stix_schema_spy 1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (482) hide show
  1. checksums.yaml +15 -0
  2. data/.gitignore +17 -0
  3. data/Gemfile +4 -0
  4. data/LICENSE.txt +24 -0
  5. data/README.md +41 -0
  6. data/Rakefile +3 -0
  7. data/config/1.0.1/stix/README.md +20 -0
  8. data/config/1.0.1/stix/campaign.xsd +210 -0
  9. data/config/1.0.1/stix/course_of_action.xsd +166 -0
  10. data/config/1.0.1/stix/cybox/README.md +13 -0
  11. data/config/1.0.1/stix/cybox/cybox_common.xsd +2319 -0
  12. data/config/1.0.1/stix/cybox/cybox_core.xsd +1095 -0
  13. data/config/1.0.1/stix/cybox/cybox_default_vocabularies.xsd +3326 -0
  14. data/config/1.0.1/stix/cybox/extensions/platform/README.txt +1 -0
  15. data/config/1.0.1/stix/cybox/extensions/platform/cpe-language_2.3.xsd +234 -0
  16. data/config/1.0.1/stix/cybox/extensions/platform/cpe-naming_2.3.xsd +45 -0
  17. data/config/1.0.1/stix/cybox/extensions/platform/cpe2.3.xsd +40 -0
  18. data/config/1.0.1/stix/cybox/extensions/platform/xml.xsd +145 -0
  19. data/config/1.0.1/stix/cybox/objects/API_Object.xsd +55 -0
  20. data/config/1.0.1/stix/cybox/objects/Account_Object.xsd +50 -0
  21. data/config/1.0.1/stix/cybox/objects/Address_Object.xsd +122 -0
  22. data/config/1.0.1/stix/cybox/objects/Artifact_Object.xsd +206 -0
  23. data/config/1.0.1/stix/cybox/objects/Code_Object.xsd +417 -0
  24. data/config/1.0.1/stix/cybox/objects/Custom_Object.xsd +43 -0
  25. data/config/1.0.1/stix/cybox/objects/DNS_Cache_Object.xsd +53 -0
  26. data/config/1.0.1/stix/cybox/objects/DNS_Query_Object.xsd +159 -0
  27. data/config/1.0.1/stix/cybox/objects/DNS_Record_Object.xsd +87 -0
  28. data/config/1.0.1/stix/cybox/objects/Device_Object.xsd +55 -0
  29. data/config/1.0.1/stix/cybox/objects/Disk_Object.xsd +117 -0
  30. data/config/1.0.1/stix/cybox/objects/Disk_Partition_Object.xsd +199 -0
  31. data/config/1.0.1/stix/cybox/objects/Email_Message_Object.xsd +273 -0
  32. data/config/1.0.1/stix/cybox/objects/File_Object.xsd +359 -0
  33. data/config/1.0.1/stix/cybox/objects/GUI_Dialogbox_Object.xsd +41 -0
  34. data/config/1.0.1/stix/cybox/objects/GUI_Object.xsd +40 -0
  35. data/config/1.0.1/stix/cybox/objects/GUI_Window_Object.xsd +46 -0
  36. data/config/1.0.1/stix/cybox/objects/HTTP_Session_Object.xsd +623 -0
  37. data/config/1.0.1/stix/cybox/objects/Library_Object.xsd +114 -0
  38. data/config/1.0.1/stix/cybox/objects/Link_Object.xsd +36 -0
  39. data/config/1.0.1/stix/cybox/objects/Linux_Package_Object.xsd +119 -0
  40. data/config/1.0.1/stix/cybox/objects/Memory_Object.xsd +70 -0
  41. data/config/1.0.1/stix/cybox/objects/Mutex_Object.xsd +40 -0
  42. data/config/1.0.1/stix/cybox/objects/Network_Connection_Object.xsd +609 -0
  43. data/config/1.0.1/stix/cybox/objects/Network_Flow_Object.xsd +1559 -0
  44. data/config/1.0.1/stix/cybox/objects/Network_Packet_Object.xsd +2948 -0
  45. data/config/1.0.1/stix/cybox/objects/Network_Route_Entry_Object.xsd +155 -0
  46. data/config/1.0.1/stix/cybox/objects/Network_Route_Object.xsd +93 -0
  47. data/config/1.0.1/stix/cybox/objects/Network_Socket_Object.xsd +524 -0
  48. data/config/1.0.1/stix/cybox/objects/Network_Subnet_Object.xsd +64 -0
  49. data/config/1.0.1/stix/cybox/objects/PDF_File_Object.xsd +601 -0
  50. data/config/1.0.1/stix/cybox/objects/Pipe_Object.xsd +40 -0
  51. data/config/1.0.1/stix/cybox/objects/Port_Object.xsd +74 -0
  52. data/config/1.0.1/stix/cybox/objects/Process_Object.xsd +197 -0
  53. data/config/1.0.1/stix/cybox/objects/Product_Object.xsd +60 -0
  54. data/config/1.0.1/stix/cybox/objects/Semaphore_Object.xsd +50 -0
  55. data/config/1.0.1/stix/cybox/objects/Socket_Address_Object.xsd +42 -0
  56. data/config/1.0.1/stix/cybox/objects/System_Object.xsd +409 -0
  57. data/config/1.0.1/stix/cybox/objects/URI_Object.xsd +62 -0
  58. data/config/1.0.1/stix/cybox/objects/Unix_File_Object.xsd +164 -0
  59. data/config/1.0.1/stix/cybox/objects/Unix_Network_Route_Entry_Object.xsd +56 -0
  60. data/config/1.0.1/stix/cybox/objects/Unix_Pipe_Object.xsd +36 -0
  61. data/config/1.0.1/stix/cybox/objects/Unix_Process_Object.xsd +143 -0
  62. data/config/1.0.1/stix/cybox/objects/Unix_User_Account_Object.xsd +78 -0
  63. data/config/1.0.1/stix/cybox/objects/Unix_Volume_Object.xsd +41 -0
  64. data/config/1.0.1/stix/cybox/objects/User_Account_Object.xsd +110 -0
  65. data/config/1.0.1/stix/cybox/objects/User_Session_Object.xsd +60 -0
  66. data/config/1.0.1/stix/cybox/objects/Volume_Object.xsd +235 -0
  67. data/config/1.0.1/stix/cybox/objects/Whois_Object.xsd +456 -0
  68. data/config/1.0.1/stix/cybox/objects/Win_Computer_Account_Object.xsd +135 -0
  69. data/config/1.0.1/stix/cybox/objects/Win_Critical_Section_Object.xsd +40 -0
  70. data/config/1.0.1/stix/cybox/objects/Win_Driver_Object.xsd +269 -0
  71. data/config/1.0.1/stix/cybox/objects/Win_Event_Log_Object.xsd +137 -0
  72. data/config/1.0.1/stix/cybox/objects/Win_Event_Object.xsd +80 -0
  73. data/config/1.0.1/stix/cybox/objects/Win_Executable_File_Object.xsd +1333 -0
  74. data/config/1.0.1/stix/cybox/objects/Win_File_Object.xsd +269 -0
  75. data/config/1.0.1/stix/cybox/objects/Win_Handle_Object.xsd +186 -0
  76. data/config/1.0.1/stix/cybox/objects/Win_Kernel_Hook_Object.xsd +109 -0
  77. data/config/1.0.1/stix/cybox/objects/Win_Kernel_Object.xsd +128 -0
  78. data/config/1.0.1/stix/cybox/objects/Win_Mailslot_Object.xsd +56 -0
  79. data/config/1.0.1/stix/cybox/objects/Win_Memory_Page_Region_Object.xsd +198 -0
  80. data/config/1.0.1/stix/cybox/objects/Win_Mutex_Object.xsd +42 -0
  81. data/config/1.0.1/stix/cybox/objects/Win_Network_Route_Entry_Object.xsd +200 -0
  82. data/config/1.0.1/stix/cybox/objects/Win_Network_Share_Object.xsd +205 -0
  83. data/config/1.0.1/stix/cybox/objects/Win_Pipe_Object.xsd +73 -0
  84. data/config/1.0.1/stix/cybox/objects/Win_Prefetch_Object.xsd +113 -0
  85. data/config/1.0.1/stix/cybox/objects/Win_Process_Object.xsd +167 -0
  86. data/config/1.0.1/stix/cybox/objects/Win_Registry_Key_Object.xsd +290 -0
  87. data/config/1.0.1/stix/cybox/objects/Win_Semaphore_Object.xsd +42 -0
  88. data/config/1.0.1/stix/cybox/objects/Win_Service_Object.xsd +287 -0
  89. data/config/1.0.1/stix/cybox/objects/Win_System_Object.xsd +126 -0
  90. data/config/1.0.1/stix/cybox/objects/Win_System_Restore_Object.xsd +199 -0
  91. data/config/1.0.1/stix/cybox/objects/Win_Task_Object.xsd +755 -0
  92. data/config/1.0.1/stix/cybox/objects/Win_Thread_Object.xsd +146 -0
  93. data/config/1.0.1/stix/cybox/objects/Win_User_Account_Object.xsd +73 -0
  94. data/config/1.0.1/stix/cybox/objects/Win_Volume_Object.xsd +161 -0
  95. data/config/1.0.1/stix/cybox/objects/Win_Waitable_Timer_Object.xsd +90 -0
  96. data/config/1.0.1/stix/cybox/objects/X509_Certificate_Object.xsd +270 -0
  97. data/config/1.0.1/stix/data_marking.xsd +92 -0
  98. data/config/1.0.1/stix/exploit_target.xsd +224 -0
  99. data/config/1.0.1/stix/extensions/address/ciq_address_3.0.xsd +27 -0
  100. data/config/1.0.1/stix/extensions/address/readme.txt +1 -0
  101. data/config/1.0.1/stix/extensions/attack_pattern/capec_2.6.1.xsd +31 -0
  102. data/config/1.0.1/stix/extensions/attack_pattern/readme.txt +1 -0
  103. data/config/1.0.1/stix/extensions/identity/ciq_identity_3.0.xsd +108 -0
  104. data/config/1.0.1/stix/extensions/identity/readme.txt +1 -0
  105. data/config/1.0.1/stix/extensions/malware/maec_4.0.1.xsd +31 -0
  106. data/config/1.0.1/stix/extensions/malware/readme.txt +1 -0
  107. data/config/1.0.1/stix/extensions/marking/simple_marking.xsd +30 -0
  108. data/config/1.0.1/stix/extensions/marking/tlp.xsd +39 -0
  109. data/config/1.0.1/stix/extensions/structured_coa/generic.xsd +46 -0
  110. data/config/1.0.1/stix/extensions/test_mechanism/generic.xsd +46 -0
  111. data/config/1.0.1/stix/extensions/test_mechanism/open_ioc_2010.xsd +32 -0
  112. data/config/1.0.1/stix/extensions/test_mechanism/oval_5.10.xsd +37 -0
  113. data/config/1.0.1/stix/extensions/test_mechanism/snort.xsd +36 -0
  114. data/config/1.0.1/stix/extensions/test_mechanism/yara.xsd +36 -0
  115. data/config/1.0.1/stix/extensions/vulnerability/cvrf_1.1.xsd +33 -0
  116. data/config/1.0.1/stix/extensions/vulnerability/readme.txt +1 -0
  117. data/config/1.0.1/stix/external/capec_2.6.1/ap_schema_v2.6.1.xsd +3618 -0
  118. data/config/1.0.1/stix/external/cvrf_1.1/common.xsd +176 -0
  119. data/config/1.0.1/stix/external/cvrf_1.1/cpe-language_2.2a.xsd +182 -0
  120. data/config/1.0.1/stix/external/cvrf_1.1/cvrf.xsd +487 -0
  121. data/config/1.0.1/stix/external/cvrf_1.1/cvss-v2_0.9.xsd +415 -0
  122. data/config/1.0.1/stix/external/cvrf_1.1/dc.xsd +118 -0
  123. data/config/1.0.1/stix/external/cvrf_1.1/prod.xsd +292 -0
  124. data/config/1.0.1/stix/external/cvrf_1.1/scap-core_0.9.xsd +170 -0
  125. data/config/1.0.1/stix/external/cvrf_1.1/vuln.xsd +631 -0
  126. data/config/1.0.1/stix/external/cvrf_1.1/xml.xsd +287 -0
  127. data/config/1.0.1/stix/external/maec_4.0.1/maec_bundle_schema.xsd +1139 -0
  128. data/config/1.0.1/stix/external/maec_4.0.1/maec_package_schema.xsd +938 -0
  129. data/config/1.0.1/stix/external/maec_4.0.1/metadataSharing.xsd +1712 -0
  130. data/config/1.0.1/stix/external/oasis_ciq_3.0/CommonTypes.xsd +104 -0
  131. data/config/1.0.1/stix/external/oasis_ciq_3.0/xAL-types.xsd +511 -0
  132. data/config/1.0.1/stix/external/oasis_ciq_3.0/xAL.xsd +672 -0
  133. data/config/1.0.1/stix/external/oasis_ciq_3.0/xNAL-types.xsd +36 -0
  134. data/config/1.0.1/stix/external/oasis_ciq_3.0/xNAL.xsd +126 -0
  135. data/config/1.0.1/stix/external/oasis_ciq_3.0/xNL-types.xsd +222 -0
  136. data/config/1.0.1/stix/external/oasis_ciq_3.0/xNL.xsd +284 -0
  137. data/config/1.0.1/stix/external/oasis_ciq_3.0/xPIL-types.xsd +854 -0
  138. data/config/1.0.1/stix/external/oasis_ciq_3.0/xPIL.xsd +1621 -0
  139. data/config/1.0.1/stix/external/oasis_ciq_3.0/xlink-2003-12-31.xsd +90 -0
  140. data/config/1.0.1/stix/external/open_ioc_2010/ioc-TR.xsd +25 -0
  141. data/config/1.0.1/stix/external/open_ioc_2010/ioc.xsd +105 -0
  142. data/config/1.0.1/stix/external/oval_5.10/oval-common-schema.xsd +781 -0
  143. data/config/1.0.1/stix/external/oval_5.10/oval-definitions-schema.xsd +1608 -0
  144. data/config/1.0.1/stix/external/oval_5.10/oval-variables-schema.xsd +84 -0
  145. data/config/1.0.1/stix/external/oval_5.10/xmldsig-core-schema.xsd +309 -0
  146. data/config/1.0.1/stix/incident.xsd +787 -0
  147. data/config/1.0.1/stix/indicator.xsd +310 -0
  148. data/config/1.0.1/stix/stix_common.xsd +762 -0
  149. data/config/1.0.1/stix/stix_core.xsd +218 -0
  150. data/config/1.0.1/stix/stix_default_vocabularies.xsd +1684 -0
  151. data/config/1.0.1/stix/threat_actor.xsd +174 -0
  152. data/config/1.0.1/stix/ttp.xsd +341 -0
  153. data/config/1.0/stix/campaign.xsd +209 -0
  154. data/config/1.0/stix/course_of_action.xsd +165 -0
  155. data/config/1.0/stix/cybox/cybox_common.xsd +2319 -0
  156. data/config/1.0/stix/cybox/cybox_core.xsd +1090 -0
  157. data/config/1.0/stix/cybox/cybox_default_vocabularies.xsd +3106 -0
  158. data/config/1.0/stix/cybox/extensions/platform/README.txt +1 -0
  159. data/config/1.0/stix/cybox/extensions/platform/cpe2.3.xsd +40 -0
  160. data/config/1.0/stix/cybox/objects/API_Object.xsd +55 -0
  161. data/config/1.0/stix/cybox/objects/Account_Object.xsd +50 -0
  162. data/config/1.0/stix/cybox/objects/Address_Object.xsd +122 -0
  163. data/config/1.0/stix/cybox/objects/Artifact_Object.xsd +206 -0
  164. data/config/1.0/stix/cybox/objects/Code_Object.xsd +417 -0
  165. data/config/1.0/stix/cybox/objects/Custom_Object.xsd +43 -0
  166. data/config/1.0/stix/cybox/objects/DNS_Cache_Object.xsd +53 -0
  167. data/config/1.0/stix/cybox/objects/DNS_Query_Object.xsd +159 -0
  168. data/config/1.0/stix/cybox/objects/DNS_Record_Object.xsd +87 -0
  169. data/config/1.0/stix/cybox/objects/Device_Object.xsd +55 -0
  170. data/config/1.0/stix/cybox/objects/Disk_Object.xsd +117 -0
  171. data/config/1.0/stix/cybox/objects/Disk_Partition_Object.xsd +199 -0
  172. data/config/1.0/stix/cybox/objects/Email_Message_Object.xsd +273 -0
  173. data/config/1.0/stix/cybox/objects/File_Object.xsd +359 -0
  174. data/config/1.0/stix/cybox/objects/GUI_Dialogbox_Object.xsd +41 -0
  175. data/config/1.0/stix/cybox/objects/GUI_Object.xsd +40 -0
  176. data/config/1.0/stix/cybox/objects/GUI_Window_Object.xsd +46 -0
  177. data/config/1.0/stix/cybox/objects/HTTP_Session_Object.xsd +623 -0
  178. data/config/1.0/stix/cybox/objects/Library_Object.xsd +114 -0
  179. data/config/1.0/stix/cybox/objects/Link_Object.xsd +24 -0
  180. data/config/1.0/stix/cybox/objects/Linux_Package_Object.xsd +119 -0
  181. data/config/1.0/stix/cybox/objects/Memory_Object.xsd +70 -0
  182. data/config/1.0/stix/cybox/objects/Mutex_Object.xsd +40 -0
  183. data/config/1.0/stix/cybox/objects/Network_Connection_Object.xsd +609 -0
  184. data/config/1.0/stix/cybox/objects/Network_Flow_Object.xsd +1559 -0
  185. data/config/1.0/stix/cybox/objects/Network_Packet_Object.xsd +2948 -0
  186. data/config/1.0/stix/cybox/objects/Network_Route_Entry_Object.xsd +155 -0
  187. data/config/1.0/stix/cybox/objects/Network_Route_Object.xsd +93 -0
  188. data/config/1.0/stix/cybox/objects/Network_Socket_Object.xsd +524 -0
  189. data/config/1.0/stix/cybox/objects/Network_Subnet_Object.xsd +64 -0
  190. data/config/1.0/stix/cybox/objects/PDF_File_Object.xsd +601 -0
  191. data/config/1.0/stix/cybox/objects/Pipe_Object.xsd +40 -0
  192. data/config/1.0/stix/cybox/objects/Port_Object.xsd +74 -0
  193. data/config/1.0/stix/cybox/objects/Process_Object.xsd +197 -0
  194. data/config/1.0/stix/cybox/objects/Product_Object.xsd +60 -0
  195. data/config/1.0/stix/cybox/objects/Semaphore_Object.xsd +50 -0
  196. data/config/1.0/stix/cybox/objects/Socket_Address_Object.xsd +42 -0
  197. data/config/1.0/stix/cybox/objects/System_Object.xsd +409 -0
  198. data/config/1.0/stix/cybox/objects/URI_Object.xsd +62 -0
  199. data/config/1.0/stix/cybox/objects/Unix_File_Object.xsd +164 -0
  200. data/config/1.0/stix/cybox/objects/Unix_Network_Route_Entry_Object.xsd +56 -0
  201. data/config/1.0/stix/cybox/objects/Unix_Pipe_Object.xsd +36 -0
  202. data/config/1.0/stix/cybox/objects/Unix_Process_Object.xsd +143 -0
  203. data/config/1.0/stix/cybox/objects/Unix_User_Account_Object.xsd +78 -0
  204. data/config/1.0/stix/cybox/objects/Unix_Volume_Object.xsd +41 -0
  205. data/config/1.0/stix/cybox/objects/User_Account_Object.xsd +110 -0
  206. data/config/1.0/stix/cybox/objects/User_Session_Object.xsd +60 -0
  207. data/config/1.0/stix/cybox/objects/Volume_Object.xsd +235 -0
  208. data/config/1.0/stix/cybox/objects/Whois_Object.xsd +456 -0
  209. data/config/1.0/stix/cybox/objects/Win_Computer_Account_Object.xsd +135 -0
  210. data/config/1.0/stix/cybox/objects/Win_Critical_Section_Object.xsd +40 -0
  211. data/config/1.0/stix/cybox/objects/Win_Driver_Object.xsd +269 -0
  212. data/config/1.0/stix/cybox/objects/Win_Event_Log_Object.xsd +137 -0
  213. data/config/1.0/stix/cybox/objects/Win_Event_Object.xsd +80 -0
  214. data/config/1.0/stix/cybox/objects/Win_Executable_File_Object.xsd +1333 -0
  215. data/config/1.0/stix/cybox/objects/Win_File_Object.xsd +269 -0
  216. data/config/1.0/stix/cybox/objects/Win_Handle_Object.xsd +186 -0
  217. data/config/1.0/stix/cybox/objects/Win_Kernel_Hook_Object.xsd +109 -0
  218. data/config/1.0/stix/cybox/objects/Win_Kernel_Object.xsd +128 -0
  219. data/config/1.0/stix/cybox/objects/Win_Mailslot_Object.xsd +56 -0
  220. data/config/1.0/stix/cybox/objects/Win_Memory_Page_Region_Object.xsd +198 -0
  221. data/config/1.0/stix/cybox/objects/Win_Mutex_Object.xsd +42 -0
  222. data/config/1.0/stix/cybox/objects/Win_Network_Route_Entry_Object.xsd +200 -0
  223. data/config/1.0/stix/cybox/objects/Win_Network_Share_Object.xsd +205 -0
  224. data/config/1.0/stix/cybox/objects/Win_Pipe_Object.xsd +73 -0
  225. data/config/1.0/stix/cybox/objects/Win_Prefetch_Object.xsd +113 -0
  226. data/config/1.0/stix/cybox/objects/Win_Process_Object.xsd +167 -0
  227. data/config/1.0/stix/cybox/objects/Win_Registry_Key_Object.xsd +290 -0
  228. data/config/1.0/stix/cybox/objects/Win_Semaphore_Object.xsd +42 -0
  229. data/config/1.0/stix/cybox/objects/Win_Service_Object.xsd +287 -0
  230. data/config/1.0/stix/cybox/objects/Win_System_Object.xsd +126 -0
  231. data/config/1.0/stix/cybox/objects/Win_System_Restore_Object.xsd +199 -0
  232. data/config/1.0/stix/cybox/objects/Win_Task_Object.xsd +755 -0
  233. data/config/1.0/stix/cybox/objects/Win_Thread_Object.xsd +146 -0
  234. data/config/1.0/stix/cybox/objects/Win_User_Account_Object.xsd +73 -0
  235. data/config/1.0/stix/cybox/objects/Win_Volume_Object.xsd +161 -0
  236. data/config/1.0/stix/cybox/objects/Win_Waitable_Timer_Object.xsd +90 -0
  237. data/config/1.0/stix/cybox/objects/X509_Certificate_Object.xsd +270 -0
  238. data/config/1.0/stix/data_marking.xsd +92 -0
  239. data/config/1.0/stix/exploit_target.xsd +223 -0
  240. data/config/1.0/stix/extensions/address/ciq_address_3.0.xsd +27 -0
  241. data/config/1.0/stix/extensions/address/readme.txt +1 -0
  242. data/config/1.0/stix/extensions/attack_pattern/capec_2.5.xsd +31 -0
  243. data/config/1.0/stix/extensions/identity/ciq_identity_3.0.xsd +108 -0
  244. data/config/1.0/stix/extensions/identity/readme.txt +1 -0
  245. data/config/1.0/stix/extensions/malware/maec_4.0.xsd +32 -0
  246. data/config/1.0/stix/extensions/malware/readme.txt +3 -0
  247. data/config/1.0/stix/extensions/marking/simple_marking.xsd +30 -0
  248. data/config/1.0/stix/extensions/marking/tlp.xsd +39 -0
  249. data/config/1.0/stix/extensions/structured_coa/generic.xsd +46 -0
  250. data/config/1.0/stix/extensions/test_mechanism/generic.xsd +46 -0
  251. data/config/1.0/stix/extensions/test_mechanism/open_ioc_2010.xsd +32 -0
  252. data/config/1.0/stix/extensions/test_mechanism/oval_5.10.xsd +37 -0
  253. data/config/1.0/stix/extensions/test_mechanism/snort.xsd +36 -0
  254. data/config/1.0/stix/extensions/test_mechanism/yara.xsd +36 -0
  255. data/config/1.0/stix/extensions/vulnerability/cvrf_1.1.xsd +33 -0
  256. data/config/1.0/stix/extensions/vulnerability/readme.txt +1 -0
  257. data/config/1.0/stix/external/capec_2.5/ap_schema_v2.5.xsd +2671 -0
  258. data/config/1.0/stix/external/cvrf_1.1/common.xsd +176 -0
  259. data/config/1.0/stix/external/cvrf_1.1/cpe-language_2.2a.xsd +182 -0
  260. data/config/1.0/stix/external/cvrf_1.1/cvrf.xsd +487 -0
  261. data/config/1.0/stix/external/cvrf_1.1/cvss-v2_0.9.xsd +415 -0
  262. data/config/1.0/stix/external/cvrf_1.1/dc.xsd +118 -0
  263. data/config/1.0/stix/external/cvrf_1.1/prod.xsd +292 -0
  264. data/config/1.0/stix/external/cvrf_1.1/scap-core_0.9.xsd +170 -0
  265. data/config/1.0/stix/external/cvrf_1.1/vuln.xsd +631 -0
  266. data/config/1.0/stix/external/cvrf_1.1/xml.xsd +287 -0
  267. data/config/1.0/stix/external/oasis_ciq_3.0/CommonTypes.xsd +104 -0
  268. data/config/1.0/stix/external/oasis_ciq_3.0/xAL-types.xsd +511 -0
  269. data/config/1.0/stix/external/oasis_ciq_3.0/xAL.xsd +672 -0
  270. data/config/1.0/stix/external/oasis_ciq_3.0/xNAL-types.xsd +36 -0
  271. data/config/1.0/stix/external/oasis_ciq_3.0/xNAL.xsd +126 -0
  272. data/config/1.0/stix/external/oasis_ciq_3.0/xNL-types.xsd +222 -0
  273. data/config/1.0/stix/external/oasis_ciq_3.0/xNL.xsd +284 -0
  274. data/config/1.0/stix/external/oasis_ciq_3.0/xPIL-types.xsd +854 -0
  275. data/config/1.0/stix/external/oasis_ciq_3.0/xPIL.xsd +1621 -0
  276. data/config/1.0/stix/external/oasis_ciq_3.0/xlink-2003-12-31.xsd +90 -0
  277. data/config/1.0/stix/external/open_ioc_2010/ioc-TR.xsd +25 -0
  278. data/config/1.0/stix/external/open_ioc_2010/ioc.xsd +105 -0
  279. data/config/1.0/stix/external/oval_5.10/oval-common-schema.xsd +781 -0
  280. data/config/1.0/stix/external/oval_5.10/oval-definitions-schema.xsd +1608 -0
  281. data/config/1.0/stix/external/oval_5.10/oval-variables-schema.xsd +84 -0
  282. data/config/1.0/stix/external/oval_5.10/xmldsig-core-schema.xsd +309 -0
  283. data/config/1.0/stix/incident.xsd +786 -0
  284. data/config/1.0/stix/indicator.xsd +309 -0
  285. data/config/1.0/stix/stix_common.xsd +762 -0
  286. data/config/1.0/stix/stix_core.xsd +217 -0
  287. data/config/1.0/stix/stix_default_vocabularies.xsd +1578 -0
  288. data/config/1.0/stix/threat_actor.xsd +173 -0
  289. data/config/1.0/stix/ttp.xsd +340 -0
  290. data/config/1.1/stix/campaign.xsd +223 -0
  291. data/config/1.1/stix/course_of_action.xsd +190 -0
  292. data/config/1.1/stix/cybox/cybox_common.xsd +2700 -0
  293. data/config/1.1/stix/cybox/cybox_core.xsd +1145 -0
  294. data/config/1.1/stix/cybox/cybox_default_vocabularies.xsd +5180 -0
  295. data/config/1.1/stix/cybox/extensions/location/ciq_address_3.0.xsd +27 -0
  296. data/config/1.1/stix/cybox/extensions/platform/README.txt +1 -0
  297. data/config/1.1/stix/cybox/extensions/platform/cpe2.3.xsd +34 -0
  298. data/config/1.1/stix/cybox/external/cpe_2.3/cpe-language_2.3.xsd +234 -0
  299. data/config/1.1/stix/cybox/external/cpe_2.3/cpe-naming_2.3.xsd +45 -0
  300. data/config/1.1/stix/cybox/external/cpe_2.3/xml.xsd +145 -0
  301. data/config/1.1/stix/cybox/external/oasis_ciq_3.0/CommonTypes.xsd +104 -0
  302. data/config/1.1/stix/cybox/external/oasis_ciq_3.0/xAL-types.xsd +511 -0
  303. data/config/1.1/stix/cybox/external/oasis_ciq_3.0/xAL.xsd +672 -0
  304. data/config/1.1/stix/cybox/external/oasis_ciq_3.0/xNAL-types.xsd +36 -0
  305. data/config/1.1/stix/cybox/external/oasis_ciq_3.0/xNAL.xsd +126 -0
  306. data/config/1.1/stix/cybox/external/oasis_ciq_3.0/xNL-types.xsd +222 -0
  307. data/config/1.1/stix/cybox/external/oasis_ciq_3.0/xNL.xsd +284 -0
  308. data/config/1.1/stix/cybox/external/oasis_ciq_3.0/xPIL-types.xsd +854 -0
  309. data/config/1.1/stix/cybox/external/oasis_ciq_3.0/xPIL.xsd +1621 -0
  310. data/config/1.1/stix/cybox/external/oasis_ciq_3.0/xlink-2003-12-31.xsd +90 -0
  311. data/config/1.1/stix/cybox/objects/API_Object.xsd +55 -0
  312. data/config/1.1/stix/cybox/objects/ARP_Cache_Object.xsd +98 -0
  313. data/config/1.1/stix/cybox/objects/AS_Object.xsd +50 -0
  314. data/config/1.1/stix/cybox/objects/Account_Object.xsd +501 -0
  315. data/config/1.1/stix/cybox/objects/Address_Object.xsd +127 -0
  316. data/config/1.1/stix/cybox/objects/Archive_File_Object.xsd +134 -0
  317. data/config/1.1/stix/cybox/objects/Artifact_Object.xsd +212 -0
  318. data/config/1.1/stix/cybox/objects/Code_Object.xsd +417 -0
  319. data/config/1.1/stix/cybox/objects/Custom_Object.xsd +42 -0
  320. data/config/1.1/stix/cybox/objects/DNS_Cache_Object.xsd +53 -0
  321. data/config/1.1/stix/cybox/objects/DNS_Query_Object.xsd +164 -0
  322. data/config/1.1/stix/cybox/objects/DNS_Record_Object.xsd +92 -0
  323. data/config/1.1/stix/cybox/objects/Device_Object.xsd +65 -0
  324. data/config/1.1/stix/cybox/objects/Disk_Object.xsd +117 -0
  325. data/config/1.1/stix/cybox/objects/Disk_Partition_Object.xsd +199 -0
  326. data/config/1.1/stix/cybox/objects/Domain_Name_Object.xsd +57 -0
  327. data/config/1.1/stix/cybox/objects/Email_Message_Object.xsd +278 -0
  328. data/config/1.1/stix/cybox/objects/File_Object.xsd +397 -0
