openapi: 3.2.0
info:
  title: IROH-INT Enrich Reputation API
  version: 1.0.107
  license:
    name: All Rights Reserved
    url: https://www.cisco.com
  contact:
    name: Cisco Security Business Group -- Advanced Threat
    email: cisco-intel-api-support@cisco.com
  description: 'IROH Integrations: configure and query Threat Response modules'
  x-provenance:
    method: harvested
    authored_by: Cisco XDR
    harvested_by: API Evangelist
    harvested_on: '2026-08-19'
    first_party: true
    note: Published by Cisco. Retrieved unmodified except for this x-provenance block.
    provider_published: true
  x-evidence:
  - type: source
    url: https://visibility.amp.cisco.com/iroh/iroh-enrich/index.html
  - type: raw
    url: https://visibility.amp.cisco.com/iroh/iroh-enrich/swagger.json
servers:
- url: https://visibility.amp.cisco.com/
security:
- iroh: []
- AuthorizationHeader: []
- oauth2:
  - telemetry
  - integration
  - private-intel
  - admin
  - cognitive
  - profile
  - inspect
  - asset
  - event
  - feedback
  - sse
  - registry
  - users
  - investigation
  - invite
  - casebook
  - orbital
  - enrich
  - oauth
  - vault
  - response
  - notification
  - global-intel:read
  - webhook
  - ao
tags:
- name: Reputation
paths:
  /iroh/iroh-enrich/reputation/observable:
    get:
      x-no-doc: false
      tags:
      - Reputation
      description: '[required scopes](/iroh/doc/iroh-auth/#scopes): `enrich/observables/reputation:read`


        This route queries intel modules with supplied `Observable` in order to calculate its `Reputation`'
      responses:
        '200':
          description: Reputation verdict calculated for given observable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EnvelopedReputation'
            application/x-yaml:
              schema:
                $ref: '#/components/schemas/EnvelopedReputation'
            application/edn:
              schema:
                $ref: '#/components/schemas/EnvelopedReputation'
            application/transit+json:
              schema:
                $ref: '#/components/schemas/EnvelopedReputation'
            application/transit+msgpack:
              schema:
                $ref: '#/components/schemas/EnvelopedReputation'
        '401':
          description: A `NormalizedError` including a `trace_id`
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NormalizedError-401'
            application/x-yaml:
              schema:
                $ref: '#/components/schemas/NormalizedError-401'
            application/edn:
              schema:
                $ref: '#/components/schemas/NormalizedError-401'
            application/transit+json:
              schema:
                $ref: '#/components/schemas/NormalizedError-401'
            application/transit+msgpack:
              schema:
                $ref: '#/components/schemas/NormalizedError-401'
        '500':
          description: A `NormalizedError` including a `trace_id`
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NormalizedError-500'
            application/x-yaml:
              schema:
                $ref: '#/components/schemas/NormalizedError-500'
            application/edn:
              schema:
                $ref: '#/components/schemas/NormalizedError-500'
            application/transit+json:
              schema:
                $ref: '#/components/schemas/NormalizedError-500'
            application/transit+msgpack:
              schema:
                $ref: '#/components/schemas/NormalizedError-500'
      parameters:
      - in: query
        name: type
        description: The type of observable.
        required: true
        example: ip
        schema:
          type: string
          enum:
          - file_path
          - mac_address
          - trend_micro_id
          - cybereason_id
          - process_args
          - s1_agent_id
          - device
          - hostname
          - certificate_common_name
          - serial_number
          - meraki_network_id
          - url
          - jamf_management_id
          - certificate_serial
          - intune_id
          - meraki_org_id
          - cisco_cm_id
          - registry_key
          - process_path
          - darktrace_id
          - process_username
          - cortex_agent_id
          - orbital_node_id
          - process_uid
          - ngfw_name
          - user
          - certificate_issuer
          - ipv6
          - email
          - cisco_uc_id
          - cvm_id
          - sha256
          - crowdstrike_id
          - google_cloud_id
          - google_chromebook_id
          - acudid
          - sha1
          - registry_name
          - md5
          - service_now_id
          - ip
          - domain
          - email_subject
          - imei
          - ngfw_id
          - amp_computer_guid
          - ms_machine_id
          - secure_access_id
          - mutex
          - processor_id
          - swc_device_id
          - registry_path
          - odns_identity
          - odns_identity_label
          - cisco_mid
          - process_name
          - pki_serial
          - meraki_node_sn
          - email_messageid
          - imsi
          - user_agent
          - process_hash
          - file_name
      - in: query
        name: value
        description: The value of the observable.
        required: true
        example: 1.2.3.4
        schema:
          type: string
      - in: query
        name: mids
        description: Use this parameter to query only some Modules passing their Ids
        required: false
        example:
        - a78f09b4-16fa-4617-8bbf-f6044284ec0f
        - 36716d80-2bd7-47fc-a179-cde2a0a8c5fe
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
      summary: Enrich Observable Reputation
components:
  schemas:
    AttackPattern:
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        abstraction_level:
          example: aggregate
          description: The CAPEC abstraction level for patterns describing techniques to attack a system.
          type: string
          enum:
          - detailed
          - standard
          - aggregate
          - meta
          - category
        schema_version:
          example: 1.3.30
          description: CTIM schema version for this entity.
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        type:
          example: attack-pattern
          type: string
          enum:
          - attack-pattern
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        x_mitre_platforms:
          example:
          - string
          description: ATT&CK Technique.Platforms.
          type: array
          items:
            type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        x_mitre_data_sources:
          example:
          - string
          description: ATT&CK Technique.Data Sources.
          type: array
          items:
            type: string
        kill_chain_phases:
          example:
          - kill_chain_name: string
            phase_name: string
          description: A kill chain is a series of steps that an attacker must go through to successfully achieve their objective. The concept was originally developed by the military, but has been adapted to the cybersecurity field to describe the steps an attacker goes through to compromise a target system and achieve their goal.
          type: array
          items:
            $ref: '#/components/schemas/KillChainPhase'
        client_id:
          type: string
        x_mitre_contributors:
          example:
          - string
          description: ATT&CK Technique.Contributors.
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
      additionalProperties: false
      required:
      - description
      - schema_version
      - type
      - short_description
      - title
      - id
    Assertion:
      example:
        name: cisco:ctr:ad:host_domain_name
        value: string
      type: object
      properties:
        name:
          example: cisco:ctr:ad:host_domain_name
          description: An open vocabulary containing well known assertion types
          type: string
        value:
          example: string
          type: string
      additionalProperties: false
      required:
      - name
      - value
    LibraryLoadType:
      example:
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        process_id: 10
        process_name: string
        process_guid: 10
        process_username: string
        type: LibraryLoadEvent
        dll_library_name: string
        dll_library_path: string
      type: object
      properties:
        time:
          $ref: '#/components/schemas/ObservedTime'
        process_id:
          example: 10
          type: integer
          format: int64
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        type:
          example: LibraryLoadEvent
          type: string
          enum:
          - LibraryLoadEvent
        dll_library_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        dll_library_path:
          example: string
          description: String with at most 2048 characters.
          type: string
      additionalProperties: false
      required:
      - time
      - process_id
      - process_name
      - type
      - dll_library_name
      - dll_library_path
    CompositeIndicatorExpression:
      example:
        operator: and
        indicator_ids:
        - string
      type: object
      properties:
        operator:
          example: and
          type: string
          enum:
          - not
          - or
          - and
        indicator_ids:
          example:
          - string
          type: array
          items:
            type: string
      additionalProperties: false
      required:
      - operator
      - indicator_ids
    NormalizedError-500:
      example:
        error: unknown server error
        error_description: An unknown error has occurred during the enrichment
        trace_id: 2e790e2c-e7fe-42ed-a18b-7413d9f1f4b0
      type: object
      properties:
        error:
          type: string
        error_description:
          type: string
        error_code:
          type: string
        error_uri:
          type: string
        trace_id:
          type: string
        schema.core.AnythingSchema@3c6f0b88: {}
      additionalProperties: {}
    OperatingSystem:
      example:
        prevalence: Often
        name: string
        version: string
        cpe_id: string
        class: Android
      type: object
      properties:
        prevalence:
          example: Often
          description: Defines the different regularities that guide the applicability of platforms.
          type: string
          enum:
          - Undetermined
          - Sometimes
          - Often
          - Rarely
        name:
          example: string
          description: String with at most 1024 characters.
          type: string
        version:
          example: string
          description: String with at most 1024 characters.
          type: string
        cpe_id:
          example: string
          description: String with at most 1024 characters.
          type: string
        class:
          example: Android
          description: Class of Operating System.
          type: string
      additionalProperties: false
      required:
      - prevalence
    NetflowType:
      example:
        parent_process_name: string
        byte_count_in: 10
        process_guid: 10
        process_path: string
        traffic:
          destination_host_name: string
          protocol: 10
          source_ip: string
          destination_subnet: string
          destination_ip: string
          source_subnet: string
          destination_port: 10
          direction: incoming
          source_port: 10
        flow_time: '2016-01-01T01:01:01.000Z'
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        parent_process_account: string
        type: NetflowEvent
        process_account_type: string
        parent_process_path: string
        parent_process_id: 10
        parent_process_args: string
        process_name: string
        process_account: string
        parent_process_account_type: string
        process_hash: string
        process_id: 10
        parent_process_hash: string
        process_username: string
        byte_count_out: 10
        process_args: string
      type: object
      properties:
        parent_process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        byte_count_in:
          example: 10
          type: integer
          format: int64
        process_guid:
          example: 10
          type: integer
          format: int64
        process_path:
          example: string
          description: String with at most 1024 characters.
          type: string
        traffic:
          $ref: '#/components/schemas/Traffic'
        flow_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Schema definition for all date or timestamp values.  Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
          type: string
          format: date-time
        time:
          $ref: '#/components/schemas/ObservedTime'
        parent_process_account:
          example: string
          description: String with at most 1024 characters.
          type: string
        type:
          example: NetflowEvent
          type: string
          enum:
          - NetflowEvent
        process_account_type:
          example: string
          description: String with at most 1024 characters.
          type: string
        parent_process_path:
          example: string
          description: String with at most 1024 characters.
          type: string
        parent_process_id:
          example: 10
          type: integer
          format: int64
        parent_process_args:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_account:
          example: string
          description: String with at most 1024 characters.
          type: string
        parent_process_account_type:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_hash:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        parent_process_hash:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        byte_count_out:
          example: 10
          type: integer
          format: int64
        process_args:
          example: string
          description: String with at most 1024 characters.
          type: string
      additionalProperties: false
      required:
      - traffic
      - time
      - type
      - process_name
      - process_id
    OpenIOCSpecification:
      example:
        type: OpenIOC
        open_IOC: string
      description: An indicator which contains an XML blob of an openIOC indicator.
      type: object
      properties:
        type:
          example: OpenIOC
          type: string
          enum:
          - OpenIOC
        open_IOC:
          example: string
          type: string
      additionalProperties: false
      required:
      - type
      - open_IOC
    ObservedTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If the observation was made over a period of time, than this field indicates the end of that period.
          type: string
          format: date-time
      additionalProperties: false
      required:
      - start_time
    ActionType:
      example:
        type: alert
      type: object
      properties:
        type:
          example: alert
          type: string
          enum:
          - stop
          - save
          - delete
          - remediate
          - redirect
          - alert
          - query
          - augment
          - snapshot
          - update
          - allow
          - scan
          - investigate
          - modify
          - sync
          - start
          - pause
          - deny
          - substitute
          - distill
          - move
          - restart
          - other
          - detonate
          - response
          - set
          - notify
          - report
          - restore
          - get
          - throttle
          - mitigate
          - resume
          - locate
          - contain
      additionalProperties: false
      required:
      - type
    Incident:
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        assignees:
          example:
          - string
          description: A set of owners assigned to this incident.
          type: array
          items:
            type: string
        detection_sources:
          example:
          - string
          description: A set of sources that contributed threat detections to the incident.
          type: array
          items:
            type: string
        meta:
          $ref: '#/components/schemas/MetaData'
        schema_version:
          example: 1.3.30
          description: CTIM schema version for this entity.
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        type:
          example: incident
          type: string
          enum:
          - incident
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        incident_time:
          $ref: '#/components/schemas/IncidentTime'
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        discovery_method:
          example: Agent Disclosure
          description: Identifies how the incident was discovered.
          type: string
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        intended_effect:
          example: Account Takeover
          description: Specifies the suspected intended effect of this incident
          type: string
        categories:
          example:
          - Attrition
          description: A set of categories for this incident.
          type: array
          items:
            type: string
        status:
          example: Closed
          description: The `status` field represents the current state of an incident within the incident management process. Its values help in tracking and reporting the progress of the incident from its discovery to its resolution.
          type: string
          enum:
          - New
          - Closed
          - 'Open: Recovered'
          - 'Closed: Other'
          - 'Hold: Internal'
          - 'Hold: Legal'
          - 'Closed: Under Review'
          - Rejected
          - Open
          - 'Closed: Merged'
          - Restoration Achieved
          - Incident Reported
          - 'Closed: Suspected'
          - Stalled
          - 'Open: Contained'
          - 'Closed: Near-Miss'
          - 'Hold: External'
          - Containment Achieved
          - 'New: Processing'
          - 'Closed: Confirmed Threat'
          - 'Closed: False Positive'
          - 'Open: Reported'
          - 'Open: Investigating'
          - Hold
          - 'New: Presented'
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        detection_status:
          example: active
          description: Represents the state of an incident within the incident generation process, indicating whether the incident is actively receiving updates or is no longer being updated.
          type: string
          enum:
          - inactive_oversized
          - inactive_user_closed
          - active
          - inactive_merged
          - inactive_expired
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        promotion_method:
          example: Automated
          description: Describes method for promoting an Incident, whether manually or automatically. An Incident may be created manually by a SOAR analyst or SOC operator, or through an automated correlation or aggregation rule or engine that matches a specific set of events or alerts, and promotes them to Incident(s).
          type: string
          enum:
          - Automated
          - Manual
        severity:
          example: Critical
          description: "Represents the potential impact of an incident on an organization's security posture and business operations. It helps organizations prioritize and allocate resources for incident response based on the severity level of the incident \nIt helps analysts and incident handlers prioritize incidents by indicating the level of risk and potential impact associated with the incident. This enables organizations to allocate resources efficiently and address the most critical incidents first.\nCan also be used to generate reports and metrics for measuring the effectiveness of the incident response process and to identify trends and patterns in the threat landscape.\nIt is important to note that the `severity` field is subjective and can be interpreted differently by different organizations or analysts. Therefore, it should be used in conjunction with other intelligence attributes, such as the `confidence` field, to provide a more comprehensive view of the incident."
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Critical
          - Low
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        scores:
          $ref: '#/components/schemas/IncidentScores'
        client_id:
          type: string
        techniques:
          example:
          - string
          description: Represents the specific methods or actions used by an attacker to carry out an offensive maneuver or achieve their goals.
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        confidence:
          example: High
          description: 'Represents the level of certainty or trustworthiness associated with the incident. It denotes the reliability of the intelligence associated with the incident.

            The `confidence` field can take on several values, including:

            - `info`: Indicates that the incident information is based on sources with no previous track record or there is no track record for the source reporting the incident.

            - `low`: Indicates that the incident information is based on sources with a questionable track record or there is limited information about the accuracy of the source.

            - `medium`: Indicates that the incident information is based on sources with a mixed track record or of uncertain reliability.

            - `high`: Indicates that the incident information is based on sources with a proven track record and high degree of reliability.

            The `confidence` field can be used to indicate the level of trust and confidence that can be attributed to the incident, and it may impact how the incident is prioritized, analyzed and addressed. It can also help in the decision-making process associated with the incident response activities.

