stix_schema_spy 1.0 → 1.1

data/config/1.1.1/stix/external/oasis_ciq_3.0/xlink-2003-12-31.xsd

@@ -0,0 +1,90 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- (c) XBRL International.  See www.xbrl.org/legal  
+ XLink attribute specification - produced by xBRL group with joint design agreement with OASIS CIQ TC
+in December 2006
+    Thanks to xBRL for giving OASIS CIQ TC permission to use this specification
+-->
+<schema xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2001/XMLSchema" targetNamespace="http://www.w3.org/1999/xlink" elementFormDefault="qualified" attributeFormDefault="qualified">
+	<annotation>
+		<documentation>
+    XLink attribute specification
+    </documentation>
+	</annotation>
+	<attribute name="type">
+		<simpleType>
+			<annotation>
+				<documentation>
+	    Enumeration of values for the type attribute
+	    </documentation>
+			</annotation>
+			<restriction base="string">
+				<enumeration value="simple"/>
+				<enumeration value="extended"/>
+				<enumeration value="locator"/>
+				<enumeration value="arc"/>
+				<enumeration value="resource"/>
+				<enumeration value="title"/>
+			</restriction>
+		</simpleType>
+	</attribute>
+	<attribute name="role">
+		<simpleType>
+			<annotation>
+				<documentation>
+	      A URI with a minimum length of 1 character.
+	      </documentation>
+			</annotation>
+			<restriction base="anyURI">
+				<minLength value="1"/>
+			</restriction>
+		</simpleType>
+	</attribute>
+	<attribute name="arcrole">
+		<simpleType>
+			<annotation>
+				<documentation>
+	      A URI with a minimum length of 1 character.
+	      </documentation>
+			</annotation>
+			<restriction base="anyURI">
+				<minLength value="1"/>
+			</restriction>
+		</simpleType>
+	</attribute>
+	<attribute name="title" type="string"/>
+	<attribute name="show">
+		<simpleType>
+			<annotation>
+				<documentation>
+	      Enumeration of values for the show attribute
+	      </documentation>
+			</annotation>
+			<restriction base="string">
+				<enumeration value="new"/>
+				<enumeration value="replace"/>
+				<enumeration value="embed"/>
+				<enumeration value="other"/>
+				<enumeration value="none"/>
+			</restriction>
+		</simpleType>
+	</attribute>
+	<attribute name="actuate">
+		<simpleType>
+			<annotation>
+				<documentation>
+      Enumeration of values for the actuate attribute
+      </documentation>
+			</annotation>
+			<restriction base="string">
+				<enumeration value="onLoad"/>
+				<enumeration value="onRequest"/>
+				<enumeration value="other"/>
+				<enumeration value="none"/>
+			</restriction>
+		</simpleType>
+	</attribute>
+	<attribute name="label" type="NCName"/>
+	<attribute name="from" type="NCName"/>
+	<attribute name="to" type="NCName"/>
+	<attribute name="href" type="anyURI"/>
+</schema>

data/config/1.1.1/stix/external/open_ioc_2010/ioc-TR.xsd

@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<xs:schema xmlns:tns="http://schemas.mandiant.com/2010/ioc/TR/" elementFormDefault="qualified" targetNamespace="http://schemas.mandiant.com/2010/ioc/TR/" xmlns:xs="http://www.w3.org/2001/XMLSchema">
+  <xs:element name="indicator" nillable="true" type="tns:IocTest" />
+  <xs:complexType name="IocTest">
+    <xs:sequence>
+      <xs:element minOccurs="0" maxOccurs="unbounded" name="param" type="tns:Parameter" />
+      <xs:element minOccurs="0" maxOccurs="1" name="UniqueIdentity" type="xs:string" />
+    </xs:sequence>
+    <xs:attribute name="operator" type="tns:IocOperator" use="required" />
+  </xs:complexType>
+  <xs:complexType name="Parameter">
+    <xs:sequence>
+      <xs:element minOccurs="0" maxOccurs="1" name="value" />
+    </xs:sequence>
+    <xs:attribute name="name" type="xs:string" />
+    <xs:attribute name="title" type="xs:string" />
+  </xs:complexType>
+  <xs:simpleType name="IocOperator">
+    <xs:restriction base="xs:string">
+      <xs:enumeration value="and" />
+      <xs:enumeration value="or" />
+    </xs:restriction>
+  </xs:simpleType>
+  <xs:element name="param" type="tns:Parameter" />
+</xs:schema>

