stix_schema_spy 1.0

data/config/1.1/stix/cybox/objects/Address_Object.xsd

@@ -0,0 +1,127 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2" xmlns:cyboxCommon="http://cybox.mitre.org/common-2" targetNamespace="http://cybox.mitre.org/objects#AddressObject-2" elementFormDefault="qualified" attributeFormDefault="unqualified" version="2.1">
+	<xs:annotation>
+		<xs:documentation>This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org.</xs:documentation>
+		<xs:appinfo>
+			<schema>Address_Object</schema>
+			<version>2.1</version>
+			<date>01/22/2014</date>			
+			<short_description>The following specifies the fields and types that compose this defined CybOX Object type. Each defined object is an extension of the abstract ObjectPropertiesType, defined in CybOX Common. For more information on this extension mechanism, please see the CybOX Specification. This document is intended for developers and assumes some familiarity with XML. </short_description>
+			<terms_of_use>Copyright (c) 2012-2014, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the CybOX License located at http://cybox.mitre.org/about/termsofuse.html. See the CybOX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the CybOX Schema, this license header must be included.</terms_of_use>
+		</xs:appinfo>
+	</xs:annotation>
+	<xs:import namespace="http://cybox.mitre.org/common-2" schemaLocation="../cybox_common.xsd"/>
+	<xs:element name="Address" type="AddressObj:AddressObjectType">
+		<xs:annotation>
+			<xs:documentation>The Address object is intended to specify a cyber address.</xs:documentation>
+		</xs:annotation>
+	</xs:element>
+	<xs:complexType name="AddressObjectType">
+		<xs:annotation>
+			<xs:documentation>The AddressObjectType is intended to characterize cyber addresses.</xs:documentation>
+		</xs:annotation>
+		<xs:complexContent>
+			<xs:extension base="cyboxCommon:ObjectPropertiesType">
+				<xs:sequence>
+					<xs:element name="Address_Value" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The required Address_Value construct specifies the actual value of the address.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="VLAN_Name" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The VLAN_Name field specifies the name of the Virtual LAN to which the address belongs.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="VLAN_Num" type="cyboxCommon:IntegerObjectPropertyType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The VLAN_Num field specifies the number of the Virtual LAN to which the address belongs.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+				</xs:sequence>
+				<xs:attribute name="category" type="AddressObj:CategoryTypeEnum" default="ipv4-addr">
+					<xs:annotation>
+						<xs:documentation>The category field specifies the address category that is being defined.</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+				<xs:attribute name="is_source" type="xs:boolean">
+					<xs:annotation>
+						<xs:documentation>The is_source field specifies if this is a "Source" address.</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+				<xs:attribute name="is_destination" type="xs:boolean">
+					<xs:annotation>
+						<xs:documentation>The is_destination field specifies if this is a "Destination" address.</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+				<xs:attribute name="is_spoofed" type="xs:boolean">
+					<xs:annotation>
+						<xs:documentation>The is_spoofed field specifies whether the address is spoofed, i.e. forged to conceal its identity or true source.</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+			</xs:extension>
+		</xs:complexContent>
+	</xs:complexType>
+	<xs:simpleType name="CategoryTypeEnum">
+		<xs:annotation>
+			<xs:documentation>The CategoryTypeEnum type is an enumeration of address types.</xs:documentation>
+		</xs:annotation>
+		<xs:restriction base="xs:NMTOKEN">
+			<xs:enumeration value="asn">
+				<xs:annotation>
+					<xs:documentation>The asn value specifies an identifier for an Autonomous System Number.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="atm">
+				<xs:annotation>
+					<xs:documentation>The atm value specifies an Asynchronous Transfer Mode address.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="cidr">
+				<xs:annotation>
+					<xs:documentation>The CIDR value specifies an address in Classless Inter-domain Routing notation (the IP address and its associated routing prefix).</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="e-mail">