            It is important to note that the `confidence` field is subjective and can be interpreted differently by different organizations or analysts. As such, it is often used in conjunction with other intelligence attributes, such as the `severity` field, to provide a more complete picture of the incident.'
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        short_id:
          example: string
          description: A human-readable, short identifier for the incident, unique within an organization.
          type: string
        tactics:
          example:
          - string
          description: Represents the offensive techniques, approaches, or procedures that an adversary may use to achieve their objectives during an attack. It helps in understanding the intent and capabilities of the adversary and can be used to identify indicators of attack (IoAs) or indicators of compromise (IoCs) that are associated with the adversary's tactics.
          type: array
          items:
            type: string
      additionalProperties: false
      required:
      - schema_version
      - type
      - incident_time
      - status
      - id
      - confidence
    CVSSv2:
      example:
        integrity_impact: complete
        target_distribution: not_defined
        availability_requirement: not_defined
        exploitability: not_defined
        access_complexity: low
        temporal_vector_string: string
        exploitability_score: 10.0
        impact_score: 10.0
        user_interaction_required: true
        environmental_vector_string: string
        obtain_other_privilege: true
        availability_impact: complete
        access_vector: network
        base_severity: High
        confidentiality_impact: complete
        confidentiality_requirement: not_defined
        report_confidence: not_defined
        authentication: none
        base_score: 10.0
        obtain_user_privilege: true
        obtain_all_privilege: true
        collateral_damage_potential: not_defined
        remediation_level: not_defined
        vector_string: string
        integrity_requirement: not_defined
      type: object
      properties:
        integrity_impact:
          example: complete
          description: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and guaranteed veracity of information. Increased integrity impact increases the vulnerability score.
          type: string
          enum:
          - partial
          - none
          - complete
        target_distribution:
          example: not_defined
          description: This metric measures the proportion of vulnerable systems. It is meant as an environment-specific indicator in order to approximate the percentage of systems that could be affected by the vulnerability. The greater the proportion of vulnerable systems, the higher the score.
          type: string
          enum:
          - low
          - none
          - high
          - medium
          - not_defined
        availability_requirement:
          example: not_defined
          description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
          type: string
          enum:
          - low
          - high
          - medium
          - not_defined
        exploitability:
          example: not_defined
          description: This metric measures the current state of exploit techniques or code availability. Public availability of easy-to-use exploit code increases the number of potential attackers by including those who are unskilled thereby increasing the severity of the vulnerability.
          type: string
          enum:
          - high
          - unproven
          - functional
          - proof_of_concept
          - not_defined
        access_complexity:
          example: low
          description: 'This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system. For example, consider a buffer overflow in an Internet service: once the target system is located, the attacker can launch an exploit at will.'
          type: string
          enum:
          - low
          - high
          - medium
        temporal_vector_string:
          example: string
          description: A text representation of a set of CVSSv2 temporal metrics. Temporal metrics allow analysists to calculate threat severity based on temporal factors such as reliability of vulnerability reports, availability of mitigations, and the ease or difficulty of conducting the exploit. It is commonly used to record or transfer CVSSv2 metric information in a concise form
          type: string
        exploitability_score:
          example: 10.0
          description: a Score number from 0 to 10
          type: number
          format: double
        impact_score:
          example: 10.0
          description: a Score number from 0 to 10
          type: number
          format: double
        user_interaction_required:
          example: true
          type: boolean
        environmental_vector_string:
          example: string
          description: A text representation of a set of CVSSv2 environmental metrics. Environmental metrics allow analysists to calculate threat scores in relation to environmental security requirements, collateral damage potential, and target availability. It is commonly used to record or transfer CVSSv2 metric information in a concise form
          type: string
        obtain_other_privilege:
          example: true
          type: boolean
        availability_impact:
          example: complete
          description: This metric measures the impact to availability of a successfully exploited vulnerability. Availability refers to the accessibility of information resources. Attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system. Increased availability impact increases the vulnerability score.
          type: string
          enum:
          - partial
          - none
          - complete
        access_vector:
          example: network
          description: This metric reflects how the vulnerability is exploited.The more remote an attacker can be to attack a host, the greater the vulnerability score.
          type: string
          enum:
          - network
          - adjacent network
          - local
        base_severity:
          example: High
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        confidentiality_impact:
          example: complete
          description: This metric measures the impact on confidentiality of a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. Increasedconfidentiality impact increases the vulnerability score.
          type: string
          enum:
          - partial
          - none
          - complete
        confidentiality_requirement:
          example: not_defined
          description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
          type: string
          enum:
          - low
          - high
          - medium
          - not_defined
        report_confidence:
          example: not_defined
          description: This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details. Sometimes, only the existence of vulnerabilities are publicized, but without specific details. The vulnerability may later be corroborated and then confirmed through acknowledgement by the author or vendor of the affected technology. The urgency of a vulnerability is higher when a vulnerability is known to exist with certainty. This metric also suggests the level of technical knowledge available to would-be attackers. The more a vulnerability is validated by the vendor or other reputable sources, the higher the score.
          type: string
          enum:
          - uncorroborated
          - unconfirmed
          - confirmed
          - not_defined
        authentication:
          example: none
          description: This metric measures the number of times an attacker must authenticate to a target in order to exploit a vulnerability. This metric does not gauge the strength or complexity of the authentication process, only that an attacker is required to provide credentials before an exploit may occur. The fewer authentication instances that are required, the higher the vulnerability score.
          type: string
          enum:
          - none
          - single
          - multiple
        base_score:
          example: 10.0
          description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v2/guide'
          type: number
          format: double
        obtain_user_privilege:
          example: true
          type: boolean
        obtain_all_privilege:
          example: true
          type: boolean
        collateral_damage_potential:
          example: not_defined
          description: This metric measures the potential for loss of life or physical assets through damage or theft of property or equipment.  The metric may also measure economic loss of productivity or revenue. Naturally, the greater the damage potential, the higher the vulnerability score.
          type: string
          enum:
          - low
          - none
          - high
          - medium_high
          - low_medium
          - not_defined
        remediation_level:
          example: not_defined
          description: The remediation level of a vulnerability is an important factor for prioritization. The typical vulnerability is unpatched when initially published. Workarounds or hotfixes may offer interim remediation until an official patch or upgrade is issued. Each of these respective stages adjusts the temporal score downwards, reflecting the decreasing urgency as remediation becomes final. The less official and permanent a fix, the higher the vulnerability score is.
          type: string
          enum:
          - temporary_fix
          - workaround
          - official_fix
          - unavailable
          - not_defined
        vector_string:
          example: string
          description: a text representation of a set of CVSSv2 metrics. It is commonly used to record or transfer CVSSv2 metric information in a concise form
          type: string
        integrity_requirement:
          example: not_defined
          description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
          type: string
          enum:
          - low
          - high
          - medium
          - not_defined
      additionalProperties: false
      required:
      - base_severity
      - base_score
      - vector_string
    RegistryDeleteType:
      example:
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        process_id: 10
        process_name: string
        process_guid: 10
        process_username: string
        registry_key: string
        type: RegistryDeleteEvent
        registry_value: string
      type: object
      properties:
        time:
          $ref: '#/components/schemas/ObservedTime'
        process_id:
          example: 10
          type: integer
          format: int64
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        registry_key:
          example: string
          description: String with at most 1024 characters.
          type: string
        type:
          example: RegistryDeleteEvent
          type: string
          enum:
          - RegistryDeleteEvent
        registry_value:
          example: string
          description: String with at most 2048 characters.
          type: string
      additionalProperties: false
      required:
      - time
      - process_id
      - process_name
      - registry_key
      - type
    MetaData:
      example:
        keyword: string
      description: metadata associated to the incident.
      type: object
      additionalProperties:
        example: string
        description: custom field relevant to attach meta data to.
        x-oneOf:
        - example: string
          type: string
        - example: 10.0
          type: number
          format: double
        - example: '2016-01-01T01:01:01.000Z'
          type: string
          format: date-time
        - example: keyword
          type: string
        - example: true
          type: boolean
    Tool:
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        labels:
          example:
          - credential-exploitation
          description: The kind(s) of tool(s) being described.
          type: array
          items:
            type: string
        schema_version:
          example: 1.3.30
          description: CTIM schema version for this entity.
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        type:
          example: tool
          type: string
          enum:
          - tool
        created:
          type: string
          format: date-time
        x_mitre_aliases:
          example:
          - string
          description: ATT&CK Software.aliases.
          type: array
          items:
            type: string
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tool_version:
          example: string
          description: The version identifier associated with the Tool.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        kill_chain_phases:
          example:
          - kill_chain_name: string
            phase_name: string
          description: The list of kill chain phases for which this Tool can be used.
          type: array
          items:
            $ref: '#/components/schemas/KillChainPhase'
        client_id:
          type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
      additionalProperties: false
      required:
      - description
      - labels
      - schema_version
      - type
      - short_description
      - title
      - id
    DeliberateEnvelopedObserveBundleDataDataFeedbacks:
      type: object
      properties:
        count:
          type: number
          format: double
        docs:
          type: array
          items:
            $ref: '#/components/schemas/Feedback'
          uniqueItems: true
      additionalProperties: false
      required:
      - count
      - docs
    Weakness:
      type: object
      properties:
        description:
          example: string
          description: Should be short and limited to the key points that define this weakness.
          type: string
        background_details:
          example: string
          description: Information that is relevant but not related to the nature of the weakness itself.
          type: string
        paradigms:
          example:
          - prevalence: Often
            name: string
          description: Applicable paradigms.
          type: array
          items:
            $ref: '#/components/schemas/Paradigm'
        abstraction_level:
          example: Base
          description: Refers to the level of abstraction or granularity used to describe the weakness. It helps to categorize the vulnerability based on the level of detail provided.
          type: string
          enum:
          - Variant
          - Class
          - Base
          - Compound
        architectures:
          example:
          - prevalence: Often
            name: string
            class: Embedded
          description: Applicable architectures.
          type: array
          items:
            $ref: '#/components/schemas/Architecture'
        schema_version:
          example: 1.3.30
          description: CTIM schema version for this entity.
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        alternate_terms:
          example:
          - term: string
            description: string
          description: Indicates one or more other names used to describe this weakness.
          type: array
          items:
            $ref: '#/components/schemas/AlternateTerm'
        likelihood:
          example: High
          description: Likelihood of exploit.
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        type:
          example: weakness
          description: The fixed value weakness
          type: string
          enum:
          - weakness
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        functional_areas:
          example:
          - Authentication
          description: Identifies the functional area of the software in which the weakness is most likely to occur.
          type: array
          items:
            type: string
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        modes_of_introduction:
          example:
          - phase: Architecture and Design
            note: string
          description: Information about how and when a given weakness may be introduced.
          type: array
          items:
            $ref: '#/components/schemas/ModeOfIntroduction'
        structure:
          example: Chain
          description: Defines the structural nature of the weakness.
          type: string
          enum:
          - Chain
          - Simple
          - Composite
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        notes:
          example:
          - type: Applicable Platform
            note: string
          description: Provides any additional comments about the weakness.
          type: array
          items:
            $ref: '#/components/schemas/Note'
        common_consequences:
          example:
          - scopes:
            - Access Control
            impacts:
            - Alter Execution Logic
            likelihood: High
            note: string
          description: Refers to the typical or expected negative effects that can result from exploiting the weakness. This could include anything from unauthorized access to data, denial of service, system crashes or other things.
          type: array
          items:
            $ref: '#/components/schemas/Consequence'
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        detection_methods:
          example:
          - method: Architecture or Design Review
            description: string
            effectiveness: High
            effectiveness_notes: string
          description: Identifies methods that may be employed to detect this weakness, including their strengths and limitations.
          type: array
          items:
            $ref: '#/components/schemas/DetectionMethod'
        operating_systems:
          example:
          - prevalence: Often
            name: string
            version: string
            cpe_id: string
            class: Android
          description: Applicable operating systems.
          type: array
          items:
            $ref: '#/components/schemas/OperatingSystem'
        client_id:
          type: string
        affected_resources:
          example:
          - CPU
          description: Identifies system resources that can be affected by an exploit of this weakness.
          type: array
          items:
            type: string
        languages:
          example:
          - prevalence: Often
            name: string
            class: Assembly
          description: Applicable Languages.
          type: array
          items:
            $ref: '#/components/schemas/Language'
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        potential_mitigations:
          example:
          - description: string
            phases:
            - Architecture and Design
            strategy: Attack Surface Reduction
            effectiveness: Defense in Depth
            effectiveness_notes: string
          description: Describes potential mitigations associated with a weakness.
          type: array
          items:
            $ref: '#/components/schemas/Mitigation'
        technologies:
          example:
          - prevalence: Often
            name: string
          description: Applicable technologies.
          type: array
          items:
            $ref: '#/components/schemas/Technology'
      additionalProperties: false
      required:
      - description
      - schema_version
      - type
      - id
    Context:
      example:
        http_events:
        - process_guid: 10
          traffic:
            destination_host_name: string
            protocol: 10
            source_ip: string
            destination_subnet: string
            destination_ip: string
            source_subnet: string
            destination_port: 10
            direction: incoming
            source_port: 10
          method: CONNECT
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: HTTPEvent
          host: string
          process_name: string
          process_id: 10
          process_username: string
          query: string
          encrypted: true
          url_port: 10
        process_create_events:
        - parent_process_name: string
          process_guid: 10
          parent_process_guid: 10
          process_disposition: string
          parent_process_size: 10
          process_size: 10
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          parent_process_disposition: string
          type: ProcessCreateEvent
          parent_process_username: string
          parent_process_id: 10
          parent_process_args: string
          process_name: string
          process_hash: string
          process_id: 10
          parent_process_hash: string
          process_username: string
          parent_creation_time: '2016-01-01T01:01:01.000Z'
          process_args: string
        registry_delete_events:
        - time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          process_id: 10
          process_name: string
          process_guid: 10
          process_username: string
          registry_key: string
          type: RegistryDeleteEvent
          registry_value: string
        file_modify_events:
        - file_name: string
          process_guid: 10
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: FileModifyEvent
          file_path: string
          process_name: string
          process_id: 10
          process_username: string
          failed: false
        registry_set_events:
        - process_guid: 10
          registry_data: string
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: RegistrySetEvent
          registry_data_length: 10
          registry_value: string
          registry_key: string
          process_name: string
          process_id: 10
          process_username: string
        file_create_events:
        - file_name: string
          process_guid: 10
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: FileCreateEvent
          file_path: string
          process_name: string
          process_id: 10
          process_username: string
          failed: false
        registry_create_events:
        - time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          process_id: 10
          process_name: string
          process_guid: 10
          process_username: string
          registry_key: string
          type: RegistryCreateEvent
        library_load_events:
        - time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          process_id: 10
          process_name: string
          process_guid: 10
          process_username: string
          type: LibraryLoadEvent
          dll_library_name: string
          dll_library_path: string
        file_move_events:
        - file_name: string
          process_guid: 10
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: FileMoveEvent
          old_name: string
          file_path: string
          process_name: string
          process_id: 10
          process_username: string
          new_name: string
        file_delete_events:
        - file_name: string
          process_guid: 10
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: FileDeleteEvent
          file_path: string
          process_name: string
          process_id: 10
          process_username: string
          failed: false
        netflow_events:
        - parent_process_name: string
          byte_count_in: 10
          process_guid: 10
          process_path: string
          traffic:
            destination_host_name: string
            protocol: 10
            source_ip: string
            destination_subnet: string
            destination_ip: string
            source_subnet: string
            destination_port: 10
            direction: incoming
            source_port: 10
          flow_time: '2016-01-01T01:01:01.000Z'
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          parent_process_account: string
          type: NetflowEvent
          process_account_type: string
          parent_process_path: string
          parent_process_id: 10
          parent_process_args: string
          process_name: string
          process_account: string
          parent_process_account_type: string
          process_hash: string
          process_id: 10
          parent_process_hash: string
          process_username: string
          byte_count_out: 10
          process_args: string
        registry_rename_events:
        - time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          process_id: 10
          process_name: string
          process_guid: 10
          process_username: string
          registry_key: string
          type: RegistryRenameEvent
          registry_old_key: string
      description: Context including the event type that best fits the type of the sighting.
      type: object
      properties:
        http_events:
          example:
          - process_guid: 10
            traffic:
              destination_host_name: string
              protocol: 10
              source_ip: string
              destination_subnet: string
              destination_ip: string
              source_subnet: string
              destination_port: 10
              direction: incoming
              source_port: 10
            method: CONNECT
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: HTTPEvent
            host: string
            process_name: string
            process_id: 10
            process_username: string
            query: string
            encrypted: true
            url_port: 10
          description: a list of `HTTPType`
          type: array
          items:
            $ref: '#/components/schemas/HTTPType'
        process_create_events:
          example:
          - parent_process_name: string
            process_guid: 10
            parent_process_guid: 10
            process_disposition: string
            parent_process_size: 10
            process_size: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            parent_process_disposition: string
            type: ProcessCreateEvent
            parent_process_username: string
            parent_process_id: 10
            parent_process_args: string
            process_name: string
            process_hash: string
            process_id: 10
            parent_process_hash: string
            process_username: string
            parent_creation_time: '2016-01-01T01:01:01.000Z'
            process_args: string
          description: a list of `ProcessCreate`
          type: array
          items:
            $ref: '#/components/schemas/ProcessCreateType'
        registry_delete_events:
          example:
          - time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            process_id: 10
            process_name: string
            process_guid: 10
            process_username: string
            registry_key: string
            type: RegistryDeleteEvent
            registry_value: string
          description: a list of `RegistryDeleteType`
          type: array
          items:
            $ref: '#/components/schemas/RegistryDeleteType'
        file_modify_events:
          example:
          - file_name: string
            process_guid: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: FileModifyEvent
            file_path: string
            process_name: string
            process_id: 10
            process_username: string
            failed: false
          description: a list of `FileModifyType`
          type: array
          items:
            $ref: '#/components/schemas/FileModifyType'
        registry_set_events:
          example:
          - process_guid: 10
            registry_data: string
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: RegistrySetEvent
            registry_data_length: 10
            registry_value: string
            registry_key: string
            process_name: string
            process_id: 10
            process_username: string
          description: a list of `RegistrySetType`
          type: array
          items:
            $ref: '#/components/schemas/RegistrySetType'
        file_create_events:
          example:
          - file_name: string
            process_guid: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: FileCreateEvent
            file_path: string
            process_name: string
            process_id: 10
            process_username: string
            failed: false
          description: a list of `FileCreateType`
          type: array
          items:
            $ref: '#/components/schemas/FileCreateType'
        registry_create_events:
          example:
          - time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            process_id: 10
            process_name: string
            process_guid: 10
            process_username: string
            registry_key: string
            type: RegistryCreateEvent
          description: a list of `RegistryCreateType`
          type: array
          items:
            $ref: '#/components/schemas/RegistryCreateType'
        library_load_events:
          example:
          - time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            process_id: 10
            process_name: string
            process_guid: 10
            process_username: string
            type: LibraryLoadEvent
            dll_library_name: string
            dll_library_path: string
          description: a list of `LibraryLoadType`
          type: array
          items:
            $ref: '#/components/schemas/LibraryLoadType'
        file_move_events:
          example:
          - file_name: string
            process_guid: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: FileMoveEvent
            old_name: string
            file_path: string
            process_name: string
            process_id: 10
            process_username: string
            new_name: string
          description: a list of `FileMoveType`
          type: array
          items:
            $ref: '#/components/schemas/FileMoveType'
        file_delete_events:
          example:
          - file_name: string
            process_guid: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: FileDeleteEvent
            file_path: string
            process_name: string
            process_id: 10
            process_username: string
            failed: false
          description: a list of `FileDeleteType`
          type: array
          items:
            $ref: '#/components/schemas/FileDeleteType'
        netflow_events:
          example:
          - parent_process_name: string
            byte_count_in: 10
            process_guid: 10
            process_path: string
            traffic:
              destination_host_name: string
              protocol: 10
              source_ip: string
              destination_subnet: string
              destination_ip: string
              source_subnet: string
              destination_port: 10
              direction: incoming
              source_port: 10
            flow_time: '2016-01-01T01:01:01.000Z'
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            parent_process_account: string
            type: NetflowEvent
            process_account_type: string
            parent_process_path: string
            parent_process_id: 10
            parent_process_args: string
            process_name: string
            process_account: string
            parent_process_account_type: string
            process_hash: string
            process_id: 10
            parent_process_hash: string
            process_username: string
            byte_count_out: 10
            process_args: string
          description: a list of `NetflowType`
          type: array
          items:
            $ref: '#/components/schemas/NetflowType'
        registry_rename_events:
          example:
          - time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            process_id: 10
            process_name: string
            process_guid: 10
            process_username: string
            registry_key: string
            type: RegistryRenameEvent
            registry_old_key: string
          description: a list of `RegistryRenameType`
          type: array
          items:
            $ref: '#/components/schemas/RegistryRenameType'
      additionalProperties: false
    DeliberateEnvelopedObserveBundleDataDataVulnerabilities:
      type: object
      properties:
        count:
          type: number
          format: double
        docs:
          type: array
          items:
            $ref: '#/components/schemas/Vulnerability'
          uniqueItems: true
      additionalProperties: false
      required:
      - count
      - docs
    FileCreateType:
      example:
        file_name: string
        process_guid: 10
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        type: FileCreateEvent
        file_path: string
        process_name: string
        process_id: 10
        process_username: string
        failed: false
      type: object
      properties:
        file_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        time:
          $ref: '#/components/schemas/ObservedTime'
        type:
          example: FileCreateEvent
          type: string
          enum:
          - FileCreateEvent
        file_path:
          example: string
          description: String with at most 2048 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        failed:
          example: false
          type: boolean
      additionalProperties: false
      required:
      - file_name
      - time
      - type
      - file_path
      - process_name
      - process_id
    IncidentTime:
      example:
        opened: '2016-01-01T01:01:01.000Z'
        discovered: '2016-01-01T01:01:01.000Z'
        reported: '2016-01-01T01:01:01.000Z'
        remediated: '2016-01-01T01:01:01.000Z'
        closed: '2016-01-01T01:01:01.000Z'
        rejected: '2016-01-01T01:01:01.000Z'
        contained: '2016-01-01T01:01:01.000Z'
      description: Relevant time values associated with this Incident.
      type: object
      properties:
        opened:
          example: '2016-01-01T01:01:01.000Z'
          description: Time the incident was first opened.
          type: string
          format: date-time
        discovered:
          example: '2016-01-01T01:01:01.000Z'
          description: Time the incident was first discovered.
          type: string
          format: date-time
        reported:
          example: '2016-01-01T01:01:01.000Z'
          description: Time the incident was first reported.
          type: string
          format: date-time
        remediated:
          example: '2016-01-01T01:01:01.000Z'
          description: Time that the remediation of the damage from the incident was completed.
          type: string
          format: date-time
        closed:
          example: '2016-01-01T01:01:01.000Z'
          description: Time that the incident was last closed.
          type: string
          format: date-time
        rejected:
          example: '2016-01-01T01:01:01.000Z'
          description: Time that the incident was first rejected.
          type: string
          format: date-time
        contained:
          example: '2016-01-01T01:01:01.000Z'
          description: Time that the incident was first contained.
          type: string
          format: date-time
      additionalProperties: false
      required:
      - opened
    CPEMatch:
      example:
        vulnerable: true
        cpe23Uri: string
        versionStartIncluding: string
        versionEndIncluding: string
        versionStartExcluding: string
        versionEndExcluding: string
      type: object
      properties:
        vulnerable:
          example: true
          type: boolean
        cpe23Uri:
          example: string
          description: A text representation of a software or hardware platform.
          type: string
        versionStartIncluding:
          example: string
          description: A string representing the lower bound(inclusive) of version in the CPE.
          type: string
        versionEndIncluding:
          example: string
          description: A string representing the upper bound(inclusive) of version in the CPE.
          type: string
        versionStartExcluding:
          example: string
          description: A string representing the lower bound(exclusive) of version in the CPE.
          type: string
        versionEndExcluding:
          example: string
          description: A string representing the upper bound(exclusive) of version in the CPE.
          type: string
      additionalProperties: false
      required:
      - vulnerable
      - cpe23Uri
    DeliberateEnvelopedObserveBundleDataDataJudgements:
      type: object
      properties:
        count:
          type: number
          format: double
        docs:
          type: array
          items:
            $ref: '#/components/schemas/Judgement'
          uniqueItems: true
      additionalProperties: false
      required:
      - count
      - docs
    Mitigation:
      example:
        description: string
        phases:
        - Architecture and Design
        strategy: Attack Surface Reduction
        effectiveness: Defense in Depth
        effectiveness_notes: string
      type: object
      properties:
        description:
          example: string
          description: A description of this individual mitigation including any strengths and shortcomings of this mitigation for the weakness.
          type: string
        phases:
          example:
          - Architecture and Design
          description: Indicates the development life cycle phase during which this particular mitigation may be applied.
          type: array
          items:
            type: string
        strategy:
          example: Attack Surface Reduction
          description: A general strategy for protecting a system to which this mitigation contributes.
          type: string
        effectiveness:
          example: Defense in Depth
          description: Summarizes how effective the mitigation may be in preventing the weakness.
          type: string
        effectiveness_notes:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
      additionalProperties: false
      required:
      - description
    ModifierType:
      example:
        response: acknowledge
        method:
        - acl
        additional_properties:
          context: string
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        frequency: string
        duration: '2016-01-01T01:01:01.000Z'
        source: string
        search: cve
        option: string
        id: string
        location: internal
        delay: '2016-01-01T01:01:01.000Z'
        destination: copy-to
      type: object
      properties:
        response:
          example: acknowledge
          type: string
          enum:
          - query
          - status
          - acknowledge
          - command-ref
        method:
          example:
          - acl
          type: array
          items:
            type: string
            enum:
            - blackhole
            - unauthenticated
            - suspend
            - graceful
            - hibernate
            - whitelist
            - honeypot
            - immediate
            - spawn
            - blacklist
            - acl
            - segmentation
            - authenticated
        additional_properties:
          $ref: '#/components/schemas/AdditionalProperties'
        time:
          $ref: '#/components/schemas/ValidTime'
        frequency:
          example: string
          description: String with at most 1024 characters.
          type: string
        duration:
          example: '2016-01-01T01:01:01.000Z'
          description: Schema definition for all date or timestamp values.  Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
          type: string
          format: date-time
        source:
          example: string
          description: String with at most 1024 characters.
          type: string
        search:
          example: cve
          type: string
          enum:
          - vendor_bulletin
          - patch
          - signature
          - cve
        option:
          example: string
          description: String with at most 1024 characters.
          type: string
        id:
          example: string
          description: String with at most 1024 characters.
          type: string
        location:
          example: internal
          type: string
          enum:
          - internal
          - perimeter
        delay:
          example: '2016-01-01T01:01:01.000Z'
          description: Schema definition for all date or timestamp values.  Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
          type: string
          format: date-time
        destination:
          example: copy-to
          type: string
          enum:
          - modify-to
          - set-to
          - copy-to
          - move-to
          - save-to
          - restore-point
          - report-to
      additionalProperties: false
    ModuleErrorMessage:
      type: object
      properties:
        code:
          type: string
        message:
          type: string
        type:
          type: string
          enum:
          - fatal
          - warning
          - error
        module:
          type: string
      additionalProperties: false
      required:
      - code
      - message
      - type
    DeliberateEnvelopedObserveBundleDataDataVerdicts:
      type: object
      properties:
        count:
          type: number
          format: double
        docs:
          type: array
          items:
            $ref: '#/components/schemas/Verdict'
          uniqueItems: true
      additionalProperties: false
      required:
      - count
      - docs
    ModeOfIntroduction:
      example:
        phase: Architecture and Design
        note: string
      type: object
      properties:
        phase:
          example: Architecture and Design
          description: Identifies the point in the software life cycle at which the weakness may be introduced.
          type: string
        note:
          example: string
          description: Provides a typical scenario related to introduction during the given phase.
          type: string
      additionalProperties: false
      required:
      - phase
    Configurations:
      example:
        CVE_data_version: string
        nodes:
        - operator: AND
          cpe_match:
          - vulnerable: true
            cpe23Uri: string
            versionStartIncluding: string
            versionEndIncluding: string
            versionStartExcluding: string
            versionEndExcluding: string
          children:
          - operator: AND
            cpe_match:
            - vulnerable: true
              cpe23Uri: string
              versionStartIncluding: string
              versionEndIncluding: string
              versionStartExcluding: string
              versionEndExcluding: string
            negate: true
          negate: true
      description: "Represents a list of affected versions or configurations of a software component that is impacted by a vulnerability. \nBy tracking the affected software components and versions, defenders can identify which systems are potentially exposed to an attack, and apply appropriate mitigations."
      type: object
      properties:
        CVE_data_version:
          example: string
          description: Specifies the version of the CVE (Common Vulnerabilities and Exposures) dictionary used by the vulnerability information provider.
          type: string
        nodes:
          example:
          - operator: AND
            cpe_match:
            - vulnerable: true
              cpe23Uri: string
              versionStartIncluding: string
              versionEndIncluding: string
              versionStartExcluding: string
              versionEndExcluding: string
            children:
            - operator: AND
              cpe_match:
              - vulnerable: true
                cpe23Uri: string
                versionStartIncluding: string
                versionEndIncluding: string
                versionStartExcluding: string
                versionEndExcluding: string
              negate: true
            negate: true
          description: Each `node` in the CTIM standard configuration includes information such as the `operator` (such as "less than", or "greater than or equal to"), and the `cpe` (Common Platform Enumeration) string which identifies the specific software, `CPE` is a structured naming scheme for IT systems, platforms, and software packages, and it is instrumental in enabling data exchange between different systems.
          type: array
          items:
            $ref: '#/components/schemas/CPENode'
      additionalProperties: false
      required:
      - CVE_data_version
      - nodes
    Traffic:
      example:
        destination_host_name: string
        protocol: 10
        source_ip: string
        destination_subnet: string
        destination_ip: string
        source_subnet: string
        destination_port: 10
        direction: incoming
        source_port: 10
      type: object
      properties:
        destination_host_name:
          example: string
          type: string
        protocol:
          example: 10
          description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)
          type: integer
          format: int64
        source_ip:
          example: string
          type: string
        destination_subnet:
          example: string
          type: string
        destination_ip:
          example: string
          type: string
        source_subnet:
          example: string
          type: string
        destination_port:
          example: 10
          type: integer
          format: int64
        direction:
          example: incoming
          type: string
          enum:
          - incoming
          - outgoing
        source_port:
          example: 10
          type: integer
          format: int64
      additionalProperties: false
      required:
      - protocol
      - source_ip
      - destination_ip
      - destination_port
      - direction
      - source_port
    CVE:
      example:
        cve_data_meta:
          id: string
          assigner: string
      type: object
      properties:
        cve_data_meta:
          $ref: '#/components/schemas/CVEDataMeta'
      additionalProperties: false
      required:
      - cve_data_meta
    IncidentScores:
      example:
        asset: 10.0
      description: Used to indicate the severity or impact score of the threat represented by the incident.
      type: object
      additionalProperties:
        example: 10.0
        description: "Field is used to indicate the severity or impact of the threat represented by the incident.\nIt's an open-type dictionary object with score types and numeric value of the score.\n\nFor example, systems can have the following score types:\n\n- `asset` - assesses the potential damage or harm that the threat can cause to the affected asset(s). The scale ranges from 0 to 10, with 10 indicating the highest potential harm. \n\n- `global` - assesses the overall impact or significance of the threat to the organization or wider community. The scale ranges from 0 to 1000, with 1000 indicating the highest impact.\n\n- `ttp` - a measure of the threat actor's proficiency in utilizing TTPs. Typically, ranges from 0-100, with a higher score indicating a greater threat or concern."
        type: number
        format: double
    RegistryRenameType:
      example:
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        process_id: 10
        process_name: string
        process_guid: 10
        process_username: string
        registry_key: string
        type: RegistryRenameEvent
        registry_old_key: string
      type: object
      properties:
        time:
          $ref: '#/components/schemas/ObservedTime'
        process_id:
          example: 10
          type: integer
          format: int64
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        registry_key:
          example: string
          description: String with at most 1024 characters.
          type: string
        type:
          example: RegistryRenameEvent
          type: string
          enum:
          - RegistryRenameEvent
        registry_old_key:
          example: string
          description: String with at most 1024 characters.
          type: string
      additionalProperties: false
      required:
      - time
      - process_id
      - process_name
      - registry_key
      - type
      - registry_old_key
    Sighting:
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        schema_version:
          example: 1.3.30
          description: CTIM schema version for this entity.
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        relations:
          example:
          - origin: string
            origin_uri: string
            relation: Allocated
            relation_info:
              keyword: anything
            source:
              value: 1.2.3.4
              type: ip
            related:
              value: 1.2.3.4
              type: ip
          description: Provide any context we can about where the observable came from.
          type: array
          items:
            $ref: '#/components/schemas/ObservedRelation'
        sensor_coordinates:
          $ref: '#/components/schemas/SensorCoordinates'
        observables:
          example:
          - value: 1.2.3.4
            type: ip
          description: The object(s) of interest.
          type: array
          items:
            $ref: '#/components/schemas/Observable'
        type:
          example: sighting
          type: string
          enum:
          - sighting
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        targets:
          example:
          - type: endpoint
            observables:
            - value: 1.2.3.4
              type: ip
            observed_time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            os: string
          description: 'May include one or more targets that observed the associated indicator. Targets can include network devices, host devices, or other entities that are capable of detecting indicators of compromise.


