Actor Object

Describes malicious actors (or adversaries) related to a cyber attack

Property	Type	Description	Required?
actor_type	ThreatActorType String		✓
id	String	Globally unique URI identifying this object.	✓
schema_version	String	CTIM schema version for this entity	✓
source	MedString String		✓
type	ActorTypeIdentifier String		✓
valid_time	ValidTime Object		✓
confidence	HighMedLow String
description	Markdown String	A description of object, which may be detailed.
external_ids	String List
external_references	ExternalReference Object List	Specifies a list of external references which refers to non-CTIM information. This property is used to provide one or more URLs, descriptions, or IDs to records in other systems.
identity	Identity Object
intended_effect	IntendedEffect String
language	ShortString String	The human language this object is specified in.
motivation	Motivation String
planning_and_operational_support	LongString String
revision	Integer	A monotonically increasing revision, incremented each time the object is changed.
short_description	MedString String	A single line, short summary of the object.
sophistication	Sophistication String
source_uri	String
timestamp	Inst (Date)	The time this object was created at, or last modified.
title	ShortString String	A short title for this object, used as primary display and reference value
tlp	TLP String	Specification for how, and to whom, this object can be shared.

• Reference: ThreatActorType

Property actor_type ∷ ThreatActorType String

• This entry is required

  • Allowed Values:
    • Cyber Espionage Operations
    • Disgruntled Customer / User
    • Hacker
    • Hacker - Black hat
    • Hacker - Gray hat
    • Hacker - White hat
    • Hacktivist
    • Insider Threat
    • State Actor / Agency
    • eCrime Actor - Credential Theft Botnet Operator
    • eCrime Actor - Credential Theft Botnet Service
    • eCrime Actor - Malware Developer
    • eCrime Actor - Money Laundering Network
    • eCrime Actor - Organized Crime Actor
    • eCrime Actor - Spam Service
    • eCrime Actor - Traffic Service
    • eCrime Actor - Underground Call Service

Property confidence ∷ HighMedLow String

• This entry is optional

  • Allowed Values:
    • High
    • Info
    • Low
    • Medium
    • None
    • Unknown
  • Reference: HighMedLowVocab

Property description ∷ Markdown String

A description of object, which may be detailed.

• This entry is optional

  • Markdown string with at most 5000 characters

Property external_ids ∷ String List

• This entry is optional
• This entry's type is sequential (allows zero or more values)

Property external_references ∷ ExternalReference Object List

Specifies a list of external references which refers to non-CTIM information. This property is used to provide one or more URLs, descriptions, or IDs to records in other systems.

• This entry is optional
• This entry's type is sequential (allows zero or more values)

• ExternalReference Object Value
  • Details: ExternalReference Object

Property id ∷ String

Globally unique URI identifying this object.

• This entry is required

  • IDs are URIs, for example https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014 for a Judgement. This ID type compares to the STIX id field. The optional STIX idref field is not used.

Property identity ∷ Identity Object

• This entry is optional

• Identity Object Value
  • Details: Identity Object

Property intended_effect ∷ IntendedEffect String

• This entry is optional

  • Allowed Values:
    • Account Takeover
    • Advantage
    • Advantage - Economic
    • Advantage - Military
    • Advantage - Political
    • Brand Damage
    • Competitive Advantage
    • Degradation of Service
    • Denial and Deception
    • Destruction
    • Disruption
    • Embarrassment
    • Exposure
    • Extortion
    • Fraud
    • Harassment
    • ICS Control
    • Theft
    • Theft - Credential Theft
    • Theft - Identity Theft
    • Theft - Intellectual Property
    • Theft - Theft of Proprietary Information
    • Traffic Diversion
    • Unauthorized Access

Property language ∷ ShortString String

The human language this object is specified in.

• This entry is optional

  • String with at most 1024 characters

Property motivation ∷ Motivation String

• This entry is optional

  • Allowed Values:
    • Ego
    • Financial or Economic
    • Ideological
    • Ideological - Anti-Corruption
    • Ideological - Anti-Establishment
    • Ideological - Environmental
    • Ideological - Ethnic / Nationalist
    • Ideological - Human Rights
    • Ideological - Information Freedom
    • Ideological - Religious
    • Ideological - Security Awareness
    • Military
    • Opportunistic
    • Political

Property planning_and_operational_support ∷ LongString String

• This entry is optional

  • String with at most 5000 characters

Property revision ∷ Integer

A monotonically increasing revision, incremented each time the object is changed.

• This entry is optional

  • Zero, or a positive integer

Property schema_version ∷ String

CTIM schema version for this entity

• This entry is required

  • A semantic version matching the CTIM version against which this object should be valid.