+				<xs:annotation>
+					<xs:documentation>The e-mail value specifies an e-mail address.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="mac">
+				<xs:annotation>
+					<xs:documentation>The mac value specifies a system's MAC address.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="ipv4-addr">
+				<xs:annotation>
+					<xs:documentation>The IPV4-addr value specifies an IPV4 address.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="ipv4-net">
+				<xs:annotation>
+					<xs:documentation/>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="ipv4-net-mask">
+				<xs:annotation>
+					<xs:documentation>The IPV4-net-mask value specifies an IPV4 bitwise netmask.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="ipv6-addr">
+				<xs:annotation>
+					<xs:documentation>The IPV6-addr value specifies an IPV6 address.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="ipv6-net">
+				<xs:annotation>
+					<xs:documentation/>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="ipv6-net-mask">
+				<xs:annotation>
+					<xs:documentation>The IPV6-net-mask value specifies an IPV6 bitwise netmask.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+		</xs:restriction>
+	</xs:simpleType>
+</xs:schema>

data/config/1.1/stix/cybox/objects/Archive_File_Object.xsd

@@ -0,0 +1,134 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:ArchiveFileObj="http://cybox.mitre.org/objects#ArchiveFileObject-1" xmlns:cyboxCommon="http://cybox.mitre.org/common-2" xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2" targetNamespace="http://cybox.mitre.org/objects#ArchiveFileObject-1" elementFormDefault="qualified" attributeFormDefault="unqualified" version="1.0">
+    <xs:annotation>
+        <xs:documentation>This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org. </xs:documentation>
+        <xs:appinfo>
+            <schema>Archive_File_Object</schema>
+            <version>1.0</version>
+            <date>01/22/2014</date>
+            <short_description>The following specifies the fields and types that compose this defined CybOX Object type. Each defined object is an extension of the abstract ObjectPropertiesType, defined in CybOX Common. For more information on this extension mechanism, please see the CybOX Specification. This document is intended for developers and assumes some familiarity with XML. </short_description>
+            <terms_of_use>Copyright (c) 2012-2014, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the CybOX License located at http://cybox.mitre.org/about/termsofuse.html. See the CybOX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the CybOX Schema, this license header must be included.</terms_of_use>
+        </xs:appinfo>
+    </xs:annotation>
+    <xs:import namespace="http://cybox.mitre.org/common-2" schemaLocation="../cybox_common.xsd"/>
+    <xs:import namespace="http://cybox.mitre.org/objects#FileObject-2" schemaLocation="File_Object.xsd"/>
+    <xs:element name="Archive_File" type="ArchiveFileObj:ArchiveFileObjectType">
+        <xs:annotation>
+            <xs:documentation>The Archive_File object is intended to characterize archive files.</xs:documentation>
+        </xs:annotation>
+    </xs:element>
+    <xs:complexType name="ArchiveFileObjectType" mixed="false">
+        <xs:annotation>
+            <xs:documentation>The ArchiveFileObjectType type is intended to characterize archive files.</xs:documentation>
+        </xs:annotation>
+        <xs:complexContent>
+            <xs:extension base="FileObj:FileObjectType">
+                <xs:sequence minOccurs="1">
+                    <xs:element minOccurs="0" name="Archive_Format" type="ArchiveFileObj:ArchiveFileFormatType">
+                        <xs:annotation>
+                            <xs:documentation>The Archive Format specifies the format of the archive file.</xs:documentation>
+                        </xs:annotation>
+                    </xs:element>
+                    <xs:element minOccurs="0" name="Version" type="cyboxCommon:StringObjectPropertyType">
+                        <xs:annotation>
+                            <xs:documentation>The Version field specifies the archive type used to create archive file.</xs:documentation>
+                        </xs:annotation>
+                    </xs:element>
+                    <xs:element minOccurs="0" name="File_Count" type="cyboxCommon:IntegerObjectPropertyType">