            Can be used to assess the scope of potential threats, helping analysts understand which devices or components of the network may be vulnerable to attack. For example, if a particular malware strain is detected on several different systems within an organization, the `targets` field may indicate which systems are affected and which may need to be isolated or patched to prevent further spread.'
          type: array
          items:
            $ref: '#/components/schemas/IdentitySpecification'
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        resolution:
          example: detected
          description: Represents the disposition or actions taken on the associated threat intelligence.
          type: string
        internal:
          example: false
          description: "If `true`, indicates that the sighting was reported from internal sources, such as an organization's own internal security tools or SOC.\n Internal sightings are often considered more reliable and actionable than external sightings, which are reported from external sources and may have a lower level of trustworthiness. Internal sightings can provide more context and can help identify potential threats that are unique to a particular environment or organization.\n Internal sightings can also help organizations prioritize their security response efforts by identifying threats that are specific to their environment and may not yet be widely known."
          type: boolean
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        detection_interval:
          $ref: '#/components/schemas/ObservedTime'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        activity_interval:
          $ref: '#/components/schemas/ObservedTime'
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        count:
          example: 10
          description: 'The number of times an indicator was observed within a certain period of time.

            For example, if an IP address associated with known malicious activity is observed once within a period of time, it may indicate a low-level threat. However, if the same IP address is observed multiple times within a short time frame, it may indicate a more severe and persistent threat.

            It can also be used to prioritize security alerts and indicate the urgency of a response. High counts indicate that an indicator is actively being used in a larger campaign, while low counts may indicate isolated incidents.'
          type: integer
          format: int64
        severity:
          example: Critical
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Critical
          - Low
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        modification_interval:
          $ref: '#/components/schemas/ObservedTime'
        context:
          $ref: '#/components/schemas/Context'
        client_id:
          type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        confidence:
          example: High
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        observed_time:
          $ref: '#/components/schemas/ObservedTime'
        sensor:
          example: endpoint
          description: The OpenC2 Actuator name that best fits the device that is creating this sighting (e.g. network.firewall)
          type: string
        data:
          $ref: '#/components/schemas/SightingDataTable'
      additionalProperties: false
      required:
      - schema_version
      - type
      - id
      - count
      - confidence
      - observed_time
    AdditionalProperties:
      example:
        context: string
      type: object
      properties:
        context:
          example: string
          description: String with at most 1024 characters.
          type: string
      additionalProperties: false
      required:
      - context
    Vulnerability:
      type: object
      properties:
        description:
          example: string
          description: "Various sources of vulnerability information can be used, including third-party  resources like the National Vulnerability Database (NVD) and the Common  Vulnerabilities and Exposures (CVE) database. The platform then analyzes this  data and provides the user with relevant details such as the severity of the  vulnerability, the affected systems, and remediation recommendations. \n\n Based on this information, the user can prioritize patching and other mitigation  strategies to reduce the risk of potential attacks."
          type: string
        schema_version:
          example: 1.3.30
          description: CTIM schema version for this entity.
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        published_date:
          example: '2016-01-01T01:01:01.000Z'
          description: "Represents the date when a vulnerability was publicly disclosed or made available to the general public. \n\nImportant for tracking the age of a vulnerability, as well as for determining when a particular vulnerability was first introduced into a system. The published date can be used to identify the time window during which a system may have been vulnerable to a particular exploit.\n\nFor example, if an organization discovers that a vulnerability was published before their system's installation date, but they did not apply the necessary security updates in a timely manner, it can be concluded that their system was vulnerable for the period between the installation date and the date when the necessary security updates were applied."
          type: string
          format: date-time
        cve:
          $ref: '#/components/schemas/CVE'
        configurations:
          $ref: '#/components/schemas/Configurations'
        type:
          example: vulnerability
          description: The fixed value vulnerability
          type: string
          enum:
          - vulnerability
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        client_id:
          type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        last_modified_date:
          example: '2016-01-01T01:01:01.000Z'
          description: 'Represents the date when the vulnerability metadata was last updated in the internal database.

