: string example: string description: String with at most 1024 characters. version: type: string example: string description: String with at most 1024 characters. cpe_id: type: string example: string description: String with at most 1024 characters. class: type: string example: Android description: Class of Operating System. required: - prevalence example: prevalence: Often name: string version: string cpe_id: string class: Android example: - prevalence: Often name: string version: string cpe_id: string class: Android description: Applicable operating systems. architectures: type: array items: type: object properties: prevalence: type: string enum: - Often - Rarely - Sometimes - Undetermined example: Often description: Defines the different regularities that guide the applicability of platforms. name: type: string example: string description: Architecture name (ARM, x86, ...) class: type: string example: Embedded description: Class of architecture required: - prevalence example: prevalence: Often name: string class: Embedded example: - prevalence: Often name: string class: Embedded description: Applicable architectures. paradigms: type: array items: type: object properties: prevalence: type: string enum: - Often - Rarely - Sometimes - Undetermined example: Often description: Defines the different regularities that guide the applicability of platforms. name: type: string example: string description: Paradigm name (Client Server, Mainframe) required: - prevalence example: prevalence: Often name: string example: - prevalence: Often name: string description: Applicable paradigms. technologies: type: array items: type: object properties: prevalence: type: string enum: - Often - Rarely - Sometimes - Undetermined example: Often description: Defines the different regularities that guide the applicability of platforms. name: type: string example: string description: Technology name (Web Server, Web Client) required: - prevalence example: prevalence: Often name: string example: - prevalence: Often name: string description: Applicable technologies. background_details: type: string example: string description: Information that is relevant but not related to the nature of the weakness itself. alternate_terms: type: array items: type: object properties: term: type: string example: string description: The actual alternate term. description: type: string example: string description: Provides context for the alternate term by which this weakness may be known. required: - term example: term: string description: string example: - term: string description: string description: Indicates one or more other names used to describe this weakness. modes_of_introduction: type: array items: type: object properties: phase: type: string example: Architecture and Design description: Identifies the point in the software life cycle at which the weakness may be introduced. note: type: string example: string description: Provides a typical scenario related to introduction during the given phase. required: - phase example: phase: Architecture and Design note: string example: - phase: Architecture and Design note: string description: Information about how and when a given weakness may be introduced. likelihood: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: Likelihood of exploit. common_consequences: type: array items: type: object properties: scopes: type: array items: type: string example: Access Control description: Defines the different areas of software security that can be affected by exploiting a weakness. example: - Access Control description: Identifies the security property that is violated. impacts: type: array items: type: string example: Alter Execution Logic example: - Alter Execution Logic description: Describes the technical impact that arises if an adversary succeeds in exploiting this weakness. likelihood: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: How likely the specific consequence is expected to be seen relative to the other consequences. note: type: string example: string description: Additional commentary about a consequence. required: - scopes example: scopes: - Access Control impacts: - Alter Execution Logic likelihood: High note: string example: - scopes: - Access Control impacts: - Alter Execution Logic likelihood: High note: string description: Refers to the typical or expected negative effects that can result from exploiting the weakness. This could include anything from unauthorized access to data, denial of service, system crashes or other things. detection_methods: type: array items: type: object properties: method: type: string example: Architecture or Design Review description: Identifies the particular detection method being described. description: type: string example: string description: Provides some context of how this method can be applied to a specific weakness. effectiveness: type: string example: High description: How effective the detection method may be in detecting the associated weakness. effectiveness_notes: type: string example: string description: Provides additional discussion of the strengths and shortcomings of this detection method. required: - method - description example: method: Architecture or Design Review description: string effectiveness: High effectiveness_notes: string example: - method: Architecture or Design Review description: string effectiveness: High effectiveness_notes: string description: Identifies methods that may be employed to detect this weakness, including their strengths and limitations. potential_mitigations: type: array items: type: object properties: description: type: string example: string description: A description of this individual mitigation including any strengths and shortcomings of this mitigation for the weakness. phases: type: array items: type: string example: Architecture and Design description: Defines the different regularities that guide the applicability of platforms. example: - Architecture and Design description: Indicates the development life cycle phase during which this particular mitigation may be applied. strategy: type: string example: Attack Surface Reduction description: A general strategy for protecting a system to which this mitigation contributes. effectiveness: type: string example: Defense in Depth description: Summarizes how effective the mitigation may be in preventing the weakness. effectiveness_notes: type: string example: string description: Markdown string with at most 5000 characters. required: - description example: description: string phases: - Architecture and Design strategy: Attack Surface Reduction effectiveness: Defense in Depth effectiveness_notes: string example: - description: string phases: - Architecture and Design strategy: Attack Surface Reduction effectiveness: Defense in Depth effectiveness_notes: string description: Describes potential mitigations associated with a weakness. functional_areas: type: array items: type: string example: Authentication description: Defines the different functional areas of software in which the weakness may appear. example: - Authentication description: Identifies the functional area of the software in which the weakness is most likely to occur. affected_resources: type: array items: type: string example: CPU description: Defines a resource of a system. example: - CPU description: Identifies system resources that can be affected by an exploit of this weakness. notes: type: array items: type: object properties: type: type: string example: Applicable Platform description: Defines the different types of notes that can be associated with a weakness. note: type: string example: string description: Markdown string with at most 5000 characters. required: - type - note example: type: Applicable Platform note: string example: - type: Applicable Platform note: string description: Provides any additional comments about the weakness. abstraction_level: type: string enum: - Base - Class - Compound - Variant example: Base description: Refers to the level of abstraction or granularity used to describe the weakness. It helps to categorize the vulnerability based on the level of detail provided. required: - description example: description: string background_details: string paradigms: - prevalence: Often name: string abstraction_level: Base architectures: - prevalence: Often name: string class: Embedded schema_version: 1.3.30 revision: 10 alternate_terms: - term: string description: string likelihood: High type: weakness source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string functional_areas: - Authentication source_uri: string modes_of_introduction: - phase: Architecture and Design note: string structure: Chain language: string id: string notes: - type: Applicable Platform note: string common_consequences: - scopes: - Access Control impacts: - Alter Execution Logic likelihood: High note: string tlp: green detection_methods: - method: Architecture or Design Review description: string effectiveness: High effectiveness_notes: string operating_systems: - prevalence: Often name: string version: string cpe_id: string class: Android affected_resources: - CPU languages: - prevalence: Often name: string class: Assembly timestamp: '2016-01-01T01:01:01Z' potential_mitigations: - description: string phases: - Architecture and Design strategy: Attack Surface Reduction effectiveness: Defense in Depth effectiveness_notes: string technologies: - prevalence: Often name: string description: For submitting a new weakness. uniqueItems: true example: - description: string background_details: string paradigms: - prevalence: Often name: string abstraction_level: Base architectures: - prevalence: Often name: string class: Embedded schema_version: 1.3.30 revision: 10 alternate_terms: - term: string description: string likelihood: High type: weakness source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string functional_areas: - Authentication source_uri: string modes_of_introduction: - phase: Architecture and Design note: string structure: Chain language: string id: string notes: - type: Applicable Platform note: string common_consequences: - scopes: - Access Control impacts: - Alter Execution Logic likelihood: High note: string tlp: green detection_methods: - method: Architecture or Design Review description: string effectiveness: High effectiveness_notes: string operating_systems: - prevalence: Often name: string version: string cpe_id: string class: Android affected_resources: - CPU languages: - prevalence: Often name: string class: Assembly timestamp: '2016-01-01T01:01:01Z' potential_mitigations: - description: string phases: - Architecture and Design strategy: Attack Surface Reduction effectiveness: Defense in Depth effectiveness_notes: string technologies: - prevalence: Often name: string description: a list of `NewWeakness`s. vulnerabilities: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - vulnerability example: vulnerability description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: "Various sources of vulnerability information can be used, including third-party resources like the National Vulnerability Database (NVD) and the Common Vulnerabilities and Exposures (CVE) database. The platform then analyzes this data and provides the user with relevant details such as the severity of the vulnerability, the affected systems, and remediation recommendations. \n\n Based on this information, the user can prioritize patching and other mitigation strategies to reduce the risk of potential attacks." short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. cve: type: object properties: cve_data_meta: type: object properties: id: type: string example: string description: String with at most 1024 characters. assigner: type: string example: string description: String with at most 1024 characters. example: id: string assigner: string required: - cve_data_meta example: cve_data_meta: id: string assigner: string impact: type: object properties: cvss_v2: type: object properties: vector_string: type: string example: string description: a text representation of a set of CVSSv2 metrics. It is commonly used to record or transfer CVSSv2 metric information in a concise form base_score: type: number format: double example: 10.0 description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v2/guide' base_severity: type: string enum: - High - Info - Low - Medium - None - Unknown example: High impact_score: type: number format: double example: 10.0 description: a Score number from 0 to 10 exploitability_score: type: number format: double example: 10.0 description: a Score number from 0 to 10 access_vector: type: string enum: - adjacent network - local - network example: network description: This metric reflects how the vulnerability is exploited.The more remote an attacker can be to attack a host, the greater the vulnerability score. access_complexity: type: string enum: - high - low - medium example: low description: 'This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system. For example, consider a buffer overflow in an Internet service: once the target system is located, the attacker can launch an exploit at will.' authentication: type: string enum: - multiple - none - single example: none description: This metric measures the number of times an attacker must authenticate to a target in order to exploit a vulnerability. This metric does not gauge the strength or complexity of the authentication process, only that an attacker is required to provide credentials before an exploit may occur. The fewer authentication instances that are required, the higher the vulnerability score. confidentiality_impact: type: string enum: - complete - none - partial example: complete description: This metric measures the impact on confidentiality of a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. Increasedconfidentiality impact increases the vulnerability score. integrity_impact: type: string enum: - complete - none - partial example: complete description: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and guaranteed veracity of information. Increased integrity impact increases the vulnerability score. availability_impact: type: string enum: - complete - none - partial example: complete description: This metric measures the impact to availability of a successfully exploited vulnerability. Availability refers to the accessibility of information resources. Attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system. Increased availability impact increases the vulnerability score. exploitability: type: string enum: - functional - high - not_defined - proof_of_concept - unproven example: not_defined description: This metric measures the current state of exploit techniques or code availability. Public availability of easy-to-use exploit code increases the number of potential attackers by including those who are unskilled thereby increasing the severity of the vulnerability. remediation_level: type: string enum: - not_defined - official_fix - temporary_fix - unavailable - workaround example: not_defined description: The remediation level of a vulnerability is an important factor for prioritization. The typical vulnerability is unpatched when initially published. Workarounds or hotfixes may offer interim remediation until an official patch or upgrade is issued. Each of these respective stages adjusts the temporal score downwards, reflecting the decreasing urgency as remediation becomes final. The less official and permanent a fix, the higher the vulnerability score is. report_confidence: type: string enum: - confirmed - not_defined - unconfirmed - uncorroborated example: not_defined description: This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details. Sometimes, only the existence of vulnerabilities are publicized, but without specific details. The vulnerability may later be corroborated and then confirmed through acknowledgement by the author or vendor of the affected technology. The urgency of a vulnerability is higher when a vulnerability is known to exist with certainty. This metric also suggests the level of technical knowledge available to would-be attackers. The more a vulnerability is validated by the vendor or other reputable sources, the higher the score. temporal_vector_string: type: string example: string description: A text representation of a set of CVSSv2 temporal metrics. Temporal metrics allow analysists to calculate threat severity based on temporal factors such as reliability of vulnerability reports, availability of mitigations, and the ease or difficulty of conducting the exploit. It is commonly used to record or transfer CVSSv2 metric information in a concise form collateral_damage_potential: type: string enum: - high - low - low_medium - medium_high - none - not_defined example: not_defined description: This metric measures the potential for loss of life or physical assets through damage or theft of property or equipment. The metric may also measure economic loss of productivity or revenue. Naturally, the greater the damage potential, the higher the vulnerability score. target_distribution: type: string enum: - high - low - medium - none - not_defined example: not_defined description: This metric measures the proportion of vulnerable systems. It is meant as an environment-specific indicator in order to approximate the percentage of systems that could be affected by the vulnerability. The greater the proportion of vulnerable systems, the higher the score. confidentiality_requirement: type: string enum: - high - low - medium - not_defined example: not_defined description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.' integrity_requirement: type: string enum: - high - low - medium - not_defined example: not_defined description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.' availability_requirement: type: string enum: - high - low - medium - not_defined example: not_defined description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.' environmental_vector_string: type: string example: string description: A text representation of a set of CVSSv2 environmental metrics. Environmental metrics allow analysists to calculate threat scores in relation to environmental security requirements, collateral damage potential, and target availability. It is commonly used to record or transfer CVSSv2 metric information in a concise form obtain_all_privilege: type: boolean example: true obtain_user_privilege: type: boolean example: true obtain_other_privilege: type: boolean example: true user_interaction_required: type: boolean example: true required: - vector_string - base_score - base_severity example: integrity_impact: complete target_distribution: not_defined availability_requirement: not_defined exploitability: not_defined access_complexity: low temporal_vector_string: string exploitability_score: 10.0 impact_score: 10.0 user_interaction_required: true environmental_vector_string: string obtain_other_privilege: true availability_impact: complete access_vector: network base_severity: High confidentiality_impact: complete confidentiality_requirement: not_defined report_confidence: not_defined authentication: none base_score: 10.0 obtain_user_privilege: true obtain_all_privilege: true collateral_damage_potential: not_defined remediation_level: not_defined vector_string: string integrity_requirement: not_defined cvss_v3: type: object properties: vector_string: type: string example: string description: a text representation of a set of CVSSv3 metrics. It is commonly used to record or transfer CVSSv3 metric information in a concise form base_score: type: number format: double example: 10.0 description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v3-1' base_severity: type: string enum: - critical - high - low - medium - none example: critical impact_score: type: number format: double example: 10.0 description: a Score number from 0 to 10 exploitability_score: type: number format: double example: 10.0 description: a Score number from 0 to 10 attack_vector: type: string enum: - adjacent_network - local - network - physical example: adjacent_network description: Reflects the context by which vulnerability exploitation is possible modified_attack_vector: type: string enum: - adjacent_network - local - network - not_defined - physical example: not_defined description: modified attack vector attack_complexity: type: string enum: - high - low example: high description: describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability modified_attack_complexity: type: string enum: - high - low - not_defined example: not_defined description: modified attack complexity privileges_required: type: string enum: - high - low - none example: high description: describes the level of privileges an attacker must possess before successfully exploiting the vulnerability modified_privileges_required: type: string enum: - high - low - none - not_defined example: not_defined description: modified privileges required user_interaction: type: string enum: - none - required example: none description: captures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerable component modified_user_interaction: type: string enum: - none - not_defined - required example: none description: modified user interaction scope: type: string enum: - changed - unchanged example: changed description: the ability for a vulnerability in one software component to impact resources beyond its means, or privileges modified_scope: type: string enum: - changed - not_defined - unchanged example: not_defined description: modified scope confidentiality_impact: type: string enum: - high - low - none example: high description: measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability modified_confidentiality_impact: type: string enum: - high - low - none - not_defined example: not_defined description: modified confidentiality impact integrity_impact: type: string enum: - high - low - none example: high description: measures the impact to integrity of a successfully exploited vulnerability modified_integrity_impact: type: string enum: - high - low - none - not_defined example: not_defined description: modified integrity impact availability_impact: type: string enum: - high - low - none example: high description: measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability modified_availability_impact: type: string enum: - high - low - none - not_defined example: not_defined description: modified availability impact exploit_code_maturity: type: string enum: - functional - high - not_defined - proof_of_concept - unproven example: functional description: measures the likelihood of the vulnerability being attacked remediation_level: type: string enum: - high - not_defined - offical_fix - temporary_fix - unavailable - workaround example: high description: Remediation Level of a vulnerability is an important factor for prioritization report_confidence: type: string enum: - confirmed - reasonable - unknown example: confirmed description: measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details temporal_score: type: number format: double example: 10.0 description: Round up(CVSSv3BaseScore × CVSSv3ExploitCodeMaturity × CVSSv3RemediationLevel × CVSSv3ReportConfidence) temporal_severity: type: string enum: - critical - high - low - medium - none example: critical description: temporal severity availability_requirement: type: string enum: - high - low - none - not_defined example: high description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).' confidentiality_requirement: type: string enum: - high - low - none - not_defined example: high description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).' integrity_requirement: type: string enum: - high - low - none - not_defined example: high description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).' environmental_score: type: number format: double example: 10.0 description: a Score number from 0 to 10 environmental_severity: type: string enum: - critical - high - low - medium - none example: critical required: - vector_string - base_score - base_severity example: integrity_impact: high modified_user_interaction: none modified_scope: not_defined availability_requirement: high user_interaction: none modified_integrity_impact: not_defined privileges_required: high exploitability_score: 10.0 impact_score: 10.0 environmental_severity: critical modified_availability_impact: not_defined availability_impact: high scope: changed exploit_code_maturity: functional modified_attack_complexity: not_defined base_severity: critical confidentiality_impact: high temporal_severity: critical modified_confidentiality_impact: not_defined confidentiality_requirement: high report_confidence: confirmed temporal_score: 10.0 modified_privileges_required: not_defined modified_attack_vector: not_defined base_score: 10.0 environmental_score: 10.0 remediation_level: high vector_string: string integrity_requirement: high attack_vector: adjacent_network attack_complexity: high example: cvss_v2: integrity_impact: complete target_distribution: not_defined availability_requirement: not_defined exploitability: not_defined access_complexity: low temporal_vector_string: string exploitability_score: 10.0 impact_score: 10.0 user_interaction_required: true environmental_vector_string: string obtain_other_privilege: true availability_impact: complete access_vector: network base_severity: High confidentiality_impact: complete confidentiality_requirement: not_defined report_confidence: not_defined authentication: none base_score: 10.0 obtain_user_privilege: true obtain_all_privilege: true collateral_damage_potential: not_defined remediation_level: not_defined vector_string: string integrity_requirement: not_defined cvss_v3: integrity_impact: high modified_user_interaction: none modified_scope: not_defined availability_requirement: high user_interaction: none modified_integrity_impact: not_defined privileges_required: high exploitability_score: 10.0 impact_score: 10.0 environmental_severity: critical modified_availability_impact: not_defined availability_impact: high scope: changed exploit_code_maturity: functional modified_attack_complexity: not_defined base_severity: critical confidentiality_impact: high temporal_severity: critical modified_confidentiality_impact: not_defined confidentiality_requirement: high report_confidence: confirmed temporal_score: 10.0 modified_privileges_required: not_defined modified_attack_vector: not_defined base_score: 10.0 environmental_score: 10.0 remediation_level: high vector_string: string integrity_requirement: high attack_vector: adjacent_network attack_complexity: high description: "Describes the potential impact of a vulnerability that is being tracked in the system. Provides information on the extent of damage that a vulnerability can cause and how serious the consequences could be if it is exploited. \n\nMay contain granular information about the vulnerability severity using the CVSS system, versions 2 and 3.