  329. data/config/1.1/stix/cybox/objects/GUI_Dialogbox_Object.xsd +41 -0
  330. data/config/1.1/stix/cybox/objects/GUI_Object.xsd +40 -0
  331. data/config/1.1/stix/cybox/objects/GUI_Window_Object.xsd +46 -0
  332. data/config/1.1/stix/cybox/objects/HTTP_Session_Object.xsd +633 -0
  333. data/config/1.1/stix/cybox/objects/Hostname_Object.xsd +45 -0
  334. data/config/1.1/stix/cybox/objects/Image_File_Object.xsd +124 -0
  335. data/config/1.1/stix/cybox/objects/Library_Object.xsd +114 -0
  336. data/config/1.1/stix/cybox/objects/Link_Object.xsd +36 -0
  337. data/config/1.1/stix/cybox/objects/Linux_Package_Object.xsd +75 -0
  338. data/config/1.1/stix/cybox/objects/Memory_Object.xsd +141 -0
  339. data/config/1.1/stix/cybox/objects/Mutex_Object.xsd +40 -0
  340. data/config/1.1/stix/cybox/objects/Network_Connection_Object.xsd +540 -0
  341. data/config/1.1/stix/cybox/objects/Network_Flow_Object.xsd +1559 -0
  342. data/config/1.1/stix/cybox/objects/Network_Packet_Object.xsd +2934 -0
  343. data/config/1.1/stix/cybox/objects/Network_Route_Entry_Object.xsd +155 -0
  344. data/config/1.1/stix/cybox/objects/Network_Route_Object.xsd +93 -0
  345. data/config/1.1/stix/cybox/objects/Network_Socket_Object.xsd +529 -0
  346. data/config/1.1/stix/cybox/objects/Network_Subnet_Object.xsd +64 -0
  347. data/config/1.1/stix/cybox/objects/PDF_File_Object.xsd +595 -0
  348. data/config/1.1/stix/cybox/objects/Pipe_Object.xsd +40 -0
  349. data/config/1.1/stix/cybox/objects/Port_Object.xsd +40 -0
  350. data/config/1.1/stix/cybox/objects/Process_Object.xsd +199 -0
  351. data/config/1.1/stix/cybox/objects/Product_Object.xsd +65 -0
  352. data/config/1.1/stix/cybox/objects/SMS_Message_Object.xsd +79 -0
  353. data/config/1.1/stix/cybox/objects/Semaphore_Object.xsd +50 -0
  354. data/config/1.1/stix/cybox/objects/Socket_Address_Object.xsd +50 -0
  355. data/config/1.1/stix/cybox/objects/System_Object.xsd +410 -0
  356. data/config/1.1/stix/cybox/objects/URI_Object.xsd +62 -0
  357. data/config/1.1/stix/cybox/objects/URL_History_Object.xsd +104 -0
  358. data/config/1.1/stix/cybox/objects/Unix_File_Object.xsd +164 -0
  359. data/config/1.1/stix/cybox/objects/Unix_Network_Route_Entry_Object.xsd +56 -0
  360. data/config/1.1/stix/cybox/objects/Unix_Pipe_Object.xsd +36 -0
  361. data/config/1.1/stix/cybox/objects/Unix_Process_Object.xsd +143 -0
  362. data/config/1.1/stix/cybox/objects/Unix_User_Account_Object.xsd +78 -0
  363. data/config/1.1/stix/cybox/objects/Unix_Volume_Object.xsd +41 -0
  364. data/config/1.1/stix/cybox/objects/User_Account_Object.xsd +110 -0
  365. data/config/1.1/stix/cybox/objects/User_Session_Object.xsd +60 -0
  366. data/config/1.1/stix/cybox/objects/Volume_Object.xsd +235 -0
  367. data/config/1.1/stix/cybox/objects/Whois_Object.xsd +430 -0
  368. data/config/1.1/stix/cybox/objects/Win_Computer_Account_Object.xsd +135 -0
  369. data/config/1.1/stix/cybox/objects/Win_Critical_Section_Object.xsd +40 -0
  370. data/config/1.1/stix/cybox/objects/Win_Driver_Object.xsd +270 -0
  371. data/config/1.1/stix/cybox/objects/Win_Event_Log_Object.xsd +137 -0
  372. data/config/1.1/stix/cybox/objects/Win_Event_Object.xsd +80 -0
  373. data/config/1.1/stix/cybox/objects/Win_Executable_File_Object.xsd +1311 -0
  374. data/config/1.1/stix/cybox/objects/Win_File_Object.xsd +269 -0
  375. data/config/1.1/stix/cybox/objects/Win_Filemapping_Object.xsd +175 -0
  376. data/config/1.1/stix/cybox/objects/Win_Handle_Object.xsd +351 -0
  377. data/config/1.1/stix/cybox/objects/Win_Hook_Object.xsd +152 -0
  378. data/config/1.1/stix/cybox/objects/Win_Kernel_Hook_Object.xsd +109 -0
  379. data/config/1.1/stix/cybox/objects/Win_Kernel_Object.xsd +128 -0
  380. data/config/1.1/stix/cybox/objects/Win_Mailslot_Object.xsd +56 -0
  381. data/config/1.1/stix/cybox/objects/Win_Memory_Page_Region_Object.xsd +198 -0
  382. data/config/1.1/stix/cybox/objects/Win_Mutex_Object.xsd +42 -0
  383. data/config/1.1/stix/cybox/objects/Win_Network_Route_Entry_Object.xsd +200 -0
  384. data/config/1.1/stix/cybox/objects/Win_Network_Share_Object.xsd +205 -0
  385. data/config/1.1/stix/cybox/objects/Win_Pipe_Object.xsd +73 -0
  386. data/config/1.1/stix/cybox/objects/Win_Prefetch_Object.xsd +113 -0
  387. data/config/1.1/stix/cybox/objects/Win_Process_Object.xsd +174 -0
  388. data/config/1.1/stix/cybox/objects/Win_Registry_Key_Object.xsd +290 -0
  389. data/config/1.1/stix/cybox/objects/Win_Semaphore_Object.xsd +42 -0
  390. data/config/1.1/stix/cybox/objects/Win_Service_Object.xsd +287 -0
  391. data/config/1.1/stix/cybox/objects/Win_System_Object.xsd +126 -0
  392. data/config/1.1/stix/cybox/objects/Win_System_Restore_Object.xsd +207 -0
  393. data/config/1.1/stix/cybox/objects/Win_Task_Object.xsd +755 -0
  394. data/config/1.1/stix/cybox/objects/Win_Thread_Object.xsd +146 -0
  395. data/config/1.1/stix/cybox/objects/Win_User_Account_Object.xsd +73 -0
  396. data/config/1.1/stix/cybox/objects/Win_Volume_Object.xsd +161 -0
  397. data/config/1.1/stix/cybox/objects/Win_Waitable_Timer_Object.xsd +90 -0
  398. data/config/1.1/stix/cybox/objects/X509_Certificate_Object.xsd +275 -0
  399. data/config/1.1/stix/data_marking.xsd +96 -0
  400. data/config/1.1/stix/exploit_target.xsd +323 -0
  401. data/config/1.1/stix/extensions/address/ciq_3.0_address.xsd +27 -0
  402. data/config/1.1/stix/extensions/address/readme.txt +1 -0
  403. data/config/1.1/stix/extensions/attack_pattern/capec_2.7_attack_pattern.xsd +31 -0
  404. data/config/1.1/stix/extensions/attack_pattern/readme.txt +1 -0
  405. data/config/1.1/stix/extensions/identity/ciq_3.0_identity.xsd +113 -0
  406. data/config/1.1/stix/extensions/identity/readme.txt +1 -0
  407. data/config/1.1/stix/extensions/malware/maec_4.1_malware.xsd +31 -0
  408. data/config/1.1/stix/extensions/malware/readme.txt +1 -0
  409. data/config/1.1/stix/extensions/marking/simple_marking.xsd +31 -0
  410. data/config/1.1/stix/extensions/marking/terms_of_use_marking.xsd +31 -0
  411. data/config/1.1/stix/extensions/marking/tlp_marking.xsd +40 -0
  412. data/config/1.1/stix/extensions/structured_coa/generic_structured_coa.xsd +46 -0
  413. data/config/1.1/stix/extensions/test_mechanism/generic_test_mechanism.xsd +46 -0
  414. data/config/1.1/stix/extensions/test_mechanism/open_ioc_2010_test_mechanism.xsd +32 -0
  415. data/config/1.1/stix/extensions/test_mechanism/oval_5.10_test_mechanism.xsd +37 -0
  416. data/config/1.1/stix/extensions/test_mechanism/snort_test_mechanism.xsd +56 -0
  417. data/config/1.1/stix/extensions/test_mechanism/yara_test_mechanism.xsd +36 -0
  418. data/config/1.1/stix/extensions/vulnerability/cvrf_1.1_vulnerability.xsd +33 -0
  419. data/config/1.1/stix/extensions/vulnerability/readme.txt +1 -0
  420. data/config/1.1/stix/external/capec_2.7/ap_schema_v2.7.xsd +3618 -0
  421. data/config/1.1/stix/external/cvrf_1.1/common.xsd +176 -0
  422. data/config/1.1/stix/external/cvrf_1.1/cpe-language_2.2a.xsd +182 -0
  423. data/config/1.1/stix/external/cvrf_1.1/cvrf.xsd +487 -0
  424. data/config/1.1/stix/external/cvrf_1.1/cvss-v2_0.9.xsd +415 -0
  425. data/config/1.1/stix/external/cvrf_1.1/dc.xsd +118 -0
  426. data/config/1.1/stix/external/cvrf_1.1/prod.xsd +292 -0
  427. data/config/1.1/stix/external/cvrf_1.1/scap-core_0.9.xsd +170 -0
  428. data/config/1.1/stix/external/cvrf_1.1/vuln.xsd +631 -0
  429. data/config/1.1/stix/external/cvrf_1.1/xml.xsd +287 -0
  430. data/config/1.1/stix/external/maec_4.1/maec_bundle_schema.xsd +1228 -0
  431. data/config/1.1/stix/external/maec_4.1/maec_container_schema.xsd +62 -0
  432. data/config/1.1/stix/external/maec_4.1/maec_default_vocabularies.xsd +5325 -0
  433. data/config/1.1/stix/external/maec_4.1/maec_package_schema.xsd +1095 -0
  434. data/config/1.1/stix/external/maec_4.1/metadataSharing.xsd +1712 -0
  435. data/config/1.1/stix/external/oasis_ciq_3.0/CommonTypes.xsd +104 -0
  436. data/config/1.1/stix/external/oasis_ciq_3.0/xAL-types.xsd +511 -0
  437. data/config/1.1/stix/external/oasis_ciq_3.0/xAL.xsd +672 -0
  438. data/config/1.1/stix/external/oasis_ciq_3.0/xNAL-types.xsd +36 -0
  439. data/config/1.1/stix/external/oasis_ciq_3.0/xNAL.xsd +126 -0
  440. data/config/1.1/stix/external/oasis_ciq_3.0/xNL-types.xsd +222 -0
  441. data/config/1.1/stix/external/oasis_ciq_3.0/xNL.xsd +284 -0
  442. data/config/1.1/stix/external/oasis_ciq_3.0/xPIL-types.xsd +854 -0
  443. data/config/1.1/stix/external/oasis_ciq_3.0/xPIL.xsd +1621 -0
  444. data/config/1.1/stix/external/oasis_ciq_3.0/xlink-2003-12-31.xsd +90 -0
  445. data/config/1.1/stix/external/open_ioc_2010/ioc-TR.xsd +25 -0
  446. data/config/1.1/stix/external/open_ioc_2010/ioc.xsd +105 -0
  447. data/config/1.1/stix/external/oval_5.10/oval-common-schema.xsd +781 -0
  448. data/config/1.1/stix/external/oval_5.10/oval-definitions-schema.xsd +1608 -0
  449. data/config/1.1/stix/external/oval_5.10/oval-variables-schema.xsd +84 -0
  450. data/config/1.1/stix/external/oval_5.10/xmldsig-core-schema.xsd +309 -0
  451. data/config/1.1/stix/incident.xsd +759 -0
  452. data/config/1.1/stix/indicator.xsd +367 -0
  453. data/config/1.1/stix/stix_common.xsd +932 -0
  454. data/config/1.1/stix/stix_core.xsd +253 -0
  455. data/config/1.1/stix/stix_default_vocabularies.xsd +2015 -0
  456. data/config/1.1/stix/threat_actor.xsd +181 -0
  457. data/config/1.1/stix/ttp.xsd +429 -0
  458. data/config/1.1/uber_schema.xsd +149 -0
  459. data/config/mappings.json +30 -0
  460. data/lib/stix_schema_spy.rb +18 -0
  461. data/lib/stix_schema_spy/models/attribute.rb +20 -0
  462. data/lib/stix_schema_spy/models/complex_type.rb +50 -0
  463. data/lib/stix_schema_spy/models/element.rb +26 -0
  464. data/lib/stix_schema_spy/models/external_type.rb +48 -0
  465. data/lib/stix_schema_spy/models/has_children.rb +83 -0
  466. data/lib/stix_schema_spy/models/node.rb +71 -0
  467. data/lib/stix_schema_spy/models/schema.rb +217 -0
  468. data/lib/stix_schema_spy/models/simple_type.rb +47 -0
  469. data/lib/stix_schema_spy/models/special_field.rb +21 -0
  470. data/lib/stix_schema_spy/models/type.rb +106 -0
  471. data/lib/stix_schema_spy/util/schema_naming.rb +106 -0
  472. data/lib/stix_schema_spy/util/tasks.rb +69 -0
  473. data/lib/stix_schema_spy/version.rb +3 -0
  474. data/spec/lib/schema_naming_spec.rb +190 -0
  475. data/spec/models/complex_type_spec.rb +68 -0
  476. data/spec/models/node_spec.rb +47 -0
  477. data/spec/models/schema_spec.rb +63 -0
  478. data/spec/models/simple_type_spec.rb +38 -0
  479. data/spec/models/type_spec.rb +43 -0
  480. data/spec/spec_helper.rb +8 -0
  481. data/stix_schema_spy.gemspec +27 -0
  482. metadata +602 -0
@@ -0,0 +1,37 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:indicator="http://stix.mitre.org/Indicator-2" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval-var="http://oval.mitre.org/XMLSchema/oval-variables-5" xmlns:stix-oval="http://stix.mitre.org/extensions/TestMechanism#OVAL5.10-1" targetNamespace="http://stix.mitre.org/extensions/TestMechanism#OVAL5.10-1" elementFormDefault="qualified" attributeFormDefault="unqualified" version="1.1" xml:lang="English">
3
+ <xs:annotation>
4
+ <xs:documentation>This schema was originally developed by The MITRE Corporation. The STIX XML Schema implementation is maintained by The MITRE Corporation and developed by the open STIX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the STIX website at http://stix.mitre.org.</xs:documentation>
5
+ <xs:appinfo>
6
+ <schema>STIX Extension - OVAL Test Mechanism Instance</schema>
7
+ <version>1.1</version>
8
+ <date>02/20/2014 9:00:00 AM</date>
9
+ <short_description>Structured Threat Information eXpression (STIX) Extension - OVAL Test Mechanism Instance - Schematic implementation for the using OVAL to describe a Test Machanism within the STIX structured cyber threat expression language architecture.</short_description>
10
+ <terms_of_use>Copyright (c) 2012-2014, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the STIX License located at http://stix.mitre.org/about/termsofuse.html. See the STIX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the STIX Schema, this license header must be included. </terms_of_use>
11
+ </xs:appinfo>
12
+ </xs:annotation>
13
+ <xs:import namespace="http://stix.mitre.org/Indicator-2" schemaLocation="../../indicator.xsd"/>
14
+ <xs:import namespace="http://oval.mitre.org/XMLSchema/oval-definitions-5" schemaLocation="../../external/oval_5.10/oval-definitions-schema.xsd"/>
15
+ <xs:import namespace="http://oval.mitre.org/XMLSchema/oval-variables-5" schemaLocation="../../external/oval_5.10/oval-variables-schema.xsd"/>
16
+ <xs:complexType name="OVAL5.10TestMechanismType">
17
+ <xs:annotation>
18
+ <xs:documentation>The OVALTestMechanismType provides an extension to the TestMechanismType which imports and leverages the OVAL schema in order to include OVAL Definitions as the test mechanism.</xs:documentation>
19
+ </xs:annotation>
20
+ <xs:complexContent>
21
+ <xs:extension base="indicator:TestMechanismType">
22
+ <xs:sequence>
23
+ <xs:element ref="oval-def:oval_definitions">
24
+ <xs:annotation>
25
+ <xs:documentation>The oval_definitions field contains the structured specification of the OVAL test mechanism. When including OVAL Definition documents it is expected that at least one valid OVAL Definition Definition is included.</xs:documentation>
26
+ </xs:annotation>
27
+ </xs:element>
28
+ <xs:element ref="oval-var:oval_variables" minOccurs="0">
29
+ <xs:annotation>
30
+ <xs:documentation>The oval_variables field contains a valid OVAL Variables document and should only be used to supply external variable values needed by this OVAL Test Mechanism's OVAL Definitions.</xs:documentation>
31
+ </xs:annotation>
32
+ </xs:element>
33
+ </xs:sequence>
34
+ </xs:extension>
35
+ </xs:complexContent>
36
+ </xs:complexType>
37
+ </xs:schema>
@@ -0,0 +1,56 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:stixCommon="http://stix.mitre.org/common-1" xmlns:indicator="http://stix.mitre.org/Indicator-2" xmlns:snortTM="http://stix.mitre.org/extensions/TestMechanism#Snort-1" targetNamespace="http://stix.mitre.org/extensions/TestMechanism#Snort-1" elementFormDefault="qualified" attributeFormDefault="unqualified" version="1.1" xml:lang="English">
3
+ <xs:annotation>
4
+ <xs:documentation>This schema was originally developed by The MITRE Corporation. The STIX XML Schema implementation is maintained by The MITRE Corporation and developed by the open STIX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the STIX website at http://stix.mitre.org.</xs:documentation>
5
+ <xs:appinfo>
6
+ <schema>STIX Extension - Snort Test Mechanism Instance</schema>
7
+ <version>1.1</version>
8
+ <date>02/20/2014 9:00:00 AM</date>
9
+ <short_description>Structured Threat Information eXpression (STIX) Extension - Snort Test Mechanism Instance - Schematic implementation for the using a Snort rule as a Test Machanism within the STIX structured cyber threat expression language architecture.</short_description>
10
+ <terms_of_use>Copyright (c) 2012-2014, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the STIX License located at http://stix.mitre.org/about/termsofuse.html. See the STIX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the STIX Schema, this license header must be included. </terms_of_use>
11
+ </xs:appinfo>
12
+ </xs:annotation>
13
+ <xs:import namespace="http://stix.mitre.org/Indicator-2" schemaLocation="../../indicator.xsd"/>
14
+ <xs:import namespace="http://stix.mitre.org/common-1" schemaLocation="../../stix_common.xsd"/>
15
+ <xs:complexType name="SnortTestMechanismType">
16
+ <xs:annotation>
17
+ <xs:documentation>The SnortTestMechanismType specifies an instantial extension from the abstract TestMechanismType intended to support the inclusion of a Snort rule as a test mechanism content.</xs:documentation>
18
+ </xs:annotation>
19
+ <xs:complexContent>
20
+ <xs:extension base="indicator:TestMechanismType">
21
+ <xs:sequence>
22
+ <xs:element name="Product_Name" type="xs:string" minOccurs="0">
23
+ <xs:annotation>
24
+ <xs:documentation>Name of the Snort-compatible tool that the rules were written again. If the tool has a CPE name, use of that name is suggested, otherwise a simple name like "Snort", "Suricata", or "Sourcefire" could be used.</xs:documentation>
25
+ </xs:annotation>
26
+ </xs:element>
27
+ <xs:element name="Version" type="xs:string" minOccurs="0">
28
+ <xs:annotation>
29
+ <xs:documentation>The Version of Snort or Snort-compatible tool that the rules were written against.</xs:documentation>
30
+ </xs:annotation>
31
+ </xs:element>
32
+ <xs:element name="Rule" type="stixCommon:EncodedCDATAType" minOccurs="0" maxOccurs="unbounded">
33
+ <xs:annotation>
34
+ <xs:documentation>The Rule field encapsulates a Snort rule in its native format within a String field. The specification should be within a CDATA construct within the String field.</xs:documentation>
35
+ </xs:annotation>
36
+ </xs:element>
37
+ <xs:element name="Event_Filter" type="stixCommon:EncodedCDATAType" minOccurs="0" maxOccurs="unbounded">
38
+ <xs:annotation>
39
+ <xs:documentation>The Event_Filter field encapsulates a Snort event filter line in its native format within a String field. The specification should be within a CDATA construct within the String field.</xs:documentation>
40
+ </xs:annotation>
41
+ </xs:element>
42
+ <xs:element name="Rate_Filter" type="stixCommon:EncodedCDATAType" minOccurs="0" maxOccurs="unbounded">
43
+ <xs:annotation>
44
+ <xs:documentation>The Rate_Filter field encapsulates a Snort rate filter line in its native format within a String field. The specification should be within a CDATA construct within the String field.</xs:documentation>
45
+ </xs:annotation>
46
+ </xs:element>
47
+ <xs:element name="Event_Suppression" type="stixCommon:EncodedCDATAType" minOccurs="0" maxOccurs="unbounded">
48
+ <xs:annotation>
49
+ <xs:documentation>The Event_Suppression field encapsulates a Snort event suppression line in its native format within a String field. The specification should be within a CDATA construct within the String field.</xs:documentation>
50
+ </xs:annotation>
51
+ </xs:element>
52
+ </xs:sequence>
53
+ </xs:extension>
54
+ </xs:complexContent>
55
+ </xs:complexType>
56
+ </xs:schema>
@@ -0,0 +1,36 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:indicator="http://stix.mitre.org/Indicator-2" xmlns:stixCommon="http://stix.mitre.org/common-1" xmlns:yaraTM="http://stix.mitre.org/extensions/TestMechanism#YARA-1" targetNamespace="http://stix.mitre.org/extensions/TestMechanism#YARA-1" elementFormDefault="qualified" attributeFormDefault="unqualified" version="1.1" xml:lang="English">
3
+ <xs:annotation>
4
+ <xs:documentation>This schema was originally developed by The MITRE Corporation. The STIX XML Schema implementation is maintained by The MITRE Corporation and developed by the open STIX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the STIX website at http://stix.mitre.org.</xs:documentation>
5
+ <xs:appinfo>
6
+ <schema>STIX Extension - YARA Test Mechanism Instance</schema>
7
+ <version>1.1</version>
8
+ <date>02/20/2014 9:00:00 AM</date>
9
+ <short_description>Structured Threat Information eXpression (STIX) Extension - YARA Test Mechanism Instance - Schematic implementation for the using a YARA rule as a Test Machanism within the STIX structured cyber threat expression language architecture.</short_description>
10
+ <terms_of_use>Copyright (c) 2012-2014, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the STIX License located at http://stix.mitre.org/about/termsofuse.html. See the STIX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the STIX Schema, this license header must be included. </terms_of_use>
11
+ </xs:appinfo>
12
+ </xs:annotation>
13
+ <xs:import namespace="http://stix.mitre.org/Indicator-2" schemaLocation="../../indicator.xsd"/>
14
+ <xs:import namespace="http://stix.mitre.org/common-1" schemaLocation="../../stix_common.xsd"/>
15
+ <xs:complexType name="YaraTestMechanismType">
16
+ <xs:annotation>
17
+ <xs:documentation>The YaraTestMechanismType specifies an instantial extension from the abstract TestMechanismType intended to support the inclusion of a YARA rule as a test mechanism content.</xs:documentation>
18
+ </xs:annotation>
19
+ <xs:complexContent>
20
+ <xs:extension base="indicator:TestMechanismType">
21
+ <xs:sequence>
22
+ <xs:element name="Version" type="xs:string" minOccurs="0">
23
+ <xs:annotation>
24
+ <xs:documentation>The Version of YARA that the rule was written against.</xs:documentation>
25
+ </xs:annotation>
26
+ </xs:element>
27
+ <xs:element name="Rule" type="stixCommon:EncodedCDATAType" minOccurs="0">
28
+ <xs:annotation>
29
+ <xs:documentation>The Rule field encapsulates a YARA rule in its native format within a String field. The specification should be within a CDATA construct within the String field.</xs:documentation>
30
+ </xs:annotation>
31
+ </xs:element>
32
+ </xs:sequence>
33
+ </xs:extension>
34
+ </xs:complexContent>
35
+ </xs:complexType>
36
+ </xs:schema>
@@ -0,0 +1,33 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" elementFormDefault="qualified" xmlns:stix-cvrf="http://stix.mitre.org/extensions/Vulnerability#CVRF-1" targetNamespace="http://stix.mitre.org/extensions/Vulnerability#CVRF-1" xmlns:cvrf="http://www.icasi.org/CVRF/schema/cvrf/1.1" xmlns:et="http://stix.mitre.org/ExploitTarget-1" version="1.1" xml:lang="English">
3
+ <xs:annotation>
4
+ <xs:documentation>This schema was originally developed by The MITRE Corporation. The STIX XML Schema implementation is maintained by The MITRE Corporation and developed by the open STIX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the STIX website at http://stix.mitre.org. </xs:documentation>
5
+ <xs:appinfo>
6
+ <schema>STIX Extension - CVRF 1.1 Vulnerability Instance</schema>
7
+ <version>1.1</version>
8
+ <date>02/20/2014 9:00:00 AM</date>
9
+ <short_description>Structured Threat Information eXpression (STIX) Extension - CVRF 1.1 Vulnerability Instance - Schematic implementation for the using version 1.1 of CVRF to describe an Vulneability within the STIX structured cyber threat expression language architecture.</short_description>
10
+ <terms_of_use>Copyright (c) 2012-2014, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the STIX License located at http://stix.mitre.org/about/termsofuse.html. See the STIX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the STIX Schema, this license header must be included. </terms_of_use>
11
+ </xs:appinfo>
12
+ </xs:annotation>
13
+ <xs:import namespace="http://www.icasi.org/CVRF/schema/cvrf/1.1" schemaLocation="../../external/cvrf_1.1/cvrf.xsd"/>
14
+ <xs:import namespace="http://stix.mitre.org/ExploitTarget-1" schemaLocation="../../exploit_target.xsd"/>
15
+ <xs:complexType name="CVRF1.1InstanceType">
16
+ <xs:annotation>
17
+ <xs:documentation>
18
+ The CVRF1.1InstanceType provides an extension to the VulnerabilityType which imports and leverages the CVRF schema for structured characterization of Vulnerabilities. This could include characterization of 0-days or other vulnerabilities that do not have a CVE or OSVDB ID.