            It can be used to track the freshness of the vulnerability information. If the `last_modified_date` is more recent than the `published_date`, it can indicate that there has been some new information or updates related to the vulnerability, such as new patch releases or changes in the severity or impact rating.'
          type: string
          format: date-time
        impact:
          $ref: '#/components/schemas/VulnerabilityImpact'
      additionalProperties: false
      required:
      - description
      - schema_version
      - type
      - id
    Language:
      example:
        prevalence: Often
        name: string
        class: Assembly
      type: object
      properties:
        prevalence:
          example: Often
          description: Defines the different regularities that guide the applicability of platforms.
          type: string
          enum:
          - Undetermined
          - Sometimes
          - Often
          - Rarely
        name:
          example: string
          description: Language name (Clojure, Java, ...)
          type: string
        class:
          example: Assembly
          description: Class of language.
          type: string
      additionalProperties: false
      required:
      - prevalence
    ThreatBrainSpecification:
      example:
        type: ThreatBrain
        query: string
        variables:
        - string
      description: An indicator which runs in threatbrain...
      type: object
      properties:
        type:
          example: ThreatBrain
          type: string
          enum:
          - ThreatBrain
        query:
          example: string
          type: string
        variables:
          example:
          - string
          type: array
          items:
            type: string
      additionalProperties: false
      required:
      - type
      - variables
    CPELeafNode:
      example:
        operator: AND
        cpe_match:
        - vulnerable: true
          cpe23Uri: string
          versionStartIncluding: string
          versionEndIncluding: string
          versionStartExcluding: string
          versionEndExcluding: string
        negate: true
      type: object
      properties:
        operator:
          example: AND
          description: The operator string influences how seqs of cpe matches are related to one another.
          type: string
          enum:
          - AND
          - OR
        cpe_match:
          example:
          - vulnerable: true
            cpe23Uri: string
            versionStartIncluding: string
            versionEndIncluding: string
            versionStartExcluding: string
            versionEndExcluding: string
          type: array
          items:
            $ref: '#/components/schemas/CPEMatch'
        negate:
          example: true
          description: Negates operator when true.
          type: boolean
      additionalProperties: false
      required:
      - operator
      - cpe_match
    FileModifyType:
      example:
        file_name: string
        process_guid: 10
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        type: FileModifyEvent
        file_path: string
        process_name: string
        process_id: 10
        process_username: string
        failed: false
      type: object
      properties:
        file_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        time:
          $ref: '#/components/schemas/ObservedTime'
        type:
          example: FileModifyEvent
          type: string
          enum:
          - FileModifyEvent
        file_path:
          example: string
          description: String with at most 2048 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        failed:
          example: false
          type: boolean
      additionalProperties: false
      required:
      - file_name
      - time
      - type
      - file_path
      - process_name
      - process_id
    DeliberateEnvelopedObserveBundleDataDataCoas:
      type: object
      properties:
        count:
          type: number
          format: double
        docs:
          type: array
          items:
            $ref: '#/components/schemas/COA'
          uniqueItems: true
      additionalProperties: false
      required:
      - count
      - docs
    DeliberateEnvelopedObserveBundleDataDataSightings:
      type: object
      properties:
        count:
          type: number
          format: double
        docs:
          type: array
          items:
            $ref: '#/components/schemas/Sighting'
          uniqueItems: true
      additionalProperties: false
      required:
      - count
      - docs
    FileMoveType:
      example:
        file_name: string
        process_guid: 10
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        type: FileMoveEvent
        old_name: string
        file_path: string
        process_name: string
        process_id: 10
        process_username: string
        new_name: string
      type: object
      properties:
        file_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        time:
          $ref: '#/components/schemas/ObservedTime'
        type:
          example: FileMoveEvent
          type: string
          enum:
          - FileMoveEvent
        old_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        file_path:
          example: string
          description: String with at most 2048 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        new_name:
          example: string
          description: String with at most 1024 characters.
          type: string
      additionalProperties: false
      required:
      - file_name
      - time
      - type
      - old_name
      - file_path
      - process_name
      - process_id
      - new_name
    DeliberateEnvelopedObserveBundleDataDataMalwares:
      type: object
      properties:
        count:
          type: number
          format: double
        docs:
          type: array
          items:
            $ref: '#/components/schemas/Malware'
          uniqueItems: true
      additionalProperties: false
      required:
      - count
      - docs
    TargetType:
      example:
        type: acudid
        specifiers: string
      type: object
      properties:
        type:
          example: acudid
          type: string
        specifiers:
          example: string
          description: Observable types that can be acted upon.
          type: string
      additionalProperties: false
      required:
      - type
    ColumnDefinition:
      example:
        name: string
        type: integer
        description: string
        required: true
        short_description: string
      type: object
      properties:
        name:
          example: string
          type: string
        type:
          example: integer
          type: string
          enum:
          - url
          - string
          - observable
          - number
          - integer
          - markdown
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        required:
          example: true
          description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`.
          type: boolean
        short_description:
          example: string
          type: string
      additionalProperties: false
      required:
      - name
      - type
    IdentityCoordinates:
      example:
        observables:
        - value: 1.2.3.4
          type: ip
      description: Attributes for which the assertion is being made.
      type: object
      properties:
        observables:
          example:
          - value: 1.2.3.4
            type: ip
          type: array
          items:
            $ref: '#/components/schemas/Observable'
      additionalProperties: false
      required:
      - observables
    Feedback:
      type: object
      properties:
        feedback:
          example: -1
          type: integer
          format: int64
          enum:
          - 0
          - 1
          - -1
        schema_version:
          example: 1.3.30
          description: CTIM schema version for this entity.
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        type:
          example: feedback
          type: string
          enum:
          - feedback
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        reason:
          example: string
          type: string
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        entity_id:
          example: string
          description: A URI leading to an entity.
          type: string
        client_id:
          type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
      additionalProperties: false
      required:
      - feedback
      - schema_version
      - type
      - reason
      - id
      - entity_id
    NormalizedError-401:
      example:
        error: invalid_request
        error_description: No JWT found in HTTP Authorization header
      type: object
      properties:
        error:
          type: string
        error_description:
          type: string
        error_code:
          type: string
        error_uri:
          type: string
        trace_id:
          type: string
        schema.core.AnythingSchema@3c6f0b88: {}
      additionalProperties: {}
    EnvelopedReputation:
      example:
        data:
          data:
          - module: AMP File Reputation
            module_instance_id: 21efe095-a80b-4a14-aa50-3cd30aa12966
            module_type_id: 6f24c0f4-3ca7-4b38-af8b-7dbfaef3ab96
            data:
              verdicts:
                count: 1
                docs:
                - type: verdict
                  disposition: 2
                  observable:
                    value: 8fda14f91e27afec5c1b1f71d708775c9b6e2af31e8331bbf26751bc0583dc7e
                    type: sha256
                  disposition_name: Malicious
                  valid_time:
                    start_time: '2023-02-09T17:03:03.999Z'
                    end_time: '2525-01-01T00:00:00.000Z'
              judgements:
                count: 1
                docs:
                - valid_time:
                    start_time: '2023-02-09T17:03:03.999Z'
                    end_time: '2525-01-01T00:00:00.000Z'
                  schema_version: 1.2.1
                  observable:
                    value: 8fda14f91e27afec5c1b1f71d708775c9b6e2af31e8331bbf26751bc0583dc7e
                    type: sha256
                  type: judgement
                  source: AMP Protect DB
                  disposition: 2
                  reason: AMP ProtectDB Conviction
                  disposition_name: Malicious
                  priority: 90
                  id: transient:fb7b99cb-b6a0-434c-88ea-a74038c3052e
                  severity: High
                  tlp: amber
                  confidence: High
          - module: SecureX Global Threat Intelligence
            module_instance_id: 06ce1f6c-fc38-44f3-92c7-08b15258bd89
            module_type_id: f0c76f8e-e766-495e-8804-6c6f9247f4db
            data:
              attack_patterns:
                count: 4
                docs:
                - description: 'Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking [cmd](https://attack.mitre.org/software/S0106). For example, [Forfiles](https://attack.mitre.org/software/S0193), the Program Compatibility Assistant (pcalua.exe), components of the Windows Subsystem for Linux (WSL), as well as other utilities may invoke the execution of programs and commands from a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), Run window, or via scripts. (Citation: VectorSec ForFiles Aug 2017) (Citation: Evi1cg Forfiles Nov 2017)


                    Adversaries may abuse these features for [Defense Evasion](https://attack.mitre.org/tactics/TA0005), specifically to perform arbitrary execution while subverting detections and/or mitigation controls (such as Group Policy) that limit/prevent the usage of [cmd](https://attack.mitre.org/software/S0106) or file extensions more commonly associated with malicious payloads.'
                  abstraction_level: meta
                  schema_version: 1.1.3
                  type: attack-pattern
                  source: MITRE Enterprise ATT&CK
                  external_ids:
                  - attack-pattern--3b0e52ce-517a-4614-a523-1bd5deef6c5e
                  - ATT&CK-T1202
                  short_description: No short-description provided for MITRE Attack Pattern "Indirect Command Execution".
                  title: Indirect Command Execution
                  external_references:
                  - source_name: mitre-attack
                    url: https://attack.mitre.org/techniques/T1202
                    external_id: T1202
                  - source_name: Evi1cg Forfiles Nov 2017
                    description: Evi1cg. (2017, November 26). block cmd.exe ? try this :. Retrieved January 22, 2018.
                    url: https://twitter.com/Evi1cg/status/935027922397573120
                  - source_name: RSA Forfiles Aug 2017
                    description: Partington, E. (2017, August 14). Are you looking out for forfiles.exe (if you are watching for cmd.exe). Retrieved January 22, 2018.
                    url: https://community.rsa.com/community/products/netwitness/blog/2017/08/14/are-you-looking-out-for-forfilesexe-if-you-are-watching-for-cmdexe
                  - source_name: VectorSec ForFiles Aug 2017
                    description: vector_sec. (2017, August 11). Defenders watching launches of cmd? What about forfiles?. Retrieved January 22, 2018.
                    url: https://twitter.com/vector_sec/status/896049052642533376
                  source_uri: https://attack.mitre.org
                  x_mitre_platforms:
                  - Windows
                  id: https://intel.int.iroh.site:443/ctia/attack-pattern/attack-pattern-d928f8b6-595e-41b3-9a69-a24cb15be96e
                  tlp: green
                  x_mitre_data_sources:
                  - 'Process: Process Creation'
                  - 'Command: Command Execution'
                  kill_chain_phases:
                  - kill_chain_name: mitre-attack
                    phase_name: defense-evasion
                  - kill_chain_name: lockheed-martin-cyber-kill-chain
                    phase_name: installation
                  x_mitre_contributors:
                  - Matthew Demaske, Adaptforward
                  timestamp: '2022-05-05T05:06:38.938Z'
                - description: 'Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of [Unix Shell](https://attack.mitre.org/techniques/T1059/004) while Windows installations include the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).


                    There are also cross-platform interpreters such as [Python](https://attack.mitre.org/techniques/T1059/006), as well as those commonly associated with client applications such as [JavaScript](https://attack.mitre.org/techniques/T1059/007) and [Visual Basic](https://attack.mitre.org/techniques/T1059/005).


                    Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in [Initial Access](https://attack.mitre.org/tactics/TA0001) payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various [Remote Services](https://attack.mitre.org/techniques/T1021) in order to achieve remote Execution.(Citation: Powershell Remote Commands)(Citation: Cisco IOS Software Integrity Assurance - Command History)(Citation: Remote Shell Execution in Python)'
                  abstraction_level: meta
                  schema_version: 1.1.3
                  type: attack-pattern
                  source: MITRE Enterprise ATT&CK
                  external_ids:
                  - attack-pattern--7385dfaf-6886-4229-9ecd-6fd678040830
                  - ATT&CK-T1059
                  short_description: No short-description provided for MITRE Attack Pattern "Command and Scripting Interpreter".
                  title: Command and Scripting Interpreter
                  external_references:
                  - source_name: mitre-attack
                    url: https://attack.mitre.org/techniques/T1059
                    external_id: T1059
                  - source_name: Remote Shell Execution in Python
                    description: Abdou Rockikz. (2020, July). How to Execute Shell Commands in a Remote Machine in Python. Retrieved July 26, 2021.
                    url: https://www.thepythoncode.com/article/executing-bash-commands-remotely-in-python
                  - source_name: Cisco IOS Software Integrity Assurance - Command History
                    description: Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Command History. Retrieved October 21, 2020.
                    url: https://tools.cisco.com/security/center/resources/integrity_assurance.html#23
                  - source_name: Powershell Remote Commands
                    description: Microsoft. (2020, August 21). Running Remote Commands. Retrieved July 26, 2021.
                    url: https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/running-remote-commands?view=powershell-7.1
                  source_uri: https://attack.mitre.org
                  x_mitre_platforms:
                  - Linux
                  - macOS
                  - Windows
                  - Network
                  id: https://intel.int.iroh.site:443/ctia/attack-pattern/attack-pattern-7be8c117-3603-448e-ad0d-9691e32ed0ce
                  tlp: green
                  x_mitre_data_sources:
                  - 'Process: Process Creation'
                  - 'Command: Command Execution'
                  - 'Script: Script Execution'
                  - 'Process: Process Metadata'
                  - 'Module: Module Load'
                  kill_chain_phases:
                  - kill_chain_name: mitre-attack
                    phase_name: execution
                  - kill_chain_name: lockheed-martin-cyber-kill-chain
                    phase_name: installation
                  timestamp: '2022-04-19T18:31:48.827Z'
                - description: 'Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project) Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.


                    Similarly, on Linux systems adversaries may abuse trusted binaries such as <code>split</code> to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split)'
                  abstraction_level: meta
                  schema_version: 1.1.3
                  type: attack-pattern
                  source: MITRE Enterprise ATT&CK
                  external_ids:
                  - attack-pattern--457c7820-d331-465a-915e-42f85500ccc4
                  - ATT&CK-T1218
                  short_description: No short-description provided for MITRE Attack Pattern "System Binary Proxy Execution".
                  title: System Binary Proxy Execution
                  external_references:
                  - source_name: mitre-attack
                    url: https://attack.mitre.org/techniques/T1218
                    external_id: T1218
                  - source_name: GTFO split
                    description: GTFOBins. (2020, November 13). split. Retrieved April 18, 2022.
                    url: https://gtfobins.github.io/gtfobins/split/
                  - source_name: LOLBAS Project
                    description: Oddvar Moe et al. (2022, February).  Living Off The Land Binaries, Scripts and Libraries. Retrieved March 7, 2022.
                    url: https://github.com/LOLBAS-Project/LOLBAS#criteria
                  - source_name: split man page
                    description: Torbjorn Granlund, Richard M. Stallman. (2020, March null). split(1) — Linux manual page. Retrieved March 25, 2022.
                    url: https://man7.org/linux/man-pages/man1/split.1.html
                  source_uri: https://attack.mitre.org
                  x_mitre_platforms:
                  - Windows
                  - Linux
                  - macOS
                  id: https://intel.int.iroh.site:443/ctia/attack-pattern/attack-pattern-949789a8-dbf1-45fc-96b9-45e4bc613b5d
                  tlp: green
                  x_mitre_data_sources:
                  - 'File: File Creation'
                  - 'Windows Registry: Windows Registry Key Modification'
                  - 'Command: Command Execution'
                  - 'Process: OS API Execution'
                  - 'Module: Module Load'
                  - 'Process: Process Creation'
                  - 'Network Traffic: Network Connection Creation'
                  kill_chain_phases:
                  - kill_chain_name: mitre-attack
                    phase_name: defense-evasion
                  - kill_chain_name: lockheed-martin-cyber-kill-chain
                    phase_name: installation
                  x_mitre_contributors:
                  - Nishan Maharjan, @loki248
                  - Hans Christoffer Gaardløs
                  - Praetorian
                  - Wes Hurd
                  timestamp: '2022-04-18T14:52:08.678Z'
                - description: 'An app could contain malicious code in obfuscated or encrypted form, then deobfuscate or decrypt the code at runtime to evade many app vetting techniques.(Citation: Rastogi) (Citation: Zhou) (Citation: TrendMicro-Obad) (Citation: Xiao-iOS)'
                  abstraction_level: meta
                  schema_version: 1.1.0
                  type: attack-pattern
                  source: MITRE Device Access
                  external_ids:
                  - attack-pattern--d13fa042-8f26-44e1-a2a8-af0bf8e2ac9a
                  short_description: Obfuscated Files or Information
                  title: Obfuscated Files or Information
                  external_references:
                  - source_name: mitre-mobile-attack
                    url: https://attack.mitre.org/techniques/T1406
                    external_id: T1406
                  - source_name: NIST Mobile Threat Catalogue
                    url: https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-21.html
                    external_id: APP-21
                  - source_name: Rastogi
                    description: 'Vaibhav Rastogi, Yan Chen, and Xuxian Jiang. (2013, May). DroidChameleon: Evaluating Android Anti-malware against Transformation Attacks. Retrieved December 9, 2016.'
                    url: http://pages.cs.wisc.edu/~vrastogi/static/papers/rcj13b.pdf
                  - source_name: Zhou
                    description: 'Yajin Zhou and Xuxian Jiang. (2012, May). Dissecting Android Malware: Characterization and Evolution. Retrieved December 9, 2016.'
                    url: http://ieeexplore.ieee.org/document/6234407
                  - source_name: TrendMicro-Obad
                    description: Veo Zhang. (2013, June 13). Cybercriminals Improve Android Malware Stealth Routines with OBAD. Retrieved December 9, 2016.
                    url: http://blog.trendmicro.com/trendlabs-security-intelligence/cybercriminals-improve-android-malware-stealth-routines-with-obad/
                  - source_name: Xiao-iOS
                    description: 'Claud Xiao. (2016, July). Fruit vs Zombies: Defeat Non-jailbroken iOS Malware. Retrieved December 9, 2016.'
                    url: http://www.slideshare.net/Shakacon/fruit-vs-zombies-defeat-nonjailbroken-ios-malware-by-claud-xiao
                  source_uri: https://attack.mitre.org
                  x_mitre_platforms:
                  - Android
                  - iOS
                  id: https://intel.int.iroh.site:443/ctia/attack-pattern/attack-pattern-8ecdd4b2-3ab4-471f-9bed-468c1c407431
                  tlp: green
                  kill_chain_phases:
                  - kill_chain_name: mitre-mobile-attack
                    phase_name: defense-evasion
                  - kill_chain_name: lockheed-martin-cyber-kill-chain
                    phase_name: installation
                  timestamp: '2019-09-23T13:26:01.263Z'
              indicators:
                count: 1
                docs:
                - description: 'Talos Threat Advisory blog post regarding Threat Spotlight: Following the LNK metadata trail'
                  tags:
                  - Base Blog Indicator
                  valid_time:
                    start_time: '2023-01-19T13:04:02.000Z'
                    end_time: '2023-02-18T13:04:02.000Z'
                  producer: Cisco Talos
                  schema_version: 1.2.0
                  type: indicator
                  source: Talos Threat Advisory Blog
                  external_ids: []
                  title: 'Threat Spotlight: Following the LNK metadata trail'
                  source_uri: https://blog.talosintelligence.com/following-the-lnk-metadata-trail
                  id: https://intel.int.iroh.site:443/ctia/indicator/indicator-bf1ea06c-c132-4bff-9f92-c13ed049265d
                  tlp: green
                  timestamp: '2023-01-19T13:49:07.662Z'
              actors:
                count: 1
                docs:
                - description: '[Gamaredon Group](https://attack.mitre.org/groups/G0047) is a suspected Russian cyber espionage threat group that has targeted military, NGO, judiciary, law enforcement, and non-profit organizations in Ukraine since at least 2013. The name [Gamaredon Group](https://attack.mitre.org/groups/G0047) comes from a misspelling of the word "Armageddon", which was detected in the adversary''s early campaigns.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: Symantec Shuckworm January 2022)(Citation: Microsoft Actinium February 2022)