\n\nCVSSv2 and CVSSv3 have different methods of calculating base scores, but both are designed to provide an indication of the level of risk that a vulnerability poses. The base score ranges from 0 to 10, with 10 being the most severe. Additionally, both CVSSv2 and CVSSv3 define severity levels, such as low, medium, high, and critical, based on the base score." configurations: type: object properties: CVE_data_version: type: string example: string description: Specifies the version of the CVE (Common Vulnerabilities and Exposures) dictionary used by the vulnerability information provider. nodes: type: array items: type: object properties: operator: type: string enum: - AND - OR example: AND description: The operator string influences how seqs of cpe matches are related to one another. cpe_match: type: array items: type: object properties: vulnerable: type: boolean example: true cpe23Uri: type: string example: string description: A text representation of a software or hardware platform. versionStartIncluding: type: string example: string description: A string representing the lower bound(inclusive) of version in the CPE. versionEndIncluding: type: string example: string description: A string representing the upper bound(inclusive) of version in the CPE. versionStartExcluding: type: string example: string description: A string representing the lower bound(exclusive) of version in the CPE. versionEndExcluding: type: string example: string description: A string representing the upper bound(exclusive) of version in the CPE. required: - vulnerable - cpe23Uri example: vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string example: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string children: type: array items: type: object properties: operator: type: string enum: - AND - OR example: AND description: The operator string influences how seqs of cpe matches are related to one another. cpe_match: type: array items: type: object properties: vulnerable: type: boolean example: true cpe23Uri: type: string example: string description: A text representation of a software or hardware platform. versionStartIncluding: type: string example: string description: A string representing the lower bound(inclusive) of version in the CPE. versionEndIncluding: type: string example: string description: A string representing the upper bound(inclusive) of version in the CPE. versionStartExcluding: type: string example: string description: A string representing the lower bound(exclusive) of version in the CPE. versionEndExcluding: type: string example: string description: A string representing the upper bound(exclusive) of version in the CPE. required: - vulnerable - cpe23Uri example: vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string example: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: type: boolean example: true description: Negates operator when true. required: - operator - cpe_match example: operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true example: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true negate: type: boolean example: true description: Negates operator when true. required: - operator example: operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string children: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true negate: true example: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string children: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true negate: true description: Each `node` in the CTIM standard configuration includes information such as the `operator` (such as "less than", or "greater than or equal to"), and the `cpe` (Common Platform Enumeration) string which identifies the specific software, `CPE` is a structured naming scheme for IT systems, platforms, and software packages, and it is instrumental in enabling data exchange between different systems. required: - CVE_data_version - nodes example: CVE_data_version: string nodes: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string children: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true negate: true description: "Represents a list of affected versions or configurations of a software component that is impacted by a vulnerability. \nBy tracking the affected software components and versions, defenders can identify which systems are potentially exposed to an attack, and apply appropriate mitigations." published_date: type: string format: date-time example: '2016-01-01T01:01:01Z' description: "Represents the date when a vulnerability was publicly disclosed or made available to the general public. \n\nImportant for tracking the age of a vulnerability, as well as for determining when a particular vulnerability was first introduced into a system. The published date can be used to identify the time window during which a system may have been vulnerable to a particular exploit.\n\nFor example, if an organization discovers that a vulnerability was published before their system's installation date, but they did not apply the necessary security updates in a timely manner, it can be concluded that their system was vulnerable for the period between the installation date and the date when the necessary security updates were applied." last_modified_date: type: string format: date-time example: '2016-01-01T01:01:01Z' description: 'Represents the date when the vulnerability metadata was last updated in the internal database. It can be used to track the freshness of the vulnerability information. If the `last_modified_date` is more recent than the `published_date`, it can indicate that there has been some new information or updates related to the vulnerability, such as new patch releases or changes in the severity or impact rating.' required: - description example: description: string schema_version: 1.3.30 revision: 10 published_date: '2016-01-01T01:01:01Z' cve: cve_data_meta: id: string assigner: string configurations: CVE_data_version: string nodes: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string children: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true negate: true type: vulnerability source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' last_modified_date: '2016-01-01T01:01:01Z' impact: cvss_v2: integrity_impact: complete target_distribution: not_defined availability_requirement: not_defined exploitability: not_defined access_complexity: low temporal_vector_string: string exploitability_score: 10.0 impact_score: 10.0 user_interaction_required: true environmental_vector_string: string obtain_other_privilege: true availability_impact: complete access_vector: network base_severity: High confidentiality_impact: complete confidentiality_requirement: not_defined report_confidence: not_defined authentication: none base_score: 10.0 obtain_user_privilege: true obtain_all_privilege: true collateral_damage_potential: not_defined remediation_level: not_defined vector_string: string integrity_requirement: not_defined cvss_v3: integrity_impact: high modified_user_interaction: none modified_scope: not_defined availability_requirement: high user_interaction: none modified_integrity_impact: not_defined privileges_required: high exploitability_score: 10.0 impact_score: 10.0 environmental_severity: critical modified_availability_impact: not_defined availability_impact: high scope: changed exploit_code_maturity: functional modified_attack_complexity: not_defined base_severity: critical confidentiality_impact: high temporal_severity: critical modified_confidentiality_impact: not_defined confidentiality_requirement: high report_confidence: confirmed temporal_score: 10.0 modified_privileges_required: not_defined modified_attack_vector: not_defined base_score: 10.0 environmental_score: 10.0 remediation_level: high vector_string: string integrity_requirement: high attack_vector: adjacent_network attack_complexity: high description: For submitting a new vulnerability. uniqueItems: true example: - description: string schema_version: 1.3.30 revision: 10 published_date: '2016-01-01T01:01:01Z' cve: cve_data_meta: id: string assigner: string configurations: CVE_data_version: string nodes: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string children: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true negate: true type: vulnerability source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' last_modified_date: '2016-01-01T01:01:01Z' impact: cvss_v2: integrity_impact: complete target_distribution: not_defined availability_requirement: not_defined exploitability: not_defined access_complexity: low temporal_vector_string: string exploitability_score: 10.0 impact_score: 10.0 user_interaction_required: true environmental_vector_string: string obtain_other_privilege: true availability_impact: complete access_vector: network base_severity: High confidentiality_impact: complete confidentiality_requirement: not_defined report_confidence: not_defined authentication: none base_score: 10.0 obtain_user_privilege: true obtain_all_privilege: true collateral_damage_potential: not_defined remediation_level: not_defined vector_string: string integrity_requirement: not_defined cvss_v3: integrity_impact: high modified_user_interaction: none modified_scope: not_defined availability_requirement: high user_interaction: none modified_integrity_impact: not_defined privileges_required: high exploitability_score: 10.0 impact_score: 10.0 environmental_severity: critical modified_availability_impact: not_defined availability_impact: high scope: changed exploit_code_maturity: functional modified_attack_complexity: not_defined base_severity: critical confidentiality_impact: high temporal_severity: critical modified_confidentiality_impact: not_defined confidentiality_requirement: high report_confidence: confirmed temporal_score: 10.0 modified_privileges_required: not_defined modified_attack_vector: not_defined base_score: 10.0 environmental_score: 10.0 remediation_level: high vector_string: string integrity_requirement: high attack_vector: adjacent_network attack_complexity: high description: a list of `NewVulnerability`s. actor_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string asset_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string asset_mapping_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string asset_properties_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string attack_pattern_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string campaign_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string coa_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string feedback_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string identity_assertion_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string incident_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string indicator_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string judgement_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string malware_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string note_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string relationship_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string sighting_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string target_record_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string tool_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string verdict_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string data_table_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string weakness_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string vulnerability_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. required: - source example: description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' asset_mapping_refs: - string note_refs: - string data_table_refs: - string attack_pattern_refs: - string sighting_refs: - string schema_version: 1.3.30 revision: 10 assets: - description: string asset_type: application valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 type: asset source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' weakness_refs: - string tool_refs: - string target_record_refs: - string asset_refs: - string tools: - description: string labels: - credential-exploitation schema_version: 1.3.30 revision: 10 type: tool x_mitre_aliases: - string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tool_version: string tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string timestamp: '2016-01-01T01:01:01Z' indicators: - description: string tags: - string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' producer: string schema_version: 1.3.30 revision: 10 type: indicator test_mechanisms: - string source: string external_ids: - string short_description: string composite_indicator_expression: operator: and indicator_ids: - string title: string likely_impact: string indicator_type: - Anonymization external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string severity: Critical tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string negate: true timestamp: '2016-01-01T01:01:01Z' confidence: High specification: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string attack_patterns: - description: string abstraction_level: aggregate schema_version: 1.3.30 revision: 10 type: attack-pattern source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string x_mitre_platforms: - string language: string id: string tlp: green x_mitre_data_sources: - string kill_chain_phases: - kill_chain_name: string phase_name: string x_mitre_contributors: - string timestamp: '2016-01-01T01:01:01Z' type: bundle weaknesses: - description: string background_details: string paradigms: - prevalence: Often name: string abstraction_level: Base architectures: - prevalence: Often name: string class: Embedded schema_version: 1.3.30 revision: 10 alternate_terms: - term: string description: string likelihood: High type: weakness source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string functional_areas: - Authentication source_uri: string modes_of_introduction: - phase: Architecture and Design note: string structure: Chain language: string id: string notes: - type: Applicable Platform note: string common_consequences: - scopes: - Access Control impacts: - Alter Execution Logic likelihood: High note: string tlp: green detection_methods: - method: Architecture or Design Review description: string effectiveness: High effectiveness_notes: string operating_systems: - prevalence: Often name: string version: string cpe_id: string class: Android affected_resources: - CPU languages: - prevalence: Often name: string class: Assembly timestamp: '2016-01-01T01:01:01Z' potential_mitigations: - description: string phases: - Architecture and Design strategy: Attack Surface Reduction effectiveness: Defense in Depth effectiveness_notes: string technologies: - prevalence: Often name: string source: string external_ids: - string feedback_refs: - string asset_properties: - properties: - name: string value: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 asset_ref: string type: asset-properties source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' short_description: string feedbacks: - feedback: -1 schema_version: 1.3.30 revision: 10 type: feedback source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string reason: string source_uri: string language: string id: string tlp: green entity_id: string timestamp: '2016-01-01T01:01:01Z' judgement_refs: - string title: string coa_refs: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string verdicts: - type: verdict disposition: 1 observable: value: 1.2.3.4 type: ip judgement_id: string disposition_name: Clean valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' campaigns: - description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 type: campaign campaign_type: string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string activity: - date_time: '2016-01-01T01:01:01Z' description: string source_uri: string intended_effect: - Account Takeover status: Future language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' confidence: High names: - string source_uri: string actors: - description: string motivation: Ego valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' identity: description: string related_identities: - identity: string confidence: High information_source: string relationship: string sophistication: Aspirant schema_version: 1.3.30 revision: 10 planning_and_operational_support: string type: actor source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string intended_effect: Account Takeover language: string id: string tlp: green aliases: - string timestamp: '2016-01-01T01:01:01Z' confidence: High actor_types: - Cyber Espionage Operations indicator_refs: - string actor_refs: - string language: string data_tables: - description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 columns: - name: string type: integer description: string required: true short_description: string type: data-table source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string rows: - - anything source_uri: string language: string id: string tlp: green row_count: 10 timestamp: '2016-01-01T01:01:01Z' id: string notes: - schema_version: 1.3.30 revision: 10 content: string note_class: keyword type: note source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string author: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' related_entities: - entity_type: string entity_id: string identity_assertions: - valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' identity: observables: - value: 1.2.3.4 type: ip schema_version: 1.3.30 revision: 10 type: identity-assertion source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' assertions: - name: cisco:ctr:ad:host_domain_name value: string judgements: - valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 observable: value: 1.2.3.4 type: ip reason_uri: string type: judgement source: string external_ids: - string disposition: 1 external_references: - source_name: string description: string url: string hashes: - string external_id: string reason: string source_uri: string disposition_name: Clean priority: 10 language: string id: string severity: Critical tlp: green timestamp: '2016-01-01T01:01:01Z' confidence: High malwares: - description: string labels: - adware abstraction_level: family schema_version: 1.3.30 revision: 10 type: malware x_mitre_aliases: - string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string timestamp: '2016-01-01T01:01:01Z' target_records: - description: string schema_version: 1.3.30 revision: 10 type: target-record source: string external_ids: - string targets: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string internal: false sensor: string source_uri: string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' asset_mappings: - asset_type: application valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' stability: Managed schema_version: 1.3.30 revision: 10 observable: value: 1.2.3.4 type: ip asset_ref: string type: asset-mapping source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' specificity: Low confidence: High relationship_refs: - string tlp: green incidents: - description: string assignees: - string detection_sources: - string meta: keyword: string schema_version: 1.3.30 revision: 10 type: incident source: string external_ids: - string short_description: string title: string incident_time: opened: '2016-01-01T01:01:01Z' discovered: '2016-01-01T01:01:01Z' reported: '2016-01-01T01:01:01Z' remediated: '2016-01-01T01:01:01Z' closed: '2016-01-01T01:01:01Z' rejected: '2016-01-01T01:01:01Z' contained: '2016-01-01T01:01:01Z' external_references: - source_name: string description: string url: string hashes: - string external_id: string discovery_method: Agent Disclosure source_uri: string intended_effect: Account Takeover categories: - Attrition status: Closed language: string detection_status: active id: string promotion_method: Automated severity: Critical tlp: green scores: asset: 10.0 techniques: - string timestamp: '2016-01-01T01:01:01Z' confidence: High short_id: string tactics: - string identity_assertion_refs: - string sightings: - description: string schema_version: 1.3.30 revision: 10 relations: - origin: string origin_uri: string relation: Allocated relation_info: keyword: anything source: value: 1.2.3.4 type: ip related: value: 1.2.3.4 type: ip sensor_coordinates: type: endpoint observables: - value: 1.2.3.4 type: ip os: string observables: - value: 1.2.3.4 type: ip type: sighting source: string external_ids: - string targets: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string short_description: string title: string resolution: detected internal: false external_references: - source_name: string description: string url: string hashes: - string external_id: string detection_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' source_uri: string activity_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' language: string id: string count: 10 severity: Critical tlp: green modification_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' context: http_events: - process_guid: 10 traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 method: CONNECT time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: HTTPEvent host: string process_name: string process_id: 10 process_username: string query: string encrypted: true url_port: 10 process_create_events: - parent_process_name: string process_guid: 10 parent_process_guid: 10 process_disposition: string parent_process_size: 10 process_size: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_disposition: string type: ProcessCreateEvent parent_process_username: string parent_process_id: 10 parent_process_args: string process_name: string process_hash: string process_id: 10 parent_process_hash: string process_username: string parent_creation_time: '2016-01-01T01:01:01Z' process_args: string registry_delete_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryDeleteEvent registry_value: string file_modify_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileModifyEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_set_events: - process_guid: 10 registry_data: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: RegistrySetEvent registry_data_length: 10 registry_value: string registry_key: string process_name: string process_id: 10 process_username: string file_create_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileCreateEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_create_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryCreateEvent library_load_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string type: LibraryLoadEvent dll_library_name: string dll_library_path: string file_move_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileMoveEvent old_name: string file_path: string process_name: string process_id: 10 process_username: string new_name: string file_delete_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileDeleteEvent file_path: string process_name: string process_id: 10 process_username: string failed: false netflow_events: - parent_process_name: string byte_count_in: 10 process_guid: 10 process_path: string traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 flow_time: '2016-01-01T01:01:01Z' time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_account: string type: NetflowEvent process_account_type: string parent_process_path: string parent_process_id: 10 parent_process_args: string process_name: string process_account: string parent_process_account_type: string process_hash: string process_id: 10 parent_process_hash: string process_username: string byte_count_out: 10 process_args: string registry_rename_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryRenameEvent registry_old_key: string timestamp: '2016-01-01T01:01:01Z' confidence: High observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' sensor: endpoint data: columns: - name: string type: integer description: string required: true short_description: string rows: - - anything row_count: 10 campaign_refs: - string vulnerability_refs: - string asset_properties_refs: - string relationships: - description: string schema_version: 1.3.30 revision: 10 target_ref: string type: relationship source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string source_ref: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' relationship_type: attributed-to timestamp: '2016-01-01T01:01:01Z' verdict_refs: - string malware_refs: - string incident_refs: - string vulnerabilities: - description: string schema_version: 1.3.30 revision: 10 published_date: '2016-01-01T01:01:01Z' cve: cve_data_meta: id: string assigner: string configurations: CVE_data_version: string nodes: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string children: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true negate: true