19
+ </xs:documentation>
20
+ </xs:annotation>
21
+ <xs:complexContent>
22
+ <xs:extension base="et:VulnerabilityType">
23
+ <xs:sequence>
24
+ <xs:element ref="cvrf:cvrfdoc">
25
+ <xs:annotation>
26
+ <xs:documentation>The CVRF field contains the structured characterization of Vulnerabilities utilizing the CVRF schema.</xs:documentation>
27
+ </xs:annotation>
28
+ </xs:element>
29
+ </xs:sequence>
30
+ </xs:extension>
31
+ </xs:complexContent>
32
+ </xs:complexType>
33
+ </xs:schema>
@@ -0,0 +1 @@
1
+ The default type for representing vulnerabilities in STIX is CVRF1.1InstanceType in cvrf1.1_vulnerability.xsd
@@ -0,0 +1,3618 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:capec="http://capec.mitre.org/capec-2"
3
+ xmlns:cybox="http://cybox.mitre.org/cybox-2" targetNamespace="http://capec.mitre.org/capec-2"
4
+ elementFormDefault="qualified" attributeFormDefault="unqualified" version="2.7">
5
+ <xs:import namespace="http://cybox.mitre.org/cybox-2"
6
+ schemaLocation="../../cybox/cybox_core.xsd"/>
7
+ <xs:element name="Attack_Pattern_Catalog">
8
+ <xs:annotation>
9
+ <xs:documentation>This is the enumerated catalog of common attack
10
+ patterns.</xs:documentation>
11
+ </xs:annotation>
12
+ <xs:complexType>
13
+ <xs:sequence>
14
+ <xs:element name="Views" minOccurs="0">
15
+ <xs:complexType>
16
+ <xs:sequence>
17
+ <xs:element ref="capec:View" minOccurs="0" maxOccurs="unbounded"/>
18
+ </xs:sequence>
19
+ </xs:complexType>
20
+ </xs:element>
21
+ <xs:element name="Categories" minOccurs="0">
22
+ <xs:complexType>
23
+ <xs:sequence>
24
+ <xs:element ref="capec:Category" minOccurs="0" maxOccurs="unbounded">
25
+ <xs:annotation>
26
+ <xs:documentation>A category is a collection of attack patterns
27
+ sharing a common attribute. The shared attribute may any
28
+ number of things.</xs:documentation>
29
+ </xs:annotation>
30
+ </xs:element>
31
+ </xs:sequence>
32
+ </xs:complexType>
33
+ </xs:element>
34
+ <xs:element name="Attack_Patterns" minOccurs="0">
35
+ <xs:complexType>
36
+ <xs:sequence>
37
+ <xs:element ref="capec:Attack_Pattern" minOccurs="0"
38
+ maxOccurs="unbounded"/>
39
+ </xs:sequence>
40
+ </xs:complexType>
41
+ </xs:element>
42
+ <xs:element name="Compound_Elements" minOccurs="0">
43
+ <xs:complexType>
44
+ <xs:sequence>
45
+ <xs:element ref="capec:Compound_Element">
46
+ <xs:annotation>
47
+ <xs:documentation>The Compound_Element structure represents a
48
+ meaningful aggregation of several attack patterns.
49
+ </xs:documentation>
50
+ </xs:annotation>
51
+ </xs:element>
52
+ </xs:sequence>
53
+ </xs:complexType>
54
+ </xs:element>
55
+ <xs:element name="Common_Attack_Steps" minOccurs="0">
56
+ <xs:complexType>
57
+ <xs:sequence>
58
+ <xs:element name="Common_Attack_Step" maxOccurs="unbounded">
59
+ <xs:complexType>
60
+ <xs:complexContent>
61
+ <xs:extension base="capec:Custom_Attack_StepType">
62
+ <xs:attribute name="ID" type="xs:integer" use="required"
63
+ />
64
+ </xs:extension>
65
+ </xs:complexContent>
66
+ </xs:complexType>
67
+ </xs:element>
68
+ </xs:sequence>
69
+ </xs:complexType>
70
+ </xs:element>
71
+ <xs:element name="Common_Attack_Surfaces" minOccurs="0">
72
+ <xs:complexType>
73
+ <xs:sequence>
74
+ <xs:element name="Common_Attack_Surface" maxOccurs="unbounded">
75
+ <xs:complexType>
76
+ <xs:complexContent>
77
+ <xs:extension
78
+ base="capec:Target_Attack_Surface_DescriptionType">
79
+ <xs:attribute name="ID" type="xs:integer" use="required"
80
+ />
81
+ </xs:extension>
82
+ </xs:complexContent>
83
+ </xs:complexType>
84
+ </xs:element>
85
+ </xs:sequence>
86
+ </xs:complexType>
87
+ </xs:element>
88
+ <xs:element name="Environments" minOccurs="0">
89
+ <xs:complexType>
90
+ <xs:sequence>
91
+ <xs:element ref="capec:Environment" maxOccurs="unbounded"/>
92
+ </xs:sequence>
93
+ </xs:complexType>
94
+ </xs:element>
95
+ </xs:sequence>
96
+ <xs:attribute name="Catalog_Name" type="xs:string" use="required"/>
97
+ <xs:attribute name="Catalog_Version" type="xs:string" use="required"/>
98
+ <xs:attribute name="Catalog_Date" type="xs:date"/>
99
+ </xs:complexType>
100
+ </xs:element>
101
+ <xs:element name="View">
102
+ <xs:annotation>
103
+ <xs:documentation>Each View element represents a perspective with which one might look
104
+ at the attack patterns in CAPEC.</xs:documentation>
105
+ </xs:annotation>
106
+ <xs:complexType>
107
+ <xs:group ref="capec:View_Attributes">
108
+ <xs:annotation>
109
+ <xs:documentation>The View_Attributes structure is a collection of common
110
+ elements which might be shared by all Views.</xs:documentation>
111
+ </xs:annotation>
112
+ </xs:group>
113
+ <xs:attribute name="ID" type="xs:integer" use="required">
114
+ <xs:annotation>
115
+ <xs:documentation>The ID attribute provides a unique identifier for the entry.
116
+ It will be static for the lifetime of the entry. In the event that this
117
+ entry becomes deprecated, the ID will not be reused and a pointer will be
118
+ left in this entry to the replacement. This is required for all
119
+ Views.</xs:documentation>
120
+ </xs:annotation>
121
+ </xs:attribute>
122
+ <xs:attribute name="Name" type="xs:string" use="required">
123
+ <xs:annotation>
124
+ <xs:documentation>The Name is a descriptive attribute used to give the reader an
125
+ idea of what perspective this view represents. All words in the name should
126
+ be capitalized except for articles and prepositions unless they begin or end
127
+ the name. Subsequent words in a hyphenated chain are also not capitalized.
128
+ This is required for all Views.</xs:documentation>
129
+ </xs:annotation>
130
+ </xs:attribute>
131
+ <xs:attribute name="Status" type="capec:Status_Type" use="required">
132
+ <xs:annotation>
133
+ <xs:documentation>The Status attribute defines the status level for this view.
134
+ </xs:documentation>
135
+ </xs:annotation>
136
+ </xs:attribute>
137
+ </xs:complexType>
138
+ </xs:element>
139
+ <xs:element name="Category">
140
+ <xs:complexType>
141
+ <xs:sequence>
142
+ <xs:element name="Description">
143
+ <xs:annotation>
144
+ <xs:documentation>This field provides a description of this Category. Its
145
+ primary subelement is Description_Summary which is intended to serve as
146
+ a minimalistic description which provides the information necessary to
147
+ understand the primary focus of this entry. Additionally, it has the
148
+ subelement Extended_Description which is optional and is used to provide
149
+ further information pertaining to this attack pattern.
150
+ </xs:documentation>
151
+ </xs:annotation>
152
+ <xs:complexType>
153
+ <xs:sequence>
154
+ <xs:element name="Description_Summary" type="xs:string">
155
+ <xs:annotation>
156
+ <xs:documentation>This description should be short and should
157
+ limit itself to describing the key points that define this
158
+ entry. Further explanation can be included in the extended
159
+ description element. This is required for all entries.
160
+ </xs:documentation>
161
+ </xs:annotation>
162
+ </xs:element>
163
+ <xs:element name="Extended_Description"
164
+ type="capec:Structured_Text_Type" minOccurs="0">
165
+ <xs:annotation>
166
+ <xs:documentation>This element provides a place for details
167
+ important to the description of this entry to be included
168
+ that are not necessary to convey the fundamental concept
169
+ behind the entry. This is not required for all entries and
170
+ should only be included where appropriate.
171
+ </xs:documentation>
172
+ </xs:annotation>
173
+ </xs:element>
174
+ </xs:sequence>
175
+ </xs:complexType>
176
+ </xs:element>
177
+ <xs:element name="Related_Weaknesses" minOccurs="0">
178
+ <xs:annotation>
179
+ <xs:documentation>Which specific weaknesses does this attack target and
180
+ leverage? Specific weaknesses (underlying issues that may cause
181
+ vulnerabilities) reference the industry-standard Common Weakness
182
+ Enumeration (CWE). This list should include not only those weaknesses
183
+ that are directly targeted by the attack but also those whose presence
184
+ can directly increase the likelihood of the attack succeeding or the
185
+ impact if it does succeed.</xs:documentation>
186
+ </xs:annotation>
187
+ <xs:complexType>
188
+ <xs:sequence>
189
+ <xs:element name="Related_Weakness" maxOccurs="unbounded">
190
+ <xs:annotation>
191
+ <xs:documentation>This field describes an individual related
192
+ weakness.</xs:documentation>
193
+ </xs:annotation>
194
+ <xs:complexType>
195
+ <xs:sequence>
196
+ <xs:element name="CWE_ID" type="xs:integer">
197
+ <xs:annotation>
198
+ <xs:documentation>The CWE_ID is a field that exists
199
+ for all weaknesses enumerated in the Common
200
+ Weakness Enumeration (CWE). It is a unique value
201
+ that allows each weakness to be unambiguously
202
+ identified. The CWE_ID field for the attack
203
+ pattern contains the value of the CWE_ID for the
204
+ specific related weakness.</xs:documentation>
205
+ </xs:annotation>
206
+ </xs:element>
207
+ <xs:element name="Weakness_Relationship_Type">
208
+ <xs:annotation>
209
+ <xs:documentation>This field describes the nature of
210
+ the relationship between this weakness and the
211
+ attack pattern. Weaknesses that are specifically
212
+ targeted by the attack are of type “Targeted”.
213
+ Weaknesses which are not specifically targeted but
214
+ whose presence may increase the likelihood of the
215
+ attack succeeding or the impact of the attack if
216
+ it does succeed are of type
217
+ “Secondary”.</xs:documentation>
218
+ </xs:annotation>
219
+ <xs:simpleType>
220
+ <xs:restriction base="xs:string">
221
+ <xs:whiteSpace value="collapse"/>
222
+ <xs:enumeration value="Targeted"/>
223
+ <xs:enumeration value="Secondary"/>
224
+ </xs:restriction>
225
+ </xs:simpleType>
226
+ </xs:element>
227
+ </xs:sequence>
228
+ </xs:complexType>
229
+ </xs:element>
230
+ </xs:sequence>
231
+ </xs:complexType>
232
+ </xs:element>
233
+ <xs:element name="Attack_Prerequisites" minOccurs="0">
234
+ <xs:annotation>
235
+ <xs:documentation>This field describes the conditions that must exist or the
236
+ functionality and characteristics that the target software must have or
237
+ behavior it must exhibit for an attack of this type to
238
+ succeed.</xs:documentation>
239
+ </xs:annotation>
240
+ <xs:complexType>
241
+ <xs:sequence>
242
+ <xs:element name="Attack_Prerequisite" type="capec:Structured_Text_Type"
243
+ maxOccurs="unbounded">
244
+ <xs:annotation>
245
+ <xs:documentation>This field describes an individual attack
246
+ prerequisite.</xs:documentation>
247
+ </xs:annotation>
248
+ </xs:element>
249
+ </xs:sequence>
250
+ </xs:complexType>
251
+ </xs:element>
252
+ <xs:element name="Methods_of_Attack" minOccurs="0">
253
+ <xs:annotation>
254
+ <xs:documentation>This field describes the mechanism of attack used by this
255
+ pattern. This field can help define the applicable attack surface
256
+ required for this attack.</xs:documentation>
257
+ </xs:annotation>
258
+ <xs:complexType>
259
+ <xs:sequence>
260
+ <xs:element name="Method_of_Attack" minOccurs="0" maxOccurs="unbounded">
261
+ <xs:annotation>
262
+ <xs:documentation>This field describes the mechanism of attack
263
+ used by this pattern. In order to assist in normalization
264
+ and classification, this field involves a selection from an
265
+ enumerated list of defined vectors which is currently
266
+ incomplete and will grow as new relevant vectors are
267
+ identified. This field can help define the applicable attack
268
+ surface required for this attack.</xs:documentation>
269
+ </xs:annotation>
270
+ <xs:simpleType>
271
+ <xs:restriction base="xs:string">
272
+ <xs:whiteSpace value="collapse"/>
273
+ <xs:enumeration value="Injection"/>
274
+ <xs:enumeration value="Modification of Resources"/>
275
+ <xs:enumeration value="Protocol Manipulation"/>
276
+ <xs:enumeration value="Analysis"/>
277
+ <xs:enumeration value="API Abuse"/>
278
+ <xs:enumeration value="Brute Force"/>
279
+ <xs:enumeration value="Flooding"/>
280
+ <xs:enumeration value="Time and State"/>
281
+ <xs:enumeration value="Spoofing"/>
282
+ <xs:enumeration value="Social Engineering"/>
283
+ </xs:restriction>
284
+ </xs:simpleType>
285
+ </xs:element>
286
+ </xs:sequence>
287
+ </xs:complexType>
288
+ </xs:element>
289
+ <xs:element name="Attacker_Skills_or_Knowledge_Required" minOccurs="0">
290
+ <xs:annotation>
291
+ <xs:documentation>This field describes the level of skills or specific
292
+ knowledge required by an attacker to execute this type of attack.
293
+ </xs:documentation>
294
+ </xs:annotation>
295
+ <xs:complexType>
296
+ <xs:sequence>
297
+ <xs:element name="Attacker_Skill_or_Knowledge_Required"
298
+ maxOccurs="unbounded">
299
+ <xs:annotation>
300
+ <xs:documentation>This field describes the level of skill or
301
+ specific knowledge required by an attacker to execute this
302
+ type of attack.</xs:documentation>
303
+ </xs:annotation>
304
+ <xs:complexType>
305
+ <xs:sequence>
306
+ <xs:element name="Skill_or_Knowledge_Level" minOccurs="0">
307
+ <xs:annotation>
308
+ <xs:documentation>This should be communicated on a
309
+ rough scale (Low, Medium, High). For example: •
310
+ Low - Basic computer familiarity • Low - Basic SQL
311
+ knowledge • Medium - Moderate scripting and shell
312
+ experience and ability to disassemble and
313
+ decompile • High - Expert knowledge of LINUX
314
+ kernel • High - Detailed knowledge of target
315
+ software development practices and business
316
+ context (former employee) • Etc.
317
+ </xs:documentation>
318
+ </xs:annotation>
319
+ <xs:simpleType>
320
+ <xs:restriction base="xs:string">
321
+ <xs:whiteSpace value="collapse"/>
322
+ <xs:enumeration value="Low"/>
323
+ <xs:enumeration value="Medium"/>
324
+ <xs:enumeration value="High"/>
325
+ </xs:restriction>
326
+ </xs:simpleType>
327
+ </xs:element>
328
+ <xs:element name="Skill_or_Knowledge_Type"
329
+ type="capec:Structured_Text_Type" minOccurs="0">
330
+ <xs:annotation>
331
+ <xs:documentation>This field provides contextual
332
+ detail for the skill or knowledge
333
+ level.</xs:documentation>
334
+ </xs:annotation>
335
+ </xs:element>
336
+ </xs:sequence>
337
+ </xs:complexType>
338
+ </xs:element>
339
+ </xs:sequence>
340
+ </xs:complexType>
341
+ </xs:element>
342
+ <xs:element name="Resources_Required" type="capec:Structured_Text_Type"
343
+ minOccurs="0">
344
+ <xs:annotation>
345
+ <xs:documentation>This field describes the resources (CPU cycles, IP
346
+ addresses, tools, etc.) required by an attacker to effectively execute
347
+ this type of attack.</xs:documentation>
348
+ </xs:annotation>
349
+ </xs:element>
350
+ <xs:element name="Attack_Motivation-Consequences" minOccurs="0">
351
+ <xs:annotation>
352
+ <xs:documentation>What is the attacker trying to achieve by using this
353
+ attack? This is not the end business/mission goal of the attack within
354
+ the target context but rather the specific technical result desired that
355
+ could be leveraged to achieve the end business/mission objective. This
356
+ information is useful for aligning attack patterns to threat models and
357
+ for determining which attack patterns are relevant for a given
358
+ context.</xs:documentation>
359
+ </xs:annotation>
360
+ <xs:complexType>
361
+ <xs:sequence>
362
+ <xs:element name="Attack_Motivation-Consequence"
363
+ type="capec:Common_ConsequenceType" maxOccurs="unbounded">
364
+ <xs:annotation>
365
+ <xs:documentation>What is the attacker trying to achieve by
366
+ using this attack? This is not the end business/mission goal
367
+ of the attack within the target context but rather the
368
+ specific technical result desired that could be leveraged to
369
+ achieve the end business/mission objective. In order to
370
+ assist in normalization and classification, this field
371
+ involves a selection from an enumerated list of defined
372
+ motivations/consequences which is currently incomplete and
373
+ will grow as new relevant possibilities are identified. This
374
+ information is useful for aligning attack patterns to threat
375
+ models and for determining which attack patterns are
376
+ relevant for a given context.</xs:documentation>
377
+ </xs:annotation>
378
+ </xs:element>
379
+ </xs:sequence>
380
+ </xs:complexType>
381
+ </xs:element>
382
+ <xs:element ref="capec:Relationships" minOccurs="0">
383
+ <xs:annotation>
384
+ <xs:documentation>The Relationships structure contains one or more
385
+ Relationship elements, each of which identifies an association between
386
+ this structure, whether it is an Attack Pattern, Category, or
387
+ Compound_Element and another structure.</xs:documentation>
388
+ </xs:annotation>
389
+ </xs:element>
390
+ <xs:element ref="capec:Relationship_Notes" minOccurs="0">
391
+ <xs:annotation>
392
+ <xs:documentation>This structure houses one or more Relationship_Note
393
+ elements, which each contain details regarding the relationships between
394
+ CAPEC entries.</xs:documentation>
395
+ </xs:annotation>
396
+ </xs:element>
397
+ <xs:element ref="capec:Maintenance_Notes" minOccurs="0">
398
+ <xs:annotation>
399
+ <xs:documentation>This element contains one or more Maintenance_Note
400
+ elements which each contain significant maintenance tasks within this
401
+ entry that still need to be addressed, such as clarifying the concepts
402
+ involved or improving relationships. It should be filled out in any
403
+ entry that is still undergoing significant review by the CAPEC
404
+ team.</xs:documentation>
405
+ </xs:annotation>
406
+ </xs:element>
407
+ <xs:element name="Background_Details" minOccurs="0">
408
+ <xs:annotation>
409
+ <xs:documentation>This structure contains one or more Background_Detail
410
+ elements, each of which holds information regarding the entry or any
411
+ technologies that are related to it, where the background information is
412
+ not related to the nature of the entry itself. It should be filled out
413
+ where appropriate.</xs:documentation>
414
+ </xs:annotation>
415
+ <xs:complexType>
416
+ <xs:sequence>
417
+ <xs:element name="Background_Detail" type="capec:Structured_Text_Type"
418
+ maxOccurs="unbounded">
419
+ <xs:annotation>
420
+ <xs:documentation>This element contains background information
421
+ regarding the entry or any technologies that are related to
422
+ it, where the background information is not related to the
423
+ nature of the category itself. It should be filled out where
424
+ appropriate.</xs:documentation>
425
+ </xs:annotation>
426
+ </xs:element>
427
+ </xs:sequence>
428
+ </xs:complexType>
429
+ </xs:element>
430
+ <xs:element ref="capec:Other_Notes" minOccurs="0">
431
+ <xs:annotation>
432
+ <xs:documentation>This element contains one or more Note elements, each of
433
+ which provide any additional notes or comments that cannot be captured
434
+ using other elements. New elements might be defined in the future to
435
+ contain this information. It should be filled out where needed.
436
+ </xs:documentation>
437
+ </xs:annotation>
438
+ </xs:element>
439
+ <xs:element ref="capec:Alternate_Terms" minOccurs="0">
440
+ <xs:annotation>
441
+ <xs:documentation>This element contains one or more Alternate_Term elements,
442
+ each of which contains other names used to describe this attack
443
+ pattern.</xs:documentation>
444
+ </xs:annotation>
445
+ </xs:element>
446
+ <xs:element ref="capec:Research_Gaps" minOccurs="0">
447
+ <xs:annotation>
448
+ <xs:documentation>This structure contains one or more Research gap elements,
449
+ each of which identifies potential opportunities for the vulnerability
450
+ research community to conduct further exploration of issues related to
451
+ this attack pattern. It is intended to highlight parts of CAPEC that
452
+ have not received sufficient attention from researchers. This should be
453
+ filled out where appropriate for attack patterns and
454
+ categories.</xs:documentation>
455
+ </xs:annotation>
456
+ </xs:element>
457
+ <xs:element name="References" type="capec:Reference_List_Type" minOccurs="0">
458
+ <xs:annotation>
459
+ <xs:documentation>The References element contains one or more Reference
460
+ elements, each of which provide further reading and insight into this
461
+ attack pattern.</xs:documentation>
462
+ </xs:annotation>
463
+ </xs:element>
464
+ <xs:element ref="capec:Content_History" minOccurs="0">
465
+ <xs:annotation>
466
+ <xs:documentation>This element is used to keep track of the author of the
467
+ attack pattern entry and anyone who has made modifications to the
468
+ content. This provides a means of contacting the authors and modifiers
469
+ for clarifying ambiguities, merging overlapping contributions, etc. This
470
+ should be filled out for all entries.</xs:documentation>
471
+ </xs:annotation>
472
+ </xs:element>
473
+ </xs:sequence>
474
+ <xs:attribute name="ID" type="xs:integer" use="required">
475
+ <xs:annotation>
476
+ <xs:documentation>This attribute provides a unique identifier for the entry. It
477
+ will be static for the lifetime of the entry. In the event that this entry
478
+ becomes deprecated, the ID will not be reused and a pointer will be left in
479
+ this entry to the replacement. This is required for all
480
+ Categories.</xs:documentation>
481
+ </xs:annotation>
482
+ </xs:attribute>
483
+ <xs:attribute name="Name" type="xs:string" use="required">
484
+ <xs:annotation>
485
+ <xs:documentation>The Name is a descriptive name used to give the reader an idea
486
+ of what the commonality is amongst the children of this category. All words
487
+ in the name should be capitalized except for articles and prepositions
488
+ unless they begin or end the name. Subsequent words in a hyphenated chain
489
+ are also not capitalized. This is required for all
490
+ Categories.</xs:documentation>
491
+ </xs:annotation>
492
+ </xs:attribute>
493
+ <xs:attribute name="Status" type="capec:Status_Type" use="required">
494
+ <xs:annotation>
495
+ <xs:documentation>The Status attribute defines the status level for this
496
+ category.</xs:documentation>
497
+ </xs:annotation>
498
+ </xs:attribute>
499
+ </xs:complexType>
500
+ </xs:element>
501
+ <xs:element name="Attack_Pattern" type="capec:Attack_PatternType">
502
+ <xs:annotation>
503
+ <xs:documentation>This element is an individual attack pattern.</xs:documentation>
504
+ </xs:annotation>
505
+ </xs:element>
506
+ <xs:element name="Compound_Element">
507
+ <xs:complexType>
508
+ <xs:sequence>
509
+ <xs:element name="Description">
510
+ <xs:annotation>
511
+ <xs:documentation>This field provides a description of this Structure,
512
+ whether it is an Attack Pattern, Category or Compound Element. Its
513
+ primary subelement is Description_Summary which is intended to serve as
514
+ a minimalistic description which provides the information necessary to
515
+ understand the primary focus of this entry. Additionally, it has the
516
+ subelement Extended_Description which is optional and is used to provide
517
+ further information pertaining to this attack pattern.
518
+ </xs:documentation>
519
+ </xs:annotation>
520
+ <xs:complexType>
521
+ <xs:sequence>
522
+ <xs:element name="Description_Summary" type="xs:string">
523
+ <xs:annotation>
524
+ <xs:documentation>This description should be short and should
525
+ limit itself to describing the key points that define this
526
+ entry. Further explanation can be included in the extended
527
+ description element. This is required for all entries.
528
+ </xs:documentation>
529
+ </xs:annotation>
530
+ </xs:element>
531
+ <xs:element name="Extended_Description"
532
+ type="capec:Structured_Text_Type" minOccurs="0">
533
+ <xs:annotation>
534
+ <xs:documentation>This element provides a place for details
535
+ important to the description of this entry to be included
536
+ that are not necessary to convey the fundamental concept
537
+ behind the entry. This is not required for all entries and
538
+ should only be included where appropriate.
539
+ </xs:documentation>
540
+ </xs:annotation>
541
+ </xs:element>
542
+ </xs:sequence>
543
+ </xs:complexType>
544
+ </xs:element>
545
+ <xs:element ref="capec:Relationships" minOccurs="0">
546
+ <xs:annotation>
547
+ <xs:documentation>The Relationships structure contains one or more
548
+ Relationship elements, each of which identifies an association between
549
+ this structure, whether it is an Attack Pattern, Category, or
550
+ Compound_Element and another structure.</xs:documentation>
551
+ </xs:annotation>
552
+ </xs:element>
553
+ <xs:element ref="capec:Relationship_Notes" minOccurs="0">
554
+ <xs:annotation>
555
+ <xs:documentation>This structure houses one or more Relationship_Note
556
+ elements, which each contain details regarding the relationships between
557
+ CAPEC entries.</xs:documentation>
558
+ </xs:annotation>
559
+ </xs:element>
560
+ <xs:element ref="capec:Maintenance_Notes" minOccurs="0">
561
+ <xs:annotation>
562
+ <xs:documentation>This element contains one or more Maintenance_Note
563
+ elements which each contain significant maintenance tasks within this
564
+ entry that still need to be addressed, such as clarifying the concepts
565
+ involved or improving relationships. It should be filled out in any
566
+ entry that is still undergoing significant review by the CAPEC
567
+ team.</xs:documentation>
568
+ </xs:annotation>
569
+ </xs:element>
570
+ <xs:element name="Background_Details" minOccurs="0">
571
+ <xs:annotation>
572
+ <xs:documentation>This structure contains one or more Background_Detail
573
+ elements, each of which holds information regarding the entry or any
574
+ technologies that are related to it, where the background information is
575
+ not related to the nature of the entry itself. It should be filled out
576
+ where appropriate.</xs:documentation>
577
+ </xs:annotation>
578
+ <xs:complexType>
579
+ <xs:sequence>
580
+ <xs:element name="Background_Detail" type="capec:Structured_Text_Type"
581
+ maxOccurs="unbounded">
582
+ <xs:annotation>
583
+ <xs:documentation>This element contains background information
584
+ regarding the entry or any technologies that are related to
585
+ it, where the background information is not related to the
586
+ nature of the attack pattern itself. It should be filled out
587
+ where appropriate.</xs:documentation>
588
+ </xs:annotation>
589
+ </xs:element>
590
+ </xs:sequence>
591
+ </xs:complexType>
592
+ </xs:element>
593
+ <xs:element ref="capec:Other_Notes" minOccurs="0">
594
+ <xs:annotation>
595
+ <xs:documentation>This element contains one or more Note elements, each of
596
+ which provide any additional notes or comments that cannot be captured
597
+ using other elements. New elements might be defined in the future to
598
+ contain this information. It should be filled out where needed.