                    In November 2021, the Ukrainian government publicly attributed [Gamaredon Group](https://attack.mitre.org/groups/G0047) to Russia''s Federal Security Service (FSB) Center 18.(Citation: Bleepingcomputer Gamardeon FSB November 2021)(Citation: Microsoft Actinium February 2022)'
                  valid_time:
                    start_time: '2017-05-31T21:32:09.849Z'
                    end_time: '2525-01-01T00:00:00.000Z'
                  schema_version: 1.2.0
                  type: actor
                  source: MITRE Enterprise ATT&CK
                  external_ids:
                  - intrusion-set--2e290bfe-93b5-48ce-97d6-edcd6d32b7cf
                  - ATT&CK-G0047
                  short_description: No short-description provided for MITRE group "Gamaredon Group".
                  title: Gamaredon Group
                  external_references:
                  - source_name: mitre-attack
                    url: https://attack.mitre.org/groups/G0047
                    external_id: G0047
                  - source_name: ACTINIUM
                    description: '(Citation: Microsoft Actinium February 2022)'
                  - source_name: DEV-0157
                    description: '(Citation: Microsoft Actinium February 2022)'
                  - source_name: Gamaredon Group
                    description: '(Citation: Palo Alto Gamaredon Feb 2017)'
                  - source_name: IRON TILDEN
                    description: '(Citation: Secureworks IRON TILDEN Profile)'
                  - source_name: Armageddon
                    description: '(Citation: Symantec Shuckworm January 2022)'
                  - source_name: Shuckworm
                    description: '(Citation: Symantec Shuckworm January 2022)'
                  - source_name: Primitive Bear
                    description: '(Citation: Unit 42 Gamaredon February 2022)'
                  - source_name: ESET Gamaredon June 2020
                    description: Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.
                    url: https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/
                  - source_name: TrendMicro Gamaredon April 2020
                    description: Kakara, H., Maruyama, E. (2020, April 17). Gamaredon APT Group Use Covid-19 Lure in Campaigns. Retrieved May 19, 2020.
                    url: https://blog.trendmicro.com/trendlabs-security-intelligence/gamaredon-apt-group-use-covid-19-lure-in-campaigns/
                  - source_name: Palo Alto Gamaredon Feb 2017
                    description: Kasza, A. and Reichel, D. (2017, February 27). The Gamaredon Group Toolset Evolution. Retrieved March 1, 2017.
                    url: https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/
                  - source_name: Microsoft Actinium February 2022
                    description: Microsoft Threat Intelligence Center. (2022, February 4). ACTINIUM targets Ukrainian organizations. Retrieved February 18, 2022.
                    url: https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/
                  - source_name: Secureworks IRON TILDEN Profile
                    description: Secureworks CTU. (n.d.). IRON TILDEN. Retrieved February 24, 2022.
                    url: https://www.secureworks.com/research/threat-profiles/iron-tilden
                  - source_name: Symantec Shuckworm January 2022
                    description: Symantec. (2022, January 31). Shuckworm Continues Cyber-Espionage Attacks Against Ukraine. Retrieved February 17, 2022.
                    url: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine
                  - source_name: Bleepingcomputer Gamardeon FSB November 2021
                    description: Toulas, B. (2018, November 4). Ukraine links members of Gamaredon hacker group to Russian FSB. Retrieved April 15, 2022.
                    url: https://www.bleepingcomputer.com/news/security/ukraine-links-members-of-gamaredon-hacker-group-to-russian-fsb/
                  - source_name: Unit 42 Gamaredon February 2022
                    description: Unit 42. (2022, February 3). Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine. Retrieved February 21, 2022.
                    url: https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/
                  source_uri: https://attack.mitre.org
                  id: https://intel.int.iroh.site:443/ctia/actor/actor-8d80e0a4-6ed9-4907-940a-b940187a7131
                  tlp: green
                  aliases:
                  - Gamaredon Group
                  - IRON TILDEN
                  - Primitive Bear
                  - ACTINIUM
                  - Armageddon
                  - Shuckworm
                  - DEV-0157
                  timestamp: '2022-04-15T13:46:34.474Z'
              malwares:
                count: 2
                docs:
                - description: '[QakBot](https://attack.mitre.org/software/S0650) is a modular banking trojan that has been used primarily by financially-motivated actors since at least 2007. [QakBot](https://attack.mitre.org/software/S0650) is continuously maintained and developed and has evolved from an information stealer into a delivery agent for ransomware, most notably [ProLock](https://attack.mitre.org/software/S0654) and [Egregor](https://attack.mitre.org/software/S0554).(Citation: Trend Micro Qakbot December 2020)(Citation: Red Canary Qbot)(Citation: Kaspersky QakBot September 2021)(Citation: ATT QakBot April 2021)'
                  labels:
                  - malware
                  abstraction_level: family
                  schema_version: 1.1.3
                  type: malware
                  source: MITRE Enterprise ATT&CK
                  external_ids:
                  - malware--edc5e045-5401-42bb-ad92-52b5b2ee0de9
                  - ATT&CK-S0650
                  short_description: No short-description provided for MITRE malware "QakBot".
                  title: QakBot
                  external_references:
                  - source_name: mitre-attack
                    url: https://attack.mitre.org/software/S0650
                    external_id: S0650
                  - source_name: Pinkslipbot
                    description: '(Citation: Kaspersky QakBot September 2021)(Citation: ATT QakBot April 2021)'
                  - source_name: QuackBot
                    description: '(Citation: Kaspersky QakBot September 2021)'
                  - source_name: QBot
                    description: '(Citation: Trend Micro Qakbot December 2020)(Citation: Red Canary Qbot)(Citation: Kaspersky QakBot September 2021)(Citation: ATT QakBot April 2021)'
                  - source_name: Trend Micro Qakbot December 2020
                    description: 'Trend Micro. (2020, December 17). QAKBOT: A decade-old malware still with new tricks. Retrieved September 27, 2021.'
                    url: https://success.trendmicro.com/solution/000283381
                  - source_name: Red Canary Qbot
                    description: Rainey, K. (n.d.). Qbot. Retrieved September 27, 2021.
                    url: https://redcanary.com/threat-detection-report/threats/qbot/
                  - source_name: Kaspersky QakBot September 2021
                    description: Kuzmenko, A. et al. (2021, September 2). QakBot technical analysis. Retrieved September 27, 2021.
                    url: https://securelist.com/qakbot-technical-analysis/103931/
                  - source_name: ATT QakBot April 2021
                    description: Morrow, D. (2021, April 15). The rise of QakBot. Retrieved September 27, 2021.
                    url: https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot
                  source_uri: https://attack.mitre.org
                  id: https://intel.int.iroh.site:443/ctia/malware/malware-900f118c-b038-4a77-a320-8e56ffee1602
                  tlp: green
                  timestamp: '2021-10-15T21:47:13.084Z'
                - description: '[IcedID](https://attack.mitre.org/software/S0483) is a modular banking malware designed to steal financial information that has been observed in the wild since at least 2017.  [IcedID](https://attack.mitre.org/software/S0483)  has been downloaded by [Emotet](https://attack.mitre.org/software/S0367) in multiple campaigns.(Citation: IBM IcedID November 2017)(Citation: Juniper IcedID June 2020)'
                  labels:
                  - malware
                  abstraction_level: family
                  schema_version: 1.1.0
                  type: malware
                  source: MITRE Enterprise ATT&CK
                  external_ids:
                  - malware--5147ef15-1cae-4707-8ea1-bee8d98b7f1d
                  - ATT&CK-S0483
                  short_description: IcedID
                  title: IcedID
                  external_references:
                  - source_name: mitre-attack
                    url: https://attack.mitre.org/software/S0483
                    external_id: S0483
                  - source_name: IBM IcedID November 2017
                    description: Kessem, L., et al. (2017, November 13). New Banking Trojan IcedID Discovered by IBM X-Force Research. Retrieved July 14, 2020.
                    url: https://securityintelligence.com/new-banking-trojan-icedid-discovered-by-ibm-x-force-research/
                  - source_name: Juniper IcedID June 2020
                    description: Kimayong, P. (2020, June 18). COVID-19 and FMLA Campaigns used to install new IcedID banking malware. Retrieved July 14, 2020.
                    url: https://blogs.juniper.net/en-us/threat-research/covid-19-and-fmla-campaigns-used-to-install-new-icedid-banking-malware
                  source_uri: https://attack.mitre.org
                  id: https://intel.int.iroh.site:443/ctia/malware/malware-bfbfebee-a01e-4311-81dc-f67163cbbf9d
                  tlp: green
                  timestamp: '2020-08-14T14:25:53.721Z'
              verdicts:
                count: 1
                docs:
                - type: verdict
                  disposition: 3
                  observable:
                    value: 8fda14f91e27afec5c1b1f71d708775c9b6e2af31e8331bbf26751bc0583dc7e
                    type: sha256
                  judgement_id: https://intel.int.iroh.site:443/ctia/judgement/judgement-c569dd26-a097-47a6-8472-c36667638f79
                  disposition_name: Suspicious
                  valid_time:
                    start_time: '2023-01-19T13:04:02.000Z'
                    end_time: '2023-02-18T13:04:02.000Z'
              relationships:
                count: 9
                docs:
                - schema_version: 1.2.0
                  target_ref: https://intel.int.iroh.site:443/ctia/attack-pattern/attack-pattern-d928f8b6-595e-41b3-9a69-a24cb15be96e
                  type: relationship
                  source: Talos Threat Advisory Blog
                  external_ids: []
                  short_description: 'Threat Spotlight: Following the LNK metadata trail indicates MITRE ATT&CK attack-pattern: attack-pattern--3b0e52ce-517a-4614-a523-1bd5deef6c5e'
                  source_uri: https://blog.talosintelligence.com/following-the-lnk-metadata-trail
                  source_ref: https://intel.int.iroh.site:443/ctia/indicator/indicator-bf1ea06c-c132-4bff-9f92-c13ed049265d
                  id: https://intel.int.iroh.site:443/ctia/relationship/relationship-7e0bb3c5-9f42-47e9-9eb6-05c9f563b46a
                  tlp: green
                  timestamp: '2023-01-19T13:49:10.510Z'
                  relationship_type: indicates
                - schema_version: 1.2.0
                  target_ref: https://intel.int.iroh.site:443/ctia/attack-pattern/attack-pattern-8ecdd4b2-3ab4-471f-9bed-468c1c407431
                  type: relationship
                  source: Talos Threat Advisory Blog
                  external_ids: []
                  short_description: 'Threat Spotlight: Following the LNK metadata trail indicates MITRE ATT&CK attack-pattern: attack-pattern--d13fa042-8f26-44e1-a2a8-af0bf8e2ac9a'
                  source_uri: https://blog.talosintelligence.com/following-the-lnk-metadata-trail
                  source_ref: https://intel.int.iroh.site:443/ctia/indicator/indicator-bf1ea06c-c132-4bff-9f92-c13ed049265d
                  id: https://intel.int.iroh.site:443/ctia/relationship/relationship-3202781c-b368-41c7-bce1-d18e00d43f44
                  tlp: green
                  timestamp: '2023-01-19T13:49:10.510Z'
                  relationship_type: indicates
                - schema_version: 1.2.0
                  target_ref: https://intel.int.iroh.site:443/ctia/attack-pattern/attack-pattern-7be8c117-3603-448e-ad0d-9691e32ed0ce
                  type: relationship
                  source: Talos Threat Advisory Blog
                  external_ids: []
                  short_description: 'Threat Spotlight: Following the LNK metadata trail indicates MITRE ATT&CK attack-pattern: attack-pattern--7385dfaf-6886-4229-9ecd-6fd678040830'
                  source_uri: https://blog.talosintelligence.com/following-the-lnk-metadata-trail
                  source_ref: https://intel.int.iroh.site:443/ctia/indicator/indicator-bf1ea06c-c132-4bff-9f92-c13ed049265d
                  id: https://intel.int.iroh.site:443/ctia/relationship/relationship-ea9c61c4-44fb-4f55-b1b5-5b4861e3b41d
                  tlp: green
                  timestamp: '2023-01-19T13:49:10.510Z'
                  relationship_type: indicates
                - schema_version: 1.2.0
                  target_ref: https://intel.int.iroh.site:443/ctia/attack-pattern/attack-pattern-949789a8-dbf1-45fc-96b9-45e4bc613b5d
                  type: relationship
                  source: Talos Threat Advisory Blog
                  external_ids: []
                  short_description: 'Threat Spotlight: Following the LNK metadata trail indicates MITRE ATT&CK attack-pattern: attack-pattern--457c7820-d331-465a-915e-42f85500ccc4'
                  source_uri: https://blog.talosintelligence.com/following-the-lnk-metadata-trail
                  source_ref: https://intel.int.iroh.site:443/ctia/indicator/indicator-bf1ea06c-c132-4bff-9f92-c13ed049265d
                  id: https://intel.int.iroh.site:443/ctia/relationship/relationship-be989fc9-dc06-479b-9611-9084ca0fa0bd
                  tlp: green
                  timestamp: '2023-01-19T13:49:10.510Z'
                  relationship_type: indicates
                - schema_version: 1.2.1
                  target_ref: https://intel.int.iroh.site:443/ctia/actor/actor-8d80e0a4-6ed9-4907-940a-b940187a7131
                  type: relationship
                  source: Talos Threat Advisory Blog
                  external_ids: []
                  short_description: 'Threat Spotlight: Following the LNK metadata trail indicates MITRE ATT&CK intrusion-set: intrusion-set--2e290bfe-93b5-48ce-97d6-edcd6d32b7cf'
                  source_uri: https://blog.talosintelligence.com/following-the-lnk-metadata-trail
                  source_ref: https://intel.int.iroh.site:443/ctia/indicator/indicator-bf1ea06c-c132-4bff-9f92-c13ed049265d
                  id: https://intel.int.iroh.site:443/ctia/relationship/relationship-98f5f656-ec81-45d6-9800-545b7ca5b683
                  tlp: green
                  timestamp: '2023-01-26T18:49:17.897Z'
                  relationship_type: indicates
                - schema_version: 1.2.0
                  target_ref: https://intel.int.iroh.site:443/ctia/malware/malware-bfbfebee-a01e-4311-81dc-f67163cbbf9d
                  type: relationship
                  source: Talos Threat Advisory Blog
                  external_ids: []
                  short_description: 'Threat Spotlight: Following the LNK metadata trail indicates MITRE ATT&CK malware: malware--5147ef15-1cae-4707-8ea1-bee8d98b7f1d'
                  source_uri: https://blog.talosintelligence.com/following-the-lnk-metadata-trail
                  source_ref: https://intel.int.iroh.site:443/ctia/indicator/indicator-bf1ea06c-c132-4bff-9f92-c13ed049265d
                  id: https://intel.int.iroh.site:443/ctia/relationship/relationship-265b5c47-8ece-4389-bd5b-6ca18b85d558
                  tlp: green
                  timestamp: '2023-01-19T13:49:10.510Z'
                  relationship_type: indicates
                - schema_version: 1.2.0
                  target_ref: https://intel.int.iroh.site:443/ctia/indicator/indicator-bf1ea06c-c132-4bff-9f92-c13ed049265d
                  type: relationship
                  source: Talos Threat Advisory Blog
                  external_ids: []
                  short_description: 'judgement element-of Threat Spotlight: Following the LNK metadata trail'
                  source_uri: https://blog.talosintelligence.com/following-the-lnk-metadata-trail
                  source_ref: https://intel.int.iroh.site:443/ctia/judgement/judgement-c569dd26-a097-47a6-8472-c36667638f79
                  id: https://intel.int.iroh.site:443/ctia/relationship/relationship-7b226195-793d-4a7e-b183-c09182433000
                  tlp: green
                  timestamp: '2023-01-19T13:49:10.510Z'
                  relationship_type: element-of
                - schema_version: 1.2.0
                  target_ref: https://intel.int.iroh.site:443/ctia/indicator/indicator-bf1ea06c-c132-4bff-9f92-c13ed049265d
                  type: relationship
                  source: Talos Threat Advisory Blog
                  external_ids: []
                  short_description: 'sighting member-of Threat Spotlight: Following the LNK metadata trail'
                  source_uri: https://blog.talosintelligence.com/following-the-lnk-metadata-trail
                  source_ref: https://intel.int.iroh.site:443/ctia/sighting/sighting-a4c92299-7360-4ccd-b0a6-31a6ba4bdf9c
                  id: https://intel.int.iroh.site:443/ctia/relationship/relationship-5d4c2d53-962e-482f-98e5-4dc32582bab6
                  tlp: green
                  timestamp: '2023-01-19T13:49:10.510Z'
                  relationship_type: member-of
                - schema_version: 1.2.0
                  target_ref: https://intel.int.iroh.site:443/ctia/malware/malware-900f118c-b038-4a77-a320-8e56ffee1602
                  type: relationship
                  source: Talos Threat Advisory Blog
                  external_ids: []
                  short_description: 'Threat Spotlight: Following the LNK metadata trail indicates MITRE ATT&CK malware: malware--edc5e045-5401-42bb-ad92-52b5b2ee0de9'
                  source_uri: https://blog.talosintelligence.com/following-the-lnk-metadata-trail
                  source_ref: https://intel.int.iroh.site:443/ctia/indicator/indicator-bf1ea06c-c132-4bff-9f92-c13ed049265d
                  id: https://intel.int.iroh.site:443/ctia/relationship/relationship-d560c156-5f17-4457-a06d-8ba6908f0e9d
                  tlp: green
                  timestamp: '2023-01-19T13:49:10.511Z'
                  relationship_type: indicates
              judgements:
                count: 1
                docs:
                - valid_time:
                    start_time: '2023-01-19T13:04:02.000Z'
                    end_time: '2023-02-18T13:04:02.000Z'
                  schema_version: 1.2.0
                  observable:
                    value: 8fda14f91e27afec5c1b1f71d708775c9b6e2af31e8331bbf26751bc0583dc7e
                    type: sha256
                  type: judgement
                  source: Talos Threat Advisory Blog
                  external_ids: []
                  disposition: 3
                  source_uri: https://blog.talosintelligence.com/following-the-lnk-metadata-trail
                  disposition_name: Suspicious
                  priority: 95
                  id: https://intel.int.iroh.site:443/ctia/judgement/judgement-c569dd26-a097-47a6-8472-c36667638f79
                  severity: High
                  tlp: green
                  timestamp: '2023-01-19T13:04:02.000Z'
                  confidence: High
              sightings:
                count: 1
                docs:
                - schema_version: 1.2.0
                  observables:
                  - value: 8fda14f91e27afec5c1b1f71d708775c9b6e2af31e8331bbf26751bc0583dc7e
                    type: sha256
                  type: sighting
                  source: Talos Threat Advisory Blog
                  external_ids: []
                  source_uri: https://blog.talosintelligence.com/following-the-lnk-metadata-trail
                  id: https://intel.int.iroh.site:443/ctia/sighting/sighting-a4c92299-7360-4ccd-b0a6-31a6ba4bdf9c
                  count: 1
                  severity: High
                  tlp: green
                  timestamp: '2023-01-19T13:04:02.000Z'
                  confidence: High
                  observed_time:
                    start_time: '2023-01-19T13:04:02.000Z'
          errors: []
          reputation:
            type: verdict
            disposition: 2
            observable:
              value: 8fda14f91e27afec5c1b1f71d708775c9b6e2af31e8331bbf26751bc0583dc7e
              type: sha256
            disposition_name: Malicious
            valid_time:
              start_time: '2023-02-09T17:03:03.999Z'
              end_time: '2525-01-01T00:00:00.000Z'
      type: object
      properties:
        data:
          $ref: '#/components/schemas/EnvelopedReputationData'
        errors:
          type: array
          items:
            $ref: '#/components/schemas/ModuleErrorMessage'
      additionalProperties: false
    SnortSpecification:
      example:
        type: Snort
        snort_sig: string
      description: An indicator which runs in snort...
      type: object
      properties:
        type:
          example: Snort
          type: string
          enum:
          - Snort
        snort_sig:
          example: string
          type: string
      additionalProperties: false
      required:
      - type
      - snort_sig
    Technology:
      example:
        prevalence: Often
        name: string
      type: object
      properties:
        prevalence:
          example: Often
          description: Defines the different regularities that guide the applicability of platforms.
          type: string
          enum:
          - Undetermined
          - Sometimes
          - Often
          - Rarely
        name:
          example: string
          description: Technology name (Web Server, Web Client)
          type: string
      additionalProperties: false
      required:
      - prevalence
    Relationship:
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        schema_version:
          example: 1.3.30
          description: CTIM schema version for this entity.
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        target_ref:
          example: string
          description: A URI leading to an entity.
          type: string
        type:
          example: relationship
          type: string
          enum:
          - relationship
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        source_ref:
          example: string
          description: A URI leading to an entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        client_id:
          type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        relationship_type:
          example: attributed-to
          type: string
      additionalProperties: false
      required:
      - schema_version
      - target_ref
      - type
      - source_ref
      - id
      - relationship_type
    ObservedRelation:
      example:
        origin: string
        origin_uri: string
        relation: Allocated
        relation_info:
          keyword: anything
        source:
          value: 1.2.3.4
          type: ip
        related:
          value: 1.2.3.4
          type: ip
      description: A relation inside a Sighting.
      type: object
      properties:
        origin:
          example: string
          type: string
        origin_uri:
          example: string
          description: A URI
          type: string
        relation:
          example: Allocated
          type: string
        relation_info:
          $ref: '#/components/schemas/DeliberateEnvelopedObserveBundleDataDataSightingsDocsRelationsRelationInfo'
        source:
          $ref: '#/components/schemas/Observable'
        related:
          $ref: '#/components/schemas/Observable'
      additionalProperties: false
      required:
      - origin
      - relation
      - source
      - related
    EnvelopedReputationDataData:
      type: object
      properties:
        module:
          type: string
        module_instance_id:
          type: string
        module_type_id:
          type: string
        module_instance_state:
          type: string
        data:
          $ref: '#/components/schemas/ModuleObserveBundle'
      additionalProperties: false
      required:
      - module
      - module_instance_id
      - module_type_id
      - data
    Actor:
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        motivation:
          example: Ego
          description: The reason or purpose behind the malicious activity attributed to this Actor. By understanding a threat actor's motivation, analysts can better predict the attacker's behavior and anticipate future malicious actions.
          type: string
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        identity:
          $ref: '#/components/schemas/Identity'
        sophistication:
          example: Aspirant
          description: "Represents the level of expertise and skill that the threat actor has displayed in their malicious activities. Can help security analysts assess the potential impact of an attacker's TTPs and determine the potential attack surface. \n\nFor example, a threat actor with a low sophistication level may primarily rely on off-the-shelf malware and attack tools, while an attacker with high sophistication may use custom tools with advanced evasion techniques, zero-day exploits, and sophisticated methods for command and control of their malware. \n\nThe sophistication level of an attacker can also be inferred based on several factors such as the complexity of attacks, the attacker's knowledge of the targeted organization's systems, and the attacker's ability to remain undetected.\n\nIf an attacker shows a high level of sophistication in reconnaissances, social engineering, and phishing, then the attacker may have a good knowledge of the targeted organization and its employees. This means that the attacker may be more successful in infiltrating the organization's network and compromising its systems."
          type: string
          enum:
          - Aspirant
          - Innovator
          - Practitioner
          - Novice
          - Expert
        schema_version:
          example: 1.3.30
          description: CTIM schema version for this entity.
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        planning_and_operational_support:
          example: string
          description: "Provides information about the resources and capabilities of the attacker that could be used to assist in planning and operations related to the threat.\n\n It can be used to describe Infrastructure, Tools, Techniques, and Capabilities used by the threat actor."
          type: string
        type:
          example: actor
          type: string
          enum:
          - actor
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        intended_effect:
          example: Account Takeover
          description: "Represents the desired outcome or impact the threat actor is trying to achieve through their malicious activities. \n\n Helps security analysts to understand the attacker's goals beyond the immediate impact of the attack. By understanding the intended effect, analysts can draw connections between seemingly unrelated attacks and build a more complete understanding of an attacker's long-term goals and motivations."
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        client_id:
          type: string
        aliases:
          example:
          - string
          description: A list of other names that this Threat Actor is believed to use.
          type: array
          items:
            type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        confidence:
          example: High
          description: 'This field can help analysts decide how much trust they can put in the information provided by the threat intelligence sources.