type: vulnerability source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' last_modified_date: '2016-01-01T01:01:01Z' impact: cvss_v2: integrity_impact: complete target_distribution: not_defined availability_requirement: not_defined exploitability: not_defined access_complexity: low temporal_vector_string: string exploitability_score: 10.0 impact_score: 10.0 user_interaction_required: true environmental_vector_string: string obtain_other_privilege: true availability_impact: complete access_vector: network base_severity: High confidentiality_impact: complete confidentiality_requirement: not_defined report_confidence: not_defined authentication: none base_score: 10.0 obtain_user_privilege: true obtain_all_privilege: true collateral_damage_potential: not_defined remediation_level: not_defined vector_string: string integrity_requirement: not_defined cvss_v3: integrity_impact: high modified_user_interaction: none modified_scope: not_defined availability_requirement: high user_interaction: none modified_integrity_impact: not_defined privileges_required: high exploitability_score: 10.0 impact_score: 10.0 environmental_severity: critical modified_availability_impact: not_defined availability_impact: high scope: changed exploit_code_maturity: functional modified_attack_complexity: not_defined base_severity: critical confidentiality_impact: high temporal_severity: critical modified_confidentiality_impact: not_defined confidentiality_requirement: high report_confidence: confirmed temporal_score: 10.0 modified_privileges_required: not_defined modified_attack_vector: not_defined base_score: 10.0 environmental_score: 10.0 remediation_level: high vector_string: string integrity_requirement: high attack_vector: adjacent_network attack_complexity: high coas: - description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' stage: Containment schema_version: 1.3.30 revision: 10 efficacy: High type: coa related_COAs: - confidence: High source: string relationship: string COA_id: string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string coa_type: Diplomatic Actions language: string id: string tlp: green objective: - string cost: High timestamp: '2016-01-01T01:01:01Z' open_c2_coa: type: structured_coa id: string action: type: alert target: type: acudid specifiers: string actuator: type: endpoint specifiers: - string modifiers: response: acknowledge method: - acl additional_properties: context: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' frequency: string duration: '2016-01-01T01:01:01Z' source: string search: cve option: string id: string location: internal delay: '2016-01-01T01:01:01Z' destination: copy-to structured_coa_type: openc2 impact: string description: Describes a Bundle of any set of CTIM entities. investigated_observables: type: array items: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. source: title: InvestigationSource description: String with at most 1024 characters. type: string example: Cisco XDR Automated Question title: title: InvestigationTitle description: String with at most 1024 characters. type: string example: Which devices in my org was this sha seen on? description: title: InvestigationDescription description: String with at most 5000 characters. type: string example: 'For the following hashes: - sha256:defg...1234 - sha256:abcd..1234 Determine which devices in my org have instances of the file in the past 30 days' required: - bundle application/edn: schema: type: object properties: bundle: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - bundle example: bundle description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. actors: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - actor example: actor description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Indicates the time span for which the information about the Actor is relevant, and after which it could become outdated. actor_types: type: array items: type: string example: Cyber Espionage Operations example: - Cyber Espionage Operations identity: type: object properties: description: type: string example: string description: Markdown string with at most 5000 characters. related_identities: type: array items: type: object properties: identity: type: string example: string description: The reference (URI) of the related Identity object. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: Specifies the level of confidence in the assertion of the relationship between the two objects. information_source: type: string example: string description: Specifies the source of the information about the relationship between the two components. relationship: type: string example: string required: - identity example: identity: string confidence: High information_source: string relationship: string description: Describes a related Identity example: - identity: string confidence: High information_source: string relationship: string description: Identifies other entity Identities related to this Identity. required: - description - related_identities example: description: string related_identities: - identity: string confidence: High information_source: string relationship: string description: Can contain information such as the name of the attacker, the group or organization they belong to, or any other identifier that can help in the attribution process. motivation: type: string example: Ego description: The reason or purpose behind the malicious activity attributed to this Actor. By understanding a threat actor's motivation, analysts can better predict the attacker's behavior and anticipate future malicious actions. sophistication: type: string enum: - Aspirant - Expert - Innovator - Novice - Practitioner example: Aspirant description: "Represents the level of expertise and skill that the threat actor has displayed in their malicious activities. Can help security analysts assess the potential impact of an attacker's TTPs and determine the potential attack surface. \n\nFor example, a threat actor with a low sophistication level may primarily rely on off-the-shelf malware and attack tools, while an attacker with high sophistication may use custom tools with advanced evasion techniques, zero-day exploits, and sophisticated methods for command and control of their malware. \n\nThe sophistication level of an attacker can also be inferred based on several factors such as the complexity of attacks, the attacker's knowledge of the targeted organization's systems, and the attacker's ability to remain undetected.\n\nIf an attacker shows a high level of sophistication in reconnaissances, social engineering, and phishing, then the attacker may have a good knowledge of the targeted organization and its employees. This means that the attacker may be more successful in infiltrating the organization's network and compromising its systems." intended_effect: type: string example: Account Takeover description: "Represents the desired outcome or impact the threat actor is trying to achieve through their malicious activities. \n\n Helps security analysts to understand the attacker's goals beyond the immediate impact of the attack. By understanding the intended effect, analysts can draw connections between seemingly unrelated attacks and build a more complete understanding of an attacker's long-term goals and motivations." planning_and_operational_support: type: string example: string description: "Provides information about the resources and capabilities of the attacker that could be used to assist in planning and operations related to the threat.\n\n It can be used to describe Infrastructure, Tools, Techniques, and Capabilities used by the threat actor." confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: 'This field can help analysts decide how much trust they can put in the information provided by the threat intelligence sources. For example, an Actor entity can have high confidence if the organization''s security researchers have been tracking it for a long time and have gathered a significant amount of intelligence about it through various sources, such as analysis of malware, network traffic, and human intelligence. In contrast, low confidence may indicate the organization has only seen limited or circumstantial evidence.' aliases: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: A list of other names that this Threat Actor is believed to use. required: - source - title - description - short_description example: description: string motivation: Ego valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' identity: description: string related_identities: - identity: string confidence: High information_source: string relationship: string sophistication: Aspirant schema_version: 1.3.30 revision: 10 planning_and_operational_support: string type: actor source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string intended_effect: Account Takeover language: string id: string tlp: green aliases: - string timestamp: '2016-01-01T01:01:01Z' confidence: High actor_types: - Cyber Espionage Operations description: Schema for submitting new Actors uniqueItems: true example: - description: string motivation: Ego valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' identity: description: string related_identities: - identity: string confidence: High information_source: string relationship: string sophistication: Aspirant schema_version: 1.3.30 revision: 10 planning_and_operational_support: string type: actor source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string intended_effect: Account Takeover language: string id: string tlp: green aliases: - string timestamp: '2016-01-01T01:01:01Z' confidence: High actor_types: - Cyber Espionage Operations description: a list of `NewActor`s. assets: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - asset example: asset description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: 'Specifies the time range during which the asset is considered valid or accurate. For example, if an asset entity represents a device, the `valid_time` field could be used to indicate the period during which the device''s configuration information is deemed accurate.' asset_type: type: string enum: - application - data - device - network - person example: application description: 'Type of the Asset: Device, Person, Application, etc.' required: - source - valid_time - asset_type example: description: string asset_type: application valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 type: asset source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' description: Schema for submitting new Assets uniqueItems: true example: - description: string asset_type: application valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 type: asset source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' description: a list of `NewAsset`s. asset_mappings: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - asset-mapping example: asset-mapping description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: For each asset, we allow for the assertion of time bound properties.This gives us both a record of the current state of the asset,as well as history. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: 'Level of confidence held in the characterization of this AssetMapping e.g.: is it susceptible to manipulation or translation?' specificity: type: string enum: - Low - Medium - Unique example: Low description: Denotes the level of how many assets potentially could have this same identifier. stability: type: string enum: - Managed - Physical - Temporary example: Managed description: Do we manage when it changes, or is it always a time bound assignment? observable: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: An AssetMapping is a record that a specific Observable maps to an Asset for an indicated period of time. asset_ref: type: string example: string description: URI that points to the mapped Asset. asset_type: type: string enum: - application - data - device - network - person example: application description: 'Type of the mapped Asset: Device, Person, Application, etc.' required: - source - valid_time - confidence - specificity - stability - observable - asset_ref - asset_type example: asset_type: application valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' stability: Managed schema_version: 1.3.30 revision: 10 observable: value: 1.2.3.4 type: ip asset_ref: string type: asset-mapping source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' specificity: Low confidence: High description: Schema for submitting new AssetMapping. uniqueItems: true example: - asset_type: application valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' stability: Managed schema_version: 1.3.30 revision: 10 observable: value: 1.2.3.4 type: ip asset_ref: string type: asset-mapping source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' specificity: Low confidence: High description: a list of `NewAssetMapping`s. asset_properties: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - asset-properties example: asset-properties description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time range during which the AssetProperties is considered valid. asset_ref: type: string example: string description: URI that points to the associated Asset. properties: type: array items: type: object properties: name: type: string example: string description: The properties are an open vocabulary. value: type: string example: string required: - name - value example: name: string value: string example: - name: string value: string required: - source - valid_time - asset_ref example: properties: - name: string value: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 asset_ref: string type: asset-properties source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' description: Schema for submitting new AssetProperties uniqueItems: true example: - properties: - name: string value: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 asset_ref: string type: asset-properties source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' description: a list of `NewAssetProperties`s. attack_patterns: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - attack-pattern example: attack-pattern description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. kill_chain_phases: type: array items: type: object properties: kill_chain_name: type: string example: string description: The name of the kill chain. phase_name: type: string example: string description: The name of the phase in the kill chain. required: - kill_chain_name - phase_name example: kill_chain_name: string phase_name: string description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives. example: - kill_chain_name: string phase_name: string description: A kill chain is a series of steps that an attacker must go through to successfully achieve their objective. The concept was originally developed by the military, but has been adapted to the cybersecurity field to describe the steps an attacker goes through to compromise a target system and achieve their goal. x_mitre_data_sources: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: ATT&CK Technique.Data Sources. x_mitre_platforms: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: ATT&CK Technique.Platforms. x_mitre_contributors: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: ATT&CK Technique.Contributors. abstraction_level: type: string enum: - aggregate - category - detailed - meta - standard example: aggregate description: The CAPEC abstraction level for patterns describing techniques to attack a system. required: - title - description - short_description example: description: string abstraction_level: aggregate schema_version: 1.3.30 revision: 10 type: attack-pattern source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string x_mitre_platforms: - string language: string id: string tlp: green x_mitre_data_sources: - string kill_chain_phases: - kill_chain_name: string phase_name: string x_mitre_contributors: - string timestamp: '2016-01-01T01:01:01Z' description: For submitting a new AttackPattern uniqueItems: true example: - description: string abstraction_level: aggregate schema_version: 1.3.30 revision: 10 type: attack-pattern source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string x_mitre_platforms: - string language: string id: string tlp: green x_mitre_data_sources: - string kill_chain_phases: - kill_chain_name: string phase_name: string x_mitre_contributors: - string timestamp: '2016-01-01T01:01:01Z' description: a list of `NewAttackPattern`s. campaigns: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - campaign example: campaign description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Timestamp for the definition of a specific version of a campaign. campaign_type: type: string example: string description: 'String value that describes the type of campaign. For example, a campaign type could be ''Ransomware'', ''Advanced Persistent Threat'', ''Business Email Compromise'', ''Phishing'', etc. ' names: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: Used to capture alternate names or aliases associated with the campaign. A cyberattack campaign may have multiple names or aliases depending on the group or actor(s) behind the attack, e.g., 'Wannacry' is also known as 'WannaCrypt', 'WCry', 'Wanna Decryptor', etc. intended_effect: type: array items: type: string example: Account Takeover example: - Account Takeover description: Characterizes the intended effect of this cyber threat campaign. status: type: string enum: - Future - Historic - Ongoing example: Future description: "Indicates current Status of the Campaign. \n\nCan have one of the following values: \n\n- Ongoing: Indicates that the campaign is currently active and ongoing. For example, a mass phishing campaign that is actively targeting users is considered 'ongoing'.\n\n- Historic: Campaign has already occurred and is now in the past.\n\n- Future: This indicates that a campaign is planned or expected to occur in the future. For example, a threat actor may announce their intention to launch a specific cyberattack campaign at a future date." confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: Level of confidence held in the characterization of this Campaign. activity: type: array items: type: object properties: date_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Specifies the date and time at which the activity occured. description: type: string example: string description: A description of the activity. required: - date_time - description example: date_time: '2016-01-01T01:01:01Z' description: string description: Captures the specific activities or tactics associated with the entity. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc. example: - date_time: '2016-01-01T01:01:01Z' description: string description: 'Used to capture specific activities or tactics associated with the campaign. The ''activity'' field is an array of objects, and each element represents a specific activity and time associated with the campaign. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc. By capturing these activities analysts can identify the specific tactics used by the threat actor(s) behind the campaign.' required: - title - description - short_description - campaign_type example: description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 type: campaign campaign_type: string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string activity: - date_time: '2016-01-01T01:01:01Z' description: string source_uri: string intended_effect: - Account Takeover status: Future language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' confidence: High names: - string description: Schema for submitting new Campaigns uniqueItems: true example: - description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 type: campaign campaign_type: string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string activity: - date_time: '2016-01-01T01:01:01Z' description: string source_uri: string intended_effect: - Account Takeover status: Future language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' confidence: High names: - string description: a list of `NewCampaign`s. coas: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - coa example: coa description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. stage: type: string enum: - Containment - Eradication - Identification - Lessons Learned - Preparation - Recovery - Remedy - Response example: Containment description: Specifies what stage in the cyber threat management lifecycle this Course Of Action is relevant to. coa_type: type: string enum: - Diplomatic Actions - Eradication - Hardening - Internal Blocking - Logical Access Restrictions - Monitoring - Other - Patching - Perimeter Blocking - Phase - Physical Access Restrictions - Playbook - Policy Actions - Public Disclosure - Rebuilding - Redirection - Redirection (Honey Pot) - Task - Training example: Diplomatic Actions description: The type of this COA objective: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: Characterizes the objective to provide guidance on how to mitigate a security incident that has been identified. impact: type: string example: string description: Characterizes the estimated impact of applying this course of action. cost: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: Characterizes the estimated cost for applying this course of action. efficacy: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: Effectiveness of this course of action in achieving its targeted objective. related_COAs: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string COA_id: type: string example: string description: A URI leading to a COA. required: - COA_id example: confidence: High source: string relationship: string COA_id: string example: - confidence: High source: string relationship: string COA_id: string description: Identifies or characterizes relationships to one or more related courses of action. structured_coa_type: type: string enum: - openc2 example: openc2 open_c2_coa: type: object properties: type: type: string enum: - structured_coa example: structured_coa id: type: string example: string description: String with at most 1024 characters. action: type: object properties: type: type: string enum: - alert - allow - augment - contain - delete - deny - detonate - distill - get - investigate - locate - mitigate - modify - move - notify - other - pause - query - redirect - remediate - report - response - restart - restore - resume - save - scan - set - snapshot - start - stop - substitute - sync - throttle - update example: alert required: - type example: type: alert target: type: object properties: type: type: string example: acudid specifiers: type: string example: string description: Observable types that can be acted upon. required: - type example: type: acudid specifiers: string actuator: type: object properties: type: type: string enum: - endpoint - endpoint.digital-telephone-handset - endpoint.laptop - endpoint.pos-terminal - endpoint.printer - endpoint.sensor - endpoint.server - endpoint.smart-meter - endpoint.smart-phone - endpoint.tablet - endpoint.workstation - network - network.bridge - network.firewall - network.gateway - network.guard - network.hips - network.hub - network.ids - network.ips - network.modem - network.nic - network.proxy - network.router - network.security_manager - network.sense_making - network.sensor - network.switch - network.vpn - network.wap - other - process - process.aaa-server - process.anti-virus-scanner - process.connection-scanner - process.directory-service - process.dns-server - process.email-service - process.file-scanner - process.location-service - process.network-scanner - process.remediation-service - process.reputation-service - process.sandbox - process.virtualization-service - process.vulnerability-scanner example: endpoint specifiers: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: List of additional properties describing the actuator. required: - type example: type: endpoint specifiers: - string modifiers: type: object properties: delay: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard. duration: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard. frequency: type: string example: string description: String with at most 1024 characters. id: type: string example: string description: String with at most 1024 characters. time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. response: type: string enum: - acknowledge - command-ref - query - status example: acknowledge source: type: string example: string description: String with at most 1024 characters. destination: type: string enum: - copy-to - modify-to - move-to - report-to - restore-point - save-to - set-to example: copy-to method: type: array items: type: string enum: - acl - authenticated - blackhole - blacklist - graceful - hibernate - honeypot - immediate - segmentation - spawn - suspend - unauthenticated - whitelist example: acl example: - acl search: type: string enum: - cve - patch - signature - vendor_bulletin example: cve location: type: string enum: - internal - perimeter example: internal option: type: string example: string description: String with at most 1024 characters. additional_properties: type: object properties: context: type: string example: string description: String with at most 1024 characters. required: - context example: context: string example: response: acknowledge method: - acl additional_properties: context: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' frequency: string duration: '2016-01-01T01:01:01Z' source: string search: cve option: string id: string location: internal delay: '2016-01-01T01:01:01Z' destination: copy-to required: - type - action example: type: structured_coa id: string action: type: alert target: type: acudid specifiers: string actuator: type: endpoint specifiers: - string