The CybOX™ Language Defined Objects Specification Version 1.0(draft) Sean Barnum, Robert Martin, Bryan Worrell, Ivan Kirillov, Penny Chase, Desiree Beck, Stelios Melachrinoudis 4/13/2012 The Cyber Observable eXpression (CybOX) is a standardized language, being developed in collaboration with any and all interested parties, for the specification, capture, characterization and communication of events or stateful properties that are observable in the operational domain. A wide variety of high‐level cyber security use cases rely on such information including: event management/logging, malware characterization, intrusion detection, incident response/management, attack pattern characterization, etc. CybOX provides a common mechanism (structure and content) for addressing cyber observables across and among this full range of use cases improving consistency, efficiency, interoperability and overall situational awareness. To enable such an aggregate solution to be practical for any single use case, numerous flexibility mechanisms are designed into the language. In particular, almost everything is optional such that any single use case could leverage only the portions of CybOX that are relevant for it (from a single field to the entire language or anything in between) without being overwhelmed by the rest. This document defines the defined object types for the CybOX Language. Copyright © 2012, The MITRE Corporation. All rights reserved. Acknowledgements The authors Sean Barnum, Robert Martin, Bryan Worrell, Ivan Kirillov, Penny Chase, Desiree Beck and Stelios Melachrinoudis wish to thank the CybOX community for its assistance in contributing and reviewing this document. Trademark Information CybOX and the CybOX logo are trademarks of The MITRE Corporation. All other trademarks are the property of their respective owners. Terms of Use MITRE MAKES CybOX AVAILABLE ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.1 Feedback The MITRE Corporation welcomes any feedback regarding the CybOX Language Specification. Please send any comments, questions, or suggestions to [email protected] 1 For more information see http://cybox.mitre.org/about/termsofuse.html 2 For more information about the CybOX Language, please visit http://cybox.mitre.org Copyright © 2012, The MITRE Corporation. All rights reserved. Table of Contents Acknowledgements ....................................................................................................................................... 2 Trademark Information ................................................................................................................................. 2 Terms of Use ................................................................................................................................................. 2 Feedback ....................................................................................................................................................... 2 1 Introduction ............................................................................................................................................. 19 1.1 The CybOX Language ......................................................................................................................... 20 1.2 Document Conventions .................................................................................................................... 21 1.3 Specification Architecture ................................................................................................................. 21 1.4 CybOX Language Versioning Conventions ........................................................................................ 22 1.5 CybOX Language Naming Conventions ............................................................................................. 23 1.6 Document Structure .......................................................................................................................... 24 2 Use Cases for the CybOX Language ......................................................................................................... 25 3 Data Model .............................................................................................................................................. 26 3.1 Data Model Conventions .................................................................................................................. 26 3.1.1 Property Table Notation ............................................................................................................ 26 3.1.2 Primitive Data Types .................................................................................................................. 26 3.1.3 CybOX Primitive Datatype Expansions ....................................................................................... 27 3.1.4 CybOX Identifier Conventions .................................................................................................... 28 3.2 CybOX Object Types .......................................................................................................................... 28 3.2.1 APIObjectType (extends Common:DefinedObjectType) ........................................................... 28 3.2.2 AccountObjectType (extends Common:DefinedObjectType) .................................................... 29 3.2.3 AddressObjectType (extends Common:DefinedObjectType) .................................................... 29 3.2.3.1 CategoryTypeEnum ............................................................................................................. 29 3.2.4 CodeObjectType (extends Common:DefinedObjectType) ......................................................... 30 3.2.4.1 CodeTypeType (restriction Common:BaseObjectAttributeType) ....................................... 31 3.2.4.2 CodeTypeEnum ................................................................................................................... 31 3.2.4.3 CodePurposeType (restriction Common:BaseObjectAttributeType) ................................. 31 3.2.4.4 CodePurposeEnum .............................................................................................................. 31 3.2.4.5 CodeLanguageType (restriction Common:BaseObjectAttributeType) ............................... 32 3.2.4.6 CodeLanguageEnum ........................................................................................................... 32 3.2.4.7 ProcessorTypeType (restriction Common:BaseObjectAttributeType) ............................... 32 Copyright © 2012, The MITRE Corporation. All rights reserved. 3.2.4.8 ProcessorTypeEnum............................................................................................................ 33 3.2.4.9 TargetedPlatformsType ...................................................................................................... 33 3.2.4.10 DigitalSignaturesType ....................................................................................................... 33 3.2.5 DNSCacheObjectType (extends Common:DefinedObjectType) ................................................ 33 3.2.5.1 DNSCacheEntryType ........................................................................................................... 34 3.2.6 DNSRecordObjectType (extends Common:DefinedObjectType) ............................................... 34 3.2.7 DeviceObjectType (extends Common:DefinedObjectType) ...................................................... 34 3.2.8 DiskObjectType (extends Common:DefinedObjectType) .......................................................... 35 3.2.8.1 PartitionListType ................................................................................................................. 35 3.2.8.2 DiskType (restriction Common:BaseObjectAttributeType) ................................................ 35 3.2.8.3 DiskTypeEnum ..................................................................................................................... 35 3.2.9 DiskPartitionObjectType (extends Common:DefinedObjectType) ............................................ 36 3.2.9.1 PartitionType (restriction Common:BaseObjectAttributeType) ......................................... 36 3.2.9.2 PartitionTypeEnum ............................................................................................................. 36 3.2.10 EmailMessageObjectType (extends Common:DefinedObjectType) ........................................ 37 3.2.10.1 AttachmentsType .............................................................................................................. 37 3.2.10.2 EmailHeaderType .............................................................................................................. 38 3.2.10.3 EmailOptionalHeaderType ................................................................................................ 38 3.2.10.4 EmailRecipientsType ......................................................................................................... 39 3.2.11 FileObjectType (extends Common:DefinedObjectType) ......................................................... 39 3.2.11.1 FilePathType (extends