stix_schema_spy 1.0

data/config/1.1/stix/extensions/address/ciq_3.0_address.xsd

@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" elementFormDefault="qualified" targetNamespace="http://stix.mitre.org/extensions/Address#CIQAddress3.0-1" xmlns:stix-ciqaddress="http://stix.mitre.org/extensions/Address#CIQAddress3.0-1" xmlns:a="urn:oasis:names:tc:ciq:xal:3" xmlns:stixCommon="http://stix.mitre.org/common-1" version="1.1" xml:lang="English">
+    <xs:annotation>
+        <xs:documentation>This schema was originally developed by The MITRE Corporation. The STIX XML Schema implementation is maintained by The MITRE Corporation and developed by the open STIX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the STIX website at http://stix.mitre.org. </xs:documentation>
+        <xs:appinfo>
+            <schema>STIX Extension - CIQ Address 3.0 Instance</schema>
+            <version>1.1</version>
+            <date>02/20/2014 9:00:00 AM</date>
+            <short_description>Structured Threat Information eXpression (STIX) Extension - CIQ Address 3.0 Instance - Schematic implementation for the using version 3.0 of CIQ to describe an Address within the STIX structured cyber threat expression language architecture.</short_description>
+            <terms_of_use>Copyright (c) 2012-2014, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the STIX License located at http://stix.mitre.org/about/termsofuse.html. See the STIX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the STIX Schema, this license header must be included. </terms_of_use>
+        </xs:appinfo>
+    </xs:annotation>
+    <xs:import namespace="http://stix.mitre.org/common-1" schemaLocation="../../stix_common.xsd"/>
+    <xs:import namespace="urn:oasis:names:tc:ciq:xal:3" schemaLocation="../../external/oasis_ciq_3.0/xAL.xsd"/>
+    <xs:complexType name="CIQAddress3.0InstanceType">
+        <xs:annotation>
+            <xs:documentation>The CIQAddress3.0InstanceType provides an extension to the AddressAbstractType which imports and leverages version 3.0 of the OASIS CIQ-PIL schema for structured characterization of Addresses.</xs:documentation>
+        </xs:annotation>
+        <xs:complexContent>
+            <xs:extension base="stixCommon:AddressAbstractType">
+                <xs:sequence>
+                    <xs:element minOccurs="0" name="Location" type="a:AddressType"/>
+                </xs:sequence>
+            </xs:extension>
+        </xs:complexContent>
+    </xs:complexType>
+</xs:schema>

data/config/1.1/stix/extensions/address/readme.txt

@@ -0,0 +1 @@
+The default type for representing addresses is CIQAddress3.0InstanceType in ciq_3.0_address.xsd.

data/config/1.1/stix/extensions/attack_pattern/capec_2.7_attack_pattern.xsd

@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:capec="http://capec.mitre.org/capec-2" xmlns:ttp="http://stix.mitre.org/TTP-1" xmlns:stix-capec="http://stix.mitre.org/extensions/AP#CAPEC2.7-1" targetNamespace="http://stix.mitre.org/extensions/AP#CAPEC2.7-1" elementFormDefault="qualified" version="1.0" xml:lang="English">
+	<xs:annotation>
+		<xs:documentation>This schema was originally developed by The MITRE Corporation. The STIX XML Schema implementation is maintained by The MITRE Corporation and developed by the open STIX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the STIX website at http://stix.mitre.org. </xs:documentation>
+		<xs:appinfo>
+			<schema>STIX Extension - CAPEC 2.7 Attack Pattern Instance</schema>
+			<version>1.0</version>
+			<date>02/20/2014 9:00:00 AM</date>
+			<short_description>Structured Threat Information eXpression (STIX) Extension - CAPEC Attack Pattern Instance - Schematic implementation for the using CAPEC 2.7 to describe an Attack Pattern within the STIX structured cyber threat expression language architecture.</short_description>
+			<terms_of_use>Copyright (c) 2012-2014, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the STIX License located at http://stix.mitre.org/about/termsofuse.html. See the STIX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the STIX Schema, this license header must be included. </terms_of_use>
+		</xs:appinfo>
+	</xs:annotation>
+	<xs:import namespace="http://stix.mitre.org/TTP-1" schemaLocation="../../ttp.xsd"/>
+	<xs:import namespace="http://capec.mitre.org/capec-2" schemaLocation="../../external/capec_2.7/ap_schema_v2.7.xsd"/>
+	<xs:complexType name="CAPEC2.7InstanceType">
+		<xs:annotation>
+			<xs:documentation>The CAPECInstanceType provides an extension to the APStructureAbstractType which imports and leverages the CAPEC 2.7 schema for structured characterization of Attack Patterns.</xs:documentation>
+		</xs:annotation>
+		<xs:complexContent>
+			<xs:extension base="ttp:AttackPatternType">
+				<xs:sequence>
+					<xs:element name="CAPEC" type="capec:Attack_PatternType">
+						<xs:annotation>
+							<xs:documentation>The CAPEC field contains the structured specification of an Attack Pattern utilizing the CAPEC schema.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+				</xs:sequence>
+			</xs:extension>
+		</xs:complexContent>
+	</xs:complexType>
+</xs:schema>