modifiers: response: acknowledge method: - acl additional_properties: context: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' frequency: string duration: '2016-01-01T01:01:01Z' source: string search: cve option: string id: string location: internal delay: '2016-01-01T01:01:01Z' destination: copy-to example: description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' stage: Containment schema_version: 1.3.30 revision: 10 efficacy: High type: coa related_COAs: - confidence: High source: string relationship: string COA_id: string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string coa_type: Diplomatic Actions language: string id: string tlp: green objective: - string cost: High timestamp: '2016-01-01T01:01:01Z' open_c2_coa: type: structured_coa id: string action: type: alert target: type: acudid specifiers: string actuator: type: endpoint specifiers: - string modifiers: response: acknowledge method: - acl additional_properties: context: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' frequency: string duration: '2016-01-01T01:01:01Z' source: string search: cve option: string id: string location: internal delay: '2016-01-01T01:01:01Z' destination: copy-to structured_coa_type: openc2 impact: string description: Schema for submitting new COAs uniqueItems: true example: - description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' stage: Containment schema_version: 1.3.30 revision: 10 efficacy: High type: coa related_COAs: - confidence: High source: string relationship: string COA_id: string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string coa_type: Diplomatic Actions language: string id: string tlp: green objective: - string cost: High timestamp: '2016-01-01T01:01:01Z' open_c2_coa: type: structured_coa id: string action: type: alert target: type: acudid specifiers: string actuator: type: endpoint specifiers: - string modifiers: response: acknowledge method: - acl additional_properties: context: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' frequency: string duration: '2016-01-01T01:01:01Z' source: string search: cve option: string id: string location: internal delay: '2016-01-01T01:01:01Z' destination: copy-to structured_coa_type: openc2 impact: string description: a list of `NewCOA`s. feedbacks: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - feedback example: feedback description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. entity_id: type: string example: string description: A URI leading to an entity. feedback: type: integer enum: - -1 - 0 - 1 example: -1 reason: type: string example: string required: - entity_id - feedback - reason example: feedback: -1 schema_version: 1.3.30 revision: 10 type: feedback source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string reason: string source_uri: string language: string id: string tlp: green entity_id: string timestamp: '2016-01-01T01:01:01Z' description: Schema for submitting new Feedback. uniqueItems: true example: - feedback: -1 schema_version: 1.3.30 revision: 10 type: feedback source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string reason: string source_uri: string language: string id: string tlp: green entity_id: string timestamp: '2016-01-01T01:01:01Z' description: a list of `NewFeedback`s. incidents: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - incident example: incident description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: 'Represents the level of certainty or trustworthiness associated with the incident. It denotes the reliability of the intelligence associated with the incident. The `confidence` field can take on several values, including: - `info`: Indicates that the incident information is based on sources with no previous track record or there is no track record for the source reporting the incident. - `low`: Indicates that the incident information is based on sources with a questionable track record or there is limited information about the accuracy of the source. - `medium`: Indicates that the incident information is based on sources with a mixed track record or of uncertain reliability. - `high`: Indicates that the incident information is based on sources with a proven track record and high degree of reliability. The `confidence` field can be used to indicate the level of trust and confidence that can be attributed to the incident, and it may impact how the incident is prioritized, analyzed and addressed. It can also help in the decision-making process associated with the incident response activities. It is important to note that the `confidence` field is subjective and can be interpreted differently by different organizations or analysts. As such, it is often used in conjunction with other intelligence attributes, such as the `severity` field, to provide a more complete picture of the incident.' status: type: string enum: - Closed - 'Closed: Confirmed Threat' - 'Closed: False Positive' - 'Closed: Merged' - 'Closed: Near-Miss' - 'Closed: Other' - 'Closed: Suspected' - 'Closed: Under Review' - Containment Achieved - Hold - 'Hold: External' - 'Hold: Internal' - 'Hold: Legal' - Incident Reported - New - 'New: Presented' - 'New: Processing' - Open - 'Open: Contained' - 'Open: Investigating' - 'Open: Recovered' - 'Open: Reported' - Rejected - Restoration Achieved - Stalled example: Closed description: The `status` field represents the current state of an incident within the incident management process. Its values help in tracking and reporting the progress of the incident from its discovery to its resolution. incident_time: type: object properties: opened: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time the incident was first opened. discovered: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time the incident was first discovered. reported: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time the incident was first reported. remediated: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time that the remediation of the damage from the incident was completed. closed: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time that the incident was last closed. rejected: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time that the incident was first rejected. contained: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time that the incident was first contained. required: - opened example: opened: '2016-01-01T01:01:01Z' discovered: '2016-01-01T01:01:01Z' reported: '2016-01-01T01:01:01Z' remediated: '2016-01-01T01:01:01Z' closed: '2016-01-01T01:01:01Z' rejected: '2016-01-01T01:01:01Z' contained: '2016-01-01T01:01:01Z' description: Relevant time values associated with this Incident. meta: type: object additionalProperties: type: string example: string x-anyOf: - type: string example: string - type: number format: double example: 10.0 - type: string format: date-time example: '2016-01-01T01:01:01Z' - type: string example: keyword - type: boolean example: true example: keyword: string description: metadata associated to the incident. properties: {} scores: type: object additionalProperties: type: number format: double example: 10.0 description: A non-negative score number. example: asset: 10.0 description: Used to indicate the severity or impact score of the threat represented by the incident. properties: {} categories: type: array items: type: string example: Attrition example: - Attrition description: A set of categories for this incident. discovery_method: type: string example: Agent Disclosure description: Identifies how the incident was discovered. intended_effect: type: string example: Account Takeover description: Specifies the suspected intended effect of this incident assignees: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: A set of owners assigned to this incident. detection_sources: type: array items: type: string example: string description: String with at most 2048 characters. example: - string description: A set of sources that contributed threat detections to the incident. promotion_method: type: string enum: - Automated - Manual example: Automated description: Describes method for promoting an Incident, whether manually or automatically. An Incident may be created manually by a SOAR analyst or SOC operator, or through an automated correlation or aggregation rule or engine that matches a specific set of events or alerts, and promotes them to Incident(s). detection_status: type: string enum: - active - inactive_expired - inactive_merged - inactive_oversized - inactive_user_closed example: active description: Represents the state of an incident within the incident generation process, indicating whether the incident is actively receiving updates or is no longer being updated. severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown example: Critical description: "Represents the potential impact of an incident on an organization's security posture and business operations. It helps organizations prioritize and allocate resources for incident response based on the severity level of the incident \nIt helps analysts and incident handlers prioritize incidents by indicating the level of risk and potential impact associated with the incident. This enables organizations to allocate resources efficiently and address the most critical incidents first.\nCan also be used to generate reports and metrics for measuring the effectiveness of the incident response process and to identify trends and patterns in the threat landscape.\nIt is important to note that the `severity` field is subjective and can be interpreted differently by different organizations or analysts. Therefore, it should be used in conjunction with other intelligence attributes, such as the `confidence` field, to provide a more comprehensive view of the incident." tactics: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: Represents the offensive techniques, approaches, or procedures that an adversary may use to achieve their objectives during an attack. It helps in understanding the intent and capabilities of the adversary and can be used to identify indicators of attack (IoAs) or indicators of compromise (IoCs) that are associated with the adversary's tactics. techniques: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: Represents the specific methods or actions used by an attacker to carry out an offensive maneuver or achieve their goals. short_id: type: string example: string description: A human-readable, short identifier for the incident, unique within an organization. required: - confidence - status - incident_time example: description: string assignees: - string detection_sources: - string meta: keyword: string schema_version: 1.3.30 revision: 10 type: incident source: string external_ids: - string short_description: string title: string incident_time: opened: '2016-01-01T01:01:01Z' discovered: '2016-01-01T01:01:01Z' reported: '2016-01-01T01:01:01Z' remediated: '2016-01-01T01:01:01Z' closed: '2016-01-01T01:01:01Z' rejected: '2016-01-01T01:01:01Z' contained: '2016-01-01T01:01:01Z' external_references: - source_name: string description: string url: string hashes: - string external_id: string discovery_method: Agent Disclosure source_uri: string intended_effect: Account Takeover categories: - Attrition status: Closed language: string detection_status: active id: string promotion_method: Automated severity: Critical tlp: green scores: asset: 10.0 techniques: - string timestamp: '2016-01-01T01:01:01Z' confidence: High short_id: string tactics: - string description: For submitting a new Incident. uniqueItems: true example: - description: string assignees: - string detection_sources: - string meta: keyword: string schema_version: 1.3.30 revision: 10 type: incident source: string external_ids: - string short_description: string title: string incident_time: opened: '2016-01-01T01:01:01Z' discovered: '2016-01-01T01:01:01Z' reported: '2016-01-01T01:01:01Z' remediated: '2016-01-01T01:01:01Z' closed: '2016-01-01T01:01:01Z' rejected: '2016-01-01T01:01:01Z' contained: '2016-01-01T01:01:01Z' external_references: - source_name: string description: string url: string hashes: - string external_id: string discovery_method: Agent Disclosure source_uri: string intended_effect: Account Takeover categories: - Attrition status: Closed language: string detection_status: active id: string promotion_method: Automated severity: Critical tlp: green scores: asset: 10.0 techniques: - string timestamp: '2016-01-01T01:01:01Z' confidence: High short_id: string tactics: - string description: a list of `NewIncident`s. indicators: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - indicator example: indicator description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time range during which this Indicator is considered valid. producer: type: string example: string description: String with at most 1024 characters. severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown example: Critical negate: type: boolean example: true description: Specifies the absence of the pattern. indicator_type: type: array items: type: string enum: - Anonymization - C2 - Compromised PKI Certificate - Domain Watchlist - Exfiltration - File Hash Watchlist - Host Characteristics - IMEI Watchlist - IMSI Watchlist - IP Watchlist - Login Name - Malicious E-mail - Malware Artifacts - Private Threat Feed - URL Watchlist example: Anonymization example: - Anonymization description: Specifies the type or types for this Indicator. tags: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: Descriptors for this indicator. composite_indicator_expression: type: object properties: operator: type: string enum: - and - not - or example: and indicator_ids: type: array items: type: string example: string description: A URI leading to an indicator. example: - string required: - operator - indicator_ids example: operator: and indicator_ids: - string likely_impact: type: string example: string description: Likely potential impact within the relevant context if this Indicator were to occur. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: level of confidence held in the accuracy of this Indicator. kill_chain_phases: type: array items: type: object properties: kill_chain_name: type: string example: string description: The name of the kill chain. phase_name: type: string example: string description: The name of the phase in the kill chain. required: - kill_chain_name - phase_name example: kill_chain_name: string phase_name: string description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives. example: - kill_chain_name: string phase_name: string description: Relevant kill chain phases indicated by this Indicator. test_mechanisms: type: array items: type: string example: string description: String with at most 2048 characters. example: - string description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator. specification: type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. x-anyOf: - type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. - type: object properties: type: type: string enum: - ThreatBrain example: ThreatBrain query: type: string example: string variables: type: array items: type: string example: string example: - string required: - type - variables example: type: ThreatBrain query: string variables: - string description: An indicator which runs in threatbrain... - type: object properties: type: type: string enum: - Snort example: Snort snort_sig: type: string example: string required: - type - snort_sig example: type: Snort snort_sig: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - SIOC example: SIOC SIOC: type: string example: string required: - type - SIOC example: type: SIOC SIOC: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - OpenIOC example: OpenIOC open_IOC: type: string example: string required: - type - open_IOC example: type: OpenIOC open_IOC: string description: An indicator which contains an XML blob of an openIOC indicator. required: - producer example: description: string tags: - string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' producer: string schema_version: 1.3.30 revision: 10 type: indicator test_mechanisms: - string source: string external_ids: - string short_description: string composite_indicator_expression: operator: and indicator_ids: - string title: string likely_impact: string indicator_type: - Anonymization external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string severity: Critical tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string negate: true timestamp: '2016-01-01T01:01:01Z' confidence: High specification: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: For submitting a new Indicator uniqueItems: true example: - description: string tags: - string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' producer: string schema_version: 1.3.30 revision: 10 type: indicator test_mechanisms: - string source: string external_ids: - string short_description: string composite_indicator_expression: operator: and indicator_ids: - string title: string likely_impact: string indicator_type: - Anonymization external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string severity: Critical tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string negate: true timestamp: '2016-01-01T01:01:01Z' confidence: High specification: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: a list of `NewIndicator`s. judgements: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - judgement example: judgement description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. observable: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. disposition: type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Matches :disposition_name as in {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"} disposition_name: type: string enum: - Clean - Common - Malicious - Suspicious - Unknown example: Clean description: String verdict identifiers. priority: type: integer format: int64 example: 10 description: A value 0-100 that determine the priority of a judgement. Curated feeds of black/white lists, for example known good products within your organizations, should use a 95. All automated systems should use a priority of 90, or less. Human judgements should have a priority of 100, so that humans can always override machines. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown example: Critical valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. reason: type: string example: string description: String with at most 1024 characters. reason_uri: type: string example: string description: A URI required: - source - observable - priority - confidence - severity example: valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 observable: value: 1.2.3.4 type: ip reason_uri: string type: judgement source: string external_ids: - string disposition: 1 external_references: - source_name: string description: string url: string hashes: - string external_id: string reason: string source_uri: string disposition_name: Clean priority: 10 language: string id: string severity: Critical tlp: green timestamp: '2016-01-01T01:01:01Z' confidence: High description: Schema for submitting new Judgements. uniqueItems: true example: - valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 observable: value: 1.2.3.4 type: ip reason_uri: string type: judgement source: string external_ids: - string disposition: 1 external_references: - source_name: string description: string url: string hashes: - string external_id: string reason: string source_uri: string disposition_name: Clean priority: 10 language: string id: string severity: Critical tlp: green timestamp: '2016-01-01T01:01:01Z' confidence: High description: a list of `NewJudgement`s. malwares: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - malware example: malware description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. labels: type: array items: type: string example: adware description: Malware label is an open vocabulary that represents different types and functions of malware. Malware labels are not mutually exclusive; a malware instance can be both spyware and a screen capture tool. example: - adware description: The type of malware being described. kill_chain_phases: type: array items: type: object properties: kill_chain_name: type: string example: string description: The name of the kill chain. phase_name: type: string example: string description: The name of the phase in the kill chain. required: - kill_chain_name - phase_name example: kill_chain_name: string phase_name: string description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives. example: - kill_chain_name: string phase_name: string description: The list of Kill Chain Phases for which this Malware can be used. x_mitre_aliases: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: ATT&CK Software.aliases. abstraction_level: type: string enum: - family - variant - version example: family description: Malware abstraction level. required: - title - description - short_description - labels example: description: string labels: - adware abstraction_level: family schema_version: 1.3.30 revision: 10 type: malware x_mitre_aliases: - string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string timestamp: '2016-01-01T01:01:01Z' description: For submitting a new Malware. uniqueItems: true example: - description: string labels: - adware abstraction_level: family schema_version: 1.3.30 revision: 10 type: malware x_mitre_aliases: - string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string timestamp: '2016-01-01T01:01:01Z' description: a list of `NewMalware`s. notes: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - note example: note description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. note_class: type: string example: keyword content: type: string example: string description: Markdown string with at most 5000 characters. related_entities: type: array items: type: object properties: entity_type: type: string example: string entity_id: type: string example: string description: A URI leading to an entity. required: - entity_type - entity_id example: entity_type: string entity_id: string example: - entity_type: string entity_id: string author: type: string example: string required: - note_class - content - related_entities example: schema_version: 1.3.30 revision: 10 content: string note_class: keyword type: note source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string author: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' related_entities: - entity_type: string entity_id: string description: Schema for submitting Notes uniqueItems: true example: - schema_version: 1.3.30 revision: 10 content: string note_class: keyword type: note source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string author: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' related_entities: - entity_type: string entity_id: string description: a list of `NewNote`s. relationships: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - relationship example: relationship description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. relationship_type: type: string example: attributed-to source_ref: type: string example: string description: A URI leading to an entity. target_ref: type: string example: string description: A URI leading to an entity. required: - relationship_type - source_ref - target_ref example: description: string schema_version: 1.3.30 revision: 10 target_ref: string type: relationship source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string source_ref: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' relationship_type: attributed-to description: Schema for submitting new Relationships. uniqueItems: true example: - description: string schema_version: 1.3.30 revision: 10 target_ref: string type: relationship source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string source_ref: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' relationship_type: attributed-to description: a list of `NewRelationship`s. sightings: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - sighting example: sighting description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. observed_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High count: type: integer format: int64 example: 10 description: 'The number of times an indicator was observed within a certain period of time. For example, if an IP address associated with known malicious activity is observed once within a period of time, it may indicate a low-level threat. However, if the same IP address is observed multiple times within a short time frame, it may indicate a more severe and persistent threat. It can also be used to prioritize security alerts and indicate the urgency of a response. High counts indicate that an indicator is actively being used in a larger campaign, while low counts may indicate isolated incidents.' internal: type: boolean example: false description: "If `true`, indicates that the sighting was reported from internal sources, such as an organization's own internal security tools or SOC.\n Internal sightings are often considered more reliable and actionable than external sightings, which are reported from external sources and may have a lower level of trustworthiness. Internal sightings can provide more context and can help identify potential threats that are unique to a particular environment or organization.