599
+ </xs:documentation>
600
+ </xs:annotation>
601
+ </xs:element>
602
+ <xs:element ref="capec:Alternate_Terms" minOccurs="0">
603
+ <xs:annotation>
604
+ <xs:documentation>This element contains one or more Alternate_Term elements,
605
+ each of which contains other names used to describe this attack
606
+ pattern.</xs:documentation>
607
+ </xs:annotation>
608
+ </xs:element>
609
+ <xs:element ref="capec:Research_Gaps" minOccurs="0">
610
+ <xs:annotation>
611
+ <xs:documentation>This structure contains one or more Research gap elements,
612
+ each of which identifies potential opportunities for the vulnerability
613
+ research community to conduct further exploration of issues related to
614
+ this attack pattern. It is intended to highlight parts of CAPEC that
615
+ have not received sufficient attention from researchers. This should be
616
+ filled out where appropriate for attack patterns and
617
+ categories.</xs:documentation>
618
+ </xs:annotation>
619
+ </xs:element>
620
+ <xs:element name="References" type="capec:Reference_List_Type" minOccurs="0">
621
+ <xs:annotation>
622
+ <xs:documentation>The References element contains one or more Reference
623
+ elements, each of which provide further reading and insight into this
624
+ attack pattern.</xs:documentation>
625
+ </xs:annotation>
626
+ </xs:element>
627
+ <xs:element ref="capec:Content_History" minOccurs="0">
628
+ <xs:annotation>
629
+ <xs:documentation>This element is used to keep track of the author of the
630
+ attack pattern entry and anyone who has made modifications to the
631
+ content. This provides a means of contacting the authors and modifiers
632
+ for clarifying ambiguities, merging overlapping contributions, etc. This
633
+ should be filled out for all entries.</xs:documentation>
634
+ </xs:annotation>
635
+ </xs:element>
636
+ </xs:sequence>
637
+ <xs:attribute name="ID" type="xs:integer" use="required">
638
+ <xs:annotation>
639
+ <xs:documentation>This attribute provides a unique identifier for the entry. It
640
+ will be static for the lifetime of the entry. In the event that this entry
641
+ becomes deprecated, the ID will not be reused and a pointer will be left in
642
+ this entry to the replacement. This is required for all
643
+ Compound_Elements.</xs:documentation>
644
+ </xs:annotation>
645
+ </xs:attribute>
646
+ <xs:attribute name="Name" type="xs:string" use="required">
647
+ <xs:annotation>
648
+ <xs:documentation>The Name is a descriptive name used to give the reader an idea
649
+ of the meaning behind the compound attack pattern structure. All words in
650
+ the name should be capitalized except for articles and prepositions unless
651
+ they begin or end the name. Subsequent words in a hyphenated chain are also
652
+ not capitalized. This is required for all Compound_Elements.
653
+ </xs:documentation>
654
+ </xs:annotation>
655
+ </xs:attribute>
656
+ <xs:attribute name="Compound_Element_Abstraction" use="required">
657
+ <xs:annotation>
658
+ <xs:documentation>The Abstraction defines the abstraction level for this attack
659
+ pattern. The abstraction levels for Compound_Elements and Attack Patterns
660
+ are the same. For example, if the Compound_Element is a chain, and all
661
+ elements of the chain are Meta level, then the Compound_Element Abstraction
662
+ attribute is Meta. This is required for all
663
+ Compound_Elements.</xs:documentation>
664
+ </xs:annotation>
665
+ <xs:simpleType>
666
+ <xs:restriction base="xs:string">
667
+ <xs:whiteSpace value="collapse"/>
668
+ <xs:enumeration value="Meta"/>
669
+ <xs:enumeration value="Standard"/>
670
+ <xs:enumeration value="Detailed"/>
671
+ </xs:restriction>
672
+ </xs:simpleType>
673
+ </xs:attribute>
674
+ <xs:attribute name="Compound_Element_Completeness" use="required">
675
+ <xs:simpleType>
676
+ <xs:restriction base="xs:string">
677
+ <xs:whiteSpace value="collapse"/>
678
+ <xs:enumeration value="Complete"/>
679
+ <xs:enumeration value="Stub"/>
680
+ <xs:enumeration value="Hook"/>
681
+ </xs:restriction>
682
+ </xs:simpleType>
683
+ </xs:attribute>
684
+ <xs:attribute name="Compound_Element_Structure" use="required">
685
+ <xs:annotation>
686
+ <xs:documentation>The Structure attribute defines the structural nature of this
687
+ compound element - that is, composed of other attack patterns concurrently,
688
+ as in a composite, or consecutively, as in a chain.</xs:documentation>
689
+ </xs:annotation>
690
+ <xs:simpleType>
691
+ <xs:restriction base="xs:string">
692
+ <xs:whiteSpace value="collapse"/>
693
+ <xs:enumeration value="Composite"/>
694
+ <xs:enumeration value="Chain"/>
695
+ </xs:restriction>
696
+ </xs:simpleType>
697
+ </xs:attribute>
698
+ <xs:attribute name="Status" type="capec:Status_Type" use="required">
699
+ <xs:annotation>
700
+ <xs:documentation>The Status attribute defines the status level for this
701
+ compound element.</xs:documentation>
702
+ </xs:annotation>
703
+ </xs:attribute>
704
+ </xs:complexType>
705
+ </xs:element>
706
+ <xs:element name="Environment">
707
+ <xs:complexType>
708
+ <xs:annotation>
709
+ <xs:documentation>Description and globally unique ID for a kind of environment or
710
+ context that is required. Used in Attack Steps, Indicators of Susceptibility,
711
+ and Security Controls, etc.</xs:documentation>
712
+ </xs:annotation>
713
+ <xs:all>
714
+ <xs:element name="Environment_Title" type="xs:token"/>
715
+ <xs:element name="Environment_Description" type="xs:token"/>
716
+ </xs:all>
717
+ <xs:attribute name="ID" type="xs:ID" use="required"/>
718
+ </xs:complexType>
719
+ </xs:element>
720
+ <xs:element name="Attack_Execution_Flow">
721
+ <xs:complexType>
722
+ <xs:sequence>
723
+ <xs:element name="Attack_Phases">
724
+ <xs:complexType>
725
+ <xs:sequence>
726
+ <xs:element name="Attack_Phase" maxOccurs="3">
727
+ <xs:annotation>
728
+ <xs:documentation>Segment the attack steps into the various
729
+ phases of attack. One of three phases "Explore,"
730
+ "Experiment," or "Exploit." Each phase should appear at most
731
+ once, and attack steps should be grouped by what kind of
732
+ activities the attacker is carrying out. The exploration and
733
+ experimentation phases may or may not occur during a
734
+ particular attack, because the attacker may already know
735
+ exactly how to exploit a system.</xs:documentation>
736
+ </xs:annotation>
737
+ <xs:complexType>
738
+ <xs:sequence>
739
+ <xs:annotation>
740
+ <xs:documentation>One of three phases "Explore,"
741
+ "Experiment," or "Exploit." Each phase should appear
742
+ at most once, and attack steps should be grouped by
743
+ what kind of activities the attacker is carrying
744
+ out.</xs:documentation>
745
+ </xs:annotation>
746
+ <xs:element name="Attack_Steps">
747
+ <xs:complexType>
748
+ <xs:sequence>
749
+ <xs:element name="Attack_Step"
750
+ maxOccurs="unbounded">
751
+ <xs:annotation>
752
+ <xs:documentation>Brief description of an
753
+ individual action step in carrying out the
754
+ attack</xs:documentation>
755
+ </xs:annotation>
756
+ <xs:complexType>
757
+ <xs:choice>
758
+ <xs:element name="Common_Attack_Step">
759
+ <xs:complexType>
760
+ <xs:sequence>
761
+ <xs:element name="Pattern_Specific_Overrides"
762
+ type="capec:Custom_Attack_StepType"/>
763
+ </xs:sequence>
764
+ <xs:attribute name="Common_Attack_Step_ID"
765
+ type="xs:integer" use="required"/>
766
+ </xs:complexType>
767
+ </xs:element>
768
+ <xs:element name="Custom_Attack_Step"
769
+ type="capec:Custom_Attack_StepType"/>
770
+ </xs:choice>
771
+ <xs:attribute name="ID" type="xs:integer"
772
+ use="required"/>
773
+ </xs:complexType>
774
+ </xs:element>
775
+ </xs:sequence>
776
+ </xs:complexType>
777
+ </xs:element>
778
+ </xs:sequence>
779
+ <xs:attribute name="ID" type="xs:integer" use="required"/>
780
+ <xs:attribute name="Name" use="required">
781
+ <xs:annotation>
782
+ <xs:documentation>"Explore," "Experiment," or "Exploit."
783
+ </xs:documentation>
784
+ </xs:annotation>
785
+ <xs:simpleType>
786
+ <xs:restriction base="xs:token">
787
+ <xs:whiteSpace value="collapse"/>
788
+ <xs:enumeration value="Explore"/>
789
+ <xs:enumeration value="Experiment"/>
790
+ <xs:enumeration value="Exploit"/>
791
+ <xs:enumeration value=""/>
792
+ </xs:restriction>
793
+ </xs:simpleType>
794
+ </xs:attribute>
795
+ </xs:complexType>
796
+ </xs:element>
797
+ </xs:sequence>
798
+ </xs:complexType>
799
+ </xs:element>
800
+ </xs:sequence>
801
+ </xs:complexType>
802
+ </xs:element>
803
+ <xs:element name="Attack_Step_Technique">
804
+ <xs:complexType>
805
+ <xs:annotation>
806
+ <xs:documentation>A particular technique that may accomplish this attack step.
807
+ </xs:documentation>
808
+ </xs:annotation>
809
+ <xs:all>
810
+ <xs:element name="Attack_Step_Technique_Description"
811
+ type="capec:Structured_Text_Type">
812
+ <xs:annotation>
813
+ <xs:documentation>This field contains a brief description of the attack step
814
+ technique.</xs:documentation>
815
+ </xs:annotation>
816
+ </xs:element>
817
+ <xs:element name="Leveraged_Attack_Patterns" minOccurs="0">
818
+ <xs:complexType>
819
+ <xs:sequence>
820
+ <xs:element name="Leveraged_Attack_Pattern_ID" maxOccurs="unbounded"/>
821
+ </xs:sequence>
822
+ </xs:complexType>
823
+ </xs:element>
824
+ <xs:element name="Relevant_Attack_Surface_Elements"
825
+ type="capec:Relevant_Attack_Surface_ElementsType" minOccurs="0"/>
826
+ <xs:element name="Observables" type="cybox:ObservablesType" minOccurs="0"/>
827
+ <xs:element name="Environments" type="xs:IDREFS">
828
+ <xs:annotation>
829
+ <xs:documentation>References the defined environments where this attack step
830
+ technique is applicable.</xs:documentation>
831
+ </xs:annotation>
832
+ </xs:element>
833
+ </xs:all>
834
+ <xs:attribute name="ID" type="xs:integer" use="required"/>
835
+ </xs:complexType>
836
+ </xs:element>
837
+ <xs:group name="View_Attributes">
838
+ <xs:annotation>
839
+ <xs:documentation>The View_Attributes structure is a collection of common elements which
840
+ might be shared by all Views.</xs:documentation>
841
+ </xs:annotation>
842
+ <xs:sequence>
843
+ <xs:element name="View_Structure">
844
+ <xs:annotation>
845
+ <xs:documentation>The View_Structure element describes how this view is being
846
+ constructed. Valid values are: Implicit Slice = a slice based on a filter
847
+ criteria; Explicit Slice = a slice based on arbitrary membership, as defined
848
+ by specific relationships between entries; Graph = a bounded graphical slice
849
+ based on ChildOf relationships.</xs:documentation>
850
+ </xs:annotation>
851
+ <xs:simpleType>
852
+ <xs:restriction base="xs:string">
853
+ <xs:whiteSpace value="collapse"/>
854
+ <xs:enumeration value="Implicit_Slice"/>
855
+ <xs:enumeration value="Explicit_Slice"/>
856
+ <xs:enumeration value="Graph"/>
857
+ </xs:restriction>
858
+ </xs:simpleType>
859
+ </xs:element>
860
+ <xs:element name="View_Objective" type="capec:Structured_Text_Type">
861
+ <xs:annotation>
862
+ <xs:documentation>The View_Objective element describes the perspective from
863
+ which this View is constructed.</xs:documentation>
864
+ </xs:annotation>
865
+ </xs:element>
866
+ <xs:element name="View_Audience" minOccurs="0">
867
+ <xs:annotation>
868
+ <xs:documentation>The View_Audience element provides a reference to the targeted
869
+ audiences or groups for this view.</xs:documentation>
870
+ </xs:annotation>
871
+ <xs:complexType>
872
+ <xs:sequence>
873
+ <xs:element name="Audience" maxOccurs="unbounded">
874
+ <xs:annotation>
875
+ <xs:documentation>The Audience element provides a reference to the
876
+ target audience or group for this view.</xs:documentation>
877
+ </xs:annotation>
878
+ <xs:complexType>
879
+ <xs:sequence>
880
+ <xs:element name="Stakeholder">
881
+ <xs:annotation>
882
+ <xs:documentation>The Stakeholder element specifies what
883
+ types of members of the CAPEC community might be
884
+ interested in this view.</xs:documentation>
885
+ </xs:annotation>
886
+ <xs:simpleType>
887
+ <xs:restriction base="xs:string">
888
+ <xs:whiteSpace value="collapse"/>
889
+ <xs:enumeration value="Developers"/>
890
+ <xs:enumeration value="Software_Vendors"/>
891
+ <xs:enumeration value="Assessment_Vendors"/>
892
+ <xs:enumeration value="Educators"/>
893
+ <xs:enumeration value="OWGV"/>
894
+ <xs:enumeration value="SAMATE"/>
895
+ <xs:enumeration value="CAPEC_Formalization"/>
896
+ <xs:enumeration value="CAPEC_Team"/>
897
+ <xs:enumeration value="Software_Customers"/>
898
+ <xs:enumeration value="Assessment_Customers"/>
899
+ <xs:enumeration value="Academic_Researchers"/>
900
+ <xs:enumeration value="Applied_Researchers"/>
901
+ <xs:enumeration value="Information_Providers"/>
902
+ </xs:restriction>
903
+ </xs:simpleType>
904
+ </xs:element>
905
+ <xs:element name="Stakeholder_Description"
906
+ type="capec:Structured_Text_Type" minOccurs="0">
907
+ <xs:annotation>
908
+ <xs:documentation>The Stakeholder_Description el
909
+ provides some text describing what properties of
910
+ this View this particular Stakeholder might find
911
+ useful.</xs:documentation>
912
+ </xs:annotation>
913
+ </xs:element>
914
+ </xs:sequence>
915
+ </xs:complexType>
916
+ </xs:element>
917
+ </xs:sequence>
918
+ </xs:complexType>
919
+ </xs:element>
920
+ <xs:element ref="capec:Relationships" minOccurs="0">
921
+ <xs:annotation>
922
+ <xs:documentation>The Relationships structure contains one or more Relationship
923
+ elements, each of which identifies an association between this structure,
924
+ whether it is a Attack Pattern, Category, or Compound_Element and another
925
+ structure.</xs:documentation>
926
+ </xs:annotation>
927
+ </xs:element>
928
+ <xs:element ref="capec:Relationship_Notes" minOccurs="0">
929
+ <xs:annotation>
930
+ <xs:documentation>This structure houses one or more Relationship_Note elements,
931
+ which each contain details regarding the relationships between CAPEC
932
+ entries.</xs:documentation>
933
+ </xs:annotation>
934
+ </xs:element>
935
+ <xs:element ref="capec:Maintenance_Notes" minOccurs="0">
936
+ <xs:annotation>
937
+ <xs:documentation>This element contains one or more Maintenance_Note elements
938
+ which each contain significant maintenance tasks within this entry that
939
+ still need to be addressed, such as clarifying the concepts involved or
940
+ improving relationships. It should be filled out in any entry that is still
941
+ undergoing significant review by the CAPEC team.</xs:documentation>
942
+ </xs:annotation>
943
+ </xs:element>
944
+ <xs:element ref="capec:Other_Notes" minOccurs="0">
945
+ <xs:annotation>
946
+ <xs:documentation>This element contains one or more Note elements, each of which
947
+ provide any additional notes or comments that cannot be captured using other
948
+ elements. New elements might be defined in the future to contain this
949
+ information. It should be filled out where needed.</xs:documentation>
950
+ </xs:annotation>
951
+ </xs:element>
952
+ <xs:element ref="capec:Alternate_Terms" minOccurs="0">
953
+ <xs:annotation>
954
+ <xs:documentation>This element contains one or more Alternate_Term elements,
955
+ each of which contains other names used to describe this attack pattern.
956
+ </xs:documentation>
957
+ </xs:annotation>
958
+ </xs:element>
959
+ <xs:element ref="capec:Research_Gaps" minOccurs="0">
960
+ <xs:annotation>
961
+ <xs:documentation>This structure contains one or more Research gap elements,
962
+ each of which identifies potential opportunities for the vulnerability
963
+ research community to conduct further exploration of issues related to this
964
+ attack pattern. It is intended to highlight parts of CAPEC that have not
965
+ received sufficient attention from researchers. This should be filled out
966
+ where appropriate for attack patterns and categories.</xs:documentation>
967
+ </xs:annotation>
968
+ </xs:element>
969
+ <xs:element name="References" type="capec:Reference_List_Type" minOccurs="0">
970
+ <xs:annotation>
971
+ <xs:documentation>The References element contains one or more Reference
972
+ elements, each of which provide further reading and insight into this view.
973
+ This should be filled out when the view is based on sources or projects that
974
+ are external to the CAPEC project.</xs:documentation>
975
+ </xs:annotation>
976
+ </xs:element>
977
+ <xs:element name="View_Filter" type="xs:string" minOccurs="0">
978
+ <xs:annotation>
979
+ <xs:documentation>The View_Filter element holds an XSL query for identifying
980
+ which elements are members of an implicit slice. This should only be present
981
+ for implicit slices.</xs:documentation>
982
+ </xs:annotation>
983
+ </xs:element>
984
+ <xs:element ref="capec:Content_History" minOccurs="0">
985
+ <xs:annotation>
986
+ <xs:documentation>This element is used to keep track of the author of the attack
987
+ pattern entry and anyone who has made modifications to the content. This
988
+ provides a means of contacting the authors and modifiers for clarifying
989
+ ambiguities, merging overlapping contributions, etc. This should be filled
990
+ out for all entries.</xs:documentation>
991
+ </xs:annotation>
992
+ </xs:element>
993
+ </xs:sequence>
994
+ </xs:group>
995
+ <xs:element name="Relationships">
996
+ <xs:annotation>
997
+ <xs:documentation>The Relationships structure contains one or more Relationship
998
+ elements, each of which identifies an association between this structure, whether it
999
+ is a Attack Pattern, Category, or Compound_Element and another
1000
+ structure.</xs:documentation>
1001
+ </xs:annotation>
1002
+ <xs:complexType>
1003
+ <xs:sequence>
1004
+ <xs:element name="Relationship" type="capec:RelationshipType" maxOccurs="unbounded">
1005
+ <xs:annotation>
1006
+ <xs:documentation>Each Relationship identifies an association between this
1007
+ structure, whether it is an Attack Pattern, Category, or
1008
+ Compound_Element and another structure. The relationship also identifies
1009
+ the views under which the relationship is applicable.
1010
+ </xs:documentation>
1011
+ </xs:annotation>
1012
+ </xs:element>
1013
+ </xs:sequence>
1014
+ </xs:complexType>
1015
+ </xs:element>
1016
+ <xs:complexType name="RelationshipType">
1017
+ <xs:sequence>
1018
+ <xs:element name="Relationship_Views">
1019
+ <xs:annotation>
1020
+ <xs:documentation>This element contains a list of the individual Views to which
1021
+ this relationship pertains.</xs:documentation>
1022
+ </xs:annotation>
1023
+ <xs:complexType>
1024
+ <xs:sequence>
1025
+ <xs:element name="Relationship_View_ID" maxOccurs="unbounded">
1026
+ <xs:annotation>
1027
+ <xs:documentation>Specifies the unique ID of the individual view
1028
+ element to which this relationship pertains. This ID must
1029
+ correspond to a View.</xs:documentation>
1030
+ </xs:annotation>
1031
+ <xs:complexType>
1032
+ <xs:simpleContent>
1033
+ <xs:extension base="xs:integer">
1034
+ <xs:attribute name="Ordinal">
1035
+ <xs:annotation>
1036
+ <xs:documentation>The ordinal attribute is used to
1037
+ determine if this relationship is the primary
1038
+ ChildOf relationship for this entry for a given
1039
+ Relationship_View_ID element.. This attribute can
1040
+ only have the value "Primary" and should only be
1041
+ included for the primary parent/child
1042
+ relationship.</xs:documentation>
1043
+ </xs:annotation>
1044
+ <xs:simpleType>
1045
+ <xs:restriction base="xs:string">
1046
+ <xs:whiteSpace value="collapse"/>
1047
+ <xs:enumeration value="Primary"/>
1048
+ </xs:restriction>
1049
+ </xs:simpleType>
1050
+ </xs:attribute>
1051
+ </xs:extension>
1052
+ </xs:simpleContent>
1053
+ </xs:complexType>
1054
+ </xs:element>
1055
+ </xs:sequence>
1056
+ </xs:complexType>
1057
+ </xs:element>
1058
+ <xs:element name="Relationship_Chains" minOccurs="0">
1059
+ <xs:annotation>
1060
+ <xs:documentation>This element contains a list of the individual Chains this
1061
+ relationship pertains to.</xs:documentation>
1062
+ </xs:annotation>
1063
+ <xs:complexType>
1064
+ <xs:sequence>
1065
+ <xs:element name="Relationship_Chain_ID" type="xs:integer" minOccurs="0"
1066
+ maxOccurs="unbounded">
1067
+ <xs:annotation>
1068
+ <xs:documentation>This element specifies the unique ID of an
1069
+ individual chain element this relationship pertains
1070
+ to.</xs:documentation>
1071
+ </xs:annotation>
1072
+ </xs:element>
1073
+ </xs:sequence>
1074
+ </xs:complexType>
1075
+ </xs:element>
1076
+ <xs:element name="Relationship_Target_Form">
1077
+ <xs:annotation>
1078
+ <xs:documentation>The Relationship_Target_Form element defines the form of the
1079
+ target of this relationship, such as Category, Attack Pattern, View or
1080
+ Compound_Element.</xs:documentation>
1081
+ </xs:annotation>
1082
+ <xs:simpleType>
1083
+ <xs:restriction base="xs:string">
1084
+ <xs:whiteSpace value="collapse"/>
1085
+ <xs:enumeration value="Category"/>
1086
+ <xs:enumeration value="Attack Pattern"/>
1087
+ <xs:enumeration value="View"/>
1088
+ <xs:enumeration value="Compound_Element"/>
1089
+ </xs:restriction>
1090
+ </xs:simpleType>
1091
+ </xs:element>
1092
+ <xs:element name="Relationship_Nature" maxOccurs="unbounded">
1093
+ <xs:annotation>
1094
+ <xs:documentation>The Relationship_Nature element defines the nature of the
1095
+ relationship between this element and the target element, such as ChildOf,
1096
+ HasMember or Requires to name a few.</xs:documentation>
1097
+ </xs:annotation>
1098
+ <xs:simpleType>
1099
+ <xs:restriction base="xs:string">
1100
+ <xs:whiteSpace value="collapse"/>
1101
+ <xs:enumeration value="HasMember">
1102
+ <xs:annotation>
1103
+ <xs:documentation>This Relationship_Nature denotes the specified
1104
+ entry as a top level member of this View. This value for
1105
+ Relationship_Nature can only be used in Views. The complementary
1106
+ relationship is MemberOf.</xs:documentation>
1107
+ </xs:annotation>
1108
+ </xs:enumeration>
1109
+ <xs:enumeration value="MemberOf">
1110
+ <xs:annotation>
1111
+ <xs:documentation>This Relationship_Nature denotes membership of
1112
+ this entry in the top level of the View specified in
1113
+ Relationship_Target_ID. The complementary relationship is
1114
+ HasMember.</xs:documentation>
1115
+ </xs:annotation>
1116
+ </xs:enumeration>
1117
+ <xs:enumeration value="ChildOf">
1118
+ <xs:annotation>
1119
+ <xs:documentation>This Relationship_Nature denotes a specified entry
1120
+ as a parent of this entry. In general, this means that the
1121
+ parent will be a higher level representation of this entry from
1122
+ the perspective of the View provided in Relationship_View_ID.
1123
+ The complementary relationship is ParentOf.</xs:documentation>
1124
+ </xs:annotation>
1125
+ </xs:enumeration>
1126
+ <xs:enumeration value="ParentOf">
1127
+ <xs:annotation>
1128
+ <xs:documentation>This Relationship_Nature denotes a specified entry
1129
+ as a child of this entry. In general, this means that the child
1130
+ will be a lower level representation of this entry from the
1131
+ perspective of the View provided in Relationship_View_ID. The
1132
+ complementary relationship is ChildOf.</xs:documentation>
1133
+ </xs:annotation>
1134
+ </xs:enumeration>
1135
+ <xs:enumeration value="PeerOf">
1136
+ <xs:annotation>
1137
+ <xs:documentation>This Relationship_Nature denotes a specified entry
1138
+ as having some similarity with this entry which does not fit any
1139
+ of the other Relationship_Nature values. In this case, a
1140
+ Relationship_Note should also be provided explaining the
1141
+ connection. The complementary relationship is itself
1142
+ (PeerOf).</xs:documentation>
1143
+ </xs:annotation>
1144
+ </xs:enumeration>
1145
+ <xs:enumeration value="Requires">
1146
+ <xs:annotation>
1147
+ <xs:documentation>This Relationship_Nature denotes a
1148
+ Compound_Element of Compound_Element_Structure="Composite". All
1149
+ entries that a Composite Requires must exist simultaneously in
1150
+ order for the Compound_Element to exist. The complementary
1151
+ relationship is RequiredBy.</xs:documentation>
1152
+ </xs:annotation>
1153
+ </xs:enumeration>
1154
+ <xs:enumeration value="RequiredBy">
1155
+ <xs:annotation>
1156
+ <xs:documentation>This Relationship_Nature denotes an entry that is
1157
+ required in order for the Compound_Element specified in
1158
+ Relationship_Target_ID to exist. The complementary relationship
1159
+ is Requires.</xs:documentation>
1160
+ </xs:annotation>
1161
+ </xs:enumeration>
1162
+ <xs:enumeration value="StartsWith">
1163
+ <xs:annotation>
1164
+ <xs:documentation>This Relationship_Nature denotes the starting
1165
+ point in this chain as the entry specified by
1166
+ Relationship_Target_ID. This Relationship_Nature can only be
1167
+ used for Compound_Elements with
1168
+ Compound_Element_Structure="Chain". For named chains, the
1169
+ complementary relationship is StartsChain.</xs:documentation>
1170
+ </xs:annotation>
1171
+ </xs:enumeration>
1172
+ <xs:enumeration value="StartsChain">
1173
+ <xs:annotation>
1174
+ <xs:documentation>This Relationship_Nature denotes this entry as the
1175
+ starting point in the chain specified in Relationship_Target_ID.
1176
+ For named chains, the complementary relationship is
1177
+ StartsWith.</xs:documentation>
1178
+ </xs:annotation>
1179
+ </xs:enumeration>
1180
+ <xs:enumeration value="CanPrecede">
1181
+ <xs:annotation>
1182
+ <xs:documentation>This Relationship_Nature denotes a chain where
1183
+ this entry can precede the entry specified by
1184
+ Relationship_Target_ID in a sequential fashion. It is important
1185
+ to note that not all CanPrecede relationships are captured in a
1186
+ Compound_Element chain, only the most common for now. The
1187
+ complementary relationship is CanFollow.</xs:documentation>
1188
+ </xs:annotation>
1189
+ </xs:enumeration>
1190
+ <xs:enumeration value="CanFollow">
1191
+ <xs:annotation>
1192
+ <xs:documentation>This Relationship_Nature denotes a chain where
1193
+ this entry can follow the entry specified by
1194
+ Relationship_Target_ID in a sequential fashion. It is important
1195
+ to note that not all CanFollow relationships are captured in a
1196
+ Compound_Element chain, only the most common for now. The
1197
+ complementary relationship is CanPrecede.</xs:documentation>
1198
+ </xs:annotation>
1199
+ </xs:enumeration>
1200
+ <xs:enumeration value="CanAlsoBe">
1201
+ <xs:annotation>
1202
+ <xs:documentation>This Relationship_Nature denotes an entry that, in
1203
+ the proper environment and context, can also be perceived as the
1204
+ entry specified by Relationship_Target_ID. This relationship is
1205
+ not necessarily reciprocal.</xs:documentation>
1206
+ </xs:annotation>
1207
+ </xs:enumeration>
1208
+ </xs:restriction>
1209
+ </xs:simpleType>
1210
+ </xs:element>
1211
+ <xs:element name="Relationship_Target_ID" type="xs:integer">
1212
+ <xs:annotation>
1213
+ <xs:documentation>The Relationship_Target_ID specifies the unique ID of the
1214
+ target element of the relationship.</xs:documentation>
1215
+ </xs:annotation>
1216
+ </xs:element>
1217
+ <xs:element name="Relationship_Description" type="capec:Structured_Text_Type"
1218
+ minOccurs="0"/>
1219
+ </xs:sequence>
1220
+ </xs:complexType>
1221
+ <xs:element name="Relationship_Notes">
1222
+ <xs:annotation>
1223
+ <xs:documentation>This structure houses one or more Relationship_Note elements, which
1224
+ each contain details regarding the relationships between CAPEC entries.