            For example, an Actor entity can have high confidence if the organization''s security researchers have been tracking it for a long time and have gathered a significant amount of intelligence about it through various sources, such as analysis of malware, network traffic, and human intelligence. In contrast, low confidence may indicate the organization has only seen limited or circumstantial evidence.'
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        actor_types:
          example:
          - Cyber Espionage Operations
          type: array
          items:
            type: string
      additionalProperties: false
      required:
      - description
      - valid_time
      - schema_version
      - type
      - source
      - short_description
      - title
      - id
    DeliberateEnvelopedObserveBundleDataDataWeaknesses:
      type: object
      properties:
        count:
          type: number
          format: double
        docs:
          type: array
          items:
            $ref: '#/components/schemas/Weakness'
          uniqueItems: true
      additionalProperties: false
      required:
      - count
      - docs
    ValidTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: The time range during which this Indicator is considered valid.
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If not present, the valid time position of the indicator does not have an upper bound.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If end_time is not present, then the valid time position of the object does not have an upper bound.
          type: string
          format: date-time
      additionalProperties: false
    DeliberateEnvelopedObserveBundleDataDataTools:
      type: object
      properties:
        count:
          type: number
          format: double
        docs:
          type: array
          items:
            $ref: '#/components/schemas/Tool'
          uniqueItems: true
      additionalProperties: false
      required:
      - count
      - docs
    Activity:
      example:
        date_time: '2016-01-01T01:01:01.000Z'
        description: string
      description: Captures the specific activities or tactics associated with the entity. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc.
      type: object
      properties:
        date_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Specifies the date and time at which the activity occured.
          type: string
          format: date-time
        description:
          example: string
          description: A description of the activity.
          type: string
      additionalProperties: false
      required:
      - date_time
      - description
    HTTPType:
      example:
        process_guid: 10
        traffic:
          destination_host_name: string
          protocol: 10
          source_ip: string
          destination_subnet: string
          destination_ip: string
          source_subnet: string
          destination_port: 10
          direction: incoming
          source_port: 10
        method: CONNECT
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        type: HTTPEvent
        host: string
        process_name: string
        process_id: 10
        process_username: string
        query: string
        encrypted: true
        url_port: 10
      type: object
      properties:
        process_guid:
          example: 10
          type: integer
          format: int64
        traffic:
          $ref: '#/components/schemas/Traffic'
        method:
          example: CONNECT
          type: string
          enum:
          - OPTIONS
          - PATCH
          - TRACE
          - HEAD
          - POST
          - CONNECT
          - GET
          - PUT
        time:
          $ref: '#/components/schemas/ObservedTime'
        type:
          example: HTTPEvent
          type: string
          enum:
          - HTTPEvent
        host:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        query:
          example: string
          description: String with at most 5000 characters.
          type: string
        encrypted:
          example: true
          type: boolean
        url_port:
          example: 10
          type: integer
          format: int64
      additionalProperties: false
      required:
      - traffic
      - time
      - type
      - host
      - process_name
      - process_id
    Malware:
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        labels:
          example:
          - adware
          description: The type of malware being described.
          type: array
          items:
            type: string
        abstraction_level:
          example: family
          description: Malware abstraction level.
          type: string
          enum:
          - family
          - version
          - variant
        schema_version:
          example: 1.3.30
          description: CTIM schema version for this entity.
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        type:
          example: malware
          type: string
          enum:
          - malware
        created:
          type: string
          format: date-time
        x_mitre_aliases:
          example:
          - string
          description: ATT&CK Software.aliases.
          type: array
          items:
            type: string
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        kill_chain_phases:
          example:
          - kill_chain_name: string
            phase_name: string
          description: The list of Kill Chain Phases for which this Malware can be used.
          type: array
          items:
            $ref: '#/components/schemas/KillChainPhase'
        client_id:
          type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
      additionalProperties: false
      required:
      - description
      - labels
      - schema_version
      - type
      - short_description
      - title
      - id
    JudgementSpecification:
      example:
        type: Judgement
        judgements:
        - string
        required_judgements:
        - confidence: High
          source: string
          relationship: string
          judgement_id: string
      description: An indicator based on a list of judgements.  If any of the Observables in it's judgements are encountered, than it may be matches against.  If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
      type: object
      properties:
        type:
          example: Judgement
          type: string
          enum:
          - Judgement
        judgements:
          example:
          - string
          type: array
          items:
            type: string
        required_judgements:
          example:
          - confidence: High
            source: string
            relationship: string
            judgement_id: string
          type: array
          items:
            $ref: '#/components/schemas/RelatedJudgement'
      additionalProperties: false
      required:
      - type
      - judgements
      - required_judgements
    RegistrySetType:
      example:
        process_guid: 10
        registry_data: string
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        type: RegistrySetEvent
        registry_data_length: 10
        registry_value: string
        registry_key: string
        process_name: string
        process_id: 10
        process_username: string
      type: object
      properties:
        process_guid:
          example: 10
          type: integer
          format: int64
        registry_data:
          example: string
          description: String with at most 5000 characters.
          type: string
        time:
          $ref: '#/components/schemas/ObservedTime'
        type:
          example: RegistrySetEvent
          type: string
          enum:
          - RegistrySetEvent
        registry_data_length:
          example: 10
          type: integer
          format: int64
        registry_value:
          example: string
          description: String with at most 2048 characters.
          type: string
        registry_key:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
      additionalProperties: false
      required:
      - time
      - type
      - registry_value
      - registry_key
      - process_name
      - process_id
    VulnerabilityImpact:
      example:
        cvss_v2:
          integrity_impact: complete
          target_distribution: not_defined
          availability_requirement: not_defined
          exploitability: not_defined
          access_complexity: low
          temporal_vector_string: string
          exploitability_score: 10.0
          impact_score: 10.0
          user_interaction_required: true
          environmental_vector_string: string
          obtain_other_privilege: true
          availability_impact: complete
          access_vector: network
          base_severity: High
          confidentiality_impact: complete
          confidentiality_requirement: not_defined
          report_confidence: not_defined
          authentication: none
          base_score: 10.0
          obtain_user_privilege: true
          obtain_all_privilege: true
          collateral_damage_potential: not_defined
          remediation_level: not_defined
          vector_string: string
          integrity_requirement: not_defined
        cvss_v3:
          integrity_impact: high
          modified_user_interaction: none
          modified_scope: not_defined
          availability_requirement: high
          user_interaction: none
          modified_integrity_impact: not_defined
          privileges_required: high
          exploitability_score: 10.0
          impact_score: 10.0
          environmental_severity: critical
          modified_availability_impact: not_defined
          availability_impact: high
          scope: changed
          exploit_code_maturity: functional
          modified_attack_complexity: not_defined
          base_severity: critical
          confidentiality_impact: high
          temporal_severity: critical
          modified_confidentiality_impact: not_defined
          confidentiality_requirement: high
          report_confidence: confirmed
          temporal_score: 10.0
          modified_privileges_required: not_defined
          modified_attack_vector: not_defined
          base_score: 10.0
          environmental_score: 10.0
          remediation_level: high
          vector_string: string
          integrity_requirement: high
          attack_vector: adjacent_network
          attack_complexity: high
      description: "Describes the potential impact of a vulnerability that is being tracked in the system. Provides information on the extent of damage that a vulnerability can cause and how serious the consequences could be if it is exploited. \n\nMay contain granular information about the vulnerability severity using the CVSS system, versions 2 and 3.\n\nCVSSv2 and CVSSv3 have different methods of calculating base scores, but both are designed to provide an indication of the level of risk that a vulnerability poses. The base score ranges from 0 to 10, with 10 being the most severe. Additionally, both CVSSv2 and CVSSv3 define severity levels, such as low, medium, high, and critical, based on the base score."
      type: object
      properties:
        cvss_v2:
          $ref: '#/components/schemas/CVSSv2'
        cvss_v3:
          $ref: '#/components/schemas/CVSSv3'
      additionalProperties: false
    SensorCoordinates:
      example:
        type: endpoint
        observables:
        - value: 1.2.3.4
          type: ip
        os: string
      description: Describes the device that made the sighting (sensor) and contains identifying observables for the sensor.
      type: object
      properties:
        type:
          example: endpoint
          description: The sensor/actuator name that best fits a device.
          type: string
        observables:
          example:
          - value: 1.2.3.4
            type: ip
          type: array
          items:
            $ref: '#/components/schemas/Observable'
        os:
          example: string
          type: string
      additionalProperties: false
      required:
      - type
      - observables
    RelatedJudgement:
      example:
        confidence: High
        source: string
        relationship: string
        judgement_id: string
      type: object
      properties:
        confidence:
          example: High
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        source:
          example: string
          type: string
        relationship:
          example: string
          type: string
        judgement_id:
          example: string
          description: A URI leading to a judgement.
          type: string
      additionalProperties: false
      required:
      - judgement_id
    DeliberateEnvelopedObserveBundleDataDataAttackPatterns:
      type: object
      properties:
        count:
          type: number
          format: double
        docs:
          type: array
          items:
            $ref: '#/components/schemas/AttackPattern'
          uniqueItems: true
      additionalProperties: false
      required:
      - count
      - docs
    ActuatorType:
      example:
        type: endpoint
        specifiers:
        - string
      type: object
      properties:
        type:
          example: endpoint
          type: string
          enum:
          - endpoint.sensor
          - process.network-scanner
          - network.switch
          - network.security_manager
          - process.vulnerability-scanner
          - network.hub
          - network.ids
          - network.firewall
          - process
          - network.sense_making
          - process.sandbox
          - network.modem
          - process.email-service
          - process.dns-server
          - network.vpn
          - process.connection-scanner
          - network.nic
          - endpoint.printer
          - network.gateway
          - process.reputation-service
          - process.remediation-service
          - network
          - process.virtualization-service
          - network.ips
          - endpoint.smart-meter
          - endpoint.digital-telephone-handset
          - endpoint.workstation
          - endpoint.server
          - network.wap
          - endpoint.laptop
          - process.aaa-server
          - process.directory-service
          - endpoint.pos-terminal
          - network.bridge
          - other
          - process.file-scanner
          - network.proxy
          - endpoint
          - process.location-service
          - network.sensor
          - endpoint.smart-phone
          - network.hips
          - process.anti-virus-scanner
          - endpoint.tablet
          - network.guard
          - network.router
        specifiers:
          example:
          - string
          description: List of additional properties describing the actuator.
          type: array
          items:
            type: string
      additionalProperties: false
      required:
      - type
    DeliberateEnvelopedObserveBundleDataDataIndicators:
      type: object
      properties:
        count:
          type: number
          format: double
        docs:
          type: array
          items:
            $ref: '#/components/schemas/Indicator'
          uniqueItems: true
      additionalProperties: false
      required:
      - count
      - docs
    ErrorMessage:
      type: object
      properties:
        module_instance_id:
          type: string
        module_type_id:
          type: string
        module_instance_state:
          type: string
        code:
          type: string
        message:
          type: string
        type:
          type: string
          enum:
          - fatal
          - warning
          - error
        module:
          type: string
      additionalProperties: false
      required:
      - module_instance_id
      - module_type_id
      - code
      - message
      - type
    SIOCSpecification:
      example:
        type: SIOC
        SIOC: string
      description: An indicator which runs in snort...
      type: object
      properties:
        type:
          example: SIOC
          type: string
          enum:
          - SIOC
        SIOC:
          example: string
          type: string
      additionalProperties: false
      required:
      - type
      - SIOC
    OpenC2COA:
      example:
        type: structured_coa
        id: string
        action:
          type: alert
        target:
          type: acudid
          specifiers: string
        actuator:
          type: endpoint
          specifiers:
          - string
        modifiers:
          response: acknowledge
          method:
          - acl
          additional_properties:
            context: string
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          frequency: string
          duration: '2016-01-01T01:01:01.000Z'
          source: string
          search: cve
          option: string
          id: string
          location: internal
          delay: '2016-01-01T01:01:01.000Z'
          destination: copy-to
      type: object
      properties:
        type:
          example: structured_coa
          type: string
          enum:
          - structured_coa
        id:
          example: string
          description: String with at most 1024 characters.
          type: string
        action:
          $ref: '#/components/schemas/ActionType'
        target:
          $ref: '#/components/schemas/TargetType'
        actuator:
          $ref: '#/components/schemas/ActuatorType'
        modifiers:
          $ref: '#/components/schemas/ModifierType'
      additionalProperties: false
      required:
      - type
      - action
    IdentityAssertion:
      type: object
      properties:
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        identity:
          $ref: '#/components/schemas/IdentityCoordinates'
        schema_version:
          example: 1.3.30
          description: CTIM schema version for this entity.
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        type:
          example: identity-assertion
          type: string
          enum:
          - identity-assertion
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        client_id:
          type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        assertions:
          example:
          - name: cisco:ctr:ad:host_domain_name
            value: string
          description: Any known context about the identity attributes.
          type: array
          items:
            $ref: '#/components/schemas/Assertion'
      additionalProperties: false
      required:
      - identity
      - schema_version
      - type
      - id
      - assertions
    DeliberateEnvelopedObserveBundleDataDataActors:
      type: object
      properties:
        count:
          type: number
          format: double
        docs:
          type: array
          items:
            $ref: '#/components/schemas/Actor'
          uniqueItems: true
      additionalProperties: false
      required:
      - count
      - docs
    IdentitySpecification:
      example:
        type: endpoint
        observables:
        - value: 1.2.3.4
          type: ip
        observed_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        os: string
      description: Describes the target of the sighting and contains identifying observables for the target.
      type: object
      properties:
        type:
          example: endpoint
          description: The sensor/actuator name that best fits a device.
          type: string
        observables:
          example:
          - value: 1.2.3.4
            type: ip
          type: array
          items:
            $ref: '#/components/schemas/Observable'
        observed_time:
          $ref: '#/components/schemas/ObservedTime'
        os:
          example: string
          type: string
      additionalProperties: false
      required:
      - type
      - observables
      - observed_time
    KillChainPhase:
      example:
        kill_chain_name: string
        phase_name: string
      description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
      type: object
      properties:
        kill_chain_name:
          example: string
          description: The name of the kill chain.
          type: string
        phase_name:
          example: string
          description: The name of the phase in the kill chain.
          type: string
      additionalProperties: false
      required:
      - kill_chain_name
      - phase_name
    Paradigm:
      example:
        prevalence: Often
        name: string
      type: object
      properties:
        prevalence:
          example: Often
          description: Defines the different regularities that guide the applicability of platforms.
          type: string
          enum:
          - Undetermined
          - Sometimes
          - Often
          - Rarely
        name:
          example: string
          description: Paradigm name (Client Server, Mainframe)
          type: string
      additionalProperties: false
      required:
      - prevalence
    DeliberateEnvelopedObserveBundleDataDataDataTables:
      type: object
      properties:
        count:
          type: number
          format: double
        docs:
          type: array
          items:
            $ref: '#/components/schemas/DataTable'
          uniqueItems: true
      additionalProperties: false
      required:
      - count
      - docs
    DetectionMethod:
      example:
        method: Architecture or Design Review
        description: string
        effectiveness: High
        effectiveness_notes: string
      type: object
      properties:
        method:
          example: Architecture or Design Review
          description: Identifies the particular detection method being described.
          type: string
        description:
          example: string
          description: Provides some context of how this method can be applied to a specific weakness.
          type: string
        effectiveness:
          example: High
          description: How effective the detection method may be in detecting the associated weakness.
          type: string
        effectiveness_notes:
          example: string
          description: Provides additional discussion of the strengths and shortcomings of this detection method.
          type: string
      additionalProperties: false
      required:
      - method
      - description
    FileDeleteType:
      example:
        file_name: string
        process_guid: 10
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        type: FileDeleteEvent
        file_path: string
        process_name: string
        process_id: 10
        process_username: string
        failed: false
      type: object
      properties:
        file_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        time:
          $ref: '#/components/schemas/ObservedTime'
        type:
          example: FileDeleteEvent
          type: string
          enum:
          - FileDeleteEvent
        file_path:
          example: string
          description: String with at most 2048 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        failed:
          example: false
          type: boolean
      additionalProperties: false
      required:
      - file_name
      - time
      - type
      - file_path
      - process_name
      - process_id
    RegistryCreateType:
      example:
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        process_id: 10
        process_name: string
        process_guid: 10
        process_username: string
        registry_key: string
        type: RegistryCreateEvent
      type: object
      properties:
        time:
          $ref: '#/components/schemas/ObservedTime'
        process_id:
          example: 10
          type: integer
          format: int64
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        registry_key:
          example: string
          description: String with at most 1024 characters.
          type: string
        type:
          example: RegistryCreateEvent
          type: string
          enum:
          - RegistryCreateEvent
      additionalProperties: false
      required:
      - time
      - process_id
      - process_name
      - registry_key
      - type
    DeliberateEnvelopedObserveBundleDataDataRelationships:
      type: object
      properties:
        count:
          type: number
          format: double
        docs:
          type: array
          items:
            $ref: '#/components/schemas/Relationship'
          uniqueItems: true
      additionalProperties: false
      required:
      - count
      - docs
    EnvelopedReputationData:
      type: object
      properties:
        reputation:
          $ref: '#/components/schemas/Verdict'
        data:
          type: array
          items:
            $ref: '#/components/schemas/EnvelopedReputationDataData'
        errors:
          type: array
          items:
            $ref: '#/components/schemas/ErrorMessage'
      additionalProperties: false
    DataTable:
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        schema_version:
          example: 1.3.30
          description: CTIM schema version for this entity.
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        columns:
          example:
          - name: string
            type: integer
            description: string
            required: true
            short_description: string
          description: An ordered list of column definitions.
          type: array
          items:
            $ref: '#/components/schemas/ColumnDefinition'
        type:
          example: data-table
          type: string
          enum:
          - data-table
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        rows:
          example:
          - - anything
          description: An ordered list of rows
          type: array
          items:
            type: array
            items: {}
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        client_id:
          type: string
        row_count:
          example: 10
          description: The number of rows in the data table.
          type: integer
          format: int64
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
      additionalProperties: false
      required:
      - schema_version
      - columns
      - type
      - rows
      - id
    Indicator:
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        tags:
          example:
          - string
          description: Descriptors for this indicator.
          type: array
          items:
            type: string
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        producer:
          example: string
          description: String with at most 1024 characters.
          type: string
        schema_version:
          example: 1.3.30
          description: CTIM schema version for this entity.
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        type:
          example: indicator
          description: The fixed value indicator
          type: string
          enum:
          - indicator
        created:
          type: string
          format: date-time
        test_mechanisms:
          example:
          - string
          description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator.
          type: array
          items:
            type: string
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        composite_indicator_expression:
          $ref: '#/components/schemas/CompositeIndicatorExpression'
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        likely_impact:
          example: string
          description: Likely potential impact within the relevant context if this Indicator were to occur.
          type: string
        indicator_type:
          example:
          - Anonymization
          description: Specifies the type or types for this Indicator.
          type: array
          items:
            type: string
            enum:
            - File Hash Watchlist
            - Private Threat Feed
            - IMEI Watchlist
            - Malicious E-mail
            - Exfiltration
            - C2
            - URL Watchlist
            - IMSI Watchlist
            - Malware Artifacts
            - Domain Watchlist
            - Anonymization
            - Host Characteristics
            - IP Watchlist
            - Compromised PKI Certificate
            - Login Name
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        severity:
          example: Critical
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Critical
          - Low
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        kill_chain_phases:
          example:
          - kill_chain_name: string
            phase_name: string
          description: Relevant kill chain phases indicated by this Indicator.
          type: array
          items:
            $ref: '#/components/schemas/KillChainPhase'
        client_id:
          type: string
        negate:
          example: true
          description: Specifies the absence of the pattern.
          type: boolean
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        confidence:
          example: High
          description: level of confidence held in the accuracy of this Indicator.
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        specification:
          example:
            type: Judgement
            judgements:
            - string
            required_judgements:
            - confidence: High
              source: string
              relationship: string
              judgement_id: string
          x-oneOf:
          - $ref: '#/components/schemas/JudgementSpecification'
          - $ref: '#/components/schemas/ThreatBrainSpecification'
          - $ref: '#/components/schemas/SnortSpecification'
          - $ref: '#/components/schemas/SIOCSpecification'
          - $ref: '#/components/schemas/OpenIOCSpecification'
      additionalProperties: false
      required:
      - valid_time
      - producer
      - schema_version
      - type
      - id
    COA:
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        stage:
          example: Containment
          description: Specifies what stage in the cyber threat management lifecycle this Course Of Action is relevant to.
          type: string
          enum:
          - Identification
          - Lessons Learned
          - Remedy
          - Preparation
          - Containment
          - Response
          - Eradication
          - Recovery
        schema_version:
          example: 1.3.30
          description: CTIM schema version for this entity.
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        efficacy:
          example: High
          description: Effectiveness of this course of action in achieving its targeted objective.
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        type:
          example: coa
          type: string
          enum:
          - coa
        created:
          type: string
          format: date-time
        related_COAs:
          example:
          - confidence: High
            source: string
            relationship: string
            COA_id: string
          description: Identifies or characterizes relationships to one or more related courses of action.
          type: array
          items:
            $ref: '#/components/schemas/RelatedCOA'
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        coa_type:
          example: Diplomatic Actions
          description: The type of this COA
          type: string
          enum:
          - Diplomatic Actions
          - Physical Access Restrictions
          - Policy Actions
          - Internal Blocking
          - Playbook
          - Redirection
          - Phase
          - Eradication
          - Public Disclosure
          - Monitoring
          - Patching
          - Logical Access Restrictions
          - Redirection (Honey Pot)
          - Rebuilding
          - Perimeter Blocking
          - Hardening
          - Other
          - Training
          - Task
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        objective:
          example:
          - string
          description: Characterizes the objective to provide guidance on how to mitigate a security incident that has been identified.
          type: array
          items:
            type: string
        cost:
          example: High
          description: Characterizes the estimated cost for applying this course of action.
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        client_id:
          type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        open_c2_coa:
          $ref: '#/components/schemas/OpenC2COA'