data/config/1.1/stix/extensions/attack_pattern/readme.txt

@@ -0,0 +1 @@
+The default type for representing attack patterns is the CAPEC2.7InstanceType defined in capec_2.7_attack_pattern.xsd.

data/config/1.1/stix/extensions/identity/ciq_3.0_identity.xsd

@@ -0,0 +1,113 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" elementFormDefault="qualified" xmlns:ciq="urn:oasis:names:tc:ciq:xpil:3" xmlns:stixCommon="http://stix.mitre.org/common-1" targetNamespace="http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1" xmlns:stix-ciqidentity="http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1" version="1.1" xml:lang="English">
+    <xs:annotation>
+        <xs:documentation>This schema was originally developed by The MITRE Corporation. The STIX XML Schema implementation is maintained by The MITRE Corporation and developed by the open STIX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the STIX website at http://stix.mitre.org. </xs:documentation>
+        <xs:appinfo>
+            <schema>STIX Extension - CIQ Identity 3.0 Instance</schema>
+            <version>1.1</version>
+            <date>02/20/2014 9:00:00 AM</date>
+            <short_description>Structured Threat Information eXpression (STIX) Extension - CIQ Identity 3.0 Instance - Schematic implementation for the using version 3.0 of CIQ to describe an Identity within the STIX structured cyber threat expression language architecture.</short_description>
+            <terms_of_use>Copyright (c) 2012-2014, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the STIX License located at http://stix.mitre.org/about/termsofuse.html. See the STIX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the STIX Schema, this license header must be included. </terms_of_use>
+        </xs:appinfo>
+    </xs:annotation>
+    <xs:import namespace="http://stix.mitre.org/common-1" schemaLocation="../../stix_common.xsd"/>
+    <xs:import namespace="urn:oasis:names:tc:ciq:xpil:3" schemaLocation="../../external/oasis_ciq_3.0/xPIL.xsd"/>
+    <xs:complexType name="CIQIdentity3.0InstanceType">
+        <xs:annotation>
+            <xs:documentation>The CIQIdentity3.0InstanceType provides an extension to the IdentityStructureAbstractType which imports and leverages version 3.0 of the OASIS CIQ-PIL schema for structured characterization of Identities.</xs:documentation>
+        </xs:annotation>
+        <xs:complexContent>
+            <xs:extension base="stixCommon:IdentityType">
+                <xs:sequence>
+                    <xs:element name="Specification" type="stix-ciqidentity:STIXCIQIdentity3.0Type">
+                        <xs:annotation>
+                            <xs:documentation>The Specification field contains the structured characterization of an Identity utilizing the CIQ-PIL schema.</xs:documentation>
+                        </xs:annotation>
+                    </xs:element>
+                    <xs:element name="Role" type="xs:string" minOccurs="0" maxOccurs="unbounded">
+                        <xs:annotation>
+                            <xs:documentation>The Role field specifies a relevant role played by this entity.</xs:documentation>
+                        </xs:annotation>
+                    </xs:element>
+                </xs:sequence>
+            </xs:extension>
+        </xs:complexContent>
+    </xs:complexType>
+    <xs:complexType name="STIXCIQIdentity3.0Type">
+        <xs:annotation>
+            <xs:documentation>The STIXCIQIdentityType provides a restriction and minor extension of the imported OASIS CIQ-PIL PartyType for use in characterizing STIX Identities.</xs:documentation>
+        </xs:annotation>
+        <xs:complexContent>
+            <xs:restriction base="ciq:PartyType">
+                <xs:sequence>
+                    <xs:element minOccurs="0" ref="ciq:FreeTextLines"/>
+                    <xs:element minOccurs="0" ref="ciq:PartyName"/>
+                    <xs:element minOccurs="0" ref="ciq:Addresses"/>
+                    <xs:element minOccurs="0" ref="ciq:Accounts">
+                        <xs:annotation>
+                            <xs:documentation>A container to define the accounts details of the party such as utility account, financil accounts</xs:documentation>
+                        </xs:annotation>
+                    </xs:element>
+                    <xs:element minOccurs="0" ref="ciq:ContactNumbers"/>