1225
+ </xs:documentation>
1226
+ </xs:annotation>
1227
+ <xs:complexType>
1228
+ <xs:sequence>
1229
+ <xs:element name="Relationship_Note" type="capec:Structured_Text_Type"
1230
+ maxOccurs="unbounded">
1231
+ <xs:annotation>
1232
+ <xs:documentation>This element contains a note regarding the relationships
1233
+ between CAPEC entries.</xs:documentation>
1234
+ </xs:annotation>
1235
+ </xs:element>
1236
+ </xs:sequence>
1237
+ </xs:complexType>
1238
+ </xs:element>
1239
+ <xs:element name="Maintenance_Notes">
1240
+ <xs:annotation>
1241
+ <xs:documentation>This element contains one or more Maintenance_Note elements which each
1242
+ contain significant maintenance tasks within this entry that still need to be
1243
+ addressed, such as clarifying the concepts involved or improving relationships. It
1244
+ should be filled out in any entry that is still undergoing significant review by the
1245
+ CAPEC team.</xs:documentation>
1246
+ </xs:annotation>
1247
+ <xs:complexType>
1248
+ <xs:sequence>
1249
+ <xs:element name="Maintenance_Note" type="capec:Structured_Text_Type"
1250
+ maxOccurs="unbounded">
1251
+ <xs:annotation>
1252
+ <xs:documentation>This element describes a significant maintenance task
1253
+ within this entry that still need to be addressed, such as clarifying
1254
+ the concepts involved or improving relationships. It should be filled
1255
+ out in any entry that is still undergoing significant review by the
1256
+ CAPEC team.</xs:documentation>
1257
+ </xs:annotation>
1258
+ </xs:element>
1259
+ </xs:sequence>
1260
+ </xs:complexType>
1261
+ </xs:element>
1262
+ <xs:element name="Other_Notes">
1263
+ <xs:annotation>
1264
+ <xs:documentation>This element contains one or more Note elements, each of which provide
1265
+ any additional notes or comments that cannot be captured using other elements. New
1266
+ elements might be defined in the future to contain this information. It should be
1267
+ filled out where needed.</xs:documentation>
1268
+ </xs:annotation>
1269
+ <xs:complexType>
1270
+ <xs:sequence>
1271
+ <xs:element name="Note" type="capec:Structured_Text_Type" maxOccurs="unbounded">
1272
+ <xs:annotation>
1273
+ <xs:documentation>This element contains any additional notes or comments
1274
+ that cannot be captured using other elements. New elements might be
1275
+ defined in the future to contain this information. It should be filled
1276
+ out where needed.</xs:documentation>
1277
+ </xs:annotation>
1278
+ </xs:element>
1279
+ </xs:sequence>
1280
+ </xs:complexType>
1281
+ </xs:element>
1282
+ <xs:element name="Alternate_Terms">
1283
+ <xs:annotation>
1284
+ <xs:documentation>This element contains one or more Alternate_Term elements, each of
1285
+ which contains other names used to describe this attack pattern.</xs:documentation>
1286
+ </xs:annotation>
1287
+ <xs:complexType>
1288
+ <xs:sequence>
1289
+ <xs:element name="Alternate_Term" maxOccurs="unbounded">
1290
+ <xs:annotation>
1291
+ <xs:documentation>This element contains alternate terms by which this attack
1292
+ pattern may be known and a description to explain the context in which
1293
+ the term may be relevant. This is not required for all entries and
1294
+ should only be included where appropriate.</xs:documentation>
1295
+ </xs:annotation>
1296
+ <xs:complexType>
1297
+ <xs:sequence>
1298
+ <xs:element name="Term" type="xs:string">
1299
+ <xs:annotation>
1300
+ <xs:documentation>This element contains the actual term for the
1301
+ Alternate_Term element. Each term should follow the same
1302
+ conventions as the entry Name attribute.</xs:documentation>
1303
+ </xs:annotation>
1304
+ </xs:element>
1305
+ <xs:element name="Alternate_Term_Description"
1306
+ type="capec:Structured_Text_Type" minOccurs="0">
1307
+ <xs:annotation>
1308
+ <xs:documentation>This element provides context to each
1309
+ Alternate_Term by which this attack pattern may be
1310
+ known.</xs:documentation>
1311
+ </xs:annotation>
1312
+ </xs:element>
1313
+ </xs:sequence>
1314
+ </xs:complexType>
1315
+ </xs:element>
1316
+ </xs:sequence>
1317
+ </xs:complexType>
1318
+ </xs:element>
1319
+ <xs:element name="Research_Gaps">
1320
+ <xs:annotation>
1321
+ <xs:documentation>This structure contains one or more Research gap elements, each of
1322
+ which identifies potential opportunities for the attack research community to
1323
+ conduct further exploration of issues related to this attack pattern. It is intended
1324
+ to highlight parts of CAPEC that have not received sufficient attention from
1325
+ researchers. This should be filled out where appropriate for attack patterns and
1326
+ categories.</xs:documentation>
1327
+ </xs:annotation>
1328
+ <xs:complexType>
1329
+ <xs:sequence>
1330
+ <xs:element name="Research_Gap" type="capec:Structured_Text_Type"
1331
+ maxOccurs="unbounded">
1332
+ <xs:annotation>
1333
+ <xs:documentation>This element identifies potential opportunities for the
1334
+ vulnerability research community to conduct further exploration of
1335
+ issues related to this attack pattern. It is intended to highlight parts
1336
+ of CAPEC that have not received sufficient attention from researchers.
1337
+ This should be filled out where appropriate for attack patterns and
1338
+ categories.</xs:documentation>
1339
+ </xs:annotation>
1340
+ </xs:element>
1341
+ </xs:sequence>
1342
+ </xs:complexType>
1343
+ </xs:element>
1344
+ <xs:element name="Content_History">
1345
+ <xs:annotation>
1346
+ <xs:documentation>This element is used to keep track of the author of the attack pattern
1347
+ entry and anyone who has made modifications to the content. This provides a means of
1348
+ contacting the authors and modifiers for clarifying ambiguities, merging overlapping
1349
+ contributions, etc. This should be filled out for all entries. </xs:documentation>
1350
+ </xs:annotation>
1351
+ <xs:complexType>
1352
+ <xs:sequence>
1353
+ <xs:element name="Submissions" minOccurs="0">
1354
+ <xs:annotation>
1355
+ <xs:documentation>This structure contains one or more Submission
1356
+ elements.</xs:documentation>
1357
+ </xs:annotation>
1358
+ <xs:complexType>
1359
+ <xs:sequence>
1360
+ <xs:element name="Submission" maxOccurs="unbounded">
1361
+ <xs:annotation>
1362
+ <xs:documentation>This element houses the subelements which
1363
+ identify the submitter and the submitter's comments related
1364
+ to this entry. This element has a single attribute,
1365
+ Submission_Source, which provides a general idea of how the
1366
+ initial information for this entry was obtained, whether
1367
+ internal to the CAPEC team, external, donated,
1368
+ etc.</xs:documentation>
1369
+ </xs:annotation>
1370
+ <xs:complexType>
1371
+ <xs:sequence>
1372
+ <xs:element name="Submitter" type="xs:string" minOccurs="0">
1373
+ <xs:annotation>
1374
+ <xs:documentation>This element should contain the
1375
+ name of the author for this entry.
1376
+ </xs:documentation>
1377
+ </xs:annotation>
1378
+ </xs:element>
1379
+ <xs:element name="Submitter_Organization" type="xs:string"
1380
+ minOccurs="0">
1381
+ <xs:annotation>
1382
+ <xs:documentation>This element should identify the
1383
+ author's organization.</xs:documentation>
1384
+ </xs:annotation>
1385
+ </xs:element>
1386
+ <xs:element name="Submission_Date" type="xs:date"
1387
+ minOccurs="0">
1388
+ <xs:annotation>
1389
+ <xs:documentation>This element should provide the
1390
+ date on which this content was authored in
1391
+ YYYY-MM-DD format.</xs:documentation>
1392
+ </xs:annotation>
1393
+ </xs:element>
1394
+ <xs:element name="Submission_Comment" type="xs:string"
1395
+ minOccurs="0">
1396
+ <xs:annotation>
1397
+ <xs:documentation>This element provides the author
1398
+ with a place to store any comments regarding the
1399
+ content of this attack pattern entry, such as
1400
+ assumptions made, reasons for omitting elements,
1401
+ contact information, pending questions,
1402
+ etc.</xs:documentation>
1403
+ </xs:annotation>
1404
+ </xs:element>
1405
+ </xs:sequence>
1406
+ <xs:attribute name="Submission_Source" use="optional">
1407
+ <xs:annotation>
1408
+ <xs:documentation>This attribute identifies how the
1409
+ initial information for this entry was obtained.
1410
+ </xs:documentation>
1411
+ </xs:annotation>
1412
+ <xs:simpleType>
1413
+ <xs:restriction base="xs:string">
1414
+ <xs:whiteSpace value="collapse"/>
1415
+ <xs:enumeration value="Externally_Mined"/>
1416
+ <xs:enumeration value="NDA"/>
1417
+ <xs:enumeration value="Internal_CAPEC_Team"/>
1418
+ <xs:enumeration value="External_Submission"/>
1419
+ </xs:restriction>
1420
+ </xs:simpleType>
1421
+ </xs:attribute>
1422
+ </xs:complexType>
1423
+ </xs:element>
1424
+ </xs:sequence>
1425
+ </xs:complexType>
1426
+ </xs:element>
1427
+ <xs:element name="Contributions" minOccurs="0">
1428
+ <xs:annotation>
1429
+ <xs:documentation>This structure contains one or more Contribution
1430
+ elements.</xs:documentation>
1431
+ </xs:annotation>
1432
+ <xs:complexType>
1433
+ <xs:sequence>
1434
+ <xs:element name="Contribution" maxOccurs="unbounded">
1435
+ <xs:annotation>
1436
+ <xs:documentation>This element houses the subelements which
1437
+ identify the contributor and contributor's comments related
1438
+ to this entry. This element has a single attribute,
1439
+ Contribution_Mode, which indicates whether the contribution
1440
+ was part of feedback given to the CAPEC team or actual
1441
+ content that was donated.</xs:documentation>
1442
+ </xs:annotation>
1443
+ <xs:complexType>
1444
+ <xs:sequence>
1445
+ <xs:element name="Contributor" type="xs:string"
1446
+ minOccurs="0">
1447
+ <xs:annotation>
1448
+ <xs:documentation>This element should contain the
1449
+ name of the author for this entry.
1450
+ </xs:documentation>
1451
+ </xs:annotation>
1452
+ </xs:element>
1453
+ <xs:element name="Contribution_Organization"
1454
+ type="xs:string" minOccurs="0">
1455
+ <xs:annotation>
1456
+ <xs:documentation>This element should identify the
1457
+ author's organization.</xs:documentation>
1458
+ </xs:annotation>
1459
+ </xs:element>
1460
+ <xs:element name="Contribution_Date" type="xs:date"
1461
+ minOccurs="0">
1462
+ <xs:annotation>
1463
+ <xs:documentation>This element should provide the
1464
+ date on which this content was authored in
1465
+ YYYY-MM-DD format.</xs:documentation>
1466
+ </xs:annotation>
1467
+ </xs:element>
1468
+ <xs:element name="Contribution_Comment" type="xs:string"
1469
+ minOccurs="0">
1470
+ <xs:annotation>
1471
+ <xs:documentation>This element provides the author
1472
+ with a place to store any comments regarding the
1473
+ content of this attack patterns entry, such as
1474
+ assumptions made, reasons for omitting elements,
1475
+ contact information, pending questions,
1476
+ etc.</xs:documentation>
1477
+ </xs:annotation>
1478
+ </xs:element>
1479
+ </xs:sequence>
1480
+ <xs:attribute name="Contribution_Mode" use="optional">
1481
+ <xs:annotation>
1482
+ <xs:documentation>This attribute indicates whether the
1483
+ contribution was part of feedback given to the CAPEC
1484
+ team or actual content that was
1485
+ donated.</xs:documentation>
1486
+ </xs:annotation>
1487
+ <xs:simpleType>
1488
+ <xs:restriction base="xs:string">
1489
+ <xs:whiteSpace value="collapse"/>
1490
+ <xs:enumeration value="Content"/>
1491
+ <xs:enumeration value="Feedback"/>
1492
+ </xs:restriction>
1493
+ </xs:simpleType>
1494
+ </xs:attribute>
1495
+ </xs:complexType>
1496
+ </xs:element>
1497
+ </xs:sequence>
1498
+ </xs:complexType>
1499
+ </xs:element>
1500
+ <xs:element name="Modifications" minOccurs="0">
1501
+ <xs:annotation>
1502
+ <xs:documentation>This structure contains one or more Modification
1503
+ elements.</xs:documentation>
1504
+ </xs:annotation>
1505
+ <xs:complexType>
1506
+ <xs:sequence>
1507
+ <xs:element name="Modification" maxOccurs="unbounded">
1508
+ <xs:annotation>
1509
+ <xs:documentation>This element houses the subelements which
1510
+ identify the modifier and modifier's comments related to
1511
+ this entry. A new Modification element should exist for each
1512
+ modification of the entry content. This element has a single
1513
+ attribute, Modification_Source, which indicates whether this
1514
+ modification was made by a CAPEC team member or an external
1515
+ party.</xs:documentation>
1516
+ </xs:annotation>
1517
+ <xs:complexType>
1518
+ <xs:sequence>
1519
+ <xs:element name="Modifier" type="xs:string" minOccurs="0">
1520
+ <xs:annotation>
1521
+ <xs:documentation>This element should contain the
1522
+ name of the person modifying this entry.
1523
+ </xs:documentation>
1524
+ </xs:annotation>
1525
+ </xs:element>
1526
+ <xs:element name="Modifier_Organization" type="xs:string"
1527
+ minOccurs="0">
1528
+ <xs:annotation>
1529
+ <xs:documentation>This element should contain the
1530
+ modifier's organization.</xs:documentation>
1531
+ </xs:annotation>
1532
+ </xs:element>
1533
+ <xs:element name="Modification_Date" type="xs:date"
1534
+ minOccurs="0">
1535
+ <xs:annotation>
1536
+ <xs:documentation>This element should contain the
1537
+ date of the modifications.</xs:documentation>
1538
+ </xs:annotation>
1539
+ </xs:element>
1540
+ <xs:element name="Modification_Comment" type="xs:string"
1541
+ minOccurs="0">
1542
+ <xs:annotation>
1543
+ <xs:documentation>This element provides the modifier
1544
+ with a place to store any comments regarding the
1545
+ content of this attack pattern entry, such as
1546
+ assumptions made, reasons for omitting elements,
1547
+ contact information, pending questions,
1548
+ etc.</xs:documentation>
1549
+ </xs:annotation>
1550
+ </xs:element>
1551
+ </xs:sequence>
1552
+ <xs:attribute name="Modification_Importance">
1553
+ <xs:annotation>
1554
+ <xs:documentation>This attribute identifies how
1555
+ significant the modification is to the attack
1556
+ pattern with regard to the meaning and
1557
+ interpretation of the pattern. If a modification has
1558
+ a value of Critical, then the meaning of the entry
1559
+ or how it might be interpreted has changed and
1560
+ requires attention from anyone previously dependent
1561
+ on the attack pattern.</xs:documentation>
1562
+ </xs:annotation>
1563
+ <xs:simpleType>
1564
+ <xs:restriction base="xs:string">
1565
+ <xs:whiteSpace value="collapse"/>
1566
+ <xs:enumeration value="Normal"/>
1567
+ <xs:enumeration value="Critical"/>
1568
+ </xs:restriction>
1569
+ </xs:simpleType>
1570
+ </xs:attribute>
1571
+ <xs:attribute name="Modification_Source" use="optional">
1572
+ <xs:annotation>
1573
+ <xs:documentation>This attribute indicates whether this
1574
+ modification was created by a CAPEC team member or
1575
+ provided by an external party.</xs:documentation>
1576
+ </xs:annotation>
1577
+ <xs:simpleType>
1578
+ <xs:restriction base="xs:string">
1579
+ <xs:whiteSpace value="collapse"/>
1580
+ <xs:enumeration value="Internal"/>
1581
+ <xs:enumeration value="External"/>
1582
+ </xs:restriction>
1583
+ </xs:simpleType>
1584
+ </xs:attribute>
1585
+ </xs:complexType>
1586
+ </xs:element>
1587
+ </xs:sequence>
1588
+ </xs:complexType>
1589
+ </xs:element>
1590
+ <xs:element name="Previous_Entry_Names" minOccurs="0">
1591
+ <xs:annotation>
1592
+ <xs:documentation>This structure contains one or more Previous_Entry_Name
1593
+ elements, each of which describes a previous name that was used for this
1594
+ entry. This should be filled out whenever a substantive name change
1595
+ occurs.</xs:documentation>
1596
+ </xs:annotation>
1597
+ <xs:complexType>
1598
+ <xs:sequence>
1599
+ <xs:element name="Previous_Entry_Name" maxOccurs="unbounded">
1600
+ <xs:annotation>
1601
+ <xs:documentation>This element identifies a name that was
1602
+ previously used for this entry.</xs:documentation>
1603
+ </xs:annotation>
1604
+ <xs:complexType>
1605
+ <xs:simpleContent>
1606
+ <xs:extension base="xs:string">
1607
+ <xs:attribute name="Name_Change_Date" type="xs:date"
1608
+ use="required">
1609
+ <xs:annotation>
1610
+ <xs:documentation>This lists the date on which
1611
+ this name was changed to something else.
1612
+ Typically, this date will be closely aligned with
1613
+ new releases of CAPEC.</xs:documentation>
1614
+ </xs:annotation>
1615
+ </xs:attribute>
1616
+ </xs:extension>
1617
+ </xs:simpleContent>
1618
+ </xs:complexType>
1619
+ </xs:element>
1620
+ </xs:sequence>
1621
+ </xs:complexType>
1622
+ </xs:element>
1623
+ </xs:sequence>
1624
+ </xs:complexType>
1625
+ </xs:element>
1626
+ <xs:complexType name="ObservablesType">
1627
+ <xs:sequence>
1628
+ <xs:element name="Observable" maxOccurs="unbounded">
1629
+ <xs:complexType>
1630
+ <xs:sequence>
1631
+ <xs:element name="Signature">
1632
+ <xs:complexType>
1633
+ <xs:sequence>
1634
+ <xs:element name="Location-Sensor" minOccurs="0"/>
1635
+ <xs:element name="Stateful_Measure">
1636
+ <xs:complexType>
1637
+ <xs:sequence>
1638
+ <xs:element name="Description"
1639
+ type="capec:Structured_Text_Type"/>
1640
+ <xs:element name="Value_Type">
1641
+ <xs:complexType>
1642
+ <xs:choice>
1643
+ <xs:element name="Objective_Value"
1644
+ type="xs:string"/>
1645
+ <xs:element name="Trend">
1646
+ <xs:simpleType>
1647
+ <xs:restriction base="xs:string">
1648
+ <xs:whiteSpace value="collapse"/>
1649
+ <xs:enumeration value="Increasing"/>
1650
+ <xs:enumeration value="Decreasing"/>
1651
+ </xs:restriction>
1652
+ </xs:simpleType>
1653
+ </xs:element>
1654
+ <xs:element name="Frequency">
1655
+ <xs:complexType>
1656
+ <xs:attribute name="Rate" type="xs:float"
1657
+ use="required"/>
1658
+ <xs:attribute name="Units" type="xs:string"
1659
+ use="required"/>
1660
+ <xs:attribute name="Scale" type="xs:string"
1661
+ use="required"/>
1662
+ </xs:complexType>
1663
+ </xs:element>
1664
+ </xs:choice>
1665
+ </xs:complexType>
1666
+ </xs:element>
1667
+ </xs:sequence>
1668
+ <xs:attribute name="Name"/>
1669
+ </xs:complexType>
1670
+ </xs:element>
1671
+ <xs:element name="Event">
1672
+ <xs:complexType>
1673
+ <xs:sequence>
1674
+ <xs:element name="Description"
1675
+ type="capec:Structured_Text_Type"/>
1676
+ <xs:element name="Action">
1677
+ <xs:complexType>
1678
+ <xs:sequence>
1679
+ <xs:element name="Object" maxOccurs="unbounded">
1680
+ <xs:complexType>
1681
+ <xs:sequence>
1682
+ <xs:element name="Value" maxOccurs="unbounded">
1683
+ <xs:complexType>
1684
+ <xs:sequence>
1685
+ <xs:element name="Objective_Value"
1686
+ type="xs:string" minOccurs="0"/>
1687
+ <xs:element name="Change" type="xs:boolean"
1688
+ minOccurs="0"/>
1689
+ <xs:element name="Delta" minOccurs="0">
1690
+ <xs:complexType>
1691
+ <xs:choice>
1692
+ <xs:element name="Trend">
1693
+ <xs:simpleType>
1694
+ <xs:restriction base="xs:string">
1695
+ <xs:whiteSpace value="collapse"/>
1696
+ <xs:enumeration value="Increasing"/>
1697
+ <xs:enumeration value="Decreasing"/>
1698
+ </xs:restriction>
1699
+ </xs:simpleType>
1700
+ </xs:element>
1701
+ <xs:element name="Frequency">
1702
+ <xs:complexType>
1703
+ <xs:attribute name="Rate" type="xs:float"
1704
+ use="required"/>
1705
+ <xs:attribute name="Units" type="xs:string"
1706
+ use="required"/>
1707
+ <xs:attribute name="Scale" type="xs:string"
1708
+ use="required"/>
1709
+ </xs:complexType>
1710
+ </xs:element>
1711
+ </xs:choice>
1712
+ </xs:complexType>
1713
+ </xs:element>
1714
+ </xs:sequence>
1715
+ </xs:complexType>
1716
+ </xs:element>
1717
+ </xs:sequence>
1718
+ </xs:complexType>
1719
+ </xs:element>
1720
+ </xs:sequence>
1721
+ </xs:complexType>
1722
+ </xs:element>
1723
+ </xs:sequence>
1724
+ <xs:attribute name="Event_Type" type="xs:string"/>
1725
+ </xs:complexType>
1726
+ </xs:element>
1727
+ </xs:sequence>
1728
+ </xs:complexType>
1729
+ </xs:element>
1730
+ <xs:element name="Noisiness" minOccurs="0">
1731
+ <xs:simpleType>
1732
+ <xs:restriction base="xs:string">
1733
+ <xs:whiteSpace value="collapse"/>
1734
+ <xs:enumeration value="High"/>
1735
+ <xs:enumeration value="Medium"/>
1736
+ <xs:enumeration value="Low"/>
1737
+ </xs:restriction>
1738
+ </xs:simpleType>
1739
+ </xs:element>
1740
+ <xs:element name="Ease_of_Obfuscation" minOccurs="0">
1741
+ <xs:simpleType>
1742
+ <xs:restriction base="xs:string">
1743
+ <xs:whiteSpace value="collapse"/>
1744
+ <xs:enumeration value="High"/>
1745
+ <xs:enumeration value="Medium"/>
1746
+ <xs:enumeration value="Low"/>
1747
+ </xs:restriction>
1748
+ </xs:simpleType>
1749
+ </xs:element>
1750
+ <xs:element name="Obfuscation_Techniques" minOccurs="0">
1751
+ <xs:complexType>
1752
+ <xs:sequence>
1753
+ <xs:element name="Obfuscation_Technique" maxOccurs="unbounded">
1754
+ <xs:complexType>
1755
+ <xs:sequence>
1756
+ <xs:element name="Description"
1757
+ type="capec:Structured_Text_Type"/>
1758
+ <xs:element name="Observables"
1759
+ type="capec:ObservablesType"/>
1760
+ </xs:sequence>
1761
+ </xs:complexType>
1762
+ </xs:element>
1763
+ </xs:sequence>
1764
+ </xs:complexType>
1765
+ </xs:element>
1766
+ </xs:sequence>
1767
+ </xs:complexType>
1768
+ </xs:element>
1769
+ </xs:sequence>
1770
+ </xs:complexType>
1771
+ <xs:complexType name="Structured_Text_Type">
1772
+ <xs:sequence>
1773
+ <xs:choice maxOccurs="unbounded">
1774
+ <xs:group ref="capec:Structured_Text_Group"/>
1775
+ <xs:element ref="capec:Block">
1776
+ <xs:annotation>
1777
+ <xs:documentation>Block is a Structured_Text element consisting of one of
1778
+ Text_Title, Text, Code_Example_Language, or Code followed by another
1779
+ Block element. Structured_Text elements help define whitespace and text
1780
+ segments.</xs:documentation>
1781
+ </xs:annotation>
1782
+ </xs:element>
1783
+ </xs:choice>
1784
+ </xs:sequence>
1785
+ </xs:complexType>
1786
+ <xs:group name="Structured_Text_Group">
1787
+ <xs:sequence>
1788
+ <xs:choice>
1789
+ <xs:element name="Text_Title" type="xs:string" minOccurs="0" maxOccurs="unbounded">
1790
+ <xs:annotation>
1791
+ <xs:documentation>Presentation Element: This element is used to
1792
+ definebold-faced title for a subsequent block of text.
1793
+ </xs:documentation>
1794
+ </xs:annotation>
1795
+ </xs:element>
1796
+ <xs:element name="Text" type="xs:string" minOccurs="0" maxOccurs="unbounded">
1797
+ <xs:annotation>
1798
+ <xs:documentation>Presentation Element: This element is used to define a
1799
+ paragraph of text.</xs:documentation>
1800
+ </xs:annotation>
1801
+ </xs:element>
1802
+ <xs:element name="Code_Example_Language" type="capec:Language_Type" minOccurs="0"
1803
+ maxOccurs="unbounded">
1804
+ <xs:annotation>
1805
+ <xs:documentation>Presentation Element: This element is used to identify the
1806
+ programming language being used in the following block of
1807
+ Code</xs:documentation>
1808
+ </xs:annotation>
1809
+ </xs:element>
1810
+ <xs:element name="Code" type="xs:string" minOccurs="0" maxOccurs="unbounded">
1811
+ <xs:annotation>
1812
+ <xs:documentation>Presentation Element: This element is used to define a
1813
+ line of code.</xs:documentation>
1814
+ </xs:annotation>
1815
+ </xs:element>
1816
+ <xs:element name="Comment" type="xs:string" minOccurs="0" maxOccurs="unbounded">
1817
+ <xs:annotation>
1818
+ <xs:documentation>Presentation Element: This element is used to define a
1819
+ comment in code.</xs:documentation>
1820
+ </xs:annotation>
1821
+ </xs:element>
1822
+ <xs:element name="Images" minOccurs="0">
1823
+ <xs:annotation>
1824
+ <xs:documentation>Presentation Element: This element is used to define an
1825
+ image.</xs:documentation>
1826
+ </xs:annotation>
1827
+ <xs:complexType>
1828
+ <xs:sequence>
1829
+ <xs:element name="Image" maxOccurs="unbounded">
1830
+ <xs:annotation>
1831
+ <xs:documentation>Presentation Element: This element is used to
1832
+ define an image.</xs:documentation>
1833
+ </xs:annotation>
1834
+ <xs:complexType>
1835
+ <xs:sequence maxOccurs="unbounded">
1836
+ <xs:element name="Image_Location" type="xs:string">
1837
+ <xs:annotation>
1838
+ <xs:documentation>This element provides the location
1839
+ of the image file.</xs:documentation>
1840
+ </xs:annotation>
1841
+ </xs:element>
1842
+ <xs:element name="Image_Title" type="xs:string">
1843
+ <xs:annotation>
1844
+ <xs:documentation>This element provides a title for
1845
+ the image.</xs:documentation>
1846
+ </xs:annotation>
1847
+ </xs:element>
1848
+ </xs:sequence>
1849
+ </xs:complexType>
1850
+ </xs:element>
1851
+ </xs:sequence>
1852
+ </xs:complexType>
1853
+ </xs:element>
1854
+ </xs:choice>
1855
+ </xs:sequence>
1856
+ </xs:group>
1857
+ <xs:element name="Block">
1858
+ <xs:annotation>
1859
+ <xs:documentation>Block is a Structured_Text element consisting of one of Text_Title,
1860
+ Text, Code_Example_Language, or Code followed by another Block element.
