Marking Definition Schema

BaseMarkingDefinition

Object containing the following properties:

Property	Type
type (*)	'marking-definition'
spec_version (*)	'2.1'
id (*)	string (uuid)
created (*)	string (ISO 8601)
definition_type (*)	'tlp'
name (*)	string
definition (*)	TlpMarkingObject

(*) Required.

MarkingDefinition

Object containing the following properties:

Property	Description	Type
id (*)		string
type (*)		'marking-definition'
spec_version (*)	The version of the STIX specification used to represent this object.	'2.1'
created (*)	The created property represents the time at which the first version of this object was created. The timstamp value MUST be precise to the nearest millisecond.	string (ISO 8601)
created_by_ref (*)		never
labels	The labels property specifies a set of terms used to meta this object.	Array<string>
revoked	The revoked property indicates whether the object has been revoked.	boolean
confidence		number (int, ≥1, ≤99)
lang	Identifies the language of the text content in this object.	string
external_references	A list of external references which refers to non-STIX information	Array of at least 1 objects: source_name (*): string description: string url: string (url) external_id: string
object_marking_refs	The list of marking-definition objects to be applied to this object.	Array<string (_startsWith: marking-definition--_)> (min: 1)
granular_markings	The set of granular markings that apply to this object.	Array of objects: marking_ref (*): string - Represents identifiers across the CTI specifications. The format consists of the name of the top-level object being identified, followed by two dashes (--), followed by a UUIDv4. selectors (*): Array<string>
extensions	Specifies any extensions of the object, as a dictionary where keys are extension definition UUIDs	Object with dynamic keys of type string and values of type Object with properties: extension_type (*): 'new-sdo' | 'new-sco' | 'new-sro' | 'property-extension' | 'toplevel-property-extension' or Record<string, unknown>
name	The name of the object.	string (min length: 1)
x_mitre_old_attack_id	Old ATT&CK IDs that may have been associated with this object	string
definition_type (*)	The definition_type property identifies the type of Marking Definition.	'statement' | 'tlp'
definition (*)	The definition property contains the marking object itself (e.g., the TLP marking as defined in section 7.2.1.4, the Statement marking as defined in section 7.2.1.3). Any new marking definitions SHOULD be specified using the extension facility described in section 7.3. If the extensions property is not present, this property MUST be present.	TlpMarkingObject or StatementMarkingObject

(*) Required.

StatementMarkingObject

Object containing the following properties:

Property	Description	Type
statement (*)	A Statement (e.g., copyright, terms of use) applied to the content marked by this marking definition.	string

(*) Required.

TlpAmber

Object containing the following properties:

Property	Type
type (*)	'marking-definition'
spec_version (*)	'2.1'
id (*)	'marking-definition--f88d31f6-486f-44da-b317-01333bde0b82'
created (*)	string (ISO 8601)
definition_type (*)	'tlp'
name (*)	'TLP:AMBER'
definition (*)	Object with properties: tlp (*): 'amber'

(*) Required.

TlpGreen

Object containing the following properties:

Property	Type
type (*)	'marking-definition'
spec_version (*)	'2.1'
id (*)	'marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da'
created (*)	string (ISO 8601)
definition_type (*)	'tlp'
name (*)	'TLP:GREEN'
definition (*)	Object with properties: tlp (*): 'green'

(*) Required.

TlpMarkingDefinition

Union of the following possible types:

• TlpWhite
• TlpGreen
• TlpAmber
• TlpRed

TlpMarkingObject

Object containing the following properties:

Property	Description	Type
tlp (*)	The TLP level [TLP] of the content marked by this marking definition, as defined in this section.	string

(*) Required.

TlpRed

Object containing the following properties:

Property	Type
type (*)	'marking-definition'
spec_version (*)	'2.1'
id (*)	'marking-definition--5e57c739-391a-4eb3-b6be-7d15ca92d5ed'
created (*)	string (ISO 8601)
definition_type (*)	'tlp'
name (*)	'TLP:RED'
definition (*)	Object with properties: tlp (*): 'red'

(*) Required.

TlpWhite

Object containing the following properties:

Property	Type
type (*)	'marking-definition'
spec_version (*)	'2.1'
id (*)	'marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9'
created (*)	string (ISO 8601)
definition_type (*)	'tlp'
name (*)	'TLP:WHITE'
definition (*)	Object with properties: tlp (*): 'white'

(*) Required.