+                    <xs:element minOccurs="0" ref="ciq:Documents">
+                        <xs:annotation>
+                            <xs:documentation>A container for identification document and cards of the party that are unique to the party. e.g. license, identification card, credit card, etc</xs:documentation>
+                        </xs:annotation>
+                    </xs:element>
+                    <xs:element minOccurs="0" ref="ciq:ElectronicAddressIdentifiers"/>
+                    <xs:element minOccurs="0" ref="ciq:Events"/>
+                    <xs:element minOccurs="0" ref="ciq:Identifiers"/>
+                    <xs:element minOccurs="0" ref="ciq:Memberships">
+                        <xs:annotation>
+                            <xs:documentation>A container for memberships of party with other organisations (e.g. industry groups) or social networks (clubs, association, etc)</xs:documentation>
+                        </xs:annotation>
+                    </xs:element>
+                    <xs:element minOccurs="0" ref="ciq:Relationships">
+                        <xs:annotation>
+                            <xs:documentation>Relationships with other parties (persons or organisations, and the nature of relationship). Examples: - For person: Contacts, blood relatives, friends, referees, customers, etc - for Organisation: Subsidiary, Parent company, Branches, Divisions, Partners, etc</xs:documentation>
+                        </xs:annotation>
+                    </xs:element>
+                    <xs:element minOccurs="0" ref="ciq:Revenues">
+                        <xs:annotation>
+                            <xs:documentation>Container for income / revenue information of the party (salary/organisation revenue)</xs:documentation>
+                        </xs:annotation>
+                    </xs:element>
+                    <xs:element minOccurs="0" ref="ciq:Stocks"/>
+                    <xs:element minOccurs="0" ref="ciq:Vehicles"/>
+                    <xs:element minOccurs="0" ref="ciq:OrganisationInfo">
+                        <xs:annotation>
+                            <xs:documentation>Container for other organisation specific details that are not covered in this schema that are common to a party</xs:documentation>
+                        </xs:annotation>
+                    </xs:element>
+                    <xs:element minOccurs="0" ref="ciq:PersonInfo">
+                        <xs:annotation>
+                            <xs:documentation>Container for other person specific details that are not covered in this schema elements that are common to a party</xs:documentation>
+                        </xs:annotation>
+                    </xs:element>
+                    <xs:element minOccurs="0" ref="ciq:BirthInfo"/>
+                    <xs:element minOccurs="0" ref="ciq:CountriesOfResidence"/>
+                    <xs:element minOccurs="0" ref="ciq:Favourites"/>
+                    <xs:element minOccurs="0" ref="ciq:Habits"/>
+                    <xs:element minOccurs="0" ref="ciq:Hobbies"/>
+                    <xs:element minOccurs="0" ref="ciq:Languages"/>
+                    <xs:element minOccurs="0" ref="ciq:Nationalities"/>
+                    <xs:element minOccurs="0" ref="ciq:Occupations"/>
+                    <xs:element minOccurs="0" ref="ciq:PhysicalInfo"/>
+                    <xs:element minOccurs="0" ref="ciq:Preferences"/>
+                    <xs:element minOccurs="0" ref="ciq:Qualifications"/>
+                    <xs:element minOccurs="0" ref="ciq:Visas"/>
+                </xs:sequence>
+                <xs:attribute form="qualified" name="PartyType" type="ciq:PartyTypeList">
+                    <xs:annotation>
+                        <xs:documentation>Type of Party. e.g. Person or an organisation. An organisation could be university, college, club, association, company, etc</xs:documentation>
+                    </xs:annotation>
+                </xs:attribute>
+                <xs:attribute form="qualified" name="LanguageCode" type="xs:language">
+                    <xs:annotation>
+                        <xs:documentation>Human Language used. e.g. "en", "en-US", "en-AUS", etc</xs:documentation>
+                    </xs:annotation>
+                </xs:attribute>
+            </xs:restriction>
+        </xs:complexContent>
+    </xs:complexType>
+</xs:schema>