1861
+ Structured_Text elements help define whitespace and text segments.
1862
+ </xs:documentation>
1863
+ </xs:annotation>
1864
+ <xs:complexType>
1865
+ <xs:choice maxOccurs="unbounded">
1866
+ <xs:group ref="capec:Structured_Text_Group"/>
1867
+ <xs:element ref="capec:Block">
1868
+ <xs:annotation>
1869
+ <xs:documentation>Block is a Structured_Text element consisting of one of
1870
+ Text_Title,Text, Code_Example_Language, or Code followed by another
1871
+ Block element. Structured_Text elements help define whitespace and text
1872
+ segments.</xs:documentation>
1873
+ </xs:annotation>
1874
+ </xs:element>
1875
+ </xs:choice>
1876
+ <xs:attribute name="Block_Nature">
1877
+ <xs:annotation>
1878
+ <xs:documentation>This attribute identifies the nature of the content
1879
+ containedwithin the Block.</xs:documentation>
1880
+ </xs:annotation>
1881
+ <xs:simpleType>
1882
+ <xs:restriction base="xs:string">
1883
+ <xs:whiteSpace value="collapse"/>
1884
+ <xs:enumeration value="Good_Code"/>
1885
+ <xs:enumeration value="Bad_Code"/>
1886
+ <xs:enumeration value="Mitigation_Code"/>
1887
+ <xs:enumeration value="Attack"/>
1888
+ <xs:enumeration value="Result"/>
1889
+ <xs:enumeration value="List"/>
1890
+ <xs:enumeration value="Numeric_List"/>
1891
+ </xs:restriction>
1892
+ </xs:simpleType>
1893
+ </xs:attribute>
1894
+ </xs:complexType>
1895
+ </xs:element>
1896
+ <xs:complexType name="Reference_List_Type">
1897
+ <xs:annotation>
1898
+ <xs:documentation>The References_List_Type contains one or more Reference elements, each
1899
+ of which provide further reading and insight into the item. This should be filled
1900
+ out as appropriate.</xs:documentation>
1901
+ </xs:annotation>
1902
+ <xs:sequence>
1903
+ <xs:element name="Reference" type="capec:Reference_Type" maxOccurs="unbounded">
1904
+ <xs:annotation>
1905
+ <xs:documentation>Each Reference subelement should provide a single source from
1906
+ which more information and deeper insight can be obtained, such as a
1907
+ research paper or an excerpt from a publication. Multiple Reference
1908
+ subelements can exist. The sole attribute of this element is the id. The id
1909
+ is optional and translates to a preceding footnote below the context notes
1910
+ if the author of the entry wants to cite a reference. Not all subelements
1911
+ need to be completed, since some are designed for web references and others
1912
+ are designed for book references. The fields Reference_Author and
1913
+ Reference_Title should be filled out for all references if possible.
1914
+ Reference_Section and Reference_Date can be included for either book
1915
+ references or online references. Reference_Edition, Reference_Publication,
1916
+ Reference_Publisher, and Reference_PubDate are intended for book references,
1917
+ however they can be included where appropriate for other types of
1918
+ references. Reference_Link is intended for web references, however it can be
1919
+ included for book references as well if applicable.</xs:documentation>
1920
+ </xs:annotation>
1921
+ </xs:element>
1922
+ </xs:sequence>
1923
+ </xs:complexType>
1924
+ <xs:complexType name="Reference_Type">
1925
+ <xs:sequence>
1926
+ <xs:element name="Reference_Author" type="xs:string" minOccurs="0" maxOccurs="unbounded">
1927
+ <xs:annotation>
1928
+ <xs:documentation>This element identifies an individual author of the material
1929
+ being referenced. It is not required, but may be repeated sequentially in
1930
+ order to identify multiple authors for a single piece of
1931
+ material.</xs:documentation>
1932
+ </xs:annotation>
1933
+ </xs:element>
1934
+ <xs:element name="Reference_Title" type="xs:string" minOccurs="0">
1935
+ <xs:annotation>
1936
+ <xs:documentation>This element identifies the title of the material
1937
+ beingreferenced. It is not required if the material does not have a
1938
+ title.</xs:documentation>
1939
+ </xs:annotation>
1940
+ </xs:element>
1941
+ <xs:element name="Reference_Section" type="xs:string" minOccurs="0">
1942
+ <xs:annotation>
1943
+ <xs:documentation>This element is intended to provide a means of identifying the
1944
+ exact location of the material inside of the publication source, such as the
1945
+ relevant pages of a research paper, the appropriate chapters from a book,
1946
+ etc. This is useful for both book references and internet
1947
+ references.</xs:documentation>
1948
+ </xs:annotation>
1949
+ </xs:element>
1950
+ <xs:element name="Reference_Edition" type="xs:string" minOccurs="0">
1951
+ <xs:annotation>
1952
+ <xs:documentation>This element identifies the edition of the material being
1953
+ referenced in the event that multiple editions of the material exist. This
1954
+ will usually only be useful for book references.</xs:documentation>
1955
+ </xs:annotation>
1956
+ </xs:element>
1957
+ <xs:element name="Reference_Publication" type="xs:string" minOccurs="0">
1958
+ <xs:annotation>
1959
+ <xs:documentation>This element identifies the publication source of the
1960
+ reference material, if one exists.</xs:documentation>
1961
+ </xs:annotation>
1962
+ </xs:element>
1963
+ <xs:element name="Reference_Publisher" type="xs:string" minOccurs="0">
1964
+ <xs:annotation>
1965
+ <xs:documentation>This element identifies the publisher of the reference
1966
+ material, if one exists.</xs:documentation>
1967
+ </xs:annotation>
1968
+ </xs:element>
1969
+ <xs:element name="Reference_Date" type="xs:date" minOccurs="0">
1970
+ <xs:annotation>
1971
+ <xs:documentation>This element identifies the date when the reference was
1972
+ included in the entry. This provides the reader with a time line for when
1973
+ the material in the reference, usually the link, was valid. The date should
1974
+ be of the format YYYY-MM-DD.</xs:documentation>
1975
+ </xs:annotation>
1976
+ </xs:element>
1977
+ <xs:element name="Reference_PubDate" type="xs:string" minOccurs="0">
1978
+ <xs:annotation>
1979
+ <xs:documentation>This field describes the date when the reference was published
1980
+ YYYY.</xs:documentation>
1981
+ </xs:annotation>
1982
+ </xs:element>
1983
+ <xs:element name="Reference_Link" type="xs:string" minOccurs="0">
1984
+ <xs:annotation>
1985
+ <xs:documentation>This element should hold the URL for the material being
1986
+ referenced, if one exists. This should always be used for web references,
1987
+ and may optionally be used for book and other publication
1988
+ references.</xs:documentation>
1989
+ </xs:annotation>
1990
+ </xs:element>
1991
+ </xs:sequence>
1992
+ <xs:attribute name="Reference_ID" type="xs:string">
1993
+ <xs:annotation>
1994
+ <xs:documentation>The Reference_ID is an optional value for the related Reference
1995
+ entry identifier as a string. Only one Reference_ID element can exist for each
1996
+ Reference element (ex: REF-1). However, References across CAPEC with the same ID
1997
+ should only vary in small details. Text citing this reference should use the
1998
+ local reference ID, as this ID is only for reference library related consistency
1999
+ checking and maintenance.</xs:documentation>
2000
+ </xs:annotation>
2001
+ </xs:attribute>
2002
+ <xs:attribute name="Local_Reference_ID" type="xs:string">
2003
+ <xs:annotation>
2004
+ <xs:documentation>The Local_Reference_ID is an optional value for the related Local
2005
+ Reference entry identifier as a string. Only one Local_Reference_ID element can
2006
+ exist for each Reference element (ex: R.78.1). Text citing this reference should
2007
+ use the format [R.78.1].</xs:documentation>
2008
+ </xs:annotation>
2009
+ </xs:attribute>
2010
+ </xs:complexType>
2011
+ <xs:simpleType name="Language_Type">
2012
+ <xs:restriction base="xs:string">
2013
+ <xs:whiteSpace value="collapse"/>
2014
+ <xs:enumeration value="C"/>
2015
+ <xs:enumeration value="C++"/>
2016
+ <xs:enumeration value="C#"/>
2017
+ <xs:enumeration value="Java"/>
2018
+ <xs:enumeration value="JSP"/>
2019
+ <xs:enumeration value="Javascript"/>
2020
+ <xs:enumeration value="ASP.NET"/>
2021
+ <xs:enumeration value="SQL"/>
2022
+ <xs:enumeration value="Python"/>
2023
+ <xs:enumeration value="Perl"/>
2024
+ <xs:enumeration value="PHP"/>
2025
+ <xs:enumeration value="SOAP"/>
2026
+ <xs:enumeration value="Ruby"/>
2027
+ <xs:enumeration value="Shell"/>
2028
+ <xs:enumeration value="PseudoCode"/>
2029
+ <xs:enumeration value=".NET"/>
2030
+ <xs:enumeration value="Assembly"/>
2031
+ <xs:enumeration value="XML"/>
2032
+ <xs:enumeration value="HTML"/>
2033
+ </xs:restriction>
2034
+ </xs:simpleType>
2035
+ <xs:simpleType name="Frequency_Type">
2036
+ <xs:restriction base="xs:string">
2037
+ <xs:whiteSpace value="collapse"/>
2038
+ <xs:enumeration value="Often"/>
2039
+ <xs:enumeration value="Sometimes"/>
2040
+ <xs:enumeration value="Rarely"/>
2041
+ </xs:restriction>
2042
+ </xs:simpleType>
2043
+ <xs:simpleType name="Status_Type">
2044
+ <xs:restriction base="xs:string">
2045
+ <xs:whiteSpace value="collapse"/>
2046
+ <xs:enumeration value="Deprecated"/>
2047
+ <xs:enumeration value="Incomplete"/>
2048
+ <xs:enumeration value="Draft"/>
2049
+ <xs:enumeration value="Usable"/>
2050
+ <xs:enumeration value="Stable"/>
2051
+ </xs:restriction>
2052
+ </xs:simpleType>
2053
+ <xs:complexType name="Custom_Attack_StepType">
2054
+ <xs:sequence>
2055
+ <xs:element name="Attack_Step_Title" type="xs:string" minOccurs="0">
2056
+ <xs:annotation>
2057
+ <xs:documentation>This field contains a short descriptive title for the attack
2058
+ step. It should be kept as short as possible but also clearly convey the
2059
+ nature of the attack step being described.</xs:documentation>
2060
+ </xs:annotation>
2061
+ </xs:element>
2062
+ <xs:element name="Attack_Step_Description" type="capec:Structured_Text_Type">
2063
+ <xs:annotation>
2064
+ <xs:documentation>This field contains a brief description of the attack
2065
+ step.</xs:documentation>
2066
+ </xs:annotation>
2067
+ </xs:element>
2068
+ <xs:element name="Attack_Step_Techniques" minOccurs="0">
2069
+ <xs:complexType>
2070
+ <xs:sequence>
2071
+ <xs:element ref="capec:Attack_Step_Technique" maxOccurs="unbounded">
2072
+ <xs:annotation>
2073
+ <xs:documentation>This field captures various techniques that the
2074
+ attacker can use to achieve the attack step’s goal. For example,
2075
+ an attacker may use tools such as WebScarab and Tamper Data in
2076
+ the experimentation phase of a SQL Injection attack pattern. The
2077
+ techniques include references to environments, because not all
2078
+ techniques work in all environments</xs:documentation>
2079
+ </xs:annotation>
2080
+ </xs:element>
2081
+ </xs:sequence>
2082
+ </xs:complexType>
2083
+ </xs:element>
2084
+ <xs:element name="Indicators" minOccurs="0">
2085
+ <xs:complexType>
2086
+ <xs:sequence>
2087
+ <xs:element name="Indicator" maxOccurs="unbounded">
2088
+ <xs:annotation>
2089
+ <xs:documentation>These are indicators that the application may or
2090
+ may not be susceptible to the given attack step (not necessarily
2091
+ the pattern as a whole).</xs:documentation>
2092
+ </xs:annotation>
2093
+ <xs:complexType>
2094
+ <xs:all>
2095
+ <xs:element name="Indicator_Description"
2096
+ type="capec:Structured_Text_Type">
2097
+ <xs:annotation>
2098
+ <xs:documentation>This field contains a brief
2099
+ description of the indicator.</xs:documentation>
2100
+ </xs:annotation>
2101
+ </xs:element>
2102
+ <xs:element name="Relevant_Attack_Surface_Elements"
2103
+ type="capec:Relevant_Attack_Surface_ElementsType"
2104
+ minOccurs="0"/>
2105
+ <xs:element name="Environments" type="xs:IDREFS">
2106
+ <xs:annotation>
2107
+ <xs:documentation>References the defined environments
2108
+ where this indicator of susceptibility is
2109
+ applicable.</xs:documentation>
2110
+ </xs:annotation>
2111
+ </xs:element>
2112
+ <xs:element name="Observables" type="cybox:ObservablesType"
2113
+ minOccurs="0"/>
2114
+ </xs:all>
2115
+ <xs:attribute name="ID" type="xs:integer" use="required">
2116
+ <xs:annotation>
2117
+ <xs:documentation>This field contains a unique integer
2118
+ identifier for the indicator.</xs:documentation>
2119
+ </xs:annotation>
2120
+ </xs:attribute>
2121
+ <xs:attribute name="type" use="required">
2122
+ <xs:annotation>
2123
+ <xs:documentation>Each indicator has a mandatory type
2124
+ attribute that can be one of the values “Positive,”
2125
+ “Negative,” or “Inconclusive.” For example, a positive
2126
+ indicator of susceptibility to parameter tampering is
2127
+ the existence of parameters in the URL. Although it does
2128
+ not guarantee susceptibility, it indicates a cause for
2129
+ further examination. A negative indicator for the
2130
+ technique of privilege escalation is a lack of
2131
+ credentials and user identifiers in an application.
2132
+ Again, this is not a conclusive measure of resistance to
2133
+ attack, but an indicator that the attack step technique
2134
+ is unlikely to bear significant fruit. An inconclusive
2135
+ indicator of susceptibility to dynamic code injection is
2136
+ a page whose URL ends in .jsp, .asp, or .do but which
2137
+ has no visible explicit parameters. Such URLs typically
2138
+ indicate dynamic processing, but since no visible
2139
+ parameters are passed, it is inconclusive whether
2140
+ dynamic code could be injected into the
2141
+ application.</xs:documentation>
2142
+ </xs:annotation>
2143
+ <xs:simpleType>
2144
+ <xs:restriction base="xs:token">
2145
+ <xs:whiteSpace value="collapse"/>
2146
+ <xs:enumeration value="Positive"/>
2147
+ <xs:enumeration value="Negative"/>
2148
+ <xs:enumeration value="Inconclusive"/>
2149
+ </xs:restriction>
2150
+ </xs:simpleType>
2151
+ </xs:attribute>
2152
+ </xs:complexType>
2153
+ </xs:element>
2154
+ </xs:sequence>
2155
+ </xs:complexType>
2156
+ </xs:element>
2157
+ <xs:element name="Outcomes" minOccurs="0">
2158
+ <xs:complexType>
2159
+ <xs:sequence>
2160
+ <xs:element name="Outcome" maxOccurs="unbounded">
2161
+ <xs:annotation>
2162
+ <xs:documentation>This field captures possible outcomes for this
2163
+ attack step.</xs:documentation>
2164
+ </xs:annotation>
2165
+ <xs:complexType>
2166
+ <xs:sequence>
2167
+ <xs:element name="Outcome_Description" type="xs:string"/>
2168
+ <xs:element name="Relevant_Attack_Surface_Elements"
2169
+ type="capec:Relevant_Attack_Surface_ElementsType"
2170
+ minOccurs="0"/>
2171
+ <xs:element name="Observables" type="cybox:ObservablesType"
2172
+ minOccurs="0"/>
2173
+ </xs:sequence>
2174
+ <xs:attribute name="ID" type="xs:integer" use="required">
2175
+ <xs:annotation>
2176
+ <xs:documentation>This field contains a unique integer
2177
+ identifier for the outcome.</xs:documentation>
2178
+ </xs:annotation>
2179
+ </xs:attribute>
2180
+ <xs:attribute name="type" use="required">
2181
+ <xs:annotation>
2182
+ <xs:documentation>An outcome has a mandatory type attribute
2183
+ that can be one of the values “success,” “failure,” or
2184
+ “inconclusive.” It indicates what results of executing
2185
+ the attack step techniques should be considered
2186
+ successes, which should be considered failures, and
2187
+ which ones are inconclusive. Outcomes’ successes are
2188
+ determined relative to the attacker’s point of view. It
2189
+ is a success if the attack step got the attacker closer
2190
+ to his goal of attacking the application. It is a
2191
+ failure if the attacker got no closer to his
2192
+ goal.</xs:documentation>
2193
+ </xs:annotation>
2194
+ <xs:simpleType>
2195
+ <xs:restriction base="xs:token">
2196
+ <xs:whiteSpace value="collapse"/>
2197
+ <xs:enumeration value="Success"/>
2198
+ <xs:enumeration value="Failure"/>
2199
+ <xs:enumeration value="Inconclusive"/>
2200
+ </xs:restriction>
2201
+ </xs:simpleType>
2202
+ </xs:attribute>
2203
+ </xs:complexType>
2204
+ </xs:element>
2205
+ </xs:sequence>
2206
+ </xs:complexType>
2207
+ </xs:element>
2208
+ <xs:element name="Security_Controls" minOccurs="0">
2209
+ <xs:complexType>
2210
+ <xs:sequence>
2211
+ <xs:element name="Security_Control" maxOccurs="unbounded">
2212
+ <xs:annotation>
2213
+ <xs:documentation>This field captures security controls for this
2214
+ attack step that describe ways in which the attack step can be
2215
+ detected, corrected, or prevented. These are presented from a
2216
+ defender’s point of view, where the defender may be a developer,
2217
+ tester, operations administrator, or other resource resisting
2218
+ the attacker.</xs:documentation>
2219
+ </xs:annotation>
2220
+ <xs:complexType>
2221
+ <xs:sequence>
2222
+ <xs:element name="Security_Control_Description" type="xs:string"/>
2223
+ <xs:element name="Relevant_Attack_Surface_Elements"
2224
+ type="capec:Relevant_Attack_Surface_ElementsType"
2225
+ minOccurs="0"/>
2226
+ <xs:element name="Observable_Evidence" minOccurs="0">
2227
+ <xs:complexType>
2228
+ <xs:choice>
2229
+ <xs:element name="IfPresent_Observables"
2230
+ type="cybox:ObservablesType"/>
2231
+ <xs:element name="IfNotPresent_Observables"
2232
+ type="cybox:ObservablesType"/>
2233
+ </xs:choice>
2234
+ </xs:complexType>
2235
+ </xs:element>
2236
+ </xs:sequence>
2237
+ <xs:attribute name="ID" type="xs:integer" use="required">
2238
+ <xs:annotation>
2239
+ <xs:documentation>This field contains a unique integer
2240
+ identifier for the security control.</xs:documentation>
2241
+ </xs:annotation>
2242
+ </xs:attribute>
2243
+ <xs:attribute name="type" use="required">
2244
+ <xs:annotation>
2245
+ <xs:documentation>Each security control has a mandatory type
2246
+ attribute that can be one of the values “Detective,”
2247
+ “Corrective,” or “Preventative.” Detective controls
2248
+ detect an attacker’s activities in the attack step,
2249
+ whether the activities are successful or not. Corrective
2250
+ controls attempt to mitigate an attacker’s success by
2251
+ responding to a successful outcome. They are not related
2252
+ to or normalized against outcomes. Preventative controls
2253
+ are those that make the attack step unlikely or
2254
+ impossible to succeed.</xs:documentation>
2255
+ </xs:annotation>
2256
+ <xs:simpleType>
2257
+ <xs:restriction base="xs:token">
2258
+ <xs:whiteSpace value="collapse"/>
2259
+ <xs:enumeration value="Detective"/>
2260
+ <xs:enumeration value="Corrective"/>
2261
+ <xs:enumeration value="Preventative"/>
2262
+ </xs:restriction>
2263
+ </xs:simpleType>
2264
+ </xs:attribute>
2265
+ </xs:complexType>
2266
+ </xs:element>
2267
+ </xs:sequence>
2268
+ </xs:complexType>
2269
+ </xs:element>
2270
+ <xs:element name="Observables" type="cybox:ObservablesType" minOccurs="0"/>
2271
+ </xs:sequence>
2272
+ </xs:complexType>
2273
+ <xs:complexType name="Target_Attack_SurfaceType">
2274
+ <xs:choice>
2275
+ <xs:element name="Common_Attack_Surface_Description">
2276
+ <xs:complexType>
2277
+ <xs:sequence>
2278
+ <xs:element name="Relevant_Attack_Surface_Elements"
2279
+ type="capec:Relevant_Attack_Surface_ElementsType"/>
2280
+ <xs:element name="Pattern_Specific_Overrides"
2281
+ type="capec:Target_Attack_Surface_DescriptionType" minOccurs="0"/>
2282
+ </xs:sequence>
2283
+ <xs:attribute name="Common_Attack_Surface_ID"/>
2284
+ </xs:complexType>
2285
+ </xs:element>
2286
+ <xs:element name="Target_Attack_Surface_Description"
2287
+ type="capec:Target_Attack_Surface_DescriptionType"/>
2288
+ </xs:choice>
2289
+ </xs:complexType>
2290
+ <xs:complexType name="Target_Attack_Surface_DescriptionType">
2291
+ <xs:sequence>
2292
+ <xs:element name="Targeted_OSI_Layers">
2293
+ <xs:complexType>
2294
+ <xs:sequence>
2295
+ <xs:element name="Targeted_OSI_Layer" maxOccurs="unbounded">
2296
+ <xs:simpleType>
2297
+ <xs:restriction base="xs:string">
2298
+ <xs:whiteSpace value="collapse"/>
2299
+ <xs:enumeration value="Physical Layer"/>
2300
+ <xs:enumeration value="Data Link Layer"/>
2301
+ <xs:enumeration value="Network Layer"/>
2302
+ <xs:enumeration value="Transport Layer"/>
2303
+ <xs:enumeration value="Session Layer"/>
2304
+ <xs:enumeration value="Presentation Layer"/>
2305
+ <xs:enumeration value="Application Layer"/>
2306
+ </xs:restriction>
2307
+ </xs:simpleType>
2308
+ </xs:element>
2309
+ </xs:sequence>
2310
+ </xs:complexType>
2311
+ </xs:element>
2312
+ <xs:element name="Target_Attack_Surface_Localities">
2313
+ <xs:complexType>
2314
+ <xs:sequence>
2315
+ <xs:element name="Target_Attack_Surface_Locality" maxOccurs="unbounded">
2316
+ <xs:simpleType>
2317
+ <xs:restriction base="xs:string">
2318
+ <xs:whiteSpace value="collapse"/>
2319
+ <xs:enumeration value="Client-side"/>
2320
+ <xs:enumeration value="Server-side"/>
2321
+ </xs:restriction>
2322
+ </xs:simpleType>
2323
+ </xs:element>
2324
+ </xs:sequence>
2325
+ </xs:complexType>
2326
+ </xs:element>
2327
+ <xs:element name="Target_Attack_Surface_Types">
2328
+ <xs:complexType>
2329
+ <xs:sequence>
2330
+ <xs:element name="Target_Attack_Surface_Type" maxOccurs="unbounded">
2331
+ <xs:simpleType>
2332
+ <xs:restriction base="xs:string">
2333
+ <xs:whiteSpace value="collapse"/>
2334
+ <xs:enumeration value="Network"/>
2335
+ <xs:enumeration value="Host"/>
2336
+ <xs:enumeration value="Service"/>
2337
+ <xs:enumeration value="Non-Web Application"/>
2338
+ <xs:enumeration value="Web Application"/>
2339
+ <xs:enumeration value="Firewall"/>
2340
+ </xs:restriction>
2341
+ </xs:simpleType>
2342
+ </xs:element>
2343
+ </xs:sequence>
2344
+ </xs:complexType>
2345
+ </xs:element>
2346
+ <xs:element name="Target_Functional_Services" minOccurs="0">
2347
+ <xs:complexType>
2348
+ <xs:sequence>
2349
+ <xs:element name="Target_Functional_Service" maxOccurs="unbounded">
2350
+ <xs:complexType>
2351
+ <xs:sequence>
2352
+ <xs:element name="Protocol" minOccurs="0" maxOccurs="unbounded">
2353
+ <xs:complexType>
2354
+ <xs:sequence>
2355
+ <xs:element name="Protocol_Structure" minOccurs="0">
2356
+ <xs:complexType>
2357
+ <xs:sequence>
2358
+ <xs:element name="Protocol_Header"
2359
+ maxOccurs="unbounded">
2360
+ <xs:complexType>
2361
+ <xs:sequence>
2362
+ <xs:element name="Protocol_RFC" type="xs:string"
2363
+ minOccurs="0" maxOccurs="unbounded"/>
2364
+ <xs:element name="Protocol_Field_Name"
2365
+ type="xs:string" minOccurs="0"
2366
+ maxOccurs="unbounded"/>
2367
+ <xs:element name="Protocol_Field_Description"
2368
+ type="xs:string" minOccurs="0"
2369
+ maxOccurs="unbounded"/>
2370
+ <xs:element name="Protocol_Flag_Description"
2371
+ type="xs:string" minOccurs="0"
2372
+ maxOccurs="unbounded"/>
2373
+ <xs:element name="Protocol_Flag_Value"
2374
+ type="xs:string" minOccurs="0"
2375
+ maxOccurs="unbounded"/>
2376
+ <xs:element name="Protocol_Operation_Code"
2377
+ type="xs:string" minOccurs="0"
2378
+ maxOccurs="unbounded"/>
2379
+ <xs:element name="Protocol_Data" type="xs:string"
2380
+ minOccurs="0" maxOccurs="unbounded"/>
2381
+ </xs:sequence>
2382
+ <xs:attribute name="ID" type="xs:integer"
2383
+ use="required"/>
2384
+ <xs:attribute name="Name" type="xs:string"/>
2385
+ </xs:complexType>
2386
+ </xs:element>
2387
+ </xs:sequence>
2388
+ </xs:complexType>
2389
+ </xs:element>
2390
+ <xs:element name="Command_Structures" minOccurs="0">
2391
+ <xs:complexType>
2392
+ <xs:sequence>
2393
+ <xs:element name="Command_Structure"
2394
+ maxOccurs="unbounded">
2395
+ <xs:complexType>
2396
+ <xs:sequence>
2397
+ <xs:element name="Command_Description"
2398
+ type="xs:string" minOccurs="0"/>
2399
+ <xs:element name="Command_Type" type="xs:string"
2400
+ minOccurs="0"/>
2401
+ <xs:element name="Command_Group_Label"
2402
+ type="xs:string" minOccurs="0"/>
2403
+ </xs:sequence>
2404
+ <xs:attribute name="ID" type="xs:integer"
2405
+ use="required"/>
2406
+ <xs:attribute name="Name" type="xs:string"
2407
+ use="required"/>
2408
+ </xs:complexType>
2409
+ </xs:element>
2410
+ </xs:sequence>
2411
+ </xs:complexType>
2412
+ </xs:element>
2413
+ <xs:element name="Related_Protocols" minOccurs="0">
2414
+ <xs:complexType>
2415
+ <xs:sequence>
2416
+ <xs:element name="Related_Protocol"
2417
+ maxOccurs="unbounded">
2418
+ <xs:complexType>
2419
+ <xs:sequence>
2420
+ <xs:element name="Relationship_Type"
2421
+ maxOccurs="unbounded">
2422
+ <xs:simpleType>
2423
+ <xs:restriction base="xs:string">
2424
+ <xs:whiteSpace value="collapse"/>
2425
+ <xs:enumeration value="Is an abstraction of"/>
2426
+ <xs:enumeration value="Is a refinement of"/>
2427
+ <xs:enumeration value="Is an alternative to"/>
2428
+ <xs:enumeration value="Uses Protocol"/>
2429
+ <xs:enumeration value="Is a service of"/>
2430
+ <xs:enumeration value="Is a command of"/>
2431
+ </xs:restriction>
2432
+ </xs:simpleType>
2433
+ </xs:element>
2434
+ </xs:sequence>
2435
+ <xs:attribute name="Name"/>
2436
+ <xs:attribute name="RFC"/>
2437
+ </xs:complexType>
2438
+ </xs:element>
2439
+ </xs:sequence>
2440
+ </xs:complexType>
2441
+ </xs:element>
2442
+ </xs:sequence>
2443
+ <xs:attribute name="ID" type="xs:integer" use="required"/>
2444
+ <xs:attribute name="Name" type="xs:string"
2445
+ use="required"/>
2446
+ <xs:attribute name="RFC" type="xs:string"/>
2447
+ <xs:attribute name="Encryption" type="xs:boolean"/>
2448
+ <xs:attribute name="Encryption_Type" type="xs:string"/>
2449
+ </xs:complexType>
2450
+ </xs:element>
2451
+ </xs:sequence>
2452
+ <xs:attribute name="ID" type="xs:integer" use="required"/>
2453
+ <xs:attribute name="Name" type="xs:string" use="required"/>
2454
+ </xs:complexType>
2455
+ </xs:element>
2456
+ </xs:sequence>
2457
+ </xs:complexType>
2458
+ </xs:element>
2459
+ </xs:sequence>
2460
+ </xs:complexType>
2461
+ <xs:complexType name="Relevant_Attack_Surface_ElementsType">
2462
+ <xs:sequence>
2463
+ <xs:element name="Relevant_Functional_Services" minOccurs="0">
2464
+ <xs:complexType>
2465
+ <xs:sequence>
2466
+ <xs:element name="Relevant_Functional_Service_ID" maxOccurs="unbounded"/>
2467
+ </xs:sequence>
2468
+ </xs:complexType>
2469
+ </xs:element>
2470
+ <xs:element name="Relevant_Protocols" minOccurs="0">
2471
+ <xs:complexType>
2472
+ <xs:sequence>
2473
+ <xs:element name="Relevant_Protocol_ID" maxOccurs="unbounded"/>
2474
+ </xs:sequence>
2475
+ </xs:complexType>
2476
+ </xs:element>
2477
+ <xs:element name="Relevant_Protocol_Headers" minOccurs="0">
2478
+ <xs:complexType>
2479
+ <xs:sequence>
2480
+ <xs:element name="Relevant_Protocol_Header_ID" maxOccurs="unbounded"/>
2481
+ </xs:sequence>
2482
+ </xs:complexType>
2483
+ </xs:element>
2484
+ <xs:element name="Relevant_Command_Structures" minOccurs="0">
2485
+ <xs:complexType>
2486
+ <xs:sequence>
2487
+ <xs:element name="Relevant_Command_Structure_ID" maxOccurs="unbounded"/>
2488
+ </xs:sequence>
2489
+ </xs:complexType>
2490
+ </xs:element>
2491
+ </xs:sequence>
2492
+ </xs:complexType>
2493
+ <xs:complexType name="Common_ConsequenceType">
2494
+ <xs:sequence>
2495
+ <xs:element name="Consequence_Scope" minOccurs="0" maxOccurs="unbounded">
2496
+ <xs:annotation>
2497
+ <xs:documentation>This subelement identifies an individual consequence that may
2498
+ result from this attack pattern.</xs:documentation>
2499
+ </xs:annotation>
2500
+ <xs:simpleType>
2501
+ <xs:restriction base="xs:string">
2502
+ <xs:whiteSpace value="collapse"/>
2503
+ <xs:enumeration value="Confidentiality"/>
2504
+ <xs:enumeration value="Integrity"/>
2505
+ <xs:enumeration value="Availability"/>
2506
+ <xs:enumeration value="Access_Control"/>
2507
+ <xs:enumeration value="Non-Repudiation"/>
2508
+ <xs:enumeration value="Accountability"/>
2509
+ <xs:enumeration value="Authentication"/>
2510
+ <xs:enumeration value="Authorization"/>
2511
+ <xs:enumeration value="Other"/>
2512
+ </xs:restriction>
2513
+ </xs:simpleType>
2514
+ </xs:element>
2515
+ <xs:element name="Consequence_Technical_Impact" minOccurs="0" maxOccurs="unbounded">
2516
+ <xs:annotation>
2517
+ <xs:documentation>This subelement describes the technical impacts that can
2518
+ result from successful execution of this attack pattern.</xs:documentation>
2519
+ </xs:annotation>
2520
+ <xs:simpleType>
2521
+ <xs:restriction base="xs:string">
2522
+ <xs:whiteSpace value="collapse"/>
2523
+ <xs:enumeration value="Modify memory"/>
2524
+ <xs:enumeration value="Read memory"/>
2525
+ <xs:enumeration value="Modify files or directories"/>
2526
+ <xs:enumeration value="Read files or directories"/>
2527
+ <xs:enumeration value="Modify application data"/>
2528
+ <xs:enumeration value="Read application data"/>
2529
+ <xs:enumeration value="DoS: crash / exit / restart"/>
2530
+ <xs:enumeration value="DoS: amplification"/>
2531
+ <xs:enumeration value="DoS: instability"/>
2532
+ <xs:enumeration value="DoS: resource consumption (CPU)"/>
2533
+ <xs:enumeration value="DoS: resource consumption (memory)"/>
2534
+ <xs:enumeration value="DoS: resource consumption (other)"/>
2535
+ <xs:enumeration value="Execute unauthorized code or commands"/>
2536
+ <xs:enumeration value="Gain privileges / assume identity"/>
2537
+ <xs:enumeration value="Bypass protection mechanism"/>
2538
+ <xs:enumeration value="Hide activities"/>
2539
+ <xs:enumeration value="Alter execution logic"/>
2540
+ <xs:enumeration value="Other"/>
2541
+ <xs:enumeration value="&quot;Varies by context&quot;"/>
2542
+ <xs:enumeration value="Quality degradation"/>
2543
+ <xs:enumeration value="Unexpected State"/>
2544
+ </xs:restriction>
2545
+ </xs:simpleType>
2546
+ </xs:element>
2547
+ <xs:element name="Consequence_Note" type="capec:Structured_Text_Type" minOccurs="0">
2548
+ <xs:annotation>
2549
+ <xs:documentation>This subelement provides additional commentary about this
2550
+ consequence.</xs:documentation>
2551
+ </xs:annotation>
2552
+ </xs:element>
2553
+ </xs:sequence>
2554
+ <xs:attribute name="Common_Consequence_ID" type="xs:string">
2555
+ <xs:annotation>
2556
+ <xs:documentation>The Common_Consequence_ID stores the value for the related
2557
+ Common_Consequence entry identifier as a string. Only one Common_Consequence_ID
2558
+ element can exist for each Common_Consequence element (ex: CC-1). However,
2559
+ Common_Consequences across CAPEC with the same ID should only vary in small
2560
+ details.</xs:documentation>
2561
+ </xs:annotation>
2562
+ </xs:attribute>
2563
+ </xs:complexType>
2564
+ <xs:complexType name="Attack_PatternType">
2565
+ <xs:sequence>
2566
+ <xs:element name="Description" minOccurs="0">
2567
+ <xs:annotation>
2568
+ <xs:documentation>This element represents a detailed description of an attack
2569
+ pattern. Content may include a summary and a list of steps taken by the
2570
+ attacker. USAGE: This element can be used to capture a range of descriptive
2571
+ information. Comprehensive descriptions might include attack trees, exploit
2572
+ graphs, etc., to more clearly elaborate this type of attack.
