Merge pull request #155 from clenk/stix2.1

Update Stix2.1 branch to latest

.github/workflows/python-ci-tests.yml

@@ -25,7 +25,7 @@ jobs:
         pip install stix2-validator
     - name: Install npm dependencies
       run: |
-        npm install -g ajv-cli ajv-formats-draft2019
+        npm install -g ajv-cli ajv-formats-draft2019 ajv-formats
     - name: Test Examples
       run: |
         ./test_examples.sh

README.md

@@ -38,9 +38,10 @@ Initially, the associated TC members have designated one or more persons to serv
 
 **<a id="currentMaintainers">Current Maintainers of this TC Open Repository</a>**
 
- * [Chris Lenk](mailto:[email protected]); GitHub ID: [https://github.com/clenk](https://github.com/clenk); WWW: [MITRE](https://www.mitre.org)
  * [Jason Keirstead](mailto:[email protected]); GitHub ID: [https://github.com/JasonKeirstead](https://github.com/JasonKeirstead); WWW: [IBM](http://www.ibm.com/)
-
+ * [Emily Ratliff](mailto:[email protected]); GitHub ID: [https://github.com/ejratl](https://github.com/ejratl); WWW: [IBM](http://www.ibm.com/)
+ * [Duncan Sparrell](mailto:[email protected]); GitHub ID: [https://github.com/sparrell](https://github.com/sparrell); WWW: [sFractal](http://sfractal.com/)
+
 ## <a id="aboutOpenRepos">About OASIS TC Open Repositories</a>
 
  * [TC Open Repositories: Overview and Resources](https://www.oasis-open.org/resources/open-repositories/)

examples/interop-objectmarking-test.json

@@ -0,0 +1,21 @@
+{
+    "type": "campaign",
+    "spec_version": "2.1",
+    "id": "campaign--0c7b5b88-8ff7-4a4d-aa9d-feb398cd0061",
+    "created": "2016-05-12T08:17:27.000Z",
+    "modified": "2016-05-12T08:17:27.000Z",
+    "created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
+    "name": "Spear Phishing",
+    "external_references": [
+        {
+            "source_name": "capec",
+            "external_id": "CAPEC-163"
+        }
+    ],
+      "object_marking_refs": [
+        "marking-definition--5e57c739-391a-4eb3-b6be-7d15ca92d5ed",
+        "marking-definition--5e57c739-391a-4eb3-b6be-7d15ca92d5ec"
+      ]
+  }
+
+

interop/attack-pattern.json

@@ -0,0 +1,17 @@
+{
+    "$id":"http://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/interop/attack-pattern.json",
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "allOf": [
+        {
+          "$ref": "core.json"
+        },
+        {
+           "$ref": "../schemas/sdos/attack-pattern.json"
+        }
+    ],
+    "required": [
+        "external_references", 
+        "kill_chain_phases", 
+        "created_by_ref"
+    ]
+}

interop/campaign.json

@@ -0,0 +1,15 @@
+{
+    "$id":"http://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/interop/campaign.json",
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "allOf": [
+        {
+          "$ref": "core.json"
+        },
+        {
+           "$ref": "../schemas/sdos/campaign.json"
+        }
+    ],
+    "required": [
+        "created_by_ref"
+    ]
+}

interop/core.json

@@ -0,0 +1,39 @@
+{
+    "$id": "http://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/interop/core.json",
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "title": "core",
+    "description": "Unique interop properties",
+    "type": "object",
+    "allOf": [
+      {
+        "$ref": "../schemas/common/core.json"
+      },
+      {
+        "properties": {
+          "object_marking_refs": {
+            "type": "array",
+            "description": "The list of marking-definition objects to be applied to this object.",
+            "contains": {
+              "pattern":"^marking-definition--((613f2e26-407d-48c7-9eca-b8e91df99dc9)|(34098fce-860f-48ae-8e50-ebd3cc5e41da)|(f88d31f6-486f-44da-b317-01333bde0b82)|(5e57c739-391a-4eb3-b6be-7d15ca92d5ed))$"
+            },
+            "minContains": 0,
+            "maxContains": 1,
+            "items": {
+              "allOf":[
+                {
+                  "$ref": "../schemas/common/identifier.json"
+                },
+                {
+                  "pattern": "^marking-definition--"
+
+                }
+              ]
+            },
+            "minItems": 1
+          }
+        }
+      }
+
+    ]
+
+  }

interop/course-of-action.json

@@ -0,0 +1,16 @@
+{
+    "$id":"http://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/interop/campaign.json",
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$ref": "../schemas/sdos/course-of-action.json",
+    "allOf": [
+        {
+          "$ref": "core.json"
+        },
+        {
+           "$ref": "../schemas/sdos/course-of-action.json"
+        }
+    ],
+    "required": [
+        "created_by_ref"
+    ]
+}

interop/grouping.json

@@ -0,0 +1,15 @@
+{
+    "$id":"http://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/interop/grouping.json",
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "allOf": [
+        {
+          "$ref": "core.json"
+        },
+        {
+           "$ref": "../schemas/sdos/grouping.json"
+        }
+    ],
+    "required": [
+        "created_by_ref"
+    ]
+}