\n Internal sightings can also help organizations prioritize their security response efforts by identifying threats that are specific to their environment and may not yet be widely known." severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown example: Critical resolution: type: string example: detected description: Represents the disposition or actions taken on the associated threat intelligence. data: type: object properties: columns: type: array items: type: object properties: name: type: string example: string type: type: string enum: - integer - markdown - number - observable - string - url example: integer description: type: string example: string description: Markdown string with at most 5000 characters. required: type: boolean example: true description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`. short_description: type: string example: string required: - name - type example: name: string type: integer description: string required: true short_description: string example: - name: string type: integer description: string required: true short_description: string description: an ordered list of column definitions rows: type: array items: type: array items: example: anything example: - - anything description: an ordered list of rows row_count: type: integer format: int64 example: 10 description: The number of rows in the data table. required: - columns - rows example: columns: - name: string type: integer description: string required: true short_description: string rows: - - anything row_count: 10 description: An embedded data table for the Sighting. sensor: type: string example: endpoint description: The OpenC2 Actuator name that best fits the device that is creating this sighting (e.g. network.firewall) sensor_coordinates: type: object properties: type: type: string example: endpoint description: The sensor/actuator name that best fits a device. observables: type: array items: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. example: - value: 1.2.3.4 type: ip os: type: string example: string required: - type - observables example: type: endpoint observables: - value: 1.2.3.4 type: ip os: string description: Describes the device that made the sighting (sensor) and contains identifying observables for the sensor. targets: type: array items: type: object properties: type: type: string example: endpoint description: The sensor/actuator name that best fits a device. observables: type: array items: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. example: - value: 1.2.3.4 type: ip observed_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). os: type: string example: string required: - type - observables - observed_time example: type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string description: Describes the target of the sighting and contains identifying observables for the target. example: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string description: 'May include one or more targets that observed the associated indicator. Targets can include network devices, host devices, or other entities that are capable of detecting indicators of compromise. Can be used to assess the scope of potential threats, helping analysts understand which devices or components of the network may be vulnerable to attack. For example, if a particular malware strain is detected on several different systems within an organization, the `targets` field may indicate which systems are affected and which may need to be isolated or patched to prevent further spread.' observables: type: array items: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. example: - value: 1.2.3.4 type: ip description: The object(s) of interest. relations: type: array items: type: object properties: origin: type: string example: string origin_uri: type: string example: string description: A URI relation: type: string example: Allocated relation_info: type: object additionalProperties: example: anything example: keyword: anything properties: {} source: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. related: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. required: - origin - relation - source - related example: origin: string origin_uri: string relation: Allocated relation_info: keyword: anything source: value: 1.2.3.4 type: ip related: value: 1.2.3.4 type: ip description: A relation inside a Sighting. example: - origin: string origin_uri: string relation: Allocated relation_info: keyword: anything source: value: 1.2.3.4 type: ip related: value: 1.2.3.4 type: ip description: Provide any context we can about where the observable came from. context: type: object properties: process_create_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. type: type: string enum: - ProcessCreateEvent example: ProcessCreateEvent process_args: type: string example: string description: String with at most 2048 characters. process_hash: type: string example: string description: String with at most 2048 characters. process_size: type: integer format: int64 example: 10 process_disposition: type: string example: string description: String with at most 1024 characters. parent_creation_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard. parent_process_id: type: integer format: int64 example: 10 parent_process_guid: type: integer format: int64 example: 10 parent_process_name: type: string example: string description: String with at most 1024 characters. parent_process_args: type: string example: string description: String with at most 2048 characters. parent_process_username: type: string example: string description: String with at most 1024 characters. parent_process_hash: type: string example: string description: String with at most 2048 characters. parent_process_size: type: integer format: int64 example: 10 parent_process_disposition: type: string example: string description: String with at most 1024 characters. required: - time - process_id - process_name - type example: parent_process_name: string process_guid: 10 parent_process_guid: 10 process_disposition: string parent_process_size: 10 process_size: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_disposition: string type: ProcessCreateEvent parent_process_username: string parent_process_id: 10 parent_process_args: string process_name: string process_hash: string process_id: 10 parent_process_hash: string process_username: string parent_creation_time: '2016-01-01T01:01:01Z' process_args: string example: - parent_process_name: string process_guid: 10 parent_process_guid: 10 process_disposition: string parent_process_size: 10 process_size: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_disposition: string type: ProcessCreateEvent parent_process_username: string parent_process_id: 10 parent_process_args: string process_name: string process_hash: string process_id: 10 parent_process_hash: string process_username: string parent_creation_time: '2016-01-01T01:01:01Z' process_args: string description: a list of `ProcessCreate` library_load_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. type: type: string enum: - LibraryLoadEvent example: LibraryLoadEvent dll_library_name: type: string example: string description: String with at most 1024 characters. dll_library_path: type: string example: string description: String with at most 2048 characters. required: - time - process_id - process_name - type - dll_library_name - dll_library_path example: time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string type: LibraryLoadEvent dll_library_name: string dll_library_path: string example: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string type: LibraryLoadEvent dll_library_name: string dll_library_path: string description: a list of `LibraryLoadType` file_create_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. file_name: type: string example: string description: String with at most 1024 characters. file_path: type: string example: string description: String with at most 2048 characters. type: type: string enum: - FileCreateEvent example: FileCreateEvent failed: type: boolean example: false required: - time - process_id - process_name - file_name - file_path - type example: file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileCreateEvent file_path: string process_name: string process_id: 10 process_username: string failed: false example: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileCreateEvent file_path: string process_name: string process_id: 10 process_username: string failed: false description: a list of `FileCreateType` file_delete_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. file_name: type: string example: string description: String with at most 1024 characters. file_path: type: string example: string description: String with at most 2048 characters. type: type: string enum: - FileDeleteEvent example: FileDeleteEvent failed: type: boolean example: false required: - time - process_id - process_name - file_name - file_path - type example: file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileDeleteEvent file_path: string process_name: string process_id: 10 process_username: string failed: false example: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileDeleteEvent file_path: string process_name: string process_id: 10 process_username: string failed: false description: a list of `FileDeleteType` file_modify_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. file_name: type: string example: string description: String with at most 1024 characters. file_path: type: string example: string description: String with at most 2048 characters. type: type: string enum: - FileModifyEvent example: FileModifyEvent failed: type: boolean example: false required: - time - process_id - process_name - file_name - file_path - type example: file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileModifyEvent file_path: string process_name: string process_id: 10 process_username: string failed: false example: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileModifyEvent file_path: string process_name: string process_id: 10 process_username: string failed: false description: a list of `FileModifyType` file_move_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. file_name: type: string example: string description: String with at most 1024 characters. file_path: type: string example: string description: String with at most 2048 characters. type: type: string enum: - FileMoveEvent example: FileMoveEvent old_name: type: string example: string description: String with at most 1024 characters. new_name: type: string example: string description: String with at most 1024 characters. required: - time - process_id - process_name - file_name - file_path - type - old_name - new_name example: file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileMoveEvent old_name: string file_path: string process_name: string process_id: 10 process_username: string new_name: string example: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileMoveEvent old_name: string file_path: string process_name: string process_id: 10 process_username: string new_name: string description: a list of `FileMoveType` netflow_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. type: type: string enum: - NetflowEvent example: NetflowEvent traffic: type: object properties: protocol: type: integer format: int64 example: 10 description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml) source_ip: type: string example: string destination_ip: type: string example: string source_port: type: integer format: int64 example: 10 destination_port: type: integer format: int64 example: 10 direction: type: string enum: - incoming - outgoing example: incoming destination_host_name: type: string example: string source_subnet: type: string example: string destination_subnet: type: string example: string required: - protocol - source_ip - destination_ip - source_port - destination_port - direction example: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 process_path: type: string example: string description: String with at most 1024 characters. process_args: type: string example: string description: String with at most 1024 characters. process_hash: type: string example: string description: String with at most 1024 characters. process_account_type: type: string example: string description: String with at most 1024 characters. process_account: type: string example: string description: String with at most 1024 characters. parent_process_id: type: integer format: int64 example: 10 parent_process_name: type: string example: string description: String with at most 1024 characters. parent_process_path: type: string example: string description: String with at most 1024 characters. parent_process_args: type: string example: string description: String with at most 1024 characters. parent_process_hash: type: string example: string description: String with at most 1024 characters. parent_process_account: type: string example: string description: String with at most 1024 characters. parent_process_account_type: type: string example: string description: String with at most 1024 characters. flow_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard. byte_count_out: type: integer format: int64 example: 10 byte_count_in: type: integer format: int64 example: 10 required: - time - process_id - process_name - type - traffic example: parent_process_name: string byte_count_in: 10 process_guid: 10 process_path: string traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 flow_time: '2016-01-01T01:01:01Z' time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_account: string type: NetflowEvent process_account_type: string parent_process_path: string parent_process_id: 10 parent_process_args: string process_name: string process_account: string parent_process_account_type: string process_hash: string process_id: 10 parent_process_hash: string process_username: string byte_count_out: 10 process_args: string example: - parent_process_name: string byte_count_in: 10 process_guid: 10 process_path: string traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 flow_time: '2016-01-01T01:01:01Z' time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_account: string type: NetflowEvent process_account_type: string parent_process_path: string parent_process_id: 10 parent_process_args: string process_name: string process_account: string parent_process_account_type: string process_hash: string process_id: 10 parent_process_hash: string process_username: string byte_count_out: 10 process_args: string description: a list of `NetflowType` http_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. type: type: string enum: - HTTPEvent example: HTTPEvent host: type: string example: string description: String with at most 1024 characters. traffic: type: object properties: protocol: type: integer format: int64 example: 10 description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml) source_ip: type: string example: string destination_ip: type: string example: string source_port: type: integer format: int64 example: 10 destination_port: type: integer format: int64 example: 10 direction: type: string enum: - incoming - outgoing example: incoming destination_host_name: type: string example: string source_subnet: type: string example: string destination_subnet: type: string example: string required: - protocol - source_ip - destination_ip - source_port - destination_port - direction example: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 url_port: type: integer format: int64 example: 10 query: type: string example: string description: String with at most 5000 characters. encrypted: type: boolean example: true method: type: string enum: - CONNECT - GET - HEAD - OPTIONS - PATCH - POST - PUT - TRACE example: CONNECT required: - time - process_id - process_name - type - host - traffic example: process_guid: 10 traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 method: CONNECT time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: HTTPEvent host: string process_name: string process_id: 10 process_username: string query: string encrypted: true url_port: 10 example: - process_guid: 10 traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 method: CONNECT time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: HTTPEvent host: string process_name: string process_id: 10 process_username: string query: string encrypted: true url_port: 10 description: a list of `HTTPType` registry_create_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. registry_key: type: string example: string description: String with at most 1024 characters. type: type: string enum: - RegistryCreateEvent example: RegistryCreateEvent required: - time - process_id - process_name - registry_key - type example: time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryCreateEvent example: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryCreateEvent description: a list of `RegistryCreateType` registry_set_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. registry_key: type: string example: string description: String with at most 1024 characters. type: type: string enum: - RegistrySetEvent example: RegistrySetEvent registry_value: type: string example: string description: String with at most 2048 characters. registry_data_length: type: integer format: int64 example: 10 registry_data: type: string example: string description: String with at most 5000 characters. required: - time - process_id - process_name - registry_key - type - registry_value example: process_guid: 10 registry_data: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: RegistrySetEvent registry_data_length: 10 registry_value: string registry_key: string process_name: string process_id: 10 process_username: string example: - process_guid: 10 registry_data: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: RegistrySetEvent registry_data_length: 10 registry_value: string registry_key: string process_name: string process_id: 10 process_username: string description: a list of `RegistrySetType` registry_delete_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. registry_key: type: string example: string description: String with at most 1024 characters. type: type: string enum: - RegistryDeleteEvent example: RegistryDeleteEvent registry_value: type: string example: string description: String with at most 2048 characters. required: - time - process_id - process_name - registry_key - type example: time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryDeleteEvent registry_value: string example: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryDeleteEvent registry_value: string description: a list of `RegistryDeleteType` registry_rename_events: type: array items: type: object properties: time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). process_id: type: integer format: int64 example: 10 process_name: type: string example: string description: String with at most 1024 characters. process_guid: type: integer format: int64 example: 10 process_username: type: string example: string description: String with at most 1024 characters. registry_key: type: string example: string description: String with at most 1024 characters. type: type: string enum: - RegistryRenameEvent example: RegistryRenameEvent registry_old_key: type: string example: string description: String with at most 1024 characters. required: - time - process_id - process_name - registry_key - type - registry_old_key example: time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryRenameEvent registry_old_key: string example: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryRenameEvent registry_old_key: string description: a list of `RegistryRenameType` example: http_events: - process_guid: 10 traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 method: CONNECT time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: HTTPEvent host: string process_name: string process_id: 10 process_username: string query: string encrypted: true url_port: 10 process_create_events: - parent_process_name: string process_guid: 10 parent_process_guid: 10 process_disposition: string parent_process_size: 10 process_size: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_disposition: string type: ProcessCreateEvent parent_process_username: string parent_process_id: 10 parent_process_args: string process_name: string process_hash: string process_id: 10 parent_process_hash: string process_username: string parent_creation_time: '2016-01-01T01:01:01Z' process_args: string registry_delete_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryDeleteEvent registry_value: string file_modify_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileModifyEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_set_events: - process_guid: 10 registry_data: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: RegistrySetEvent registry_data_length: 10 registry_value: string registry_key: string process_name: string process_id: 10 process_username: string file_create_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileCreateEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_create_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryCreateEvent library_load_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string type: LibraryLoadEvent dll_library_name: string dll_library_path: string file_move_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileMoveEvent old_name: string file_path: string process_name: string process_id: 10 process_username: string new_name: string file_delete_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileDeleteEvent file_path: string process_name: string process_id: 10 process_username: string failed: false netflow_events: - parent_process_name: string byte_count_in: 10 process_guid: 10 process_path: string traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 flow_time: '2016-01-01T01:01:01Z' time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_account: string type: NetflowEvent process_account_type: string parent_process_path: string parent_process_id: 10 parent_process_args: string process_name: string process_account: string parent_process_account_type: string process_hash: string process_id: 10 parent_process_hash: string process_username: string byte_count_out: 10 process_args: string registry_rename_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryRenameEvent registry_old_key: string description: Context including the event type that best fits the type of the sighting. activity_interval: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time interval during which the malicious activity occurred. For example, the time when a malware sample was executing, or the time range of a network intrusion. detection_interval: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time interval during which the malicious activity was detected by the source engine or security tool. This may differ from the activity_interval if detection occurred after the activity. modification_interval: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time interval during which the sighting record was created or last updated in the system. required: - observed_time example: description: string schema_version: 1.3.30 revision: 10 relations: - origin: string origin_uri: string relation: Allocated relation_info: keyword: anything source: value: 1.2.3.4 type: ip related: value: 1.2.3.4 type: ip sensor_coordinates: type: endpoint observables: - value: 1.2.3.4 type: ip os: string observables: - value: 1.2.3.4 type: ip type: sighting source: string external_ids: - string targets: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string short_description: string title: string resolution: detected internal: false external_references: - source_name: string description: string url: string hashes: - string external_id: string detection_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' source_uri: string activity_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' language: string id: string count: 10 severity: Critical tlp: green modification_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' context: http_events: - process_guid: 10 traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 method: CONNECT time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: HTTPEvent host: string process_name: string process_id: 10 process_username: string query: string encrypted: true url_port: 10 process_create_events: - parent_process_name: string process_guid: 10 parent_process_guid: 10 process_disposition: string parent_process_size: 10 process_size: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_disposition: string type: ProcessCreateEvent parent_process_username: string parent_process_id: 10 parent_process_args: string process_name: string process_hash: string process_id: 10 parent_process_hash: string process_username: string parent_creation_time: '2016-01-01T01:01:01Z' process_args: string registry_delete_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryDeleteEvent registry_value: string file_modify_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileModifyEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_set_events: - process_guid: 10 registry_data: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: RegistrySetEvent registry_data_length: 10 registry_value: string registry_key: string process_name: string process_id: 10 process_username: string file_create_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileCreateEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_create_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryCreateEvent library_load_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string type: LibraryLoadEvent dll_library_name: string dll_library_path: string file_move_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileMoveEvent old_name: string file_path: string process_name: string process_id: 10 process_username: string new_name: string file_delete_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileDeleteEvent file_path: string process_name: string process_id: 10 process_username: string failed: false netflow_events: - parent_process_name: string byte_count_in: 10 process_guid: 10 process_path: string traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 flow_time: '2016-01-01T01:01:01Z' time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_account: string type: NetflowEvent process_account_type: string