data/config/1.1/stix/extensions/identity/readme.txt

@@ -0,0 +1 @@
+The default type for representing identities is CIQIdentity3.0InstanceType in ciq_3.0_identity.xsd.

data/config/1.1/stix/extensions/malware/maec_4.1_malware.xsd

@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" elementFormDefault="qualified" targetNamespace="http://stix.mitre.org/extensions/Malware#MAEC4.1-1" xmlns:stix-maec="http://stix.mitre.org/extensions/Malware#MAEC4.1-1" xmlns:maec="http://maec.mitre.org/XMLSchema/maec-package-2" xmlns:ttp="http://stix.mitre.org/TTP-1" version="1.0" xml:lang="English">
+    <xs:annotation>
+        <xs:documentation>This schema was originally developed by The MITRE Corporation. The STIX XML Schema implementation is maintained by The MITRE Corporation and developed by the open STIX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the STIX website at http://stix.mitre.org.</xs:documentation>
+        <xs:appinfo>
+            <schema>STIX Extension - MAEC 4.1 Malware Instance</schema>
+            <version>1.0</version>
+            <date>02/20/2014 9:00:00 AM</date>
+            <short_description>Structured Threat Information eXpression (STIX) Extension - MAEC 4.1 Malware Instance - Schematic implementation for the using MAEC 4.1 to describe Malware within the STIX structured cyber threat expression language architecture.</short_description>
+            <terms_of_use>Copyright (c) 2012-2014, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the STIX License located at http://stix.mitre.org/about/termsofuse.html. See the STIX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the STIX Schema, this license header must be included. </terms_of_use>
+        </xs:appinfo>
+    </xs:annotation>
+    <xs:import namespace="http://stix.mitre.org/TTP-1" schemaLocation="../../ttp.xsd"/>
+    <xs:import namespace="http://maec.mitre.org/XMLSchema/maec-package-2" schemaLocation="../../external/maec_4.1/maec_package_schema.xsd"/>
+    <xs:complexType name="MAEC4.1InstanceType">
+        <xs:annotation>
+            <xs:documentation>The MAEC4.1InstanceType provides an extension to MalwareInstanceType which imports and leverages the MAEC 4.1 schema for structured characterization of Malware.</xs:documentation>
+        </xs:annotation>
+        <xs:complexContent>
+            <xs:extension base="ttp:MalwareInstanceType">
+                <xs:sequence>
+                    <xs:element name="MAEC" type="maec:PackageType">
+                        <xs:annotation>
+                            <xs:documentation>The MAEC field contains the structured characterization of instances of Malware utilizing the MAEC Package schema.</xs:documentation>
+                        </xs:annotation>
+                    </xs:element>
+                </xs:sequence>
+            </xs:extension>
+        </xs:complexContent>
+    </xs:complexType>
+</xs:schema>

data/config/1.1/stix/extensions/malware/readme.txt

@@ -0,0 +1 @@
+The default type for representing identities is the MAEC4.1InstanceType defined in maec_4.1_malware.xsd.