+                        <xs:annotation>
+                            <xs:documentation>The File_Count field specifies the number of files contained within the archive.</xs:documentation>
+                        </xs:annotation>
+                    </xs:element>
+                    <xs:element minOccurs="0" name="Encryption_Algorithm" type="cyboxCommon:CipherType">
+                        <xs:annotation>
+                            <xs:documentation>The Encryption_Algorithm field specifies the algorithm used to encrypt an archive file.  Note: For individual files within an archive that are themselves encrypted, the specifics of that encryption are found in the FileObject definition for that file.</xs:documentation>
+                        </xs:annotation>
+                    </xs:element>
+                    <xs:element name="Decryption_Key" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
+                        <xs:annotation>
+                            <xs:documentation>The Decryption_Key field specifies the key used to decrypt the file.</xs:documentation>
+                        </xs:annotation>
+                    </xs:element>
+                    <xs:element minOccurs="0" name="Comment" type="cyboxCommon:StringObjectPropertyType">
+                        <xs:annotation>
+                            <xs:documentation>The Comment field specifies the comment information associated with archive file.</xs:documentation>
+                        </xs:annotation>
+                    </xs:element>                    
+                    <xs:element minOccurs="0" maxOccurs="unbounded" name="Archived_File" type="FileObj:FileObjectType">
+                        <xs:annotation>
+                            <xs:documentation>The Archived_File field specifies the FileObject definitions for the individual files contained within the archive.</xs:documentation>
+                        </xs:annotation>
+                    </xs:element>
+                </xs:sequence>
+            </xs:extension>
+        </xs:complexContent>
+    </xs:complexType>
+    <xs:complexType name="ArchiveFileFormatType">
+        <xs:annotation>
+            <xs:documentation>The ArchiveFileFormatType specifies archive file formats via a union of the ArchiveFileFormatEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.</xs:documentation>
+        </xs:annotation>
+        <xs:simpleContent>
+            <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
+                <xs:simpleType>
+                    <xs:union memberTypes="ArchiveFileObj:ArchiveFileFormatEnum xs:string"/>
+                </xs:simpleType>
+            </xs:restriction>
+        </xs:simpleContent>
+    </xs:complexType>
+    <xs:simpleType name="ArchiveFileFormatEnum">
+        <xs:annotation>
+            <xs:documentation>The ArchiveFileFormatEnum type is a non-exhaustive enumeration of common archive file formats.</xs:documentation>
+        </xs:annotation>
+        <xs:list>
+            <xs:simpleType>
+                <xs:restriction base="xs:string">
+                    <xs:enumeration value="7-ZIP">
+                        <xs:annotation>
+                            <xs:documentation>Specifies the open source 7-zip file format (.7z)</xs:documentation>
+                        </xs:annotation>
+                    </xs:enumeration>
+                    <xs:enumeration value="APK">
+                        <xs:annotation>
+                            <xs:documentation>Specifies the Android application package format (.apk)</xs:documentation>
+                        </xs:annotation>
+                    </xs:enumeration>
+                    <xs:enumeration value="CAB">
+                        <xs:annotation>
+                            <xs:documentation>Specifies the Microsoft native archive format (.cab)</xs:documentation>
+                        </xs:annotation>
+                    </xs:enumeration>
+                    <xs:enumeration value="DMG">
+                        <xs:annotation>
+                            <xs:documentation>Specifies the Apple disk image format (.dmg)</xs:documentation>
+                        </xs:annotation>
+                    </xs:enumeration>
+                    <xs:enumeration value="JAR">
+                        <xs:annotation>
+                            <xs:documentation>Specifies the Java archive format (.jar)</xs:documentation>
