sra-stix2-validator
Version:
76 lines • 2.69 kB
JSON
{
"$id": "../sdos/report.json",
"$schema": "http://json-schema.org/draft-06/schema#",
"title": "report",
"description": "Reports are collections of threat intelligence focused on one or more topics, such as a description of a threat actor, malware, or attack technique, including context and related details.",
"type": "object",
"allOf": [
{
"$ref": "../common/core.json"
},
{
"properties": {
"type": {
"type": "string",
"description": "The type of this object, which MUST be the literal `report`.",
"const": "report"
},
"id": {
"title": "id",
"pattern": "^report--"
},
"labels": {
"type": "array",
"description": "This field is an Open Vocabulary that specifies the primary subject of this report. The suggested values for this field are in report-label-ov.",
"items": {
"type": "string"
},
"minItems": 1
},
"name": {
"type": "string",
"description": "The name used to identify the Report."
},
"description": {
"type": "string",
"description": "A description that provides more details and context about Report."
},
"published": {
"$ref": "../common/timestamp.json",
"description": "The date that this report object was officially published by the creator of this report."
},
"object_refs": {
"type": "array",
"description": "Specifies the STIX Objects that are referred to by this Report.",
"items": {
"$ref": "../common/identifier.json"
},
"minItems": 1
}
}
}
],
"required": [
"name",
"labels",
"object_refs",
"published"
],
"definitions": {
"report-label-ov": {
"type": "string",
"enum": [
"threat-report",
"attack-pattern",
"campaign",
"identity",
"indicator",
"malware",
"observed-data",
"threat-actor",
"tool",
"vulnerability"
]
}
}
}