parent_process_path: string parent_process_id: 10 parent_process_args: string process_name: string process_account: string parent_process_account_type: string process_hash: string process_id: 10 parent_process_hash: string process_username: string byte_count_out: 10 process_args: string registry_rename_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryRenameEvent registry_old_key: string timestamp: '2016-01-01T01:01:01Z' confidence: High observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' sensor: endpoint data: columns: - name: string type: integer description: string required: true short_description: string rows: - - anything row_count: 10 description: For submitting a new Sighting. uniqueItems: true example: - description: string schema_version: 1.3.30 revision: 10 relations: - origin: string origin_uri: string relation: Allocated relation_info: keyword: anything source: value: 1.2.3.4 type: ip related: value: 1.2.3.4 type: ip sensor_coordinates: type: endpoint observables: - value: 1.2.3.4 type: ip os: string observables: - value: 1.2.3.4 type: ip type: sighting source: string external_ids: - string targets: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string short_description: string title: string resolution: detected internal: false external_references: - source_name: string description: string url: string hashes: - string external_id: string detection_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' source_uri: string activity_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' language: string id: string count: 10 severity: Critical tlp: green modification_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' context: http_events: - process_guid: 10 traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 method: CONNECT time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: HTTPEvent host: string process_name: string process_id: 10 process_username: string query: string encrypted: true url_port: 10 process_create_events: - parent_process_name: string process_guid: 10 parent_process_guid: 10 process_disposition: string parent_process_size: 10 process_size: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_disposition: string type: ProcessCreateEvent parent_process_username: string parent_process_id: 10 parent_process_args: string process_name: string process_hash: string process_id: 10 parent_process_hash: string process_username: string parent_creation_time: '2016-01-01T01:01:01Z' process_args: string registry_delete_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryDeleteEvent registry_value: string file_modify_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileModifyEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_set_events: - process_guid: 10 registry_data: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: RegistrySetEvent registry_data_length: 10 registry_value: string registry_key: string process_name: string process_id: 10 process_username: string file_create_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileCreateEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_create_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryCreateEvent library_load_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string type: LibraryLoadEvent dll_library_name: string dll_library_path: string file_move_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileMoveEvent old_name: string file_path: string process_name: string process_id: 10 process_username: string new_name: string file_delete_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileDeleteEvent file_path: string process_name: string process_id: 10 process_username: string failed: false netflow_events: - parent_process_name: string byte_count_in: 10 process_guid: 10 process_path: string traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 flow_time: '2016-01-01T01:01:01Z' time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_account: string type: NetflowEvent process_account_type: string parent_process_path: string parent_process_id: 10 parent_process_args: string process_name: string process_account: string parent_process_account_type: string process_hash: string process_id: 10 parent_process_hash: string process_username: string byte_count_out: 10 process_args: string registry_rename_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryRenameEvent registry_old_key: string timestamp: '2016-01-01T01:01:01Z' confidence: High observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' sensor: endpoint data: columns: - name: string type: integer description: string required: true short_description: string rows: - - anything row_count: 10 description: a list of `NewSighting`s. identity_assertions: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - identity-assertion example: identity-assertion description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. identity: type: object properties: observables: type: array items: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. example: - value: 1.2.3.4 type: ip required: - observables example: observables: - value: 1.2.3.4 type: ip description: Attributes for which the assertion is being made. assertions: type: array items: type: object properties: name: type: string example: cisco:ctr:ad:host_domain_name description: An open vocabulary containing well known assertion types value: type: string example: string required: - name - value example: name: cisco:ctr:ad:host_domain_name value: string example: - name: cisco:ctr:ad:host_domain_name value: string description: Any known context about the identity attributes. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. required: - identity - assertions example: valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' identity: observables: - value: 1.2.3.4 type: ip schema_version: 1.3.30 revision: 10 type: identity-assertion source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' assertions: - name: cisco:ctr:ad:host_domain_name value: string description: For submitting a new IdentityAssertion. uniqueItems: true example: - valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' identity: observables: - value: 1.2.3.4 type: ip schema_version: 1.3.30 revision: 10 type: identity-assertion source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' assertions: - name: cisco:ctr:ad:host_domain_name value: string description: a list of `NewIdentityAssertion`s. target_records: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - target-record example: target-record description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. targets: type: array items: type: object properties: type: type: string example: endpoint description: The sensor/actuator name that best fits a device. observables: type: array items: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. example: - value: 1.2.3.4 type: ip observed_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If the observation was made over a period of time, than this field indicates the end of that period. required: - start_time example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified). os: type: string example: string description: Source Operating System where TargetRecord was originated. internal: type: boolean example: false description: Is it internal to our network? sensor: type: string example: string description: 'The OpenC2 Actuator name that best fits the device that is creating this TargetRecord (e.g.: network.firewall, etc.)' source_uri: type: string example: string description: A URI required: - type - observables - observed_time example: type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string internal: false sensor: string source_uri: string description: Schema for TargetRecord Targets example: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string internal: false sensor: string source_uri: string required: - source - targets example: description: string schema_version: 1.3.30 revision: 10 type: target-record source: string external_ids: - string targets: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string internal: false sensor: string source_uri: string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' description: Schema for submitting new TargetRecord. uniqueItems: true example: - description: string schema_version: 1.3.30 revision: 10 type: target-record source: string external_ids: - string targets: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string internal: false sensor: string source_uri: string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' description: a list of `NewTargetRecord`s. tools: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - tool example: tool description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. labels: type: array items: type: string example: credential-exploitation description: Tool labels describe the categories of tools that can be used to perform attacks. example: - credential-exploitation description: The kind(s) of tool(s) being described. kill_chain_phases: type: array items: type: object properties: kill_chain_name: type: string example: string description: The name of the kill chain. phase_name: type: string example: string description: The name of the phase in the kill chain. required: - kill_chain_name - phase_name example: kill_chain_name: string phase_name: string description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives. example: - kill_chain_name: string phase_name: string description: The list of kill chain phases for which this Tool can be used. tool_version: type: string example: string description: The version identifier associated with the Tool. x_mitre_aliases: type: array items: type: string example: string description: String with at most 1024 characters. example: - string description: ATT&CK Software.aliases. required: - title - description - short_description - labels example: description: string labels: - credential-exploitation schema_version: 1.3.30 revision: 10 type: tool x_mitre_aliases: - string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tool_version: string tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string timestamp: '2016-01-01T01:01:01Z' description: For submitting a new Tool. uniqueItems: true example: - description: string labels: - credential-exploitation schema_version: 1.3.30 revision: 10 type: tool x_mitre_aliases: - string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tool_version: string tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string timestamp: '2016-01-01T01:01:01Z' description: a list of `NewTool`s. verdicts: type: array items: type: object properties: type: type: string enum: - verdict example: verdict disposition: type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Numeric verdict identifiers. observable: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. judgement_id: type: string example: string description: A URI leading to a judgement. disposition_name: type: string enum: - Clean - Common - Malicious - Suspicious - Unknown example: Clean description: 'The disposition_name field is optional, but is intended to be shown to a user. Applications must therefore remember the mapping of numbers to human words, as in: {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}' valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. required: - type - disposition - observable - valid_time example: type: verdict disposition: 1 observable: value: 1.2.3.4 type: ip judgement_id: string disposition_name: Clean valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: "A Verdict is chosen from all of the Judgements on that Observable which have not yet expired. The highest priority Judgement becomes the active verdict. If there is more than one Judgement with that priority, then Clean disposition has priority over all others, then Malicious disposition, and so on down to Unknown.\n\n The ID of a verdict is a a str of the form \"observable.type:observable.value\" for example, \"ip:1.1.1.1\"" uniqueItems: true example: - type: verdict disposition: 1 observable: value: 1.2.3.4 type: ip judgement_id: string disposition_name: Clean valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: a list of `Verdict`s. data_tables: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - data-table example: data-table description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: A description of object, which may be detailed. short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. columns: type: array items: type: object properties: name: type: string example: string type: type: string enum: - integer - markdown - number - observable - string - url example: integer description: type: string example: string description: Markdown string with at most 5000 characters. required: type: boolean example: true description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`. short_description: type: string example: string required: - name - type example: name: string type: integer description: string required: true short_description: string example: - name: string type: integer description: string required: true short_description: string description: An ordered list of column definitions. rows: type: array items: type: array items: example: anything example: - - anything description: An ordered list of rows valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. row_count: type: integer format: int64 example: 10 description: The number of rows in the data table. required: - columns - rows example: description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 columns: - name: string type: integer description: string required: true short_description: string type: data-table source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string rows: - - anything source_uri: string language: string id: string tlp: green row_count: 10 timestamp: '2016-01-01T01:01:01Z' description: Schema for submitting a NewDataTable record. uniqueItems: true example: - description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 columns: - name: string type: integer description: string required: true short_description: string type: data-table source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string rows: - - anything source_uri: string language: string id: string tlp: green row_count: 10 timestamp: '2016-01-01T01:01:01Z' description: a list of `NewDataTable`s. weaknesses: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - weakness example: weakness description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: Should be short and limited to the key points that define this weakness. short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. structure: type: string enum: - Chain - Composite - Simple example: Chain description: Defines the structural nature of the weakness. languages: type: array items: type: object properties: prevalence: type: string enum: - Often - Rarely - Sometimes - Undetermined example: Often description: Defines the different regularities that guide the applicability of platforms. name: type: string example: string description: Language name (Clojure, Java, ...) class: type: string example: Assembly description: Class of language. required: - prevalence example: prevalence: Often name: string class: Assembly example: - prevalence: Often name: string class: Assembly description: Applicable Languages. operating_systems: type: array items: type: object properties: prevalence: type: string enum: - Often - Rarely - Sometimes - Undetermined example: Often description: Defines the different regularities that guide the applicability of platforms. name: type: string example: string description: String with at most 1024 characters. version: type: string example: string description: String with at most 1024 characters. cpe_id: type: string example: string description: String with at most 1024 characters. class: type: string example: Android description: Class of Operating System. required: - prevalence example: prevalence: Often name: string version: string cpe_id: string class: Android example: - prevalence: Often name: string version: string cpe_id: string class: Android description: Applicable operating systems. architectures: type: array items: type: object properties: prevalence: type: string enum: - Often - Rarely - Sometimes - Undetermined example: Often description: Defines the different regularities that guide the applicability of platforms. name: type: string example: string description: Architecture name (ARM, x86, ...) class: type: string example: Embedded description: Class of architecture required: - prevalence example: prevalence: Often name: string class: Embedded example: - prevalence: Often name: string class: Embedded description: Applicable architectures. paradigms: type: array items: type: object properties: prevalence: type: string enum: - Often - Rarely - Sometimes - Undetermined example: Often description: Defines the different regularities that guide the applicability of platforms. name: type: string example: string description: Paradigm name (Client Server, Mainframe) required: - prevalence example: prevalence: Often name: string example: - prevalence: Often name: string description: Applicable paradigms. technologies: type: array items: type: object properties: prevalence: type: string enum: - Often - Rarely - Sometimes - Undetermined example: Often description: Defines the different regularities that guide the applicability of platforms. name: type: string example: string description: Technology name (Web Server, Web Client) required: - prevalence example: prevalence: Often name: string example: - prevalence: Often name: string description: Applicable technologies. background_details: type: string example: string description: Information that is relevant but not related to the nature of the weakness itself. alternate_terms: type: array items: type: object properties: term: type: string example: string description: The actual alternate term. description: type: string example: string description: Provides context for the alternate term by which this weakness may be known. required: - term example: term: string description: string example: - term: string description: string description: Indicates one or more other names used to describe this weakness. modes_of_introduction: type: array items: type: object properties: phase: type: string example: Architecture and Design description: Identifies the point in the software life cycle at which the weakness may be introduced. note: type: string example: string description: Provides a typical scenario related to introduction during the given phase. required: - phase example: phase: Architecture and Design note: string example: - phase: Architecture and Design note: string description: Information about how and when a given weakness may be introduced. likelihood: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: Likelihood of exploit. common_consequences: type: array items: type: object properties: scopes: type: array items: type: string example: Access Control description: Defines the different areas of software security that can be affected by exploiting a weakness. example: - Access Control description: Identifies the security property that is violated. impacts: type: array items: type: string example: Alter Execution Logic example: - Alter Execution Logic description: Describes the technical impact that arises if an adversary succeeds in exploiting this weakness. likelihood: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: How likely the specific consequence is expected to be seen relative to the other consequences. note: type: string example: string description: Additional commentary about a consequence. required: - scopes example: scopes: - Access Control impacts: - Alter Execution Logic likelihood: High note: string example: - scopes: - Access Control impacts: - Alter Execution Logic likelihood: High note: string description: Refers to the typical or expected negative effects that can result from exploiting the weakness. This could include anything from unauthorized access to data, denial of service, system crashes or other things. detection_methods: type: array items: type: object properties: method: type: string example: Architecture or Design Review description: Identifies the particular detection method being described. description: type: string example: string description: Provides some context of how this method can be applied to a specific weakness. effectiveness: type: string example: High description: How effective the detection method may be in detecting the associated weakness. effectiveness_notes: type: string example: string description: Provides additional discussion of the strengths and shortcomings of this detection method. required: - method - description example: method: Architecture or Design Review description: string effectiveness: High effectiveness_notes: string example: - method: Architecture or Design Review description: string effectiveness: High effectiveness_notes: string description: Identifies methods that may be employed to detect this weakness, including their strengths and limitations. potential_mitigations: type: array items: type: object properties: description: type: string example: string description: A description of this individual mitigation including any strengths and shortcomings of this mitigation for the weakness. phases: type: array items: type: string example: Architecture and Design description: Defines the different regularities that guide the applicability of platforms. example: - Architecture and Design description: Indicates the development life cycle phase during which this particular mitigation may be applied. strategy: type: string example: Attack Surface Reduction description: A general strategy for protecting a system to which this mitigation contributes. effectiveness: type: string example: Defense in Depth description: Summarizes how effective the mitigation may be in preventing the weakness. effectiveness_notes: type: string example: string description: Markdown string with at most 5000 characters. required: - description example: description: string phases: - Architecture and Design strategy: Attack Surface Reduction effectiveness: Defense in Depth effectiveness_notes: string example: - description: string phases: - Architecture and Design strategy: Attack Surface Reduction effectiveness: Defense in Depth effectiveness_notes: string description: Describes potential mitigations associated with a weakness. functional_areas: type: array items: type: string example: Authentication description: Defines the different functional areas of software in which the weakness may appear. example: - Authentication description: Identifies the functional area of the software in which the weakness is most likely to occur. affected_resources: type: array items: type: string example: CPU description: Defines a resource of a system. example: - CPU description: Identifies system resources that can be affected by an exploit of this weakness. notes: type: array items: type: object properties: type: type: string example: Applicable Platform description: Defines the different types of notes that can be associated with a weakness. note: type: string example: string description: Markdown string with at most 5000 characters. required: - type - note example: type: Applicable Platform note: string example: - type: Applicable Platform note: string description: Provides any additional comments about the weakness. abstraction_level: type: string enum: - Base - Class - Compound - Variant example: Base description: Refers to the level of abstraction or granularity used to describe the weakness. It helps to categorize the vulnerability based on the level of detail provided. required: - description example: description: string background_details: string paradigms: - prevalence: Often name: string abstraction_level: Base architectures: - prevalence: Often name: string class: Embedded schema_version: 1.3.30 revision: 10 alternate_terms: - term: string description: string likelihood: High type: weakness source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string functional_areas: - Authentication source_uri: string modes_of_introduction: - phase: Architecture and Design note: string structure: Chain language: string id: string notes: - type: Applicable Platform note: string common_consequences: - scopes: - Access Control impacts: - Alter Execution Logic likelihood: High note: string tlp: green detection_methods: - method: Architecture or Design Review description: string effectiveness: High effectiveness_notes: string operating_systems: - prevalence: Often name: string version: string cpe_id: string class: Android affected_resources: - CPU languages: - prevalence: Often name: string class: Assembly timestamp: '2016-01-01T01:01:01Z' potential_mitigations: - description: string phases: - Architecture and Design strategy: Attack Surface Reduction effectiveness: Defense in Depth effectiveness_notes: string technologies: - prevalence: Often name: string description: For submitting a new weakness. uniqueItems: true example: - description: string background_details: string paradigms: - prevalence: Often name: string abstraction_level: Base architectures: - prevalence: Often name: string class: Embedded schema_version: 1.3.30 revision: 10 alternate_terms: - term: string description: string likelihood: High type: weakness source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string functional_areas: - Authentication source_uri: string modes_of_introduction: - phase: Architecture and Design note: string structure: Chain language: string id: string notes: - type: Applicable Platform note: string common_consequences: - scopes: - Access Control impacts: - Alter Execution Logic likelihood: High note: string tlp: green detection_methods: - method: Architecture or Design Review description: string effectiveness: High effectiveness_notes: string