+                        </xs:annotation>
+                    </xs:enumeration>
+                    <xs:enumeration value="RAR">
+                        <xs:annotation>
+                            <xs:documentation>Specifies the RAR file format (.rar)</xs:documentation>
+                        </xs:annotation>
+                    </xs:enumeration>
+                    <xs:enumeration value="SIT">
+                        <xs:annotation>
+                            <xs:documentation>Specifies the StuffIt file format (.sit, .sitx)</xs:documentation>
+                        </xs:annotation>
+                    </xs:enumeration>
+                    <xs:enumeration value="TGZ">
+                        <xs:annotation>
+                            <xs:documentation>Specifies the compressed TAR file format (.tar.gz, .tgz, .tar.Z, .tar.bz2)</xs:documentation>
+                        </xs:annotation>
+                    </xs:enumeration>
+                    <xs:enumeration value="ZIP">
+                        <xs:annotation>
+                            <xs:documentation>Specifies the PKZip file format (.zip, .zipx)</xs:documentation>
+                        </xs:annotation>
+                    </xs:enumeration>
+                </xs:restriction>
+            </xs:simpleType>
+        </xs:list>
+    </xs:simpleType>
+</xs:schema>

data/config/1.1/stix/cybox/objects/Artifact_Object.xsd

@@ -0,0 +1,212 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:ArtifactObj="http://cybox.mitre.org/objects#ArtifactObject-2" xmlns:cyboxCommon="http://cybox.mitre.org/common-2" targetNamespace="http://cybox.mitre.org/objects#ArtifactObject-2" elementFormDefault="qualified" attributeFormDefault="unqualified" version="2.1">
+	<xs:annotation>
+		<xs:documentation>This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org.</xs:documentation>
+		<xs:appinfo>
+			<schema>Artifact_Object</schema>
+			<version>2.1</version>
+			<date>01/22/2014</date>			
+			<short_description>The following specifies the fields and types that compose this defined CybOX Object type. Each defined object is an extension of the abstract ObjectPropertiesType, defined in CybOX Common. For more information on this extension mechanism, please see the CybOX Specification. This document is intended for developers and assumes some familiarity with XML.</short_description>
+			<terms_of_use>Copyright (c) 2012-2014, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the CybOX License located at http://cybox.mitre.org/about/termsofuse.html. See the CybOX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the CybOX Schema, this license header must be included.</terms_of_use>
+		</xs:appinfo>
+	</xs:annotation>
+	<xs:import namespace="http://cybox.mitre.org/common-2" schemaLocation="../cybox_common.xsd"/>
+	<xs:element name="Artifact" type="ArtifactObj:ArtifactObjectType">
+		<xs:annotation>
+			<xs:documentation>The Artifact object is intended to encapsulate and convey the content of a Raw Artifact.</xs:documentation>
+		</xs:annotation>
+	</xs:element>
+	<xs:complexType name="ArtifactObjectType">
+		<xs:annotation>
+			<xs:documentation>The ArtifactObjectType type is intended to encapsulate and convey the content of a Raw Artifact.</xs:documentation>
+		</xs:annotation>
+		<xs:complexContent>
+			<xs:extension base="cyboxCommon:ObjectPropertiesType">
+				<xs:sequence>
+					<xs:element name="Hashes" type="cyboxCommon:HashListType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Hashes field is optional and specifies hashes for the Raw_Artifact content.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Packaging" type="ArtifactObj:PackagingType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Packaging field is optional and characterizes packaging layers (e.g. compression, encryption, encoding) applied to the original content to generate the content of the Raw_Artifact field of this Object. The ordering of entries in this sequence implicitly denotes the ordering of packaging layer operations applied.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:choice>
+						<xs:element name="Raw_Artifact" type="ArtifactObj:RawArtifactType" minOccurs="0">
+							<xs:annotation>
+								<xs:documentation>The Raw_Artifact field contains the raw content of a cyber artifact (rather than simply analysis of that artifact). It is conveyed within a string-based field and should be further enclosed in a CDATA section within the string-based field.</xs:documentation>
