Marking Definition Schema
BaseMarkingDefinition
Object containing the following properties:
| Property | Type |
|---|---|
type (*) | 'marking-definition' |
spec_version (*) | '2.1' |
id (*) | string (uuid) |
created (*) | string (ISO 8601) |
definition_type (*) | 'tlp' |
name (*) | string |
definition (*) | TlpMarkingObject |
(*) Required.
MarkingDefinition
Object containing the following properties:
| Property | Description | Type |
|---|---|---|
id (*) | any | |
type (*) | 'marking-definition' | |
name | The name of the object. | string (min length: 1) |
spec_version (*) | The version of the STIX specification used to represent this object. | '2.0' | '2.1' |
created (*) | The created property represents the time at which the first version of this object was created. The timstamp value MUST be precise to the nearest millisecond. | any |
created_by_ref (*) | The ID of the Source object that describes who created this object. | any |
definition_type (*) | The definition_type property identifies the type of Marking Definition. | 'statement' | 'tlp' |
definition (*) | The definition property contains the marking object itself (e.g., the TLP marking as defined in section 7.2.1.4, the Statement marking as defined in section 7.2.1.3). Any new marking definitions SHOULD be specified using the extension facility described in section 7.3. If the extensions property is not present, this property MUST be present. | TlpMarkingObject or StatementMarkingObject |
x_mitre_domains (*) | The technology domains to which the ATT&CK object belongs. | Array<'enterprise-attack' | 'mobile-attack' | 'ics-attack'> (min: 1) |
x_mitre_attack_spec_version (*) | The version of the ATT&CK spec used by the object. This field helps consuming software determine if the data format is supported. If the field is not present on an object, the spec version will be assumed to be 2.0.0. Refer to the ATT&CK CHANGELOG for all supported versions. | string |
(*) Required.
StatementMarkingObject
Object containing the following properties:
| Property | Description | Type |
|---|---|---|
statement (*) | A Statement (e.g., copyright, terms of use) applied to the content marked by this marking definition. | string |
(*) Required.
TlpAmber
Object containing the following properties:
| Property | Type |
|---|---|
type (*) | 'marking-definition' |
spec_version (*) | '2.1' |
id (*) | 'marking-definition--f88d31f6-486f-44da-b317-01333bde0b82' |
created (*) | string (ISO 8601) |
definition_type (*) | 'tlp' |
name (*) | 'TLP:AMBER' |
definition (*) | Object with properties:
|
(*) Required.
TlpGreen
Object containing the following properties:
| Property | Type |
|---|---|
type (*) | 'marking-definition' |
spec_version (*) | '2.1' |
id (*) | 'marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da' |
created (*) | string (ISO 8601) |
definition_type (*) | 'tlp' |
name (*) | 'TLP:GREEN' |
definition (*) | Object with properties:
|
(*) Required.
TlpMarkingDefinition
Union of the following possible types:
TlpMarkingObject
Object containing the following properties:
| Property | Description | Type |
|---|---|---|
tlp (*) | The TLP level [TLP] of the content marked by this marking definition, as defined in this section. | string |
(*) Required.
TlpRed
Object containing the following properties:
| Property | Type |
|---|---|
type (*) | 'marking-definition' |
spec_version (*) | '2.1' |
id (*) | 'marking-definition--5e57c739-391a-4eb3-b6be-7d15ca92d5ed' |
created (*) | string (ISO 8601) |
definition_type (*) | 'tlp' |
name (*) | 'TLP:RED' |
definition (*) | Object with properties:
|
(*) Required.
TlpWhite
Object containing the following properties:
| Property | Type |
|---|---|
type (*) | 'marking-definition' |
spec_version (*) | '2.1' |
id (*) | 'marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9' |
created (*) | string (ISO 8601) |
definition_type (*) | 'tlp' |
name (*) | 'TLP:WHITE' |
definition (*) | Object with properties:
|
(*) Required.