stix_schema_spy 1.0

data/config/1.0.1/stix/cybox/extensions/platform/README.txt

@@ -0,0 +1 @@
+The PlatformSpecificationType, defined in the CybOX common schema, provides a way to provide a prose description of a platform as well as any number of platform identification values. If one wishes to provide a more structured description of a platform, they can define types that extend PlatformSpecificationType. These types would be indicated using an xsi:Type attribute in the relevant element in CybOX content. This directory provides CybOX default extensions to PlatformSpecificationType to support structured description of platforms.

data/config/1.0.1/stix/cybox/extensions/platform/cpe-language_2.3.xsd

@@ -0,0 +1,234 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0"
+    xmlns:cpe-name="http://cpe.mitre.org/naming/2.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron"
+    targetNamespace="http://cpe.mitre.org/language/2.0" elementFormDefault="qualified"
+    attributeFormDefault="unqualified" version="2.3">
+    <xsd:import namespace="http://www.w3.org/XML/1998/namespace" schemaLocation="xml.xsd"/>
+    <xsd:import namespace="http://cpe.mitre.org/naming/2.0" schemaLocation="cpe-naming_2.3.xsd"/>
+    <xsd:annotation>
+        <xsd:documentation xml:lang="en">This XML Schema defines the CPE Applicability Language. An individual CPE Name
+            addresses a single part of an actual system. To identify more complex platform types, there needs to be a
+            way to combine different CPE Names using logical operators. For example, there may be a need to identify a
+            platform with a particular operating system AND a certain application. The CPE Applicability Language exists
+            to satisfy this need, enabling the CPE Name for the operating system to be combined with the CPE Name for
+            the application. For more information, consult the CPE Applicability Language Specification document. </xsd:documentation>
+        <xsd:appinfo>
+            <schema>CPE Applicability Language</schema>
+            <author>Neal Ziring, Andrew Buttner, David Waltermire</author>
+            <version>2.3</version>
+            <date>2011-07-29</date>
+        </xsd:appinfo>
+        <xsd:appinfo>
+            <!-- Declare the namespaces for schematron -->
+            <sch:ns prefix="cpe" uri="http://cpe.mitre.org/language/2.0"/>
+        </xsd:appinfo>
+    </xsd:annotation>
+
+    <!-- =============================================================================== -->
+    <!-- =============================================================================== -->
+    <!-- =============================================================================== -->
+    <xsd:element name="platform-specification" type="cpe:platformSpecificationType">
+        <xsd:annotation>
+            <xsd:documentation xml:lang="en">This element is the root element of a CPE Applicability Language XML
+                document and therefore acts as a container for child platform definitions.</xsd:documentation>
+        </xsd:annotation>
+        <xsd:key name="platformKey">
+            <xsd:selector xpath="cpe:platform"/>
+            <xsd:field xpath="@id"/>
+        </xsd:key>
+    </xsd:element>
+
+    <xsd:element name="platform" type="cpe:PlatformType"/>
+    <xsd:element name="platform-configuration" type="cpe:PlatformBaseType"/>
+
+    <xsd:element name="logical-test" type="cpe:LogicalTestType">
+        <xsd:annotation>
+            <xsd:appinfo>
+                <sch:pattern id="nonexistent-child">
+                    <sch:rule context="cpe:logical-test">
+                        <sch:assert
+                            test="count(cpe:logical-test) > 0 or count(cpe:fact-ref) > 0 or count(cpe:check-fact-ref) > 0"
+                            >All logical-test elements must contain one or more child logical-test, fact-ref, and/or
+                            check-fact-ref elements.</sch:assert>
+                    </sch:rule>
+                </sch:pattern>
+            </xsd:appinfo>
+        </xsd:annotation>
+    </xsd:element>
+
+    <xsd:element name="fact-ref" type="cpe:CPEFactRefType"/>
+    <xsd:element name="check-fact-ref" type="cpe:CheckFactRefType"/>
+
+    <!-- =============================================================================== -->
+    <!-- =========================== PLATFORM SPECIFICATION ============================ -->
+    <!-- =============================================================================== -->
+    <xsd:complexType name="platformSpecificationType">
+        <xsd:sequence>