        structured_coa_type:
          example: openc2
          type: string
          enum:
          - openc2
        impact:
          example: string
          description: Characterizes the estimated impact of applying this course of action.
          type: string
      additionalProperties: false
      required:
      - valid_time
      - schema_version
      - type
      - id
    CVEDataMeta:
      example:
        id: string
        assigner: string
      type: object
      properties:
        id:
          example: string
          description: String with at most 1024 characters.
          type: string
        assigner:
          example: string
          description: String with at most 1024 characters.
          type: string
      additionalProperties: false
    AlternateTerm:
      example:
        term: string
        description: string
      type: object
      properties:
        term:
          example: string
          description: The actual alternate term.
          type: string
        description:
          example: string
          description: Provides context for the alternate term by which this weakness may be known.
          type: string
      additionalProperties: false
      required:
      - term
    Consequence:
      example:
        scopes:
        - Access Control
        impacts:
        - Alter Execution Logic
        likelihood: High
        note: string
      type: object
      properties:
        scopes:
          example:
          - Access Control
          description: Identifies the security property that is violated.
          type: array
          items:
            type: string
        impacts:
          example:
          - Alter Execution Logic
          description: Describes the technical impact that arises if an adversary succeeds in exploiting this weakness.
          type: array
          items:
            type: string
        likelihood:
          example: High
          description: How likely the specific consequence is expected to be seen relative to the other consequences.
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        note:
          example: string
          description: Additional commentary about a consequence.
          type: string
      additionalProperties: false
      required:
      - scopes
    SightingDataTable:
      example:
        columns:
        - name: string
          type: integer
          description: string
          required: true
          short_description: string
        rows:
        - - anything
        row_count: 10
      description: An embedded data table for the Sighting.
      type: object
      properties:
        columns:
          example:
          - name: string
            type: integer
            description: string
            required: true
            short_description: string
          description: an ordered list of column definitions
          type: array
          items:
            $ref: '#/components/schemas/ColumnDefinition'
        rows:
          example:
          - - anything
          description: an ordered list of rows
          type: array
          items:
            type: array
            items: {}
        row_count:
          example: 10
          description: The number of rows in the data table.
          type: integer
          format: int64
      additionalProperties: false
      required:
      - columns
      - rows
    Verdict:
      type: object
      properties:
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        observable:
          $ref: '#/components/schemas/Observable'
        type:
          example: verdict
          type: string
          enum:
          - verdict
        created:
          type: string
          format: date-time
        modified:
          type: string
          format: date-time
        disposition:
          example: 1
          description: Numeric verdict identifiers.
          type: integer
          format: int64
          enum:
          - 1
          - 4
          - 3
          - 2
          - 5
        disposition_name:
          example: Clean
          description: 'The disposition_name field is optional, but is intended to be shown to a user.  Applications must therefore remember the mapping of numbers to human words, as in: {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}'
          type: string
          enum:
          - Common
          - Unknown
          - Suspicious
          - Malicious
          - Clean
        client_id:
          type: string
        judgement_id:
          example: string
          description: A URI leading to a judgement.
          type: string
      additionalProperties: false
      required:
      - valid_time
      - observable
      - type
      - disposition
    ProcessCreateType:
      example:
        parent_process_name: string
        process_guid: 10
        parent_process_guid: 10
        process_disposition: string
        parent_process_size: 10
        process_size: 10
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        parent_process_disposition: string
        type: ProcessCreateEvent
        parent_process_username: string
        parent_process_id: 10
        parent_process_args: string
        process_name: string
        process_hash: string
        process_id: 10
        parent_process_hash: string
        process_username: string
        parent_creation_time: '2016-01-01T01:01:01.000Z'
        process_args: string
      type: object
      properties:
        parent_process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        parent_process_guid:
          example: 10
          type: integer
          format: int64
        process_disposition:
          example: string
          description: String with at most 1024 characters.
          type: string
        parent_process_size:
          example: 10
          type: integer
          format: int64
        process_size:
          example: 10
          type: integer
          format: int64
        time:
          $ref: '#/components/schemas/ObservedTime'
        parent_process_disposition:
          example: string
          description: String with at most 1024 characters.
          type: string
        type:
          example: ProcessCreateEvent
          type: string
          enum:
          - ProcessCreateEvent
        parent_process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        parent_process_id:
          example: 10
          type: integer
          format: int64
        parent_process_args:
          example: string
          description: String with at most 2048 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_hash:
          example: string
          description: String with at most 2048 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        parent_process_hash:
          example: string
          description: String with at most 2048 characters.
          type: string
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        parent_creation_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Schema definition for all date or timestamp values.  Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
          type: string
          format: date-time
        process_args:
          example: string
          description: String with at most 2048 characters.
          type: string
      additionalProperties: false
      required:
      - time
      - type
      - process_name
      - process_id
    Observable:
      example:
        value: 1.2.3.4
        type: ip
      description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature.  This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains.  These do not exist as objects within the CTIA storage model, so you never create an observable.
      type: object
      properties:
        value:
          example: 1.2.3.4
          description: The value of the observable.
          type: string
        type:
          example: ip
          description: The type of observable.
          type: string
          enum:
          - file_path
          - mac_address
          - trend_micro_id
          - cybereason_id
          - process_args
          - s1_agent_id
          - device
          - hostname
          - certificate_common_name
          - serial_number
          - meraki_network_id
          - url
          - jamf_management_id
          - certificate_serial
          - intune_id
          - meraki_org_id
          - cisco_cm_id
          - registry_key
          - process_path
          - darktrace_id
          - process_username
          - cortex_agent_id
          - orbital_node_id
          - process_uid
          - ngfw_name
          - user
          - certificate_issuer
          - ipv6
          - email
          - cisco_uc_id
          - cvm_id
          - sha256
          - crowdstrike_id
          - google_cloud_id
          - google_chromebook_id
          - acudid
          - sha1
          - registry_name
          - md5
          - service_now_id
          - ip
          - domain
          - email_subject
          - imei
          - ngfw_id
          - amp_computer_guid
          - ms_machine_id
          - secure_access_id
          - mutex
          - processor_id
          - swc_device_id
          - registry_path
          - odns_identity
          - odns_identity_label
          - cisco_mid
          - process_name
          - pki_serial
          - meraki_node_sn
          - email_messageid
          - imsi
          - user_agent
          - process_hash
          - file_name
      additionalProperties: false
      required:
      - value
      - type
    ModuleObserveBundle:
      type: object
      properties:
        tools:
          $ref: '#/components/schemas/DeliberateEnvelopedObserveBundleDataDataTools'
        indicators:
          $ref: '#/components/schemas/DeliberateEnvelopedObserveBundleDataDataIndicators'
        attack_patterns:
          $ref: '#/components/schemas/DeliberateEnvelopedObserveBundleDataDataAttackPatterns'
        weaknesses:
          $ref: '#/components/schemas/DeliberateEnvelopedObserveBundleDataDataWeaknesses'
        feedbacks:
          $ref: '#/components/schemas/DeliberateEnvelopedObserveBundleDataDataFeedbacks'
        verdicts:
          $ref: '#/components/schemas/DeliberateEnvelopedObserveBundleDataDataVerdicts'
        campaigns:
          $ref: '#/components/schemas/DeliberateEnvelopedObserveBundleDataDataCampaigns'
        actors:
          $ref: '#/components/schemas/DeliberateEnvelopedObserveBundleDataDataActors'
        data_tables:
          $ref: '#/components/schemas/DeliberateEnvelopedObserveBundleDataDataDataTables'
        notes:
          $ref: '#/components/schemas/DeliberateEnvelopedObserveBundleDataDataNotes'
        identity_assertions:
          $ref: '#/components/schemas/DeliberateEnvelopedObserveBundleDataDataIdentityAssertions'
        judgements:
          $ref: '#/components/schemas/DeliberateEnvelopedObserveBundleDataDataJudgements'
        malwares:
          $ref: '#/components/schemas/DeliberateEnvelopedObserveBundleDataDataMalwares'
        incidents:
          $ref: '#/components/schemas/DeliberateEnvelopedObserveBundleDataDataIncidents'
        sightings:
          $ref: '#/components/schemas/DeliberateEnvelopedObserveBundleDataDataSightings'
        relationships:
          $ref: '#/components/schemas/DeliberateEnvelopedObserveBundleDataDataRelationships'
        vulnerabilities:
          $ref: '#/components/schemas/DeliberateEnvelopedObserveBundleDataDataVulnerabilities'
        coas:
          $ref: '#/components/schemas/DeliberateEnvelopedObserveBundleDataDataCoas'
      additionalProperties: false
    DeliberateEnvelopedObserveBundleDataDataCampaigns:
      type: object
      properties:
        count:
          type: number
          format: double
        docs:
          type: array
          items:
            $ref: '#/components/schemas/Campaign'
          uniqueItems: true
      additionalProperties: false
      required:
      - count
      - docs
    Judgement:
      type: object
      properties:
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        schema_version:
          example: 1.3.30
          description: CTIM schema version for this entity.
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        observable:
          $ref: '#/components/schemas/Observable'
        reason_uri:
          example: string
          description: A URI
          type: string
        type:
          example: judgement
          type: string
          enum:
          - judgement
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        disposition:
          example: 1
          description: Matches :disposition_name as in {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}
          type: integer
          format: int64
          enum:
          - 1
          - 4
          - 3
          - 2
          - 5
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        reason:
          example: string
          description: String with at most 1024 characters.
          type: string
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        disposition_name:
          example: Clean
          description: String verdict identifiers.
          type: string
          enum:
          - Common
          - Unknown
          - Suspicious
          - Malicious
          - Clean
        priority:
          example: 10
          description: A value 0-100 that determine the priority of a judgement. Curated feeds of black/white lists, for example known good products within your organizations, should use a 95. All automated systems should use a priority of 90, or less.  Human judgements should have a priority of 100, so that humans can always override machines.
          type: integer
          format: int64
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        severity:
          example: Critical
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Critical
          - Low
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        client_id:
          type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        confidence:
          example: High
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
      additionalProperties: false
      required:
      - valid_time
      - schema_version
      - observable
      - type
      - source
      - disposition
      - disposition_name
      - priority
      - id
      - severity
      - confidence
    NoteRelatedEntity:
      example:
        entity_type: string
        entity_id: string
      type: object
      properties:
        entity_type:
          example: string
          type: string
        entity_id:
          example: string
          description: A URI leading to an entity.
          type: string
      additionalProperties: false
      required:
      - entity_type
      - entity_id
    CPENode:
      example:
        operator: AND
        cpe_match:
        - vulnerable: true
          cpe23Uri: string
          versionStartIncluding: string
          versionEndIncluding: string
          versionStartExcluding: string
          versionEndExcluding: string
        children:
        - operator: AND
          cpe_match:
          - vulnerable: true
            cpe23Uri: string
            versionStartIncluding: string
            versionEndIncluding: string
            versionStartExcluding: string
            versionEndExcluding: string
          negate: true
        negate: true
      type: object
      properties:
        operator:
          example: AND
          description: The operator string influences how seqs of cpe matches are related to one another.
          type: string
          enum:
          - AND
          - OR
        cpe_match:
          example:
          - vulnerable: true
            cpe23Uri: string
            versionStartIncluding: string
            versionEndIncluding: string
            versionStartExcluding: string
            versionEndExcluding: string
          type: array
          items:
            $ref: '#/components/schemas/CPEMatch'
        children:
          example:
          - operator: AND
            cpe_match:
            - vulnerable: true
              cpe23Uri: string
              versionStartIncluding: string
              versionEndIncluding: string
              versionStartExcluding: string
              versionEndExcluding: string
            negate: true
          type: array
          items:
            $ref: '#/components/schemas/CPELeafNode'
        negate:
          example: true
          description: Negates operator when true.
          type: boolean
      additionalProperties: false
      required:
      - operator
    RelatedIdentity:
      example:
        identity: string
        confidence: High
        information_source: string
        relationship: string
      description: Describes a related Identity
      type: object
      properties:
        identity:
          example: string
          description: The reference (URI) of the related Identity object.
          type: string
        confidence:
          example: High
          description: Specifies the level of confidence in the assertion of the relationship between the two objects.
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        information_source:
          example: string
          description: Specifies the source of the information about the relationship between the two components.
          type: string
        relationship:
          example: string
          type: string
      additionalProperties: false
      required:
      - identity
    Identity:
      example:
        description: string
        related_identities:
        - identity: string
          confidence: High
          information_source: string
          relationship: string
      description: Can contain information such as the name of the attacker, the group or organization they belong to, or any other identifier that can help in the attribution process.
      type: object
      properties:
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        related_identities:
          example:
          - identity: string
            confidence: High
            information_source: string
            relationship: string
          description: Identifies other entity Identities related to this Identity.
          type: array
          items:
            $ref: '#/components/schemas/RelatedIdentity'
      additionalProperties: false
      required:
      - description
      - related_identities
    DeliberateEnvelopedObserveBundleDataDataIncidents:
      type: object
      properties:
        count:
          type: number
          format: double
        docs:
          type: array
          items:
            $ref: '#/components/schemas/Incident'
          uniqueItems: true
      additionalProperties: false
      required:
      - count
      - docs
    DeliberateEnvelopedObserveBundleDataDataSightingsDocsRelationsRelationInfo:
      example:
        keyword: anything
      type: object
      additionalProperties:
        example: anything
    RelatedCOA:
      example:
        confidence: High
        source: string
        relationship: string
        COA_id: string
      type: object
      properties:
        confidence:
          example: High
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        source:
          example: string
          type: string
        relationship:
          example: string
          type: string
        COA_id:
          example: string
          description: A URI leading to a COA.
          type: string
      additionalProperties: false
      required:
      - COA_id
    DeliberateEnvelopedObserveBundleDataDataNotes:
      type: object
      properties:
        count:
          type: number
          format: double
        docs:
          type: array
          items:
            $ref: '#/components/schemas/Note'
          uniqueItems: true
      additionalProperties: false
      required:
      - count
      - docs
    CVSSv3:
      example:
        integrity_impact: high
        modified_user_interaction: none
        modified_scope: not_defined
        availability_requirement: high
        user_interaction: none
        modified_integrity_impact: not_defined
        privileges_required: high
        exploitability_score: 10.0
        impact_score: 10.0
        environmental_severity: critical
        modified_availability_impact: not_defined
        availability_impact: high
        scope: changed
        exploit_code_maturity: functional
        modified_attack_complexity: not_defined
        base_severity: critical
        confidentiality_impact: high
        temporal_severity: critical
        modified_confidentiality_impact: not_defined
        confidentiality_requirement: high
        report_confidence: confirmed
        temporal_score: 10.0
        modified_privileges_required: not_defined
        modified_attack_vector: not_defined
        base_score: 10.0
        environmental_score: 10.0
        remediation_level: high
        vector_string: string
        integrity_requirement: high
        attack_vector: adjacent_network
        attack_complexity: high
      type: object
      properties:
        integrity_impact:
          example: high
          description: measures the impact to integrity of a successfully exploited vulnerability
          type: string
          enum:
          - low
          - none
          - high
        modified_user_interaction:
          example: none
          description: modified user interaction
          type: string
          enum:
          - none
          - required
          - not_defined
        modified_scope:
          example: not_defined
          description: modified scope
          type: string
          enum:
          - changed
          - unchanged
          - not_defined
        availability_requirement:
          example: high
          description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
          type: string
          enum:
          - low
          - none
          - high
          - not_defined
        user_interaction:
          example: none
          description: captures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerable component
          type: string
          enum:
          - none
          - required
        modified_integrity_impact:
          example: not_defined
          description: modified integrity impact
          type: string
          enum:
          - low
          - none
          - high
          - not_defined
        privileges_required:
          example: high
          description: describes the level of privileges an attacker must possess before successfully exploiting the vulnerability
          type: string
          enum:
          - low
          - none
          - high
        exploitability_score:
          example: 10.0
          description: a Score number from 0 to 10
          type: number
          format: double
        impact_score:
          example: 10.0
          description: a Score number from 0 to 10
          type: number
          format: double
        environmental_severity:
          example: critical
          type: string
          enum:
          - low
          - none
          - high
          - medium
          - critical
        modified_availability_impact:
          example: not_defined
          description: modified availability impact
          type: string
          enum:
          - low
          - none
          - high
          - not_defined
        availability_impact:
          example: high
          description: measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability
          type: string
          enum:
          - low
          - none
          - high
        scope:
          example: changed
          description: the ability for a vulnerability in one software component to impact resources beyond its means, or privileges
          type: string
          enum:
          - changed
          - unchanged
        exploit_code_maturity:
          example: functional
          description: measures the likelihood of the vulnerability being attacked
          type: string
          enum:
          - high
          - unproven
          - functional
          - proof_of_concept
          - not_defined
        modified_attack_complexity:
          example: not_defined
          description: modified attack complexity
          type: string
          enum:
          - low
          - high
          - not_defined
        base_severity:
          example: critical
          type: string
          enum:
          - low
          - none
          - high
          - medium
          - critical
        confidentiality_impact:
          example: high
          description: measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability
          type: string
          enum:
          - low
          - none
          - high
        temporal_severity:
          example: critical
          description: temporal severity
          type: string
          enum:
          - low
          - none
          - high
          - medium
          - critical
        modified_confidentiality_impact:
          example: not_defined
          description: modified confidentiality impact
          type: string
          enum:
          - low
          - none
          - high
          - not_defined
        confidentiality_requirement:
          example: high
          description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
          type: string
          enum:
          - low
          - none
          - high
          - not_defined
        report_confidence:
          example: confirmed
          description: measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details
          type: string
          enum:
          - unknown
          - reasonable
          - confirmed
        temporal_score:
          example: 10.0
          description: Round up(CVSSv3BaseScore × CVSSv3ExploitCodeMaturity × CVSSv3RemediationLevel × CVSSv3ReportConfidence)
          type: number
          format: double
        modified_privileges_required:
          example: not_defined
          description: modified privileges required
          type: string
          enum:
          - low
          - none
          - high
          - not_defined
        modified_attack_vector:
          example: not_defined
          description: modified attack vector
          type: string
          enum:
          - network
          - adjacent_network
          - local
          - physical
          - not_defined
        base_score:
          example: 10.0
          description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v3-1'
          type: number
          format: double
        environmental_score:
          example: 10.0
          description: a Score number from 0 to 10
          type: number
          format: double
        remediation_level:
          example: high
          description: Remediation Level of a vulnerability is an important factor for prioritization
          type: string
          enum:
          - temporary_fix
          - offical_fix
          - high
          - workaround
          - unavailable
          - not_defined
        vector_string:
          example: string
          description: a text representation of a set of CVSSv3 metrics. It is commonly used to record or transfer CVSSv3 metric information in a concise form
          type: string
        integrity_requirement:
          example: high
          description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
          type: string
          enum:
          - low
          - none
          - high
          - not_defined
        attack_vector:
          example: adjacent_network
          description: Reflects the context by which vulnerability exploitation is possible
          type: string
          enum:
          - network
          - adjacent_network
          - local
          - physical
        attack_complexity:
          example: high
          description: describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability
          type: string
          enum:
          - low
          - high
      additionalProperties: false
      required:
      - base_severity
      - base_score
      - vector_string
    Architecture:
      example:
        prevalence: Often
        name: string
        class: Embedded
      type: object
      properties:
        prevalence:
          example: Often
          description: Defines the different regularities that guide the applicability of platforms.
          type: string
          enum:
          - Undetermined
          - Sometimes
          - Often
          - Rarely
        name:
          example: string
          description: Architecture name (ARM, x86, ...)
          type: string
        class:
          example: Embedded
          description: Class of architecture
          type: string
      additionalProperties: false
      required:
      - prevalence
    Note:
      type: object
      properties:
        schema_version:
          example: 1.3.30
          description: CTIM schema version for this entity.
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        content:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        note_class:
          example: keyword
          type: string
        type:
          example: note
          type: string
          enum:
          - note
        created:
          type: string
          format: date-time
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        author:
          example: string
          type: string
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        client_id:
          type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        related_entities:
          example:
          - entity_type: string
            entity_id: string
          type: array
          items:
            $ref: '#/components/schemas/NoteRelatedEntity'
      additionalProperties: false
      required:
      - schema_version
      - content
      - note_class
      - type
      - id
      - related_entities
    ExternalReference:
      example:
        source_name: string
        description: string
        url: string
        hashes:
        - string
        external_id: string
      description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
      type: object
      properties:
        source_name:
          example: string
          description: The source within which the external-reference is defined (system, registry, organization, etc.)
          type: string
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        url:
          example: string
          description: A URL reference to an external resource.
          type: string
        hashes:
          example:
          - string
          description: Specifies a dictionary of hashes for the contents of the url.
          type: array
          items:
            type: string
        external_id:
          example: string
          description: An identifier for the external reference content.
          type: string
      additionalProperties: false
      required:
      - source_name
    Campaign:
      type: object
      properties:
        description:
          example: string
          description: A description of object, which may be detailed.
          type: string
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        schema_version:
          example: 1.3.30
          description: CTIM schema version for this entity.
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        type:
          example: campaign
          type: string
          enum:
          - campaign
        created:
          type: string
          format: date-time
        campaign_type:
          example: string
          description: 'String value that describes the type of campaign. For example, a campaign type could be ''Ransomware'', ''Advanced Persistent Threat'', ''Business Email Compromise'', ''Phishing'', etc. '
          type: string
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        modified:
          type: string
          format: date-time
        short_description:
          example: string
          description: A single line, short summary of the object.
          type: string
        title:
          example: string
          description: A short title for this object, used as primary display and reference value.
          type: string
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        activity:
          example:
          - date_time: '2016-01-01T01:01:01.000Z'
            description: string
          description: 'Used to capture specific activities or tactics associated with the campaign.

