Skip to content

Commit

Permalink
update formatting
Browse files Browse the repository at this point in the history
  • Loading branch information
@isaisabel
isaisabel committed Oct 18, 2021
1 parent 482364b commit f48b939
Showing 1 changed file with 8 additions and 8 deletions.
16 changes: 8 additions & 8 deletions USAGE.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -114,17 +114,17 @@ There are three general ways that ATT&CK extends the STIX 2.1 format:

- Extensions of existing object types. Fields extending the STIX 2.1 spec are prefixed with `x_mitre_`, e.g `x_mitre_platforms` in `attack-patterns`. The following extended fields are common across ATT&CK types except where otherwise noted:

| Field | Type | Description |
| :---------------------------------------------------- | :------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `x_mitre_version` | string | The version of the object in format `major.minor` where `major` and `minor` are integers. ATT&CK increments this version number when the object content is updated. not found on `relationship` objects. |
| `x_mitre_contributors` | string[] | People and organizations who have contributed to the object. Not found on `relationship` objects. |
| `x_mitre_modified_by_ref`<sup>1</sup> | string | The STIX ID of an `identity` object. Used to track the identity of the individual or organization which created the current _version_ of the object. Previous versions of the object may have been created by other individuals or organizations. |
| `x_mitre_domains`<sup>1</sup> | string[] | Identifies the domains the object is found in. See [domains](#domains) for more information. Not found on `relationship` objects. |
| `x_mitre_attack_spec_version`<sup>1</sup><sup>2</sup> | string | The version of the ATT&CK spec used by the object. Consuming software can use this field to determine if the data format is supported. If the field is not present on an object the spec version will be assumed to be `2.0.0`. See [the ATT&CK Spec](#the-attck-spec) for the current spec version number. |
| Field | Type | Description |
| :------------------------------------------ | :------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `x_mitre_version` | string | The version of the object in format `major.minor` where `major` and `minor` are integers. ATT&CK increments this version number when the object content is updated. not found on `relationship` objects. |
| `x_mitre_contributors` | string[] | People and organizations who have contributed to the object. Not found on `relationship` objects. |
| `x_mitre_modified_by_ref`<sup>1</sup> | string | The STIX ID of an `identity` object. Used to track the identity of the individual or organization which created the current _version_ of the object. Previous versions of the object may have been created by other individuals or organizations. |
| `x_mitre_domains`<sup>1</sup> | string[] | Identifies the domains the object is found in. See [domains](#domains) for more information. Not found on `relationship` objects. |
| `x_mitre_attack_spec_version`<sup>1,2</sup> | string | The version of the ATT&CK spec used by the object. Consuming software can use this field to determine if the data format is supported. If the field is not present on an object the spec version will be assumed to be `2.0.0`. See [the ATT&CK Spec](#the-attck-spec) for the current spec version number. |

<sup>1</sup> these fields were added in the upgrade to STIX 2.1 and are not available in [the STIX 2.0 dataset](https://github.com/mitre/cti).

<sup>2</sup> `x_mitre_attack_spec_version` is easily confused with `spec_version`, which tracks the version of the STIX spec used by the object, and is a required field in STIX. `x_mitre_attack_spec_version` tracks the version of MITRE ATT&CK's extensions to the STIX spec.
<sup>2</sup> `x_mitre_attack_spec_version` is easily confused with [`spec_version`](https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_xzbicbtscatx), which tracks the version of the STIX spec used by the object and is a required field in STIX. `x_mitre_attack_spec_version` tracks the version of MITRE ATT&CK's extensions to the STIX spec.

- New relationship types. Unlike custom object types and extended fields, custom relationship types are **not** prefixed with `x_mitre_`. You can find a full list of relationship types in the [Relationships](#Relationships) section, which also mentions whether the type is a default STIX type.

Expand Down

0 comments on commit f48b939

Please sign in to comment.