operating_systems: - prevalence: Often name: string version: string cpe_id: string class: Android affected_resources: - CPU languages: - prevalence: Often name: string class: Assembly timestamp: '2016-01-01T01:01:01Z' potential_mitigations: - description: string phases: - Architecture and Design strategy: Attack Surface Reduction effectiveness: Defense in Depth effectiveness_notes: string technologies: - prevalence: Often name: string description: a list of `NewWeakness`s. vulnerabilities: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - vulnerability example: vulnerability description: A valid entity type identifer schema_version: type: string enum: - 1.3.30 example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: string example: string description: "Various sources of vulnerability information can be used, including third-party resources like the National Vulnerability Database (NVD) and the Common Vulnerabilities and Exposures (CVE) database. The platform then analyzes this data and provides the user with relevant details such as the severity of the vulnerability, the affected systems, and remediation recommendations. \n\n Based on this information, the user can prioritize patching and other mitigation strategies to reduce the risk of potential attacks." short_description: type: string example: string description: A single line, short summary of the object. source: type: string example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: string example: string description: URI of the source of the intelligence that led to the creation of the entity. cve: type: object properties: cve_data_meta: type: object properties: id: type: string example: string description: String with at most 1024 characters. assigner: type: string example: string description: String with at most 1024 characters. example: id: string assigner: string required: - cve_data_meta example: cve_data_meta: id: string assigner: string impact: type: object properties: cvss_v2: type: object properties: vector_string: type: string example: string description: a text representation of a set of CVSSv2 metrics. It is commonly used to record or transfer CVSSv2 metric information in a concise form base_score: type: number format: double example: 10.0 description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v2/guide' base_severity: type: string enum: - High - Info - Low - Medium - None - Unknown example: High impact_score: type: number format: double example: 10.0 description: a Score number from 0 to 10 exploitability_score: type: number format: double example: 10.0 description: a Score number from 0 to 10 access_vector: type: string enum: - adjacent network - local - network example: network description: This metric reflects how the vulnerability is exploited.The more remote an attacker can be to attack a host, the greater the vulnerability score. access_complexity: type: string enum: - high - low - medium example: low description: 'This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system. For example, consider a buffer overflow in an Internet service: once the target system is located, the attacker can launch an exploit at will.' authentication: type: string enum: - multiple - none - single example: none description: This metric measures the number of times an attacker must authenticate to a target in order to exploit a vulnerability. This metric does not gauge the strength or complexity of the authentication process, only that an attacker is required to provide credentials before an exploit may occur. The fewer authentication instances that are required, the higher the vulnerability score. confidentiality_impact: type: string enum: - complete - none - partial example: complete description: This metric measures the impact on confidentiality of a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. Increasedconfidentiality impact increases the vulnerability score. integrity_impact: type: string enum: - complete - none - partial example: complete description: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and guaranteed veracity of information. Increased integrity impact increases the vulnerability score. availability_impact: type: string enum: - complete - none - partial example: complete description: This metric measures the impact to availability of a successfully exploited vulnerability. Availability refers to the accessibility of information resources. Attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system. Increased availability impact increases the vulnerability score. exploitability: type: string enum: - functional - high - not_defined - proof_of_concept - unproven example: not_defined description: This metric measures the current state of exploit techniques or code availability. Public availability of easy-to-use exploit code increases the number of potential attackers by including those who are unskilled thereby increasing the severity of the vulnerability. remediation_level: type: string enum: - not_defined - official_fix - temporary_fix - unavailable - workaround example: not_defined description: The remediation level of a vulnerability is an important factor for prioritization. The typical vulnerability is unpatched when initially published. Workarounds or hotfixes may offer interim remediation until an official patch or upgrade is issued. Each of these respective stages adjusts the temporal score downwards, reflecting the decreasing urgency as remediation becomes final. The less official and permanent a fix, the higher the vulnerability score is. report_confidence: type: string enum: - confirmed - not_defined - unconfirmed - uncorroborated example: not_defined description: This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details. Sometimes, only the existence of vulnerabilities are publicized, but without specific details. The vulnerability may later be corroborated and then confirmed through acknowledgement by the author or vendor of the affected technology. The urgency of a vulnerability is higher when a vulnerability is known to exist with certainty. This metric also suggests the level of technical knowledge available to would-be attackers. The more a vulnerability is validated by the vendor or other reputable sources, the higher the score. temporal_vector_string: type: string example: string description: A text representation of a set of CVSSv2 temporal metrics. Temporal metrics allow analysists to calculate threat severity based on temporal factors such as reliability of vulnerability reports, availability of mitigations, and the ease or difficulty of conducting the exploit. It is commonly used to record or transfer CVSSv2 metric information in a concise form collateral_damage_potential: type: string enum: - high - low - low_medium - medium_high - none - not_defined example: not_defined description: This metric measures the potential for loss of life or physical assets through damage or theft of property or equipment. The metric may also measure economic loss of productivity or revenue. Naturally, the greater the damage potential, the higher the vulnerability score. target_distribution: type: string enum: - high - low - medium - none - not_defined example: not_defined description: This metric measures the proportion of vulnerable systems. It is meant as an environment-specific indicator in order to approximate the percentage of systems that could be affected by the vulnerability. The greater the proportion of vulnerable systems, the higher the score. confidentiality_requirement: type: string enum: - high - low - medium - not_defined example: not_defined description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.' integrity_requirement: type: string enum: - high - low - medium - not_defined example: not_defined description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.' availability_requirement: type: string enum: - high - low - medium - not_defined example: not_defined description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.' environmental_vector_string: type: string example: string description: A text representation of a set of CVSSv2 environmental metrics. Environmental metrics allow analysists to calculate threat scores in relation to environmental security requirements, collateral damage potential, and target availability. It is commonly used to record or transfer CVSSv2 metric information in a concise form obtain_all_privilege: type: boolean example: true obtain_user_privilege: type: boolean example: true obtain_other_privilege: type: boolean example: true user_interaction_required: type: boolean example: true required: - vector_string - base_score - base_severity example: integrity_impact: complete target_distribution: not_defined availability_requirement: not_defined exploitability: not_defined access_complexity: low temporal_vector_string: string exploitability_score: 10.0 impact_score: 10.0 user_interaction_required: true environmental_vector_string: string obtain_other_privilege: true availability_impact: complete access_vector: network base_severity: High confidentiality_impact: complete confidentiality_requirement: not_defined report_confidence: not_defined authentication: none base_score: 10.0 obtain_user_privilege: true obtain_all_privilege: true collateral_damage_potential: not_defined remediation_level: not_defined vector_string: string integrity_requirement: not_defined cvss_v3: type: object properties: vector_string: type: string example: string description: a text representation of a set of CVSSv3 metrics. It is commonly used to record or transfer CVSSv3 metric information in a concise form base_score: type: number format: double example: 10.0 description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v3-1' base_severity: type: string enum: - critical - high - low - medium - none example: critical impact_score: type: number format: double example: 10.0 description: a Score number from 0 to 10 exploitability_score: type: number format: double example: 10.0 description: a Score number from 0 to 10 attack_vector: type: string enum: - adjacent_network - local - network - physical example: adjacent_network description: Reflects the context by which vulnerability exploitation is possible modified_attack_vector: type: string enum: - adjacent_network - local - network - not_defined - physical example: not_defined description: modified attack vector attack_complexity: type: string enum: - high - low example: high description: describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability modified_attack_complexity: type: string enum: - high - low - not_defined example: not_defined description: modified attack complexity privileges_required: type: string enum: - high - low - none example: high description: describes the level of privileges an attacker must possess before successfully exploiting the vulnerability modified_privileges_required: type: string enum: - high - low - none - not_defined example: not_defined description: modified privileges required user_interaction: type: string enum: - none - required example: none description: captures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerable component modified_user_interaction: type: string enum: - none - not_defined - required example: none description: modified user interaction scope: type: string enum: - changed - unchanged example: changed description: the ability for a vulnerability in one software component to impact resources beyond its means, or privileges modified_scope: type: string enum: - changed - not_defined - unchanged example: not_defined description: modified scope confidentiality_impact: type: string enum: - high - low - none example: high description: measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability modified_confidentiality_impact: type: string enum: - high - low - none - not_defined example: not_defined description: modified confidentiality impact integrity_impact: type: string enum: - high - low - none example: high description: measures the impact to integrity of a successfully exploited vulnerability modified_integrity_impact: type: string enum: - high - low - none - not_defined example: not_defined description: modified integrity impact availability_impact: type: string enum: - high - low - none example: high description: measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability modified_availability_impact: type: string enum: - high - low - none - not_defined example: not_defined description: modified availability impact exploit_code_maturity: type: string enum: - functional - high - not_defined - proof_of_concept - unproven example: functional description: measures the likelihood of the vulnerability being attacked remediation_level: type: string enum: - high - not_defined - offical_fix - temporary_fix - unavailable - workaround example: high description: Remediation Level of a vulnerability is an important factor for prioritization report_confidence: type: string enum: - confirmed - reasonable - unknown example: confirmed description: measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details temporal_score: type: number format: double example: 10.0 description: Round up(CVSSv3BaseScore × CVSSv3ExploitCodeMaturity × CVSSv3RemediationLevel × CVSSv3ReportConfidence) temporal_severity: type: string enum: - critical - high - low - medium - none example: critical description: temporal severity availability_requirement: type: string enum: - high - low - none - not_defined example: high description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).' confidentiality_requirement: type: string enum: - high - low - none - not_defined example: high description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).' integrity_requirement: type: string enum: - high - low - none - not_defined example: high description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).' environmental_score: type: number format: double example: 10.0 description: a Score number from 0 to 10 environmental_severity: type: string enum: - critical - high - low - medium - none example: critical required: - vector_string - base_score - base_severity example: integrity_impact: high modified_user_interaction: none modified_scope: not_defined availability_requirement: high user_interaction: none modified_integrity_impact: not_defined privileges_required: high exploitability_score: 10.0 impact_score: 10.0 environmental_severity: critical modified_availability_impact: not_defined availability_impact: high scope: changed exploit_code_maturity: functional modified_attack_complexity: not_defined base_severity: critical confidentiality_impact: high temporal_severity: critical modified_confidentiality_impact: not_defined confidentiality_requirement: high report_confidence: confirmed temporal_score: 10.0 modified_privileges_required: not_defined modified_attack_vector: not_defined base_score: 10.0 environmental_score: 10.0 remediation_level: high vector_string: string integrity_requirement: high attack_vector: adjacent_network attack_complexity: high example: cvss_v2: integrity_impact: complete target_distribution: not_defined availability_requirement: not_defined exploitability: not_defined access_complexity: low temporal_vector_string: string exploitability_score: 10.0 impact_score: 10.0 user_interaction_required: true environmental_vector_string: string obtain_other_privilege: true availability_impact: complete access_vector: network base_severity: High confidentiality_impact: complete confidentiality_requirement: not_defined report_confidence: not_defined authentication: none base_score: 10.0 obtain_user_privilege: true obtain_all_privilege: true collateral_damage_potential: not_defined remediation_level: not_defined vector_string: string integrity_requirement: not_defined cvss_v3: integrity_impact: high modified_user_interaction: none modified_scope: not_defined availability_requirement: high user_interaction: none modified_integrity_impact: not_defined privileges_required: high exploitability_score: 10.0 impact_score: 10.0 environmental_severity: critical modified_availability_impact: not_defined availability_impact: high scope: changed exploit_code_maturity: functional modified_attack_complexity: not_defined base_severity: critical confidentiality_impact: high temporal_severity: critical modified_confidentiality_impact: not_defined confidentiality_requirement: high report_confidence: confirmed temporal_score: 10.0 modified_privileges_required: not_defined modified_attack_vector: not_defined base_score: 10.0 environmental_score: 10.0 remediation_level: high vector_string: string integrity_requirement: high attack_vector: adjacent_network attack_complexity: high description: "Describes the potential impact of a vulnerability that is being tracked in the system. Provides information on the extent of damage that a vulnerability can cause and how serious the consequences could be if it is exploited. \n\nMay contain granular information about the vulnerability severity using the CVSS system, versions 2 and 3.\n\nCVSSv2 and CVSSv3 have different methods of calculating base scores, but both are designed to provide an indication of the level of risk that a vulnerability poses. The base score ranges from 0 to 10, with 10 being the most severe. Additionally, both CVSSv2 and CVSSv3 define severity levels, such as low, medium, high, and critical, based on the base score." configurations: type: object properties: CVE_data_version: type: string example: string description: Specifies the version of the CVE (Common Vulnerabilities and Exposures) dictionary used by the vulnerability information provider. nodes: type: array items: type: object properties: operator: type: string enum: - AND - OR example: AND description: The operator string influences how seqs of cpe matches are related to one another. cpe_match: type: array items: type: object properties: vulnerable: type: boolean example: true cpe23Uri: type: string example: string description: A text representation of a software or hardware platform. versionStartIncluding: type: string example: string description: A string representing the lower bound(inclusive) of version in the CPE. versionEndIncluding: type: string example: string description: A string representing the upper bound(inclusive) of version in the CPE. versionStartExcluding: type: string example: string description: A string representing the lower bound(exclusive) of version in the CPE. versionEndExcluding: type: string example: string description: A string representing the upper bound(exclusive) of version in the CPE. required: - vulnerable - cpe23Uri example: vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string example: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string children: type: array items: type: object properties: operator: type: string enum: - AND - OR example: AND description: The operator string influences how seqs of cpe matches are related to one another. cpe_match: type: array items: type: object properties: vulnerable: type: boolean example: true cpe23Uri: type: string example: string description: A text representation of a software or hardware platform. versionStartIncluding: type: string example: string description: A string representing the lower bound(inclusive) of version in the CPE. versionEndIncluding: type: string example: string description: A string representing the upper bound(inclusive) of version in the CPE. versionStartExcluding: type: string example: string description: A string representing the lower bound(exclusive) of version in the CPE. versionEndExcluding: type: string example: string description: A string representing the upper bound(exclusive) of version in the CPE. required: - vulnerable - cpe23Uri example: vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string example: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: type: boolean example: true description: Negates operator when true. required: - operator - cpe_match example: operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true example: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true negate: type: boolean example: true description: Negates operator when true. required: - operator example: operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string children: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true negate: true example: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string children: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true negate: true description: Each `node` in the CTIM standard configuration includes information such as the `operator` (such as "less than", or "greater than or equal to"), and the `cpe` (Common Platform Enumeration) string which identifies the specific software, `CPE` is a structured naming scheme for IT systems, platforms, and software packages, and it is instrumental in enabling data exchange between different systems. required: - CVE_data_version - nodes example: CVE_data_version: string nodes: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string children: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true negate: true description: "Represents a list of affected versions or configurations of a software component that is impacted by a vulnerability. \nBy tracking the affected software components and versions, defenders can identify which systems are potentially exposed to an attack, and apply appropriate mitigations." published_date: type: string format: date-time example: '2016-01-01T01:01:01Z' description: "Represents the date when a vulnerability was publicly disclosed or made available to the general public. \n\nImportant for tracking the age of a vulnerability, as well as for determining when a particular vulnerability was first introduced into a system. The published date can be used to identify the time window during which a system may have been vulnerable to a particular exploit.\n\nFor example, if an organization discovers that a vulnerability was published before their system's installation date, but they did not apply the necessary security updates in a timely manner, it can be concluded that their system was vulnerable for the period between the installation date and the date when the necessary security updates were applied." last_modified_date: type: string format: date-time example: '2016-01-01T01:01:01Z' description: 'Represents the date when the vulnerability metadata was last updated in the internal database. It can be used to track the freshness of the vulnerability information. If the `last_modified_date` is more recent than the `published_date`, it can indicate that there has been some new information or updates related to the vulnerability, such as new patch releases or changes in the severity or impact rating.' required: - description example: description: string schema_version: 1.3.30 revision: 10 published_date: '2016-01-01T01:01:01Z' cve: cve_data_meta: id: string assigner: string configurations: CVE_data_version: string nodes: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string children: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true negate: true type: vulnerability source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' last_modified_date: '2016-01-01T01:01:01Z' impact: cvss_v2: integrity_impact: complete target_distribution: not_defined availability_requirement: not_defined exploitability: not_defined access_complexity: low temporal_vector_string: string exploitability_score: 10.0 impact_score: 10.0 user_interaction_required: true environmental_vector_string: string obtain_other_privilege: true availability_impact: complete access_vector: network base_severity: High confidentiality_impact: complete confidentiality_requirement: not_defined report_confidence: not_defined authentication: none base_score: 10.0 obtain_user_privilege: true obtain_all_privilege: true collateral_damage_potential: not_defined remediation_level: not_defined vector_string: string integrity_requirement: not_defined cvss_v3: integrity_impact: high modified_user_interaction: none modified_scope: not_defined availability_requirement: high user_interaction: none modified_integrity_impact: not_defined privileges_required: high exploitability_score: 10.0 impact_score: 10.0 environmental_severity: critical modified_availability_impact: not_defined availability_impact: high scope: changed exploit_code_maturity: functional modified_attack_complexity: not_defined base_severity: critical confidentiality_impact: high temporal_severity: critical modified_confidentiality_impact: not_defined confidentiality_requirement: high report_confidence: confirmed temporal_score: 10.0 modified_privileges_required: not_defined modified_attack_vector: not_defined base_score: 10.0 environmental_score: 10.0 remediation_level: high vector_string: string integrity_requirement: high attack_vector: adjacent_network attack_complexity: high description: For submitting a new vulnerability. uniqueItems: true example: - description: string schema_version: 1.3.30 revision: 10 published_date: '2016-01-01T01:01:01Z' cve: cve_data_meta: id: string assigner: string configurations: CVE_data_version: string nodes: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string children: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true negate: true type: vulnerability source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' last_modified_date: '2016-01-01T01:01:01Z' impact: cvss_v2: integrity_impact: complete target_distribution: not_defined availability_requirement: not_defined exploitability: not_defined access_complexity: low temporal_vector_string: string exploitability_score: 10.0 impact_score: 10.0 user_interaction_required: true environmental_vector_string: string obtain_other_privilege: true availability_impact: complete access_vector: network base_severity: High confidentiality_impact: complete confidentiality_requirement: not_defined report_confidence: not_defined authentication: none base_score: 