+							</xs:annotation>
+						</xs:element>
+						<xs:element name="Raw_Artifact_Reference" type="xs:anyURI" minOccurs="0">
+							<xs:annotation>
+								<xs:documentation>The Raw_Artifact_Reference field contains a reference to an external instance of the raw content of a cyber artifact (rather than simply analysis of that artifact).</xs:documentation>
+							</xs:annotation>
+						</xs:element>
+					</xs:choice>
+				</xs:sequence>
+				<xs:attribute name="type" type="ArtifactObj:ArtifactTypeEnum">
+					<xs:annotation>
+						<xs:documentation>The type field specifies the general type of the artifact contained in this Defined Object.</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+				<xs:attribute name="content_type" type="xs:string">
+					<xs:annotation>
+						<xs:documentation>The content_type field is optional and specifies the Internet Media Type of the artifact contained in this Defined Object.</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+				<xs:attribute name="content_type_version" type="xs:string">
+					<xs:annotation>
+						<xs:documentation>The content_type_version field is optional and specifies the content type version of the artifact contained in this Defined Object.</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+				<xs:attribute name="suspected_malicious" type="xs:boolean">
+					<xs:annotation>
+						<xs:documentation>The suspected_malicious field is optional and conveys whether the content of the Raw_Artifact is believed to be malicious.</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+			</xs:extension>
+		</xs:complexContent>
+	</xs:complexType>
+	<xs:complexType name="RawArtifactType">
+		<xs:annotation>
+			<xs:documentation>The RawArtifactType is intended to convey, with minimal characterization, the content of the Raw Artifact itself.</xs:documentation>
+		</xs:annotation>
+		<xs:complexContent>
+			<xs:extension base="cyboxCommon:StringObjectPropertyType">
+				<xs:attribute name="byte_order" type="cyboxCommon:EndiannessTypeEnum">
+					<xs:annotation>
+						<xs:documentation>The byte_order field specifies the endianness of the unpacked (e.g., unencrypted, base64-decoded, decompressed, etc.) Raw Artifact data.</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+			</xs:extension>
+		</xs:complexContent>
+	</xs:complexType>
+	<xs:complexType name="PackagingType">
+		<xs:annotation>
+			<xs:documentation>The PackagingType captures any packaging layers applied to an artifact.</xs:documentation>
+		</xs:annotation>
+		<xs:sequence>
+			<xs:choice maxOccurs="unbounded">
+				<xs:element name="Compression" type="ArtifactObj:CompressionType" minOccurs="0">
+					<xs:annotation>
+						<xs:documentation>The Compression field is optional and specifies details for a compression layer applied to the content of the Raw_Artifact.</xs:documentation>
+					</xs:annotation>
+				</xs:element>
+				<xs:element name="Encryption" type="ArtifactObj:EncryptionType" minOccurs="0">
+					<xs:annotation>
+						<xs:documentation>The Encryption field is optional and specifies details for an encryption layer applied to the content of the Raw_Artifact.</xs:documentation>
+					</xs:annotation>
+				</xs:element>
+				<xs:element name="Encoding" type="ArtifactObj:EncodingType" minOccurs="0">
+					<xs:annotation>
+						<xs:documentation>The Encoding field is optional and specifies details for an encoding layer applied to the content of the Raw_Artifact.</xs:documentation>
+					</xs:annotation>
+				</xs:element>
+			</xs:choice>
+		</xs:sequence>
+		<xs:attribute name="is_encrypted" type="xs:boolean">
+			<xs:annotation>
+				<xs:documentation>The is_encrypted field is optional and specifies whether the Raw_Artifact content is protected/encrypted.</xs:documentation>
+			</xs:annotation>
+		</xs:attribute>
+		<xs:attribute name="is_compressed" type="xs:boolean">
+			<xs:annotation>
+				<xs:documentation>The is_compressed field is optional and specifies whether the Raw_Artifact content is compressed.</xs:documentation>
+			</xs:annotation>
+		</xs:attribute>
+	</xs:complexType>
+	<xs:complexType name="CompressionType">
+		<xs:annotation>
+			<xs:documentation>The CompressionType captures any compression packaging details for an artifact.</xs:documentation>
+		</xs:annotation>
+		<xs:attribute name="compression_mechanism" type="xs:string">
+			<xs:annotation>