            The ''activity'' field is an array of objects, and each element represents a specific activity and time associated with the campaign. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc. By capturing these activities analysts can identify the specific tactics used by the threat actor(s) behind the campaign.'
          type: array
          items:
            $ref: '#/components/schemas/Activity'
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        intended_effect:
          example:
          - Account Takeover
          description: Characterizes the intended effect of this cyber threat campaign.
          type: array
          items:
            type: string
        status:
          example: Future
          description: "Indicates current Status of the Campaign. \n\nCan have one of the following values: \n\n- Ongoing: Indicates that the campaign is currently active and ongoing. For   example, a mass phishing campaign that is actively targeting users is   considered 'ongoing'.\n\n- Historic: Campaign has already occurred and is now in the past.\n\n- Future: This indicates that a campaign is planned or expected to occur in the   future. For example, a threat actor may announce their intention to launch a   specific cyberattack campaign at a future date."
          type: string
          enum:
          - Historic
          - Future
          - Ongoing
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
          type: string
        id:
          example: string
          description: Globally unique URI identifying this object.
          type: string
        tlp:
          example: green
          description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.


            It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.


            For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
          type: string
          enum:
          - white
          - green
          - red
          - amber
        client_id:
          type: string
        timestamp:
          example: '2016-01-01T01:01:01.000Z'
          description: The time this object was created at, or last modified.
          type: string
          format: date-time
        confidence:
          example: High
          description: Level of confidence held in the characterization of this Campaign.
          type: string
          enum:
          - Medium
          - Info
          - Unknown
          - None
          - High
          - Low
        names:
          example:
          - string
          description: Used to capture alternate names or aliases associated with the campaign. A cyberattack campaign may have multiple names or aliases depending on the group or actor(s) behind the attack, e.g., 'Wannacry' is also known as 'WannaCrypt', 'WCry', 'Wanna Decryptor', etc.
          type: array
          items:
            type: string
      additionalProperties: false
      required:
      - description
      - valid_time
      - schema_version
      - type
      - campaign_type
      - short_description
      - title
      - id
    DeliberateEnvelopedObserveBundleDataDataIdentityAssertions:
      type: object
      properties:
        count:
          type: number
          format: double
        docs:
          type: array
          items:
            $ref: '#/components/schemas/IdentityAssertion'
          uniqueItems: true
      additionalProperties: false
      required:
      - count
      - docs
  securitySchemes:
    iroh:
      type: apiKey
      in: header
      name: authorization
    AuthorizationHeader:
      type: apiKey
      in: header
      name: authorization
      description: 'Ex: Bearer \<token\>'
    oauth2:
      type: oauth2
      flows:
        authorizationCode:
          scopes:
            telemetry: collect application data for analytics
            integration: Manage your modules
            private-intel: Access Private Intelligence
            admin: Provide admin privileges
            cognitive: Cognitive Integration
            profile: Get your profile information
            inspect: Extract Observables and data from text
            asset: Access and modify your assets
            event: Read IROH Events
            feedback: Submit Customer Feedback
            sse: SSE Integration. Manage your Devices.
            registry: Manage registry entries
            users: Manage users of your organisation
            investigation: Perform threat analysis investigation
            invite: Invite users into your organization
            casebook: Access and modify your casebooks
            orbital: Orbital Integration.
            enrich: Query your configured modules for threat intelligence
            oauth: Manage OAuth2 Clients
            vault: Grants access to Module Vaults
            response: List and execute response actions using configured modules
            notification: Receive notifications from integrations
            global-intel:read: Access AMP Global Intelligence
            webhook: Manage your Webhooks
            ao: AO Integration.
          authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
          tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token