data/config/1.1/stix/extensions/marking/simple_marking.xsd

@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:marking="http://data-marking.mitre.org/Marking-1" xmlns:simpleMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Simple-1" targetNamespace="http://data-marking.mitre.org/extensions/MarkingStructure#Simple-1" elementFormDefault="qualified" attributeFormDefault="unqualified" version="1.1" xml:lang="English">
+	<xs:annotation>
+		<xs:documentation>This schema was originally developed by The MITRE Corporation. The Data Marking Schema implementation is maintained by The MITRE Corporation and developed by the open STIX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the STIX website at http://stix.mitre.org. </xs:documentation>
+		<xs:appinfo>
+			<schema>Data Marking Extension - Simple Marking Instance</schema>
+			<version>1.1</version>
+			<date>02/20/2014 9:00:00 AM</date>
+			<short_description>Data Marking Extension - Simple Marking Instance - Schematic implementation for attaching a simple statement to an idendified XML structure.</short_description>
+			<terms_of_use>Copyright (c) 2012-2014, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the STIX License located at http://stix.mitre.org/about/termsofuse.html. See the STIX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the STIX Schema, this license header must be included. </terms_of_use>
+		</xs:appinfo>
+	</xs:annotation>
+	<xs:import namespace="http://data-marking.mitre.org/Marking-1" schemaLocation="../../data_marking.xsd"/>
+	<xs:complexType name="SimpleMarkingStructureType">
+		<xs:annotation>
+			<xs:documentation>The SimpleMarkingStructureType is a basic implementation of the data marking schema that allows for a string statement to be associated with the data being marked. One example might be the application of a copyright statement to some data set.</xs:documentation>
+			<xs:documentation>Nodes may be marked by multiple SimpleMarking statements. When this occurs, all SimpleMarking statements applied to that node are considered valid. There is no resolution for SimpleMarking Statements that appear to conflict: the behavior is undefined at the STIX level.</xs:documentation>
+		</xs:annotation>
+		<xs:complexContent>
+			<xs:extension base="marking:MarkingStructureType">
+				<xs:sequence>
+					<xs:element name="Statement" type="xs:string">
+						<xs:annotation>
+							<xs:documentation>The statement to apply to the structure for which the Marking is to be applied.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+				</xs:sequence>
+			</xs:extension>
+		</xs:complexContent>
+	</xs:complexType>
+</xs:schema>

data/config/1.1/stix/extensions/marking/terms_of_use_marking.xsd

@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:marking="http://data-marking.mitre.org/Marking-1" xmlns:TOUMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1" targetNamespace="http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1" elementFormDefault="qualified" attributeFormDefault="unqualified" version="1.0" xml:lang="English">
+	<xs:annotation>
+		<xs:documentation>This schema was originally developed by The MITRE Corporation in coordination with Terry MacDonald. The Data Marking Schema implementation is maintained by The MITRE Corporation and developed by the open STIX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the STIX website at http://stix.mitre.org. </xs:documentation>
+		<xs:appinfo>
+			<schema>Data Marking Extension - Terms Of Use Marking Instance</schema>
+			<version>1.0</version>
+			<date>02/20/2014 9:00:00 AM</date>
+			<short_description>Data Marking Extension - Terms Of Use Marking Instance - Schematic implementation for attaching a Terms Of Use statement to an idendified XML structure.</short_description>
+			<terms_of_use>Copyright (c) 2012-2014, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the STIX License located at http://stix.mitre.org/about/termsofuse.html. See the STIX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the STIX Schema, this license header must be included. </terms_of_use>
+		</xs:appinfo>
+	</xs:annotation>
+	<xs:import namespace="http://data-marking.mitre.org/Marking-1" schemaLocation="../../data_marking.xsd"/>
+	<xs:complexType name="TermsOfUseMarkingStructureType">
+		<xs:annotation>
+			<xs:documentation>The TermsOfUseMarkingStructureType is a basic implementation of the data marking schema that allows for a string statement describing the Terms Of Use to be associated with the data being marked.</xs:documentation>
+			<xs:documentation>Nodes may be marked by multiple Terms Of Use Marking statements. When this occurs, all of the multiple Terms of Use Marking statements apply. Its up to the organization adding an additional Term Of User Marking statement to ensure that it's Terms Of Use does not conflict with any previously applied Terms Of Use Marking Statement.</xs:documentation>
+		</xs:annotation>
+		<xs:complexContent>
+			<xs:extension base="marking:MarkingStructureType">
+				<xs:sequence>
+					<xs:element name="Terms_Of_Use" type="xs:string">
+						<xs:annotation>
+							<xs:documentation>The Terms Of Use statement to apply to the structure for which the Marking is to be applied.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+				</xs:sequence>
+			</xs:extension>
+		</xs:complexContent>
+	</xs:complexType>
+</xs:schema>