2573
+ </xs:documentation>
2574
+ </xs:annotation>
2575
+ <xs:complexType>
2576
+ <xs:sequence>
2577
+ <xs:element name="Summary" type="capec:Structured_Text_Type">
2578
+ <xs:annotation>
2579
+ <xs:documentation>This element provides a summary description of the
2580
+ attack that includes the attack target and sequence of steps.
2581
+ </xs:documentation>
2582
+ </xs:annotation>
2583
+ </xs:element>
2584
+ <xs:element ref="capec:Attack_Execution_Flow" minOccurs="0">
2585
+ <xs:annotation>
2586
+ <xs:documentation>This element lists the steps typically performed
2587
+ by an attacker when executing the attack.</xs:documentation>
2588
+ </xs:annotation>
2589
+ </xs:element>
2590
+ </xs:sequence>
2591
+ </xs:complexType>
2592
+ </xs:element>
2593
+ <xs:element ref="capec:Alternate_Terms" minOccurs="0">
2594
+ <xs:annotation>
2595
+ <xs:documentation>This element contains one or more alternative terms used to
2596
+ identify the attack pattern.</xs:documentation>
2597
+ </xs:annotation>
2598
+ </xs:element>
2599
+ <xs:element name="Target_Attack_Surface" type="capec:Target_Attack_SurfaceType"
2600
+ minOccurs="0">
2601
+ <xs:annotation>
2602
+ <xs:documentation>This element characterizes the locations where an attacker
2603
+ interacts with the target system.</xs:documentation>
2604
+ </xs:annotation>
2605
+ </xs:element>
2606
+ <xs:element name="Attack_Prerequisites" minOccurs="0">
2607
+ <xs:annotation>
2608
+ <xs:documentation>An attack prerequisite is a condition that must exist in order
2609
+ for an attack of this type to succeed.</xs:documentation>
2610
+ </xs:annotation>
2611
+ <xs:complexType>
2612
+ <xs:sequence>
2613
+ <xs:element name="Attack_Prerequisite" type="capec:Structured_Text_Type"
2614
+ maxOccurs="unbounded">
2615
+ <xs:annotation>
2616
+ <xs:documentation>This field describes an individual attack
2617
+ prerequisite.</xs:documentation>
2618
+ </xs:annotation>
2619
+ </xs:element>
2620
+ </xs:sequence>
2621
+ </xs:complexType>
2622
+ </xs:element>
2623
+ <xs:element name="Typical_Severity" minOccurs="0">
2624
+ <xs:annotation>
2625
+ <xs:documentation>This element reflect the typical severity of an attack on a
2626
+ scale of {Very Low, Low, Medium, High, Very High}. USAGE: This element is
2627
+ used to capture an overall typical average value for this type of attack
2628
+ with the understanding that it will not be completely accurate for all
2629
+ attacks.</xs:documentation>
2630
+ </xs:annotation>
2631
+ <xs:simpleType>
2632
+ <xs:restriction base="xs:string">
2633
+ <xs:whiteSpace value="collapse"/>
2634
+ <xs:enumeration value="Very High"/>
2635
+ <xs:enumeration value="High"/>
2636
+ <xs:enumeration value="Medium"/>
2637
+ <xs:enumeration value="Low"/>
2638
+ <xs:enumeration value="Very Low"/>
2639
+ </xs:restriction>
2640
+ </xs:simpleType>
2641
+ </xs:element>
2642
+ <xs:element name="Typical_Likelihood_of_Exploit" minOccurs="0">
2643
+ <xs:annotation>
2644
+ <xs:documentation>This element represents the typical likelihood that the attack
2645
+ will succeed, and provides a likelihood estimate and an explanation that
2646
+ qualifies the estimate. USAGE: This element is used to capture an overall
2647
+ typical average value for this type of attack with the understanding that it
2648
+ will not be completely accurate for all attacks.</xs:documentation>
2649
+ </xs:annotation>
2650
+ <xs:complexType>
2651
+ <xs:sequence>
2652
+ <xs:element name="Likelihood" type="xs:string" minOccurs="0">
2653
+ <xs:annotation>
2654
+ <xs:documentation>This element reflect the likelihood of attack
2655
+ success on a scale of {Very Low, Low, Medium, High, Very High},
2656
+ in consideration of the attack prerequisites, targeted weakness,
2657
+ attack surface, skills and resources required, as well as
2658
+ effectiveness of likely implemented blocking solutions.
2659
+ </xs:documentation>
2660
+ </xs:annotation>
2661
+ </xs:element>
2662
+ <xs:element name="Explanation" type="capec:Structured_Text_Type"
2663
+ minOccurs="0">
2664
+ <xs:annotation>
2665
+ <xs:documentation>This element provides qualifications or
2666
+ assumptions regarding the estimated likelihood.
2667
+ </xs:documentation>
2668
+ </xs:annotation>
2669
+ </xs:element>
2670
+ </xs:sequence>
2671
+ </xs:complexType>
2672
+ </xs:element>
2673
+ <xs:element name="Methods_of_Attack" minOccurs="0">
2674
+ <xs:annotation>
2675
+ <xs:documentation>This element represents a container of one or more methods of
2676
+ attack. Method of attack is enumerated list of defined vectors that identify
2677
+ the underlying mechanism(s) used in the attack.</xs:documentation>
2678
+ </xs:annotation>
2679
+ <xs:complexType>
2680
+ <xs:sequence>
2681
+ <xs:element name="Method_of_Attack" minOccurs="0" maxOccurs="unbounded">
2682
+ <xs:annotation>
2683
+ <xs:documentation>Method of attack is enumerated list of defined
2684
+ vectors that identify the underlying mechanism(s) used in the
2685
+ attack. USAGE: This element is represented as an enumerated list
2686
+ to facilitate normalization and classification of attack
2687
+ patterns, and to help define the applicable attack surface
2688
+ required for this attack.</xs:documentation>
2689
+ </xs:annotation>
2690
+ <xs:simpleType>
2691
+ <xs:restriction base="xs:string">
2692
+ <xs:whiteSpace value="collapse"/>
2693
+ <xs:enumeration value="Injection"/>
2694
+ <xs:enumeration value="Modification of Resources"/>
2695
+ <xs:enumeration value="Protocol Manipulation"/>
2696
+ <xs:enumeration value="Analysis"/>
2697
+ <xs:enumeration value="API Abuse"/>
2698
+ <xs:enumeration value="Brute Force"/>
2699
+ <xs:enumeration value="Flooding"/>
2700
+ <xs:enumeration value="Time and State"/>
2701
+ <xs:enumeration value="Spoofing"/>
2702
+ <xs:enumeration value="Social Engineering"/>
2703
+ </xs:restriction>
2704
+ </xs:simpleType>
2705
+ </xs:element>
2706
+ </xs:sequence>
2707
+ </xs:complexType>
2708
+ </xs:element>
2709
+ <xs:element name="Examples-Instances" minOccurs="0">
2710
+ <xs:annotation>
2711
+ <xs:documentation>This element represents a container of one or more example
2712
+ instances. An example instance details an explanatory example or
2713
+ demonstrative exploit instance of this attack, USAGE: This element is used
2714
+ to to help the reader understand the nature, context and variability of the
2715
+ attack in more practical and concrete terms.</xs:documentation>
2716
+ </xs:annotation>
2717
+ <xs:complexType>
2718
+ <xs:sequence>
2719
+ <xs:element name="Example-Instance" maxOccurs="unbounded">
2720
+ <xs:annotation>
2721
+ <xs:documentation>This element represents an exploit description and
2722
+ may also provide an external reference and/or a range of related
2723
+ vulnerabilities.</xs:documentation>
2724
+ </xs:annotation>
2725
+ <xs:complexType>
2726
+ <xs:sequence>
2727
+ <xs:element name="Example-Instance_Description"
2728
+ type="capec:Structured_Text_Type">
2729
+ <xs:annotation>
2730
+ <xs:documentation>This element describes in detail a
2731
+ specific example or exploit instance of this attack
2732
+ pattern. USAGE: This element is used to define the
2733
+ context of an attack, targeted weaknesses or
2734
+ vulnerabilities, the sequence of attack steps, and
2735
+ the resulting impact of attack success or failure.
2736
+ </xs:documentation>
2737
+ </xs:annotation>
2738
+ </xs:element>
2739
+ <xs:element name="Example-Instance_Related_Vulnerabilities"
2740
+ minOccurs="0">
2741
+ <xs:annotation>
2742
+ <xs:documentation>This element represents a container of
2743
+ one or more instance related vulnerabilities. An
2744
+ instance related vulnerability identifies
2745
+ vulnerabilities targeted by this exploit instance of
2746
+ the attack.</xs:documentation>
2747
+ </xs:annotation>
2748
+ <xs:complexType>
2749
+ <xs:sequence>
2750
+ <xs:element
2751
+ name="Example-Instance_Related_Vulnerability"
2752
+ type="capec:Structured_Text_Type"
2753
+ maxOccurs="unbounded">
2754
+ <xs:annotation>
2755
+ <xs:documentation>This element identifies specific
2756
+ vulnerabilities targeted by this exploit instance
2757
+ of the attack. USAGE: This element is used to
2758
+ reference industry-standard identifiers such as
2759
+ Common Vulnerabilities and Exposures (CVE) numbers
2760
+ and/or US-CERT numbers.</xs:documentation>
2761
+ </xs:annotation>
2762
+ </xs:element>
2763
+ </xs:sequence>
2764
+ </xs:complexType>
2765
+ </xs:element>
2766
+ </xs:sequence>
2767
+ </xs:complexType>
2768
+ </xs:element>
2769
+ </xs:sequence>
2770
+ </xs:complexType>
2771
+ </xs:element>
2772
+ <xs:element name="Attacker_Skills_or_Knowledge_Required" minOccurs="0">
2773
+ <xs:annotation>
2774
+ <xs:documentation>This element represents a container of one or more attacker
2775
+ skill or knowledge required. Attacker skill or knowledge required describes
2776
+ the level of skills or specific knowledge needed by an attacker to execute
2777
+ this type of attack.</xs:documentation>
2778
+ </xs:annotation>
2779
+ <xs:complexType>
2780
+ <xs:sequence>
2781
+ <xs:element name="Attacker_Skill_or_Knowledge_Required"
2782
+ maxOccurs="unbounded">
2783
+ <xs:annotation>
2784
+ <xs:documentation>Attacker skill or knowledge required describes the
2785
+ level of skills or specific knowledge needed by an attacker to
2786
+ execute this type of attack.</xs:documentation>
2787
+ </xs:annotation>
2788
+ <xs:complexType>
2789
+ <xs:sequence>
2790
+ <xs:element name="Skill_or_Knowledge_Level" minOccurs="0"
2791
+ maxOccurs="unbounded">
2792
+ <xs:annotation>
2793
+ <xs:documentation>This element reflects the level of
2794
+ knowledge or skill required to execute this type of
2795
+ attack on a scale of { Low, Medium, High }. USAGE:
2796
+ This element is used to represent the level with
2797
+ respect to a specified type of skill or knowledge,
2798
+ e.g., low - basic SQL knowledge, high - expert
2799
+ knowledge of LINUX kernel, etc.</xs:documentation>
2800
+ </xs:annotation>
2801
+ <xs:simpleType>
2802
+ <xs:restriction base="xs:string">
2803
+ <xs:whiteSpace value="collapse"/>
2804
+ <xs:enumeration value="Low"/>
2805
+ <xs:enumeration value="Medium"/>
2806
+ <xs:enumeration value="High"/>
2807
+ </xs:restriction>
2808
+ </xs:simpleType>
2809
+ </xs:element>
2810
+ <xs:element name="Skill_or_Knowledge_Type"
2811
+ type="capec:Structured_Text_Type" minOccurs="0">
2812
+ <xs:annotation>
2813
+ <xs:documentation>This element details the skill or
2814
+ knowledge required.</xs:documentation>
2815
+ </xs:annotation>
2816
+ </xs:element>
2817
+ </xs:sequence>
2818
+ </xs:complexType>
2819
+ </xs:element>
2820
+ </xs:sequence>
2821
+ </xs:complexType>
2822
+ </xs:element>
2823
+ <xs:element name="Resources_Required" type="capec:Structured_Text_Type" minOccurs="0">
2824
+ <xs:annotation>
2825
+ <xs:documentation>This element describes the resources (CPU cycles, IP
2826
+ addresses, tools, etc.) required by an attacker to effectively execute this
2827
+ type of attack.</xs:documentation>
2828
+ </xs:annotation>
2829
+ </xs:element>
2830
+ <xs:element name="Probing_Techniques" minOccurs="0">
2831
+ <xs:annotation>
2832
+ <xs:documentation>This element represents a container of one or more probing
2833
+ techniques. A probing technique describes a method used to probe and
2834
+ reconnoiter a potential target to determine vulnerability and/or to prepare
2835
+ for this type of attack.</xs:documentation>
2836
+ </xs:annotation>
2837
+ <xs:complexType>
2838
+ <xs:sequence>
2839
+ <xs:element name="Probing_Technique" maxOccurs="unbounded">
2840
+ <xs:annotation>
2841
+ <xs:documentation>A probing technique describes a method used to
2842
+ probe and reconnoiter a potential target to determine
2843
+ vulnerability and/or to prepare for this type of attack.
2844
+ </xs:documentation>
2845
+ </xs:annotation>
2846
+ <xs:complexType>
2847
+ <xs:sequence>
2848
+ <xs:element name="Description" type="capec:Structured_Text_Type"
2849
+ minOccurs="0">
2850
+ <xs:annotation>
2851
+ <xs:documentation>This element provides an explanatory
2852
+ description of the probing technique.
2853
+ </xs:documentation>
2854
+ </xs:annotation>
2855
+ </xs:element>
2856
+ <xs:element name="Observables" type="cybox:ObservablesType"
2857
+ minOccurs="0">
2858
+ <xs:annotation>
2859
+ <xs:documentation>This element specifies detailed cyber
2860
+ observable patterns for potential detection of the
2861
+ probing technique activity.</xs:documentation>
2862
+ </xs:annotation>
2863
+ </xs:element>
2864
+ </xs:sequence>
2865
+ </xs:complexType>
2866
+ </xs:element>
2867
+ </xs:sequence>
2868
+ </xs:complexType>
2869
+ </xs:element>
2870
+ <xs:element name="Indicators-Warnings_of_Attack" minOccurs="0">
2871
+ <xs:annotation>
2872
+ <xs:documentation>This element represents a container of one or more indicator
2873
+ warning of attack. Indicator warning of attack describes activities, events,
2874
+ conditions or behaviors that may indicate that an attack of this type is
2875
+ imminent, in progress or has occurred.</xs:documentation>
2876
+ </xs:annotation>
2877
+ <xs:complexType>
2878
+ <xs:sequence>
2879
+ <xs:element name="Indicator-Warning_of_Attack" maxOccurs="unbounded">
2880
+ <xs:annotation>
2881
+ <xs:documentation>Indicator warning of attack describes activities,
2882
+ events, conditions or behaviors that may indicate that an attack
2883
+ of this type is imminent, in progress or has occurred.
2884
+ </xs:documentation>
2885
+ </xs:annotation>
2886
+ <xs:complexType>
2887
+ <xs:sequence>
2888
+ <xs:element name="Description" type="capec:Structured_Text_Type"
2889
+ minOccurs="0">
2890
+ <xs:annotation>
2891
+ <xs:documentation>This element provides an explanatory
2892
+ description of the indicator warning of attack.
2893
+ </xs:documentation>
2894
+ </xs:annotation>
2895
+ </xs:element>
2896
+ <xs:element name="Observables" type="cybox:ObservablesType"
2897
+ minOccurs="0">
2898
+ <xs:annotation>
2899
+ <xs:documentation>This element specifies detailed cyber
2900
+ observable patterns for potential detection of the
2901
+ indicator warning of attack.</xs:documentation>
2902
+ </xs:annotation>
2903
+ </xs:element>
2904
+ </xs:sequence>
2905
+ </xs:complexType>
2906
+ </xs:element>
2907
+ </xs:sequence>
2908
+ </xs:complexType>
2909
+ </xs:element>
2910
+ <xs:element name="Obfuscation_Techniques" minOccurs="0">
2911
+ <xs:annotation>
2912
+ <xs:documentation>This element represents a container of one or more obfuscation
2913
+ techniques. An obfuscation technique can be used to disguise the fact that
2914
+ an attack of this type is imminent, in progress or has occurred.
2915
+ </xs:documentation>
2916
+ </xs:annotation>
2917
+ <xs:complexType>
2918
+ <xs:sequence>
2919
+ <xs:element name="Obfuscation_Technique" maxOccurs="unbounded">
2920
+ <xs:annotation>
2921
+ <xs:documentation>An obfuscation technique can be used to disguise
2922
+ the fact that an attack of this type is imminent, in progress or
2923
+ has occurred.</xs:documentation>
2924
+ </xs:annotation>
2925
+ <xs:complexType>
2926
+ <xs:sequence>
2927
+ <xs:element name="Description" type="capec:Structured_Text_Type"
2928
+ minOccurs="0">
2929
+ <xs:annotation>
2930
+ <xs:documentation>This element provides an explanatory
2931
+ description of the obfuscation technique.
2932
+ </xs:documentation>
2933
+ </xs:annotation>
2934
+ </xs:element>
2935
+ <xs:element name="Observables" type="cybox:ObservablesType"
2936
+ minOccurs="0">
2937
+ <xs:annotation>
2938
+ <xs:documentation>This element specifies detailed cyber
2939
+ observable patterns for potential detection of the
2940
+ obfuscation technique.</xs:documentation>
2941
+ </xs:annotation>
2942
+ </xs:element>
2943
+ </xs:sequence>
2944
+ </xs:complexType>
2945
+ </xs:element>
2946
+ </xs:sequence>
2947
+ </xs:complexType>
2948
+ </xs:element>
2949
+ <xs:element name="Solutions_and_Mitigations" minOccurs="0">
2950
+ <xs:annotation>
2951
+ <xs:documentation>This element represents a container of one or more solutions
2952
+ or mitigations. A solution or mitigation describes actions or approaches to
2953
+ prevent or mitigate the risk of this attack by improving the resilience of
2954
+ the target system, reduce its attack surface or to reduce the impact of the
2955
+ attack if it is successful.</xs:documentation>
2956
+ </xs:annotation>
2957
+ <xs:complexType>
2958
+ <xs:sequence>
2959
+ <xs:element name="Solution_or_Mitigation" type="capec:Structured_Text_Type"
2960
+ maxOccurs="unbounded">
2961
+ <xs:annotation>
2962
+ <xs:documentation>A solution or mitigation describes actions or
2963
+ approaches to prevent or mitigate the risk of this attack by
2964
+ improving the resilience of the target system, reduce its attack
2965
+ surface or to reduce the impact of the attack if it is
2966
+ successful.</xs:documentation>
2967
+ </xs:annotation>
2968
+ </xs:element>
2969
+ </xs:sequence>
2970
+ </xs:complexType>
2971
+ </xs:element>
2972
+ <xs:element name="Attack_Motivation-Consequences" minOccurs="0">
2973
+ <xs:annotation>
2974
+ <xs:documentation>This element represents a container of one ore more attack
2975
+ motivation consequences. Attack motivation consequence represents the
2976
+ desired technical results that could be achieved/leveraged by this attack
2977
+ pattern, represented as an enumerated list of defined adversary
2978
+ motivations/consequences. USAGE: This element is used to identify specific
2979
+ technical results that could be leveraged to achieve the adversary's
2980
+ business or mission objective. This information is useful for aligning
2981
+ attack patterns to threat models and for determining which attack patterns
2982
+ are relevant for a given context.</xs:documentation>
2983
+ </xs:annotation>
2984
+ <xs:complexType>
2985
+ <xs:sequence>
2986
+ <xs:element name="Attack_Motivation-Consequence"
2987
+ type="capec:Common_ConsequenceType" maxOccurs="unbounded">
2988
+ <xs:annotation>
2989
+ <xs:documentation>Attack motivation consequence represents the
2990
+ desired technical results that could be achieved/leveraged by
2991
+ this attack pattern, represented as an enumerated list of
2992
+ defined adversary motivations/consequences.</xs:documentation>
2993
+ </xs:annotation>
2994
+ </xs:element>
2995
+ </xs:sequence>
2996
+ </xs:complexType>
2997
+ </xs:element>
2998
+ <xs:element name="Injection_Vector" type="capec:Structured_Text_Type" minOccurs="0">
2999
+ <xs:annotation>
3000
+ <xs:documentation>This element details the mechanism and format of an
3001
+ input-driven attack of this type. Injection vectors take into account the
3002
+ grammar of an attack, the syntax accepted by the system, the position of
3003
+ various fields, and the ranges of data that are acceptable.