data/config/1.1.1/stix/external/open_ioc_2010/ioc.xsd

@@ -0,0 +1,105 @@
+<?xml version="1.0" encoding="utf-8"?>
+<xs:schema xmlns:tns="http://schemas.mandiant.com/2010/ioc" elementFormDefault="qualified" targetNamespace="http://schemas.mandiant.com/2010/ioc" xmlns:xs="http://www.w3.org/2001/XMLSchema">
+  <xs:import namespace="http://schemas.mandiant.com/2010/ioc/TR/" schemaLocation="ioc-TR.xsd" />
+  <xs:element name="ioctermlist" nillable="true" type="tns:IocTermList" />
+  <xs:complexType name="IocTermList">
+    <xs:sequence>
+      <xs:element minOccurs="0" maxOccurs="unbounded" name="iocterm" type="tns:IocTerm" />
+    </xs:sequence>
+    <xs:attribute name="last-modified" type="xs:dateTime" use="required" />
+  </xs:complexType>
+  <xs:complexType name="IocTerm">
+    <xs:sequence>
+      <xs:any minOccurs="0" maxOccurs="1" />
+    </xs:sequence>
+    <xs:attribute name="title" type="xs:string" />
+    <xs:attribute name="text" type="xs:string" />
+    <xs:attribute name="processor-type" type="xs:string" />
+    <xs:attribute name="display-type" type="xs:string" />
+    <xs:attribute name="data-type" type="xs:string" />
+  </xs:complexType>
+  <xs:element name="metrics" nillable="true" type="tns:MetricList" />
+  <xs:complexType name="MetricList">
+    <xs:sequence>
+      <xs:element minOccurs="0" maxOccurs="unbounded" name="metric" type="tns:Metric" />
+    </xs:sequence>
+  </xs:complexType>
+  <xs:complexType name="Metric">
+    <xs:attribute name="src" type="xs:string" />
+    <xs:attribute name="name" type="xs:string" />
+    <xs:attribute name="value" type="xs:float" use="required" />
+  </xs:complexType>
+  <xs:element name="ioc" nillable="true" type="tns:IndicatorOfCompromise" />
+  <xs:complexType name="IndicatorOfCompromise">
+    <xs:sequence>
+      <xs:element minOccurs="0" maxOccurs="1" name="short_description" type="xs:string" />
+      <xs:element minOccurs="0" maxOccurs="1" name="description" type="xs:string" />
+      <xs:element minOccurs="0" maxOccurs="1" name="keywords" type="xs:string" />
+      <xs:element minOccurs="0" maxOccurs="1" name="authored_by" type="xs:string" />
+      <xs:element minOccurs="1" maxOccurs="1" name="authored_date" nillable="true" type="xs:dateTime" />
+      <xs:element minOccurs="0" maxOccurs="1" name="links" type="tns:ArrayOfLink" />
+      <xs:element minOccurs="0" maxOccurs="1" name="definition" type="tns:ArrayOfIocIndicator" />
+    </xs:sequence>
+    <xs:attribute name="id" type="xs:string" />
+    <xs:attribute name="last-modified" type="xs:dateTime" use="required" />
+  </xs:complexType>
+  <xs:complexType name="ArrayOfLink">
+    <xs:sequence>
+      <xs:element minOccurs="0" maxOccurs="unbounded" name="link" nillable="true" type="tns:Link" />
+    </xs:sequence>
+  </xs:complexType>
+  <xs:complexType name="Link" mixed="true">
+    <xs:complexContent mixed="true">
+      <xs:extension base="tns:Identity">
+        <xs:attribute name="rel" type="xs:string" />
+        <xs:attribute name="title" type="xs:string" />
+        <xs:attribute name="type" type="xs:string" />
+      </xs:extension>
+    </xs:complexContent>
+  </xs:complexType>
+  <xs:complexType name="Identity">
+    <xs:attribute name="href" type="xs:string" />
+  </xs:complexType>
+  <xs:complexType name="ArrayOfIocIndicator">
+    <xs:sequence>
+      <xs:element minOccurs="0" maxOccurs="unbounded" name="Indicator" nillable="true" type="tns:IocIndicator" />
+    </xs:sequence>
+  </xs:complexType>
+  <xs:complexType name="IocIndicator">
+    <xs:sequence>
+      <xs:element minOccurs="0" maxOccurs="unbounded" name="IndicatorItem" type="tns:IndicatorItem" />
+      <xs:element minOccurs="0" maxOccurs="unbounded" name="Indicator" type="tns:IocIndicator" />
+      <xs:element minOccurs="0" maxOccurs="unbounded" xmlns:q1="http://schemas.mandiant.com/2010/ioc/TR/" ref="q1:param" />
+    </xs:sequence>
+    <xs:attribute name="operator" type="tns:IocOperator" use="required" />
+    <xs:attribute name="id" type="xs:string" />
+  </xs:complexType>
+  <xs:complexType name="IndicatorItem">
+    <xs:sequence>
+      <xs:element minOccurs="0" maxOccurs="1" name="Context" type="tns:IndicatorItemContext" />
+      <xs:element minOccurs="0" maxOccurs="1" name="Content" type="tns:IndicatorItemContent" />
+      <xs:element minOccurs="0" maxOccurs="1" name="Comment" type="xs:string" />
+      <xs:element minOccurs="0" maxOccurs="unbounded" xmlns:q2="http://schemas.mandiant.com/2010/ioc/TR/" ref="q2:param" />
+    </xs:sequence>
+    <xs:attribute name="id" type="xs:string" />
+    <xs:attribute name="condition" type="xs:string" />
+  </xs:complexType>
+  <xs:complexType name="IndicatorItemContext">
+    <xs:attribute name="document" type="xs:string" />
+    <xs:attribute name="search" type="xs:string" />
+    <xs:attribute name="type" type="xs:string" />
+  </xs:complexType>
+  <xs:complexType name="IndicatorItemContent">
+    <xs:simpleContent>
+      <xs:extension base="xs:string">
+        <xs:attribute name="type" type="xs:string" />
+      </xs:extension>
+    </xs:simpleContent>
+  </xs:complexType>
+  <xs:simpleType name="IocOperator">
+    <xs:restriction base="xs:string">
+      <xs:enumeration value="OR" />
+      <xs:enumeration value="AND" />
+    </xs:restriction>
+  </xs:simpleType>
+</xs:schema>