+            <xsd:element ref="cpe:platform" minOccurs="1" maxOccurs="unbounded"/>
+        </xsd:sequence>
+    </xsd:complexType>
+
+    <!-- =============================================================================== -->
+    <!-- ==================================  PLATFORM  ================================= -->
+    <!-- =============================================================================== -->
+    <xsd:complexType name="PlatformBaseType">
+        <xsd:annotation>
+            <xsd:documentation xml:lang="en">The description or qualifications of a particular IT platform type. The
+                platform is defined by the logical-test child element.</xsd:documentation>
+        </xsd:annotation>
+        <xsd:sequence>
+            <xsd:element name="title" type="cpe:TextType" minOccurs="0" maxOccurs="unbounded">
+                <xsd:annotation>
+                    <xsd:documentation xml:lang="en">A human-readable title for a platform. To support uses intended for
+                        multiple languages, the title element supports the ‘xml:lang’ attribute. At most one title
+                        element can appear for each language.</xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+            <xsd:element name="remark" type="cpe:TextType" minOccurs="0" maxOccurs="unbounded">
+                <xsd:annotation>
+                    <xsd:documentation xml:lang="en">An additional description. To support uses intended for multiple
+                        languages, the remark element supports the ‘xml:lang’ attribute. There can be multiple remarks
+                        for a single language.</xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+            <xsd:element ref="cpe:logical-test" minOccurs="1" maxOccurs="1">
+                <xsd:annotation>
+                    <xsd:documentation xml:lang="en">Definition of test using logical operators (AND, OR,
+                        negate).</xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+        </xsd:sequence>
+    </xsd:complexType>
+    <xsd:complexType name="PlatformType">
+        <xsd:complexContent>
+            <xsd:extension base="cpe:PlatformBaseType">
+                <xsd:attribute name="id" type="xsd:anyURI" use="required">
+                    <xsd:annotation>
+                        <xsd:documentation xml:lang="en">A locally unique name for the platform. There is no defined
+                            format for this id; however, it must be unique within the containing CPE Applicability
+                            Language document.</xsd:documentation>
+                    </xsd:annotation>
+                </xsd:attribute>
+            </xsd:extension>
+        </xsd:complexContent>
+    </xsd:complexType>
+    <xsd:complexType name="LogicalTestType">
+        <xsd:annotation>
+            <xsd:documentation xml:lang="en">The logical-test element appears as a child of a platform element, and may
+                also be nested to create more complex logical tests. The content consists of one or more elements:
+                fact-ref, check-fact-ref, and logical-test children are permitted. The operator to be applied, and
+                optional negation of the test, are given as attributes.</xsd:documentation>
+        </xsd:annotation>
+        <xsd:sequence>
+            <xsd:element name="logical-test" type="cpe:LogicalTestType" minOccurs="0" maxOccurs="unbounded">
+                <xsd:annotation>
+                    <xsd:documentation xml:lang="en">Definition of complex logical test using AND, OR, and/or negate
+                        operators. Evaluates to a TRUE, FALSE, or ERROR result. </xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+            <xsd:element ref="cpe:fact-ref" minOccurs="0" maxOccurs="unbounded">
+                <xsd:annotation>
+                    <xsd:documentation xml:lang="en">A reference to a bound form of a WFN; the reference always
+                        evaluates to a boolean result. The bound name contained within a fact-ref is meant to describe a
+                        possible set of products and is not meant to identify a unique product
+                        class.</xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+            <xsd:element ref="cpe:check-fact-ref" minOccurs="0" maxOccurs="unbounded">
+                <xsd:annotation>
+                    <xsd:documentation xml:lang="en">A reference to a check that always evaluates to TRUE, FALSE, or
+                        ERROR. Examples of types of checks are OVAL and OCIL checks.</xsd:documentation>