Property short_description ∷ MedString String

A single line, short summary of the object.

• This entry is optional

  • String with at most 2048 characters

Property sophistication ∷ Sophistication String

• This entry is optional

  • Allowed Values:
    • Aspirant
    • Expert
    • Innovator
    • Novice
    • Practitioner

Property source ∷ MedString String

• This entry is required

  • String with at most 2048 characters

Property source_uri ∷ String

• This entry is optional

  • A URI

Property timestamp ∷ Inst (Date)

The time this object was created at, or last modified.

• This entry is optional

  • Schema definition for all date or timestamp values. Time is stored internally as a java.util.Date object. Serialized as a string, the field should follow the rules of the ISO8601 standard.

Property title ∷ ShortString String

A short title for this object, used as primary display and reference value

• This entry is optional

  • String with at most 1024 characters

Property tlp ∷ TLP String

Specification for how, and to whom, this object can be shared.

• This entry is optional

  • TLP stands for Traffic Light Protocol, which indicates precisely how this resource is intended to be shared, replicated, copied, etc.
  • Default: green
  • Allowed Values:
    • amber
    • green
    • red
    • white

Property type ∷ ActorTypeIdentifier String

• This entry is required

  • Must equal: "actor"

Property valid_time ∷ ValidTime Object

• This entry is required

• ValidTime Object Value
  • Details: ValidTime Object

ExternalReference Object

External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.

Property	Type	Description	Required?
source_name	MedString String	The source within which the external-reference is defined (system, registry, organization, etc.)	✓
description	Markdown String
external_id	String	An identifier for the external reference content.
hashes	String List	Specifies a dictionary of hashes for the contents of the url.
url	String	A URL reference to an external resource

• Reference: External Reference

Property description ∷ Markdown String

• This entry is optional

  • Markdown string with at most 5000 characters

Property external_id ∷ String

An identifier for the external reference content.

• This entry is optional

Property hashes ∷ String List

Specifies a dictionary of hashes for the contents of the url.

• This entry is optional
• This entry's type is sequential (allows zero or more values)

Property source_name ∷ MedString String

The source within which the external-reference is defined (system, registry, organization, etc.)

• This entry is required

  • String with at most 2048 characters

Property url ∷ String

A URL reference to an external resource

• This entry is optional

  • A URI

ValidTime Object

Period of time when a cyber observation is valid.

Property	Type	Description	Required?
end_time	Inst (Date)	If end_time is not present, then the valid time position of the object does not have an upper bound.
start_time	Inst (Date)	If not present, the valid time position of the indicator does not have an upper bound

• Reference: ValidTimeType

Property end_time ∷ Inst (Date)

If end_time is not present, then the valid time position of the object does not have an upper bound.

• This entry is optional

  • Schema definition for all date or timestamp values. Time is stored internally as a java.util.Date object. Serialized as a string, the field should follow the rules of the ISO8601 standard.

Property start_time ∷ Inst (Date)

If not present, the valid time position of the indicator does not have an upper bound

• This entry is optional

  • Schema definition for all date or timestamp values. Time is stored internally as a java.util.Date object. Serialized as a string, the field should follow the rules of the ISO8601 standard.

Identity Object

Describes a person or an organization

Property	Type	Description	Required?
description	Markdown String		✓
related_identities	RelatedIdentity Object List	Identifies other entity Identities related to this Identity	✓

• Reference: IdentityType

Property description ∷ Markdown String

• This entry is required

  • Markdown string with at most 5000 characters

Property related_identities ∷ RelatedIdentity Object List

Identifies other entity Identities related to this Identity

• This entry is required
• This entry's type is sequential (allows zero or more values)

• RelatedIdentity Object Value
  • Details: RelatedIdentity Object

RelatedIdentity Object

Describes a related Identity

Property	Type	Description	Required?
identity	String	The reference (URI) of the related Identity object	✓
confidence	HighMedLow String	Specifies the level of confidence in the assertion of the relationship between the two objects
information_source	String	Specifies the source of the information about the relationship between the two components
relationship	String

• Reference: RelatedIdentityType

Property confidence ∷ HighMedLow String

Specifies the level of confidence in the assertion of the relationship between the two objects

• This entry is optional

  • Allowed Values:
    • High
    • Info
    • Low
    • Medium
    • None
    • Unknown
  • Reference: HighMedLowVocab

Property identity ∷ String

The reference (URI) of the related Identity object

• This entry is required

  • A URI

Property information_source ∷ String

Specifies the source of the information about the relationship between the two components

• This entry is optional

Property relationship ∷ String

• This entry is optional