+				<xs:documentation>The compression_mechanism field is optional and specifies the compression algorithm utilized to protect the Raw_Artifact content.</xs:documentation>
+			</xs:annotation>
+		</xs:attribute>
+		<xs:attribute name="compression_mechanism_ref" type="xs:anyURI">
+			<xs:annotation>
+				<xs:documentation>The compression_mechanism_ref field is optional and conveys a reference to a description of the compression algorithm utilized to protect the Raw_Artifact content.</xs:documentation>
+			</xs:annotation>
+		</xs:attribute>
+	</xs:complexType>
+	<xs:complexType name="EncryptionType">
+		<xs:annotation>
+			<xs:documentation>The EncryptionType captures any encryption packaging details for an artifact.</xs:documentation>
+		</xs:annotation>
+		<xs:attribute name="encryption_mechanism" type="xs:string">
+			<xs:annotation>
+				<xs:documentation>The encryption_mechanism field is optional and specifies the protection/encryption algorithm utilized to protect the Raw_Artifact content.</xs:documentation>
+			</xs:annotation>
+		</xs:attribute>
+		<xs:attribute name="encryption_mechanism_ref" type="xs:anyURI">
+			<xs:annotation>
+				<xs:documentation>The encryption_mechanism_ref field is optional and conveys a reference to a description of the protection/encryption algorithm utilized to protect the Raw_Artifact content.</xs:documentation>
+			</xs:annotation>
+		</xs:attribute>
+		<xs:attribute name="encryption_key" type="xs:string">
+			<xs:annotation>
+				<xs:documentation>The encryption_key field is optional and locally specifies the password for unprotecting/decrypting the Raw_Artifact content.</xs:documentation>
+			</xs:annotation>
+		</xs:attribute>
+		<xs:attribute name="encryption_key_ref" type="xs:anyURI">
+			<xs:annotation>
+				<xs:documentation>The encryption_key_ref field is optional and specifies a reference to a remote specification of the password for unlocking/decrypting the Raw_Artifact content.</xs:documentation>
+			</xs:annotation>
+		</xs:attribute>
+	</xs:complexType>
+	<xs:complexType name="EncodingType">
+		<xs:annotation>
+			<xs:documentation>The EncodingType captures any encoding packaging details for an artifact.</xs:documentation>
+		</xs:annotation>
+		<xs:attribute name="algorithm" type="xs:string" default="Base64">
+			<xs:annotation>
+				<xs:documentation>The algorithm field is optional and specifies the encoding algorithm utilized to encode the Raw_Artifact.</xs:documentation>
+			</xs:annotation>
+		</xs:attribute>
+		<xs:attribute name="character_set" type="xs:string">
+			<xs:annotation>
+				<xs:documentation>The character_set field is optional and specifies the character set utilized in the Raw_Artifact content encoding.</xs:documentation>
+			</xs:annotation>
+		</xs:attribute>
+		<xs:attribute name="custom_character_set_ref" type="xs:anyURI">
+			<xs:annotation>
+				<xs:documentation>The custom_character_set_ref field is optional and conveys a reference to a specification of the custom character set used to encode the Raw_Artifact.</xs:documentation>
+			</xs:annotation>
+		</xs:attribute>
+	</xs:complexType>
+	<xs:simpleType name="ArtifactTypeEnum">
+		<xs:annotation>
+			<xs:documentation>The ArtifactTypeEnum is a (non-exhaustive) enumeration of cyber raw artifact types.</xs:documentation>
+		</xs:annotation>
+		<xs:restriction base="xs:string">
+			<xs:enumeration value="File">
+				<xs:annotation>
+					<xs:documentation>The File value specifies that the artifact is a file.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="Memory Region">
+				<xs:annotation>
+					<xs:documentation>The Memory Region value specifies that the artifact is a block of data from a region of memory.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="File System Fragment">
+				<xs:annotation>
+					<xs:documentation>The File System Fragment value specifies that the artifact is a block of data from a file system.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="Network Traffic">
+				<xs:annotation>
+					<xs:documentation>The Network Traffic value specifies that the artifact is a block of network traffic data such as PCAP.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="Generic Data Region">
+				<xs:annotation>
+					<xs:documentation>The Generic Data Region value specifies that the artifact is a block of data from an unknown source.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+		</xs:restriction>
+	</xs:simpleType>
+</xs:schema>