10.0 obtain_user_privilege: true obtain_all_privilege: true collateral_damage_potential: not_defined remediation_level: not_defined vector_string: string integrity_requirement: not_defined cvss_v3: integrity_impact: high modified_user_interaction: none modified_scope: not_defined availability_requirement: high user_interaction: none modified_integrity_impact: not_defined privileges_required: high exploitability_score: 10.0 impact_score: 10.0 environmental_severity: critical modified_availability_impact: not_defined availability_impact: high scope: changed exploit_code_maturity: functional modified_attack_complexity: not_defined base_severity: critical confidentiality_impact: high temporal_severity: critical modified_confidentiality_impact: not_defined confidentiality_requirement: high report_confidence: confirmed temporal_score: 10.0 modified_privileges_required: not_defined modified_attack_vector: not_defined base_score: 10.0 environmental_score: 10.0 remediation_level: high vector_string: string integrity_requirement: high attack_vector: adjacent_network attack_complexity: high description: a list of `NewVulnerability`s. actor_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string asset_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string asset_mapping_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string asset_properties_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string attack_pattern_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string campaign_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string coa_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string feedback_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string identity_assertion_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string incident_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string indicator_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string judgement_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string malware_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string note_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string relationship_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string sighting_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string target_record_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string tool_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string verdict_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string data_table_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string weakness_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string vulnerability_refs: type: array items: type: string example: string description: A URI leading to an entity. uniqueItems: true example: - string valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: Period of time when a cyber observation is valid. required: - source example: description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' asset_mapping_refs: - string note_refs: - string data_table_refs: - string attack_pattern_refs: - string sighting_refs: - string schema_version: 1.3.30 revision: 10 assets: - description: string asset_type: application valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 type: asset source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' weakness_refs: - string tool_refs: - string target_record_refs: - string asset_refs: - string tools: - description: string labels: - credential-exploitation schema_version: 1.3.30 revision: 10 type: tool x_mitre_aliases: - string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tool_version: string tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string timestamp: '2016-01-01T01:01:01Z' indicators: - description: string tags: - string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' producer: string schema_version: 1.3.30 revision: 10 type: indicator test_mechanisms: - string source: string external_ids: - string short_description: string composite_indicator_expression: operator: and indicator_ids: - string title: string likely_impact: string indicator_type: - Anonymization external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string severity: Critical tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string negate: true timestamp: '2016-01-01T01:01:01Z' confidence: High specification: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string attack_patterns: - description: string abstraction_level: aggregate schema_version: 1.3.30 revision: 10 type: attack-pattern source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string x_mitre_platforms: - string language: string id: string tlp: green x_mitre_data_sources: - string kill_chain_phases: - kill_chain_name: string phase_name: string x_mitre_contributors: - string timestamp: '2016-01-01T01:01:01Z' type: bundle weaknesses: - description: string background_details: string paradigms: - prevalence: Often name: string abstraction_level: Base architectures: - prevalence: Often name: string class: Embedded schema_version: 1.3.30 revision: 10 alternate_terms: - term: string description: string likelihood: High type: weakness source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string functional_areas: - Authentication source_uri: string modes_of_introduction: - phase: Architecture and Design note: string structure: Chain language: string id: string notes: - type: Applicable Platform note: string common_consequences: - scopes: - Access Control impacts: - Alter Execution Logic likelihood: High note: string tlp: green detection_methods: - method: Architecture or Design Review description: string effectiveness: High effectiveness_notes: string operating_systems: - prevalence: Often name: string version: string cpe_id: string class: Android affected_resources: - CPU languages: - prevalence: Often name: string class: Assembly timestamp: '2016-01-01T01:01:01Z' potential_mitigations: - description: string phases: - Architecture and Design strategy: Attack Surface Reduction effectiveness: Defense in Depth effectiveness_notes: string technologies: - prevalence: Often name: string source: string external_ids: - string feedback_refs: - string asset_properties: - properties: - name: string value: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 asset_ref: string type: asset-properties source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' short_description: string feedbacks: - feedback: -1 schema_version: 1.3.30 revision: 10 type: feedback source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string reason: string source_uri: string language: string id: string tlp: green entity_id: string timestamp: '2016-01-01T01:01:01Z' judgement_refs: - string title: string coa_refs: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string verdicts: - type: verdict disposition: 1 observable: value: 1.2.3.4 type: ip judgement_id: string disposition_name: Clean valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' campaigns: - description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 type: campaign campaign_type: string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string activity: - date_time: '2016-01-01T01:01:01Z' description: string source_uri: string intended_effect: - Account Takeover status: Future language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' confidence: High names: - string source_uri: string actors: - description: string motivation: Ego valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' identity: description: string related_identities: - identity: string confidence: High information_source: string relationship: string sophistication: Aspirant schema_version: 1.3.30 revision: 10 planning_and_operational_support: string type: actor source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string intended_effect: Account Takeover language: string id: string tlp: green aliases: - string timestamp: '2016-01-01T01:01:01Z' confidence: High actor_types: - Cyber Espionage Operations indicator_refs: - string actor_refs: - string language: string data_tables: - description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 columns: - name: string type: integer description: string required: true short_description: string type: data-table source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string rows: - - anything source_uri: string language: string id: string tlp: green row_count: 10 timestamp: '2016-01-01T01:01:01Z' id: string notes: - schema_version: 1.3.30 revision: 10 content: string note_class: keyword type: note source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string author: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' related_entities: - entity_type: string entity_id: string identity_assertions: - valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' identity: observables: - value: 1.2.3.4 type: ip schema_version: 1.3.30 revision: 10 type: identity-assertion source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' assertions: - name: cisco:ctr:ad:host_domain_name value: string judgements: - valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' schema_version: 1.3.30 revision: 10 observable: value: 1.2.3.4 type: ip reason_uri: string type: judgement source: string external_ids: - string disposition: 1 external_references: - source_name: string description: string url: string hashes: - string external_id: string reason: string source_uri: string disposition_name: Clean priority: 10 language: string id: string severity: Critical tlp: green timestamp: '2016-01-01T01:01:01Z' confidence: High malwares: - description: string labels: - adware abstraction_level: family schema_version: 1.3.30 revision: 10 type: malware x_mitre_aliases: - string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string timestamp: '2016-01-01T01:01:01Z' target_records: - description: string schema_version: 1.3.30 revision: 10 type: target-record source: string external_ids: - string targets: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string internal: false sensor: string source_uri: string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' asset_mappings: - asset_type: application valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' stability: Managed schema_version: 1.3.30 revision: 10 observable: value: 1.2.3.4 type: ip asset_ref: string type: asset-mapping source: string external_ids: - string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' specificity: Low confidence: High relationship_refs: - string tlp: green incidents: - description: string assignees: - string detection_sources: - string meta: keyword: string schema_version: 1.3.30 revision: 10 type: incident source: string external_ids: - string short_description: string title: string incident_time: opened: '2016-01-01T01:01:01Z' discovered: '2016-01-01T01:01:01Z' reported: '2016-01-01T01:01:01Z' remediated: '2016-01-01T01:01:01Z' closed: '2016-01-01T01:01:01Z' rejected: '2016-01-01T01:01:01Z' contained: '2016-01-01T01:01:01Z' external_references: - source_name: string description: string url: string hashes: - string external_id: string discovery_method: Agent Disclosure source_uri: string intended_effect: Account Takeover categories: - Attrition status: Closed language: string detection_status: active id: string promotion_method: Automated severity: Critical tlp: green scores: asset: 10.0 techniques: - string timestamp: '2016-01-01T01:01:01Z' confidence: High short_id: string tactics: - string identity_assertion_refs: - string sightings: - description: string schema_version: 1.3.30 revision: 10 relations: - origin: string origin_uri: string relation: Allocated relation_info: keyword: anything source: value: 1.2.3.4 type: ip related: value: 1.2.3.4 type: ip sensor_coordinates: type: endpoint observables: - value: 1.2.3.4 type: ip os: string observables: - value: 1.2.3.4 type: ip type: sighting source: string external_ids: - string targets: - type: endpoint observables: - value: 1.2.3.4 type: ip observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' os: string short_description: string title: string resolution: detected internal: false external_references: - source_name: string description: string url: string hashes: - string external_id: string detection_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' source_uri: string activity_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' language: string id: string count: 10 severity: Critical tlp: green modification_interval: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' context: http_events: - process_guid: 10 traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 method: CONNECT time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: HTTPEvent host: string process_name: string process_id: 10 process_username: string query: string encrypted: true url_port: 10 process_create_events: - parent_process_name: string process_guid: 10 parent_process_guid: 10 process_disposition: string parent_process_size: 10 process_size: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_disposition: string type: ProcessCreateEvent parent_process_username: string parent_process_id: 10 parent_process_args: string process_name: string process_hash: string process_id: 10 parent_process_hash: string process_username: string parent_creation_time: '2016-01-01T01:01:01Z' process_args: string registry_delete_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryDeleteEvent registry_value: string file_modify_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileModifyEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_set_events: - process_guid: 10 registry_data: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: RegistrySetEvent registry_data_length: 10 registry_value: string registry_key: string process_name: string process_id: 10 process_username: string file_create_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileCreateEvent file_path: string process_name: string process_id: 10 process_username: string failed: false registry_create_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryCreateEvent library_load_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string type: LibraryLoadEvent dll_library_name: string dll_library_path: string file_move_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileMoveEvent old_name: string file_path: string process_name: string process_id: 10 process_username: string new_name: string file_delete_events: - file_name: string process_guid: 10 time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' type: FileDeleteEvent file_path: string process_name: string process_id: 10 process_username: string failed: false netflow_events: - parent_process_name: string byte_count_in: 10 process_guid: 10 process_path: string traffic: destination_host_name: string protocol: 10 source_ip: string destination_subnet: string destination_ip: string source_subnet: string destination_port: 10 direction: incoming source_port: 10 flow_time: '2016-01-01T01:01:01Z' time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' parent_process_account: string type: NetflowEvent process_account_type: string parent_process_path: string parent_process_id: 10 parent_process_args: string process_name: string process_account: string parent_process_account_type: string process_hash: string process_id: 10 parent_process_hash: string process_username: string byte_count_out: 10 process_args: string registry_rename_events: - time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' process_id: 10 process_name: string process_guid: 10 process_username: string registry_key: string type: RegistryRenameEvent registry_old_key: string timestamp: '2016-01-01T01:01:01Z' confidence: High observed_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' sensor: endpoint data: columns: - name: string type: integer description: string required: true short_description: string rows: - - anything row_count: 10 campaign_refs: - string vulnerability_refs: - string asset_properties_refs: - string relationships: - description: string schema_version: 1.3.30 revision: 10 target_ref: string type: relationship source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string source_ref: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' relationship_type: attributed-to timestamp: '2016-01-01T01:01:01Z' verdict_refs: - string malware_refs: - string incident_refs: - string vulnerabilities: - description: string schema_version: 1.3.30 revision: 10 published_date: '2016-01-01T01:01:01Z' cve: cve_data_meta: id: string assigner: string configurations: CVE_data_version: string nodes: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string children: - operator: AND cpe_match: - vulnerable: true cpe23Uri: string versionStartIncluding: string versionEndIncluding: string versionStartExcluding: string versionEndExcluding: string negate: true negate: true type: vulnerability source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string tlp: green timestamp: '2016-01-01T01:01:01Z' last_modified_date: '2016-01-01T01:01:01Z' impact: cvss_v2: integrity_impact: complete target_distribution: not_defined availability_requirement: not_defined exploitability: not_defined access_complexity: low temporal_vector_string: string exploitability_score: 10.0 impact_score: 10.0 user_interaction_required: true environmental_vector_string: string obtain_other_privilege: true availability_impact: complete access_vector: network base_severity: High confidentiality_impact: complete confidentiality_requirement: not_defined report_confidence: not_defined authentication: none base_score: 10.0 obtain_user_privilege: true obtain_all_privilege: true collateral_damage_potential: not_defined remediation_level: not_defined vector_string: string integrity_requirement: not_defined cvss_v3: integrity_impact: high modified_user_interaction: none modified_scope: not_defined availability_requirement: high user_interaction: none modified_integrity_impact: not_defined privileges_required: high exploitability_score: 10.0 impact_score: 10.0 environmental_severity: critical modified_availability_impact: not_defined availability_impact: high scope: changed exploit_code_maturity: functional modified_attack_complexity: not_defined base_severity: critical confidentiality_impact: high temporal_severity: critical modified_confidentiality_impact: not_defined confidentiality_requirement: high report_confidence: confirmed temporal_score: 10.0 modified_privileges_required: not_defined modified_attack_vector: not_defined base_score: 10.0 environmental_score: 10.0 remediation_level: high vector_string: string integrity_requirement: high attack_vector: adjacent_network attack_complexity: high coas: - description: string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' stage: Containment schema_version: 1.3.30 revision: 10 efficacy: High type: coa related_COAs: - confidence: High source: string relationship: string COA_id: string source: string external_ids: - string short_description: string title: string external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string coa_type: Diplomatic Actions language: string id: string tlp: green objective: - string cost: High timestamp: '2016-01-01T01:01:01Z' open_c2_coa: type: structured_coa id: string action: type: alert target: type: acudid specifiers: string actuator: type: endpoint specifiers: - string modifiers: response: acknowledge method: - acl additional_properties: context: string time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' frequency: string duration: '2016-01-01T01:01:01Z' source: string search: cve option: string id: string location: internal delay: '2016-01-01T01:01:01Z' destination: copy-to structured_coa_type: openc2 impact: string description: Describes a Bundle of any set of CTIM entities. investigated_observables: type: array items: type: object properties: value: type: string example: string description: The value of the observable. type: type: string enum: - acudid - amp_computer_guid - certificate_common_name - certificate_issuer - certificate_serial - cisco_cm_id - cisco_mid - cisco_uc_id - cortex_agent_id - crowdstrike_id - cvm_id - cybereason_id - darktrace_id - device - domain - email - email_messageid - email_subject - file_name - file_path - google_chromebook_id - google_cloud_id - hostname - imei - imsi - intune_id - ip - ipv6 - jamf_management_id - mac_address - md5 - meraki_network_id - meraki_node_sn - meraki_org_id - ms_machine_id - mutex - ngfw_id - ngfw_name - odns_identity - odns_identity_label - orbital_node_id - pki_serial - process_args - process_hash - process_name - process_path - process_uid - process_username - processor_id - registry_key - registry_name - registry_path - s1_agent_id - secure_access_id - serial_number - service_now_id - sha1 - sha256 - swc_device_id - trend_micro_id - url - user - user_agent example: acudid description: The type of observable. required: - value - type example: value: 1.2.3.4 type: ip description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable. source: title: InvestigationSource description: String with at most 1024 characters. type: string example: Cisco XDR Automated Question title: title: InvestigationTitle description: String with at most 1024 characters. type: string example: Which devices in my org was this sha seen on? description: title: InvestigationDescription description: String with at most 5000 characters. type: string example: 'For the following hashes: - sha256:defg...1234 - sha256:abcd..1234 Determine which devices in my org have instances of the file in the past 30 days' required: - bundle required: true operationId: postV2InvestigationBundle x-operation-id-source: derived /v2/investigation/snapshot: post: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: type: object properties: investigation_id: type: string format: uuid required: - investigation_id application/transit+msgpack: schema: type: object properties: investigation_id: type: string format: uuid required: - investigation_id application/transit+json: schema: type: object properties: investigation_id: type: string format: uuid required: - investigation_id application/edn: schema: type: object properties: investigation_id: type: string format: uuid required: - investigation_id '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message tags: - Investigation Creation summary: Create Investigation from Snapshot security: - JWT-Bearer: [] - oauth2: [] requestBody: content: application/json: schema: type: object additionalProperties: type: string x-allOf: - type: object additionalProperties: type: string - type: object properties: short_description: type: string description: type: string source: type: string actions: type: string timestamp: type: string required: - short_description - source - actions - timestamp application/transit+msgpack: schema: type: object additionalProperties: type: string x-allOf: - type: object additionalProperties: type: string - type: object properties: short_description: type: string description: type: string source: type: string actions: type: string timestamp: type: string required: - short_description - source - actions - timestamp application/transit+json: schema: type: object additionalProperties: type: string x-allOf: - type: object additionalProperties: type: string - type: object properties: short_description: type: string description: type: string source: type: string actions: type: string timestamp: type: string required: - short_description - source - actions - timestamp application/edn: schema: type: object additionalProperties: type: string x-allOf: - type: object additionalProperties: type: string - type: object properties: short_description: type: string description: type: string source: type: string actions: type: string timestamp: type: string required: - short_description - source - actions - timestamp required: true operationId: postV2InvestigationSnapshot x-operation-id-source: derived /v2/investigation/{investigation-id}/snapshot: get: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: type: object properties: investigation_id: type: string format: uuid required: - investigation_id application/transit+msgpack: schema: type: object properties: investigation_id: type: string format: uuid required: - investigation_id application/transit+json: schema: type: object properties: investigation_id: type: string format: uuid required: - investigation_id application/edn: schema: type: object properties: investigation_id: type: string format: uuid required: - investigation_id '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message parameters: - in: path name: investigation-id description: '' required: true schema: type: string tags: - Investigation Creation summary: Create Investigation from Investigation Id security: - JWT-Bearer: [] - oauth2: [] operationId: getV2InvestigationByInvestigationIdSnapshot x-operation-id-source: derived components: securitySchemes: JWT-Bearer: type: apiKey name: Authorization in: header oauth2: type: oauth2 flows: authorizationCode: scopes: event:read: Get event information for an org. Needed to get full report information. private-intel:read: Read data from private intel. Needed to get investigation data. private-intel: Full private intel integration scope. asset: Get Data from Device Insights. Needed during running investigations. enrich:read: Fetch Data about observables. Needed for investigations. integration:read: Get module information. Needed to create a new investigation. investigation: Run investigations. Needed for investigations. casebook: Full casebook management access. Allows read, write to casebooks. casebook:read: Read Casebook access global-intel:read: Read data from public intel. Needed to fetch global incident data and investigations. private-intel:write: Private intel write scope. ao: Execute and read workflows playbook:read: Get playbook state. Needed to get full report information. authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token x-id: - reitit.swagger/default