3004
+ </xs:documentation>
3005
+ </xs:annotation>
3006
+ </xs:element>
3007
+ <xs:element name="Payload" type="capec:Structured_Text_Type" minOccurs="0">
3008
+ <xs:annotation>
3009
+ <xs:documentation>This element describes the code, configuration or other data
3010
+ to be executed or otherwise activated as part of an injection-based attack
3011
+ of this type.</xs:documentation>
3012
+ </xs:annotation>
3013
+ </xs:element>
3014
+ <xs:element name="Activation_Zone" type="capec:Structured_Text_Type" minOccurs="0">
3015
+ <xs:annotation>
3016
+ <xs:documentation>This element describes the area within the target software
3017
+ that is capable of executing or otherwise activating the payload of an
3018
+ injection-based attack of this type. The activation zone is where the intent
3019
+ of the attacker is put into action. The activation zone may be a command
3020
+ interpreter, some active machine code in a buffer, a client browser, a
3021
+ system API call, etc.</xs:documentation>
3022
+ </xs:annotation>
3023
+ </xs:element>
3024
+ <xs:element name="Payload_Activation_Impact" minOccurs="0">
3025
+ <xs:annotation>
3026
+ <xs:documentation>This element describes the impact that the activation of the
3027
+ attack payload for an injection-based attack of this type would typically
3028
+ have on the confidentiality, integrity or availability of the target
3029
+ software.</xs:documentation>
3030
+ </xs:annotation>
3031
+ <xs:complexType>
3032
+ <xs:sequence>
3033
+ <xs:element name="Description" type="capec:Structured_Text_Type"
3034
+ minOccurs="0">
3035
+ <xs:annotation>
3036
+ <xs:documentation>This element provides an explanatory description
3037
+ of the payload activation impact.</xs:documentation>
3038
+ </xs:annotation>
3039
+ </xs:element>
3040
+ <xs:element name="Observables" type="cybox:ObservablesType" minOccurs="0">
3041
+ <xs:annotation>
3042
+ <xs:documentation>This element specifies detailed cyber observable
3043
+ patterns for potential detection of the payload activation
3044
+ impact.</xs:documentation>
3045
+ </xs:annotation>
3046
+ </xs:element>
3047
+ </xs:sequence>
3048
+ </xs:complexType>
3049
+ </xs:element>
3050
+ <xs:element name="Related_Weaknesses" minOccurs="0">
3051
+ <xs:annotation>
3052
+ <xs:documentation>This element represents a container of one or more related
3053
+ weaknesses. Related weaknesses refer to software weaknesses potentially
3054
+ targeted for exploit by this attack pattern. USAGE: This element is used to
3055
+ reference industry standard Common Weakness Enumeration (CWE) data,
3056
+ including weaknesses that are exploited by the attack as well as weaknesses
3057
+ whose presence increases the likelihood or impact of the attack.
3058
+ </xs:documentation>
3059
+ </xs:annotation>
3060
+ <xs:complexType>
3061
+ <xs:sequence>
3062
+ <xs:element name="Related_Weakness" maxOccurs="unbounded">
3063
+ <xs:annotation>
3064
+ <xs:documentation>Related weaknesses refer to software weaknesses
3065
+ potentially targeted for exploit by this attack pattern.
3066
+ </xs:documentation>
3067
+ </xs:annotation>
3068
+ <xs:complexType>
3069
+ <xs:sequence>
3070
+ <xs:element name="CWE_ID" type="xs:integer">
3071
+ <xs:annotation>
3072
+ <xs:documentation>The element contains the Common
3073
+ Weakness Enumeration (CWE) ID of the exploited
3074
+ software weakness.</xs:documentation>
3075
+ </xs:annotation>
3076
+ </xs:element>
3077
+ <xs:element name="Weakness_Relationship_Type">
3078
+ <xs:annotation>
3079
+ <xs:documentation>This element describes the nature of
3080
+ the relationship between the attack pattern and the
3081
+ software weakness, represented as the enumerated
3082
+ list {Targeted, Secondary}. USAGE: This element is
3083
+ used to indicate whether the weakness is targeted or
3084
+ secondary. If the attack is designed to exploit the
3085
+ weakness, then that weakness is Targeted. A
3086
+ weaknesses whose presence may increase the
3087
+ likelihood of the attack succeeding or the impact of
3088
+ the attack if it does succeed is Secondary.
3089
+ </xs:documentation>
3090
+ </xs:annotation>
3091
+ <xs:simpleType>
3092
+ <xs:restriction base="xs:string">
3093
+ <xs:whiteSpace value="collapse"/>
3094
+ <xs:enumeration value="Targeted"/>
3095
+ <xs:enumeration value="Secondary"/>
3096
+ </xs:restriction>
3097
+ </xs:simpleType>
3098
+ </xs:element>
3099
+ </xs:sequence>
3100
+ </xs:complexType>
3101
+ </xs:element>
3102
+ </xs:sequence>
3103
+ </xs:complexType>
3104
+ </xs:element>
3105
+ <xs:element name="Related_Vulnerabilities" minOccurs="0">
3106
+ <xs:annotation>
3107
+ <xs:documentation>This element represents a container of one or more related
3108
+ vulnerabilities. A related vulnerability refers to a specific instance
3109
+ vulnerability targeted for exploit by this attack pattern. USAGE: This
3110
+ element is used to identify specific vulnerabilities by their
3111
+ industry-standard Common Vulnerabilities and Exposures (CVE) numbers and/or
3112
+ US-CERT numbers. As vulnerabilities are much more specific and localized
3113
+ than weaknesses, it is uncommon that an attack pattern would target a
3114
+ specific vulnerability. This would most likely occur if the attack pattern
3115
+ were targeting vulnerabilities in the underlying platform, framework, or
3116
+ software library.</xs:documentation>
3117
+ </xs:annotation>
3118
+ <xs:complexType>
3119
+ <xs:sequence>
3120
+ <xs:element name="Related_Vulnerability" maxOccurs="unbounded">
3121
+ <xs:annotation>
3122
+ <xs:documentation>This element represents a specific instance
3123
+ vulnerability targeted for exploit by this attack pattern.
3124
+ </xs:documentation>
3125
+ </xs:annotation>
3126
+ <xs:complexType>
3127
+ <xs:sequence>
3128
+ <xs:element name="Vulnerability_ID" type="xs:string">
3129
+ <xs:annotation>
3130
+ <xs:documentation>The element contains the Common
3131
+ Vulnerabilities and Explosures (CVE) or US-CERT
3132
+ number identifying the vulnerability.
3133
+ </xs:documentation>
3134
+ </xs:annotation>
3135
+ </xs:element>
3136
+ <xs:element name="Vulnerability_Description"
3137
+ type="capec:Structured_Text_Type">
3138
+ <xs:annotation>
3139
+ <xs:documentation>This element contains a short textual
3140
+ description of the specific related vulnerability
3141
+ taken from the industry standard vulnerability
3142
+ listing.</xs:documentation>
3143
+ </xs:annotation>
3144
+ </xs:element>
3145
+ </xs:sequence>
3146
+ </xs:complexType>
3147
+ </xs:element>
3148
+ </xs:sequence>
3149
+ </xs:complexType>
3150
+ </xs:element>
3151
+ <xs:element name="Related_Attack_Patterns" minOccurs="0">
3152
+ <xs:annotation>
3153
+ <xs:documentation>This element represents a container of one or more related
3154
+ attack patterns. A related attack pattern refers to an attack pattern that
3155
+ is dependent on or applied in conjunction with this attack pattern.
3156
+ </xs:documentation>
3157
+ </xs:annotation>
3158
+ <xs:complexType>
3159
+ <xs:sequence>
3160
+ <xs:element name="Related_Attack_Pattern" type="capec:RelationshipType"
3161
+ maxOccurs="unbounded">
3162
+ <xs:annotation>
3163
+ <xs:documentation>A related attack pattern refers to an attack
3164
+ pattern that is dependent on or applied in conjunction with this
3165
+ attack pattern.</xs:documentation>
3166
+ </xs:annotation>
3167
+ </xs:element>
3168
+ </xs:sequence>
3169
+ </xs:complexType>
3170
+ </xs:element>
3171
+ <xs:element name="Relevant_Security_Requirements" minOccurs="0">
3172
+ <xs:annotation>
3173
+ <xs:documentation>This element represents a container of one or more relevant
3174
+ security requirements. A relevant security requirement is a general security
3175
+ requirement that is relevant to this type of attack.</xs:documentation>
3176
+ </xs:annotation>
3177
+ <xs:complexType>
3178
+ <xs:sequence>
3179
+ <xs:element name="Relevant_Security_Requirement"
3180
+ type="capec:Structured_Text_Type" maxOccurs="unbounded">
3181
+ <xs:annotation>
3182
+ <xs:documentation>A relevant security requirement is a general
3183
+ security requirement that is relevant to this type of attack.
3184
+ </xs:documentation>
3185
+ </xs:annotation>
3186
+ </xs:element>
3187
+ </xs:sequence>
3188
+ </xs:complexType>
3189
+ </xs:element>
3190
+ <xs:element name="Relevant_Design_Patterns" minOccurs="0">
3191
+ <xs:annotation>
3192
+ <xs:documentation>This element represents a container of one or more relevant
3193
+ design patterns. Relevant design patterns include both recommended design
3194
+ patterns, which increase the software's resistance or resilience to this
3195
+ type of attack, and non-recommended design patterns, which could leave the
3196
+ system especially susceptible to this type of attack.</xs:documentation>
3197
+ </xs:annotation>
3198
+ <xs:complexType>
3199
+ <xs:sequence>
3200
+ <xs:element name="Recommended_Design_Patterns">
3201
+ <xs:annotation>
3202
+ <xs:documentation>This element represents a container of one or more
3203
+ recommended design patterns. A recommended design pattern
3204
+ increases the software's resistance or resilience to this type
3205
+ of attack.</xs:documentation>
3206
+ </xs:annotation>
3207
+ <xs:complexType>
3208
+ <xs:sequence>
3209
+ <xs:element name="Recommended_Design_Pattern"
3210
+ type="capec:Structured_Text_Type" maxOccurs="unbounded">
3211
+ <xs:annotation>
3212
+ <xs:documentation>A design pattern that is likely to
3213
+ increase the software’s resistance or resiliency to
3214
+ this type of attack.</xs:documentation>
3215
+ </xs:annotation>
3216
+ </xs:element>
3217
+ </xs:sequence>
3218
+ </xs:complexType>
3219
+ </xs:element>
3220
+ <xs:element name="Non-Recommended_Design_Patterns">
3221
+ <xs:annotation>
3222
+ <xs:documentation>This element represents a container of one or more
3223
+ non-recommended design patterns. A non-recommended design can
3224
+ decrease a sofware's resistence or resilience to this type of
3225
+ attack, leaving the system more susceptible.</xs:documentation>
3226
+ </xs:annotation>
3227
+ <xs:complexType>
3228
+ <xs:sequence>
3229
+ <xs:element name="Non-Recommended_Design_Pattern"
3230
+ type="capec:Structured_Text_Type" maxOccurs="unbounded">
3231
+ <xs:annotation>
3232
+ <xs:documentation>A non-recommended design can decrease
3233
+ a sofware's resistence or resilience to this type of
3234
+ attack, leaving the system more susceptible.
3235
+ </xs:documentation>
3236
+ </xs:annotation>
3237
+ </xs:element>
3238
+ </xs:sequence>
3239
+ </xs:complexType>
3240
+ </xs:element>
3241
+ </xs:sequence>
3242
+ </xs:complexType>
3243
+ </xs:element>
3244
+ <xs:element name="Relevant_Security_Patterns" minOccurs="0">
3245
+ <xs:annotation>
3246
+ <xs:documentation>This element represents a container of one or more relevant
3247
+ security patterns. A relevant security pattern provides resistance or
3248
+ resilience to this type of attack.</xs:documentation>
3249
+ </xs:annotation>
3250
+ <xs:complexType>
3251
+ <xs:sequence>
3252
+ <xs:element name="Relevant_Security_Pattern"
3253
+ type="capec:Structured_Text_Type" maxOccurs="unbounded">
3254
+ <xs:annotation>
3255
+ <xs:documentation>A relevant security pattern provides resistance or
3256
+ resilience to this type of attack.</xs:documentation>
3257
+ </xs:annotation>
3258
+ </xs:element>
3259
+ </xs:sequence>
3260
+ </xs:complexType>
3261
+ </xs:element>
3262
+ <xs:element name="Related_Security_Principles" minOccurs="0">
3263
+ <xs:annotation>
3264
+ <xs:documentation>This element represents a container of one or more related
3265
+ security principles. A principle is defined as a rule or standard for good
3266
+ behavior. A related security principle is a security rule or practice that
3267
+ impedes this attack pattern. USAGE: Usage defined in NIST SP 800-27A,
3268
+ "Engineering Principles for Information Technology Security", Revision A.
3269
+ </xs:documentation>
3270
+ </xs:annotation>
3271
+ <xs:complexType>
3272
+ <xs:sequence>
3273
+ <xs:element name="Related_Security_Principle"
3274
+ type="capec:Structured_Text_Type" maxOccurs="unbounded">
3275
+ <xs:annotation>
3276
+ <xs:documentation>A related security principle is a security rule or
3277
+ practice that impedes this attack pattern.</xs:documentation>
3278
+ </xs:annotation>
3279
+ </xs:element>
3280
+ </xs:sequence>
3281
+ </xs:complexType>
3282
+ </xs:element>
3283
+ <xs:element name="Related_Guidelines" minOccurs="0">
3284
+ <xs:annotation>
3285
+ <xs:documentation>This element represents a container of one or more related
3286
+ guidelines. A related guideline represents a security guideline that is
3287
+ relevant to identifying or mitigating this type of attack. USAGE: It would
3288
+ be helpful to provide a usage reference. However links to security principle
3289
+ and guideline documentation on the BSI site appear to be broken. NIST SP
3290
+ 800-27 uses the terms principle and guideline interchangeably.
3291
+ </xs:documentation>
3292
+ </xs:annotation>
3293
+ <xs:complexType>
3294
+ <xs:sequence>
3295
+ <xs:element name="Related_Guideline" type="capec:Structured_Text_Type"
3296
+ maxOccurs="unbounded">
3297
+ <xs:annotation>
3298
+ <xs:documentation>A related guideline represents a security
3299
+ guideline that is relevant to identifying or mitigating this
3300
+ type of attack.</xs:documentation>
3301
+ </xs:annotation>
3302
+ </xs:element>
3303
+ </xs:sequence>
3304
+ </xs:complexType>
3305
+ </xs:element>
3306
+ <xs:element name="Purposes" minOccurs="0">
3307
+ <xs:annotation>
3308
+ <xs:documentation>This element represents a container of one or more purposes.
3309
+ Purpose refers to the intended purpose behind the attack pattern relative to
3310
+ an enumerated list of attack objectives. USAGE: This element is used to
3311
+ capture pattern composibility and assist with normalization and
3312
+ classification of attack patterns within the CAPEC catalog.
3313
+ </xs:documentation>
3314
+ </xs:annotation>
3315
+ <xs:complexType>
3316
+ <xs:sequence>
3317
+ <xs:element name="Purpose" maxOccurs="unbounded">
3318
+ <xs:annotation>
3319
+ <xs:documentation>Purpose refers to the intended purpose behind the
3320
+ attack pattern relative to an enumerated list of attack
3321
+ objectives. USAGE: This element is represented as an enumerated
3322
+ list to facilitate normalization and classification of attack
3323
+ patterns</xs:documentation>
3324
+ </xs:annotation>
3325
+ <xs:simpleType>
3326
+ <xs:restriction base="xs:string">
3327
+ <xs:whiteSpace value="collapse"/>
3328
+ <xs:enumeration value="Reconnaissance"/>
3329
+ <xs:enumeration value="Penetration"/>
3330
+ <xs:enumeration value="Exploitation"/>
3331
+ <xs:enumeration value="Obfuscation"/>
3332
+ </xs:restriction>
3333
+ </xs:simpleType>
3334
+ </xs:element>
3335
+ </xs:sequence>
3336
+ </xs:complexType>
3337
+ </xs:element>
3338
+ <xs:element name="CIA_Impact" minOccurs="0">
3339
+ <xs:annotation>
3340
+ <xs:documentation>This element characterizes the typical relative impact of this
3341
+ pattern on the confidentiality, integrity, and availability of the targeted
3342
+ software.</xs:documentation>
3343
+ </xs:annotation>
3344
+ <xs:complexType>
3345
+ <xs:sequence>
3346
+ <xs:element name="Confidentiality_Impact" minOccurs="0">
3347
+ <xs:annotation>
3348
+ <xs:documentation>This element describes the typical impact of this
3349
+ pattern on the confidentiality characteristics of the targeted
3350
+ software and related data.</xs:documentation>
3351
+ </xs:annotation>
3352
+ <xs:simpleType>
3353
+ <xs:restriction base="xs:string">
3354
+ <xs:whiteSpace value="collapse"/>
3355
+ <xs:enumeration value="Low"/>
3356
+ <xs:enumeration value="Medium"/>
3357
+ <xs:enumeration value="High"/>
3358
+ </xs:restriction>
3359
+ </xs:simpleType>
3360
+ </xs:element>
3361
+ <xs:element name="Integrity_Impact" minOccurs="0">
3362
+ <xs:annotation>
3363
+ <xs:documentation>This element describes the typical impact of this
3364
+ pattern on the integrity characteristics of the targeted
3365
+ software and related data.</xs:documentation>
3366
+ </xs:annotation>
3367
+ <xs:simpleType>
3368
+ <xs:restriction base="xs:string">
3369
+ <xs:whiteSpace value="collapse"/>
3370
+ <xs:enumeration value="Low"/>
3371
+ <xs:enumeration value="Medium"/>
3372
+ <xs:enumeration value="High"/>
3373
+ </xs:restriction>
3374
+ </xs:simpleType>
3375
+ </xs:element>
3376
+ <xs:element name="Availability_Impact" minOccurs="0">
3377
+ <xs:annotation>
3378
+ <xs:documentation>This element describes the typical impact of this
3379
+ pattern on the availability characteristics of the targeted
3380
+ software and related data.</xs:documentation>
3381
+ </xs:annotation>
3382
+ <xs:simpleType>
3383
+ <xs:restriction base="xs:string">
3384
+ <xs:whiteSpace value="collapse"/>
3385
+ <xs:enumeration value="Low"/>
3386
+ <xs:enumeration value="Medium"/>
3387
+ <xs:enumeration value="High"/>
3388
+ </xs:restriction>
3389
+ </xs:simpleType>
3390
+ </xs:element>
3391
+ </xs:sequence>
3392
+ </xs:complexType>
3393
+ </xs:element>
3394
+ <xs:element name="Technical_Context" minOccurs="0">
3395
+ <xs:annotation>
3396
+ <xs:documentation>This element characterizes the technical context where this
3397
+ pattern is applicable.</xs:documentation>
3398
+ </xs:annotation>
3399
+ <xs:complexType>
3400
+ <xs:sequence>
3401
+ <xs:element name="Architectural_Paradigms" minOccurs="0">
3402
+ <xs:annotation>
3403
+ <xs:documentation>This element represents a container of one or more
3404
+ architectural paradigms in which this attack pattern is possible
3405
+ and relevant. Architectural paradigm characterizes the target
3406
+ using an enumerated list of paradigms utilized by the target.
3407
+ </xs:documentation>
3408
+ </xs:annotation>
3409
+ <xs:complexType>
3410
+ <xs:sequence>
3411
+ <xs:element name="Architectural_Paradigm" maxOccurs="unbounded">
3412
+ <xs:annotation>
3413
+ <xs:documentation>Architectural paradigm characterizes
3414
+ the target using an enumerated list of supported
3415
+ paradigms in which this attack pattern is possible
3416
+ and relevant. USAGE: This element is represented as
3417
+ an enumerated list to facilitate normalization and
3418
+ classification of attack patterns
3419
+ </xs:documentation>
3420
+ </xs:annotation>
3421
+ <xs:simpleType>
3422
+ <xs:restriction base="xs:string">
3423
+ <xs:whiteSpace value="collapse"/>
3424
+ <xs:enumeration value="Mainframe"/>
3425
+ <xs:enumeration value="Client-Server"/>
3426
+ <xs:enumeration value="n-Tier"/>
3427
+ <xs:enumeration value="Web"/>
3428
+ <xs:enumeration value="SOA"/>
3429
+ <xs:enumeration value="Other"/>
3430
+ <xs:enumeration value="All"/>
3431
+ </xs:restriction>
3432
+ </xs:simpleType>
3433
+ </xs:element>
3434
+ </xs:sequence>
3435
+ </xs:complexType>
3436
+ </xs:element>
3437
+ <xs:element name="Frameworks" minOccurs="0">
3438
+ <xs:annotation>
3439
+ <xs:documentation>This element represents a container of one or more
3440
+ frameworks in which this attack pattern is possible and
3441
+ relevant. Frameworks characterizes the target using an
3442
+ enumerated list of frameworks utilized by the target.
3443
+ </xs:documentation>
3444
+ </xs:annotation>
3445
+ <xs:complexType>
3446
+ <xs:sequence>
3447
+ <xs:element name="Framework" minOccurs="0" maxOccurs="unbounded">
3448
+ <xs:annotation>
3449
+ <xs:documentation>Framework characterizes the target
3450
+ using an enumerated list of supported frameworks in
3451
+ which this attack pattern is possible and relevant.
3452
+ USAGE: This element is represented as an enumerated
3453
+ list to facilitate normalization and classification
3454
+ of attack patterns</xs:documentation>
3455
+ </xs:annotation>
3456
+ <xs:simpleType>
3457
+ <xs:restriction base="xs:string">
3458
+ <xs:whiteSpace value="collapse"/>
3459
+ <xs:enumeration value="J2EE"/>
3460
+ <xs:enumeration value=".NET"/>
3461
+ <xs:enumeration value="Struts"/>
3462
+ <xs:enumeration value="Spring"/>
3463
+ <xs:enumeration value="Hibernate"/>
3464
+ <xs:enumeration value="Other"/>
3465
+ <xs:enumeration value="All"/>
3466
+ </xs:restriction>
3467
+ </xs:simpleType>
3468
+ </xs:element>
3469
+ </xs:sequence>
3470
+ </xs:complexType>
3471
+ </xs:element>
3472
+ <xs:element name="Platforms" minOccurs="0">
3473
+ <xs:annotation>
3474
+ <xs:documentation>This element represents a container of one or more
3475
+ platforms in which this attack pattern is possible and relevant.
3476
+ Platforms characterizes the target using an enumerated list of
3477
+ platforms utilized by the target.</xs:documentation>
3478
+ </xs:annotation>
3479
+ <xs:complexType>
3480
+ <xs:sequence>
3481
+ <xs:element name="Platform" minOccurs="0" maxOccurs="unbounded">
3482
+ <xs:annotation>
3483
+ <xs:documentation>Platform characterizes the target
3484
+ using an enumerated list of supported platforms in
3485
+ which this attack pattern is possible and relevant.
3486
+ USAGE: This element is represented as an enumerated
3487
+ list to facilitate normalization and classification
3488
+ of attack patterns</xs:documentation>
3489
+ </xs:annotation>
3490
+ <xs:simpleType>
3491
+ <xs:restriction base="xs:string">
3492
+ <xs:whiteSpace value="collapse"/>
3493
+ <xs:enumeration value="Windows"/>
3494
+ <xs:enumeration value="UNIX-LINUX"/>
3495
+ <xs:enumeration value="Solaris"/>
3496
+ <xs:enumeration value="Other"/>
3497
+ <xs:enumeration value="All"/>
3498
+ </xs:restriction>
3499
+ </xs:simpleType>
3500
+ </xs:element>
3501
+ </xs:sequence>
3502
+ </xs:complexType>
3503
+ </xs:element>
3504
+ <xs:element name="Languages" minOccurs="0">
3505
+ <xs:annotation>
3506
+ <xs:documentation>This element represents a container of one or more
3507
+ languages in which this attack pattern is possible and relevant.
3508
+ Languages characterizes the target using an enumerated list of
3509
+ languages utilized by the target.</xs:documentation>
3510
+ </xs:annotation>
3511
+ <xs:complexType>
3512
+ <xs:sequence>
3513
+ <xs:element name="Language" minOccurs="0" maxOccurs="unbounded">
3514
+ <xs:annotation>
3515
+ <xs:documentation>Language characterizes the target
3516
+ using an enumerated list of implementation languages
3517
+ in which this attack pattern is possible and
3518
+ relevant. USAGE: This element is represented as an
3519
+ enumerated list to facilitate normalization and
3520
+ classification of attack patterns
3521
+ </xs:documentation>
3522
+ </xs:annotation>
3523
+ <xs:simpleType>
3524
+ <xs:restriction base="xs:string">
3525
+ <xs:whiteSpace value="collapse"/>
3526
+ <xs:enumeration value="AJAX"/>
3527
+ <xs:enumeration value="ASP"/>
3528
+ <xs:enumeration value="ASP.NET"/>
3529
+ <xs:enumeration value="C"/>
3530
+ <xs:enumeration value="C++"/>
3531
+ <xs:enumeration value="C#"/>
3532
+ <xs:enumeration value="Java"/>
3533
+ <xs:enumeration value="JSP"/>
3534
+ <xs:enumeration value="PHP"/>
3535
+ <xs:enumeration value="PERL"/>
3536
+ <xs:enumeration value="Ruby"/>
3537
+ <xs:enumeration value="Visual Basic"/>
3538
+ <xs:enumeration value="Other"/>
3539
+ <xs:enumeration value="All"/>
3540
+ </xs:restriction>
3541
+ </xs:simpleType>
3542
+ </xs:element>
3543
+ </xs:sequence>
3544
+ </xs:complexType>
3545
+ </xs:element>
3546
+ </xs:sequence>
3547
+ </xs:complexType>
3548
+ </xs:element>
3549
+ <xs:element name="Keywords" minOccurs="0">
3550
+ <xs:annotation>
3551
+ <xs:documentation>This element represents a container of one or more keywords.
3552
+ Keyword correspond to text strings used to tag and search CAPEC catalog
3553
+ data.</xs:documentation>
3554
+ </xs:annotation>
3555
+ <xs:complexType>
3556
+ <xs:sequence>
3557
+ <xs:element name="Keyword" type="xs:string" maxOccurs="unbounded">
3558
+ <xs:annotation>
3559
+ <xs:documentation>Keyword correspond to text strings used to tag and
3560
+ search CAPEC catalog data.</xs:documentation>
3561
+ </xs:annotation>
3562
+ </xs:element>
3563
+ </xs:sequence>
3564
+ </xs:complexType>
3565
+ </xs:element>
3566
+ <xs:element name="References" minOccurs="0">
3567
+ <xs:annotation>
3568
+ <xs:documentation>This element represents a container of one or more references.
3569
+ Reference represents a documentary resource used to develop the definition
3570
+ of this attack pattern.</xs:documentation>
3571
+ </xs:annotation>
3572
+ <xs:complexType>
3573
+ <xs:sequence>
3574
+ <xs:element name="Reference" type="capec:Reference_Type"
3575
+ maxOccurs="unbounded">
3576
+ <xs:annotation>
3577
+ <xs:documentation>Reference represents a documentary resource used
3578
+ to develop the definition of this attack pattern.
3579
+ </xs:documentation>
3580
+ </xs:annotation>
3581
+ </xs:element>
3582
+ </xs:sequence>
3583
+ </xs:complexType>
3584
+ </xs:element>
3585
+ <xs:element ref="capec:Other_Notes" minOccurs="0"/>
3586
+ <xs:element ref="capec:Maintenance_Notes" minOccurs="0"/>
3587
+ <xs:element ref="capec:Content_History" minOccurs="0"/>
3588
+ </xs:sequence>
3589
+ <xs:attribute name="ID" type="xs:integer" use="optional" default="0"/>
3590
+ <xs:attribute name="Name" type="xs:string" use="required"/>
3591
+ <xs:attribute name="Pattern_Completeness">
3592
+ <xs:simpleType>
3593
+ <xs:restriction base="xs:string">
3594
+ <xs:whiteSpace value="collapse"/>
3595
+ <xs:enumeration value="Complete"/>
3596
+ <xs:enumeration value="Stub"/>
3597
+ <xs:enumeration value="Hook"/>
3598
+ </xs:restriction>
3599
+ </xs:simpleType>
3600
+ </xs:attribute>
3601
+ <xs:attribute name="Pattern_Abstraction" use="optional">
3602
+ <xs:simpleType>
3603
+ <xs:restriction base="xs:string">
3604
+ <xs:whiteSpace value="collapse"/>
3605
+ <xs:enumeration value="Meta"/>
3606
+ <xs:enumeration value="Standard"/>
3607
+ <xs:enumeration value="Detailed"/>
3608
+ </xs:restriction>
3609
+ </xs:simpleType>
3610
+ </xs:attribute>
3611
+ <xs:attribute name="Status" type="capec:Status_Type" use="required">
3612
+ <xs:annotation>
3613
+ <xs:documentation>The Status attribute defines the status level for this view.
3614
+ </xs:documentation>
3615
+ </xs:annotation>
3616
+ </xs:attribute>
3617
+ </xs:complexType>
3618
+ </xs:schema>