interop/indicator.json

@@ -0,0 +1,17 @@
+{
+    "$id":"http://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/interop/indicator.json",
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "allOf": [
+        {
+          "$ref": "core.json"
+        },
+        {
+           "$ref": "../schemas/sdos/indicator.json"
+        }
+    ],
+    "required": [
+        "name",
+        "indicator_types",
+        "created_by_ref"
+    ]
+}

interop/infrastructure.json

@@ -0,0 +1,16 @@
+{
+    "$id":"http://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/interop/infrastructure.json",
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "allOf": [
+        {
+          "$ref": "core.json"
+        },
+        {
+           "$ref": "../schemas/sdos/infrastructure.json"
+        }
+    ],
+    "required": [
+        "infrastructure_types",
+        "created_by_ref"
+    ]
+}

interop/intrusion-set.json

@@ -0,0 +1,17 @@
+{
+    "$id":"http://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/interop/intrusion-set.json",
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "allOf": [
+        {
+          "$ref": "core.json"
+        },
+        {
+           "$ref": "../schemas/sdos/intrusion-set.json"
+        }
+    ],
+    "required": [
+        "resource_level",
+        "primary_motivation",
+        "created_by_ref"
+    ]
+}

interop/location.json

@@ -0,0 +1,16 @@
+{
+    "$id":"http://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/interop/location.json",
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "allOf": [
+        {
+          "$ref": "core.json"
+        },
+        {
+           "$ref": "../schemas/sdos/location.json"
+        }
+    ],
+    "required": [
+        "region",
+        "created_by_ref"
+    ]
+}

interop/malware-analysis.json

@@ -0,0 +1,20 @@
+{
+    "$id":"http://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/interop/malware-analysis.json",
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "allOf": [
+        {
+          "$ref": "core.json"
+        },
+        {
+           "$ref": "../schemas/sdos/malware-analysis.json"
+        }
+    ],
+    "required": [
+        "version",
+        "submitted",
+        "analysis_started",
+        "analysis_ended",
+        "result",
+        "created_by_ref"
+    ]
+}

interop/malware.json

@@ -0,0 +1,23 @@
+{
+    "$id":"http://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/interop/malware.json",
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$ref": "../schemas/sdos/malware.json",
+    "allOf": [
+        {
+          "$ref": "core.json"
+        },
+        {
+           "$ref": "../schemas/sdos/malware.json"
+        }
+    ],
+    "required": [
+        "name",
+        "malware_types",
+        "first_seen",
+        "last_seen",
+        "architecture_exectuion_envs",
+        "implementation_languages",
+        "capabiliites",
+        "created_by_ref"
+    ]
+}

interop/note.json

@@ -0,0 +1,15 @@
+{
+    "$id":"http://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/interop/note.json",
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "allOf": [
+        {
+          "$ref": "core.json"
+        },
+        {
+           "$ref": "../schemas/sdos/note.json"
+        }
+    ],
+    "required": [
+        "created_by_ref"
+    ]
+}

interop/observed-data.json

@@ -0,0 +1,16 @@
+{
+    "$id": "http://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/schemas/interop/observed-data.json",
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "allOf": [
+        {
+          "$ref": "core.json"
+        },
+        {
+           "$ref": "../schemas/sdos/observed-data.json"
+        }
+    ],
+    "required": [
+        "object_refs",
+        "created_by_ref"
+    ]
+}

interop/opinion.json

@@ -0,0 +1,15 @@
+{
+    "$id":"http://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/interop/opinion.json",
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "allOf": [
+        {
+          "$ref": "core.json"
+        },
+        {
+           "$ref": "../schemas/sdos/opinion.json"
+        }
+    ],
+    "required": [
+        "created_by_ref"
+    ]
+}

interop/relationship.json

@@ -0,0 +1,15 @@
+{
+    "$id":"http://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/interop/relationship.json",
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "allOf": [
+        {
+          "$ref": "core.json"
+        },
+        {
+           "$ref": "../schemas/sros/relationship.json"
+        }
+    ],
+    "required": [
+        "created_by_ref"
+    ]
+}

interop/report.json

@@ -0,0 +1,16 @@
+{
+    "$id":"http://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/interop/report.json",
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "allOf": [
+        {
+          "$ref": "core.json"
+        },
+        {
+           "$ref": "../schemas/sdos/report.json"
+        }
+    ],
+    "required": [
+        "report_types",
+        "created_by_ref"
+    ]
+}

interop/sighting.json

@@ -0,0 +1,18 @@
+{
+    "$id":"http://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/interop/sighting.json",
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "allOf": [
+        {
+          "$ref": "core.json"
+        },
+        {
+           "$ref": "../schemas/sros/sighting.json"
+        }
+    ],
+    "required": [
+        "first_seen",
+        "last_seen",
+        "count",
+        "created_by_ref"
+    ]
+}