data/config/1.1/stix/extensions/marking/tlp_marking.xsd

@@ -0,0 +1,40 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:marking="http://data-marking.mitre.org/Marking-1" xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1" targetNamespace="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1" elementFormDefault="qualified" attributeFormDefault="unqualified" version="1.1" xml:lang="English">
+	<xs:annotation>
+		<xs:documentation>This schema was originally developed by The MITRE Corporation. The Data Marking Schema implementation is maintained by The MITRE Corporation and developed by the open STIX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the STIX website at http://stix.mitre.org. </xs:documentation>
+		<xs:appinfo>
+			<schema>Data Marking Extension - TLP</schema>
+			<version>1.1</version>
+			<date>02/20/2014 9:00:00 AM</date>
+			<short_description>Data Marking Extension - TLP Marking Instance - Schematic implementation for attaching a Traffic Light Protocol (TLP)designation to an idendified XML structure.</short_description>
+			<terms_of_use>Copyright (c) 2012-2014, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the STIX License located at http://stix.mitre.org/about/termsofuse.html. See the STIX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the STIX Schema, this license header must be included. </terms_of_use>
+		</xs:appinfo>
+	</xs:annotation>
+	<xs:import namespace="http://data-marking.mitre.org/Marking-1" schemaLocation="../../data_marking.xsd"/>
+	<xs:complexType name="TLPMarkingStructureType">
+		<xs:annotation>
+			<xs:documentation>The TLPMarkingStructureType is an implementation of the data marking schema that allows for a TLP Designation to be attached to an identified XML structure. Information about TLP is available here: http://www.us-cert.gov/tlp.</xs:documentation>
+			<xs:documentation>Nodes may be marked by multiple TLP Marking statements. When this occurs, the node should be considered marked at the most restrictive TLP Marking of all TLP Markings that were applied to it. For example, if a node is marked both GREEN and AMBER, the node should be considered AMBER.</xs:documentation>
+		</xs:annotation>
+		<xs:complexContent>
+			<xs:extension base="marking:MarkingStructureType">
+				<xs:attribute name="color" type="tlpMarking:TLPColorEnum">
+					<xs:annotation>
+						<xs:documentation>The TLP color designation of the marked structure.</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+			</xs:extension>
+		</xs:complexContent>
+	</xs:complexType>
+	<xs:simpleType name="TLPColorEnum">
+		<xs:annotation>
+			<xs:documentation>The TLP color designation of the marked structure.</xs:documentation>
+		</xs:annotation>
+		<xs:restriction base="xs:string">
+			<xs:enumeration value="RED"/>
+			<xs:enumeration value="AMBER"/>
+			<xs:enumeration value="GREEN"/>
+			<xs:enumeration value="WHITE"/>
+		</xs:restriction>
+	</xs:simpleType>
+</xs:schema>

