Identity Schema
Identity
Object containing the following properties:
| Property | Description | Type |
|---|---|---|
id (*) | string | |
type (*) | 'identity' | |
spec_version (*) | The version of the STIX specification used to represent this object. | '2.1' |
created (*) | The created property represents the time at which the first version of this object was created. The timstamp value MUST be precise to the nearest millisecond. | string (ISO 8601) |
modified (*) | The modified property represents the time that this particular version of the object was modified. The timstamp value MUST be precise to the nearest millisecond. | string (ISO 8601) |
created_by_ref | The created_by_ref property specifies the id property of the identity object that describes the entity that created this object. If this attribute is omitted, the source of this information is undefined. This may be used by object creators who wish to remain anonymous. | string |
labels | The labels property specifies a set of terms used to meta this object. | Array<string (_min length: 1_)> (min: 1) |
revoked | The revoked property indicates whether the object has been revoked. | boolean |
confidence | Identifies the confidence that the creator has in the correctness of their data. | number (int, ≥1, ≤99) |
lang | Identifies the language of the text content in this object. | string (min length: 1) |
external_references | A list of external references which refers to non-STIX information | Array of at least 1 objects:
|
object_marking_refs (*) | The list of marking-definition objects to be applied to this object. | Array<string (_startsWith: marking-definition--_)> |
granular_markings | The set of granular markings that apply to this object. | Array of objects:
|
extensions | Specifies any extensions of the object, as a dictionary where keys are extension definition UUIDs | Object with dynamic keys of type string (min length: 1) and values of type Object with properties:
string (min length: 1) and values of type unknown |
name (*) | The name of the object. | string (min length: 1) |
x_mitre_attack_spec_version (*) | The version of the ATT&CK spec used by the object. This field helps consuming software determine if the data format is supported. If the field is not present on an object, the spec version will be assumed to be 2.0.0. Refer to the ATT&CK CHANGELOG for all supported versions. | string (min length: 1, regex: /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/) |
x_mitre_old_attack_id | Old ATT&CK IDs that may have been associated with this object | string (min length: 1) |
x_mitre_deprecated | Indicates whether the object has been deprecated. | boolean |
identity_class (*) | The type of entity that this Identity describes, e.g., an individual or organization. This is an open vocabulary and the values SHOULD come from the identity-class-ov vocabulary | 'individual' | 'group' | 'system' | 'organization' | 'class' | 'unspecified' |
description | A description of the object. | string (min length: 1) |
roles | The list of roles that this Identity performs | Array<string (_min length: 1_)> (min: 1) |
sectors | The list of industry sectors that this Identity belongs to. This is an open vocabulary and values SHOULD come from the industry-sector-ov vocabulary | Array<'agriculture' | 'aerospace' | 'automotive' | 'chemical' | 'commercial' | 'communications' | 'construction' | 'defense' | 'education' | 'energy' | 'entertainment' | 'financial-services' | 'government' | 'government-emergency-services' | 'government-local' | 'government-national' | 'government-public-services' | 'government-regional' | 'healthcare' | 'hospitality-leisure' | ...> (min: 1) |
contact_information | The contact information (e-mail, phone number, etc.) for this Identity | string (min length: 1) |
(*) Required.