Marking Definition Schema

BaseMarkingDefinition

Object containing the following properties:

Property	Description	Type
type (*)		'marking-definition'
spec_version (*)		'2.1'
id (*)		string (uuid)
created (*)		string (ISO 8601)
definition_type (*)		'tlp'
name (*)	The name of the object.	string (min length: 1)
definition (*)		TlpMarkingObject

(*) Required.

MarkingDefinition

Object containing the following properties:

Property	Description	Type
id (*)		string
type (*)		'marking-definition'
spec_version (*)	The version of the STIX specification used to represent this object.	'2.1'
created (*)	The created property represents the time at which the first version of this object was created. The timstamp value MUST be precise to the nearest millisecond.	string (ISO 8601)
created_by_ref (*)		string
labels	The labels property specifies a set of terms used to meta this object.	Array<string (_min length: 1_)> (min: 1)
revoked	The revoked property indicates whether the object has been revoked.	boolean
confidence	Identifies the confidence that the creator has in the correctness of their data.	number (int, ≥1, ≤99)
lang	Identifies the language of the text content in this object.	string (min length: 1)
external_references	A list of external references which refers to non-STIX information	Array of at least 1 objects: source_name (*): string (min length: 1) description: string (min length: 1) url: string (url) external_id: string (min length: 1)
object_marking_refs	The list of marking-definition objects to be applied to this object.	Array<string (_startsWith: marking-definition--_)>
granular_markings	The set of granular markings that apply to this object.	Array of objects: lang: string (min length: 1) - The lang property identifies the language of the text identified by this marking. The value of the lang property, if present, MUST be an [RFC5646] language code. If the marking_ref property is not present, this property MUST be present. If the marking_ref property is present, this property MUST NOT be present. marking_ref: string - The marking_ref property specifies the ID of the marking-definition object that describes the marking. If the lang property is not present, this property MUST be present. If the lang property is present, this property MUST NOT be present. selectors (*): Array<string (_min length: 1_)> (min: 1) - The selectors property specifies a list of selectors for content contained within the STIX Object in which this property appears.
extensions	Specifies any extensions of the object, as a dictionary where keys are extension definition UUIDs	Object with dynamic keys of type string (min length: 1) and values of type Object with properties: extension_type (*): 'new-sdo' | 'new-sco' | 'new-sro' | 'property-extension' | 'toplevel-property-extension' or Object with dynamic keys of type string (min length: 1) and values of type unknown
name	The name of the object.	string (min length: 1)
x_mitre_old_attack_id	Old ATT&CK IDs that may have been associated with this object	string (min length: 1)
definition_type (*)	The definition_type property identifies the type of Marking Definition.	'statement' | 'tlp'
definition (*)	The definition property contains the marking object itself (e.g., the TLP marking as defined in section 7.2.1.4, the Statement marking as defined in section 7.2.1.3). Any new marking definitions SHOULD be specified using the extension facility described in section 7.3. If the extensions property is not present, this property MUST be present.	TlpMarkingObject or StatementMarkingObject

(*) Required.

StatementMarkingObject

Object containing the following properties:

Property	Description	Type
statement (*)	A Statement (e.g., copyright, terms of use) applied to the content marked by this marking definition.	string (min length: 1)

(*) Required.

TlpAmber

Object containing the following properties:

Property	Type
type (*)	'marking-definition'
spec_version (*)	'2.1'
id (*)	'marking-definition--f88d31f6-486f-44da-b317-01333bde0b82'
created (*)	string (ISO 8601)
definition_type (*)	'tlp'
name (*)	'TLP:AMBER'
definition (*)	Object with properties: tlp (*): 'amber'

(*) Required.

TlpGreen

Object containing the following properties:

Property	Type
type (*)	'marking-definition'
spec_version (*)	'2.1'
id (*)	'marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da'
created (*)	string (ISO 8601)
definition_type (*)	'tlp'
name (*)	'TLP:GREEN'
definition (*)	Object with properties: tlp (*): 'green'

(*) Required.

TlpMarkingDefinition

Union of the following possible types:

• TlpWhite
• TlpGreen
• TlpAmber
• TlpRed

TlpMarkingObject

Object containing the following properties:

Property	Description	Type
tlp (*)	The TLP level [TLP] of the content marked by this marking definition, as defined in this section.	string (min length: 1)

(*) Required.

TlpRed

Object containing the following properties:

Property	Type
type (*)	'marking-definition'
spec_version (*)	'2.1'
id (*)	'marking-definition--5e57c739-391a-4eb3-b6be-7d15ca92d5ed'
created (*)	string (ISO 8601)
definition_type (*)	'tlp'
name (*)	'TLP:RED'
definition (*)	Object with properties: tlp (*): 'red'

(*) Required.

TlpWhite

Object containing the following properties:

Property	Type
type (*)	'marking-definition'
spec_version (*)	'2.1'
id (*)	'marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9'
created (*)	string (ISO 8601)
definition_type (*)	'tlp'
name (*)	'TLP:WHITE'
definition (*)	Object with properties: tlp (*): 'white'

(*) Required.