data/config/1.1/stix/extensions/structured_coa/generic_structured_coa.xsd

@@ -0,0 +1,46 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:coa="http://stix.mitre.org/CourseOfAction-1" xmlns:stixCommon="http://stix.mitre.org/common-1" xmlns:genericStructuredCOA="http://stix.mitre.org/extensions/StructuredCOA#Generic-1" targetNamespace="http://stix.mitre.org/extensions/StructuredCOA#Generic-1" elementFormDefault="qualified" attributeFormDefault="unqualified" version="1.1" xml:lang="English">
+    <xs:annotation>
+        <xs:documentation>This schema was originally developed by The MITRE Corporation. The STIX XML Schema implementation is maintained by The MITRE Corporation and developed by the open STIX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the STIX website at http://stix.mitre.org.</xs:documentation>
+        <xs:appinfo>
+            <schema>STIX Extension - Structured Course of Action Instance</schema>
+            <version>1.1</version>
+            <date>02/20/2014 9:00:00 AM</date>
+            <short_description>Structured Threat Information eXpression (STIX) Extension - Generic Structured Course of Action Instance - Schematic implementation for the using a generic Structured Course of Action within the STIX structured cyber threat expression language architecture.</short_description>
+            <terms_of_use>Copyright (c) 2012-2014, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the STIX License located at http://stix.mitre.org/about/termsofuse.html. See the STIX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the STIX Schema, this license header must be included. </terms_of_use>
+        </xs:appinfo>
+    </xs:annotation>
+    <xs:import namespace="http://stix.mitre.org/CourseOfAction-1" schemaLocation="../../course_of_action.xsd"/>
+    <xs:import namespace="http://stix.mitre.org/common-1" schemaLocation="../../stix_common.xsd"/>
+    <xs:complexType name="GenericStructuredCOAType">
+        <xs:annotation>
+            <xs:documentation>The GenericStructuredCOAType specifies an instantial extension from the abstract StructuredCOAType intended to support the generic inclusion of any COA content.</xs:documentation>
+        </xs:annotation>
+        <xs:complexContent>
+            <xs:extension base="coa:StructuredCOAType">
+                <xs:sequence>
+                    <xs:element name="Description" type="stixCommon:StructuredTextType">
+                        <xs:annotation>
+                            <xs:documentation>A structured Description of this Generic Structured COA.</xs:documentation>
+                        </xs:annotation>
+                    </xs:element>
+                    <xs:element name="Type" type="stixCommon:ControlledVocabularyStringType">
+                        <xs:annotation>
+                            <xs:documentation>Specifies the type of Generic Structured COA.</xs:documentation>
+                        </xs:annotation>
+                    </xs:element>
+                    <xs:element name="Specification" type="stixCommon:EncodedCDATAType">
+                        <xs:annotation>
+                            <xs:documentation>The Specification field encapsulates any test mechnism specification in its native format within a string field. The specification should be within a CDATA construct within the string field.</xs:documentation>
+                        </xs:annotation>
+                    </xs:element>
+                </xs:sequence>
+                <xs:attribute name="reference_location" type="xs:anyURI">
+                    <xs:annotation>
+                        <xs:documentation>Specifies a reference URL for the location of the Generic Structured COA.</xs:documentation>
+                    </xs:annotation>
+                </xs:attribute>
+            </xs:extension>
+        </xs:complexContent>
+    </xs:complexType>
+</xs:schema>

data/config/1.1/stix/extensions/test_mechanism/generic_test_mechanism.xsd

@@ -0,0 +1,46 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:indicator="http://stix.mitre.org/Indicator-2" xmlns:stixCommon="http://stix.mitre.org/common-1" xmlns:genericTM="http://stix.mitre.org/extensions/TestMechanism#Generic-1" targetNamespace="http://stix.mitre.org/extensions/TestMechanism#Generic-1" elementFormDefault="qualified" attributeFormDefault="unqualified" version="1.1" xml:lang="English">
+    <xs:annotation>
+        <xs:documentation>This schema was originally developed by The MITRE Corporation. The STIX XML Schema implementation is maintained by The MITRE Corporation and developed by the open STIX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the STIX website at http://stix.mitre.org.</xs:documentation>
+        <xs:appinfo>
+            <schema>STIX Extension - Generic Test Mechanism Instance</schema>
+            <version>1.1</version>
+            <date>02/20/2014 9:00:00 AM</date>
+            <short_description>Structured Threat Information eXpression (STIX) Extension - Generic Test Mechanism Instance - Schematic implementation for the using a generic Test Machanism within the STIX structured cyber threat expression language architecture.</short_description>
+            <terms_of_use>Copyright (c) 2012-2014, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the STIX License located at http://stix.mitre.org/about/termsofuse.html. See the STIX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the STIX Schema, this license header must be included. </terms_of_use>
+        </xs:appinfo>
+    </xs:annotation>
+    <xs:import namespace="http://stix.mitre.org/Indicator-2" schemaLocation="../../indicator.xsd"/>
+    <xs:import namespace="http://stix.mitre.org/common-1" schemaLocation="../../stix_common.xsd"/>
+    <xs:complexType name="GenericTestMechanismType">
+        <xs:annotation>
+            <xs:documentation>The GenericTestMechanismType specifies an instantial extension from the abstract TestMechanismType intended to support the generic inclusion of any test mechanism content.</xs:documentation>
+        </xs:annotation>
+        <xs:complexContent>
+            <xs:extension base="indicator:TestMechanismType">
+                <xs:sequence>
+                    <xs:element name="Description" type="stixCommon:StructuredTextType">
+                        <xs:annotation>
+                            <xs:documentation>A structured Description of this Generic Test Mechanism.</xs:documentation>
+                        </xs:annotation>
+                    </xs:element>
+                    <xs:element name="Type" type="stixCommon:ControlledVocabularyStringType">
+                        <xs:annotation>
+                            <xs:documentation>Specifies the type of Generic Test Mechanism.</xs:documentation>
+                        </xs:annotation>
+                    </xs:element>
+                    <xs:element name="Specification" type="stixCommon:EncodedCDATAType">
+                        <xs:annotation>
+                            <xs:documentation>The Specification field encapsulates any test mechnism specification in its native format within a string field. The specification should be within a CDATA construct within the string field.</xs:documentation>
+                        </xs:annotation>
+                    </xs:element>
+                </xs:sequence>
+                <xs:attribute name="reference_location" type="xs:anyURI">
+                    <xs:annotation>
+                        <xs:documentation>Specifies a reference URL for the location of the Generic Test Mechanism.</xs:documentation>
+                    </xs:annotation>
+                </xs:attribute>
+            </xs:extension>
+        </xs:complexContent>
+    </xs:complexType>
+</xs:schema>

data/config/1.1/stix/extensions/test_mechanism/open_ioc_2010_test_mechanism.xsd

@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:indicator="http://stix.mitre.org/Indicator-2" xmlns:ioc-tr="http://schemas.mandiant.com/2010/ioc/TR/" xmlns:ioc="http://schemas.mandiant.com/2010/ioc" xmlns:stix-openioc="http://stix.mitre.org/extensions/TestMechanism#OpenIOC2010-1" targetNamespace="http://stix.mitre.org/extensions/TestMechanism#OpenIOC2010-1" elementFormDefault="qualified" attributeFormDefault="unqualified" version="1.1" xml:lang="English">
+    <xs:annotation>
+        <xs:documentation>This schema was originally developed by The MITRE Corporation. The STIX XML Schema implementation is maintained by The MITRE Corporation and developed by the open STIX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the STIX website at http://stix.mitre.org.</xs:documentation>
+        <xs:appinfo>
+            <schema>STIX Extension - Open IOC Test Mechanism Instance</schema>
+            <version>1.1</version>
+            <date>02/20/2014 9:00:00 AM</date>
+            <short_description>Structured Threat Information eXpression (STIX) Extension - Open IOC Test Mechanism Instance - Schematic implementation for the using the 2010 version of Open IOC to describe a Test Machanism within the STIX structured cyber threat expression language architecture.</short_description>
+            <terms_of_use>Copyright (c) 2012-2014, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the STIX License located at http://stix.mitre.org/about/termsofuse.html. See the STIX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the STIX Schema, this license header must be included. </terms_of_use>
+        </xs:appinfo>
+    </xs:annotation>
+    <xs:import namespace="http://stix.mitre.org/Indicator-2" schemaLocation="../../indicator.xsd"/>
+    <xs:import namespace="http://schemas.mandiant.com/2010/ioc" schemaLocation="../../external/open_ioc_2010/ioc.xsd"/>
+    <xs:import namespace="http://schemas.mandiant.com/2010/ioc/TR/" schemaLocation="../../external/open_ioc_2010/ioc-TR.xsd"/>
+    <xs:complexType name="OpenIOC2010TestMechanismType">
+        <xs:annotation>
+            <xs:documentation>The OpenIOC2010TestMechanismType provides an extension to the TestMechanismType which imports and leverages the 2010 Open IOC schema in order to include OpenIOC elements as the test mechanism.</xs:documentation>
+        </xs:annotation>
+        <xs:complexContent>
+            <xs:extension base="indicator:TestMechanismType">
+                <xs:sequence>
+                    <xs:element name="ioc" type="ioc:IndicatorOfCompromise">
+                        <xs:annotation>
+                            <xs:documentation>The ioc field contains the structured specification of the OpenIOC test mechanism.</xs:documentation>
+                        </xs:annotation>
+                    </xs:element>
+                </xs:sequence>
+            </xs:extension>
+        </xs:complexContent>
+    </xs:complexType>
+</xs:schema>