+                </xsd:annotation>
+            </xsd:element>
+        </xsd:sequence>
+        <xsd:attribute name="operator" type="cpe:operatorEnumeration" use="required">
+            <xsd:annotation>
+                <xsd:documentation xml:lang="en">The operator applied to the results of evaluating the fact-ref,
+                    check-fact-ref, and logical-test elements. The permitted operators are "AND" and
+                    "OR".</xsd:documentation>
+            </xsd:annotation>
+        </xsd:attribute>
+        <xsd:attribute name="negate" type="xsd:boolean" use="required">
+            <xsd:annotation>
+                <xsd:documentation xml:lang="en">Whether the result of applying the operator should be negated. Possible
+                    values are "TRUE" and "FALSE". This does not apply if the initial result is
+                    ERROR.</xsd:documentation>
+            </xsd:annotation>
+        </xsd:attribute>
+    </xsd:complexType>
+    <xsd:complexType name="FactRefType">
+        <xsd:attribute name="description" type="xsd:normalizedString" use="optional"/>
+    </xsd:complexType>
+    <xsd:complexType name="CPEFactRefType">
+        <xsd:annotation>
+            <xsd:documentation xml:lang="en">A reference to a CPE Name that always evaluates to a Boolean
+                result.</xsd:documentation>
+        </xsd:annotation>
+        <xsd:complexContent>
+            <xsd:extension base="cpe:FactRefType">
+                <xsd:attribute name="name" type="cpe:namePattern" use="required"/>
+            </xsd:extension>
+        </xsd:complexContent>
+    </xsd:complexType>
+    <xsd:complexType name="CheckFactRefType">
+        <xsd:annotation>
+            <xsd:documentation xml:lang="en">A reference to a check that always evaluates to a TRUE, FALSE, or ERROR
+                result.</xsd:documentation>
+            <xsd:documentation xml:lang="en">The CheckFactRefType complex type is used to define an element for holding
+                information about an individual check. It includes a checking system specification URI, string content
+                identifying the check content to invoke, and an external reference. The checking system specification
+                should be the URI that uniquely identifies a revision of a check system language, and the id-ref will be
+                an identifier of a test written in that language. The external reference should be used to point to the
+                content in which the check identifier is defined.</xsd:documentation>
+        </xsd:annotation>
+        <xsd:complexContent>
+            <xsd:extension base="cpe:FactRefType">
+                <xsd:attribute name="system" type="xsd:anyURI" use="required"/>
+                <xsd:attribute name="href" type="xsd:anyURI" use="required"/>
+                <xsd:attribute name="id-ref" type="xsd:token" use="required"/>
+            </xsd:extension>
+        </xsd:complexContent>
+    </xsd:complexType>
+
+    <!-- =============================================================================== -->
+    <!-- ===============================  ENUMERATIONS  ================================ -->
+    <!-- =============================================================================== -->
+    <xsd:simpleType name="operatorEnumeration">
+        <xsd:annotation>
+            <xsd:documentation xml:lang="en">The OperatorEnumeration simple type defines acceptable operators. Each
+                operator defines how to evaluate multiple arguments.</xsd:documentation>
+        </xsd:annotation>
+        <xsd:restriction base="xsd:string">
+            <xsd:enumeration value="AND"/>
+            <xsd:enumeration value="OR"/>
+        </xsd:restriction>
+    </xsd:simpleType>
+    <!-- =============================================================================== -->
+    <!-- ==============================  SUPPORTING TYPES  ============================== -->
+    <!-- =============================================================================== -->
+    <xsd:complexType name="TextType">
+        <xsd:annotation>
+            <xsd:documentation xml:lang="en">This type allows the xml:lang attribute to associate a specific language
+                with an element's string content.</xsd:documentation>
+        </xsd:annotation>
+        <xsd:simpleContent>
+            <xsd:extension base="xsd:string">
+                <xsd:attribute ref="xml:lang"/>
+            </xsd:extension>
+        </xsd:simpleContent>
+    </xsd:complexType>
+    <!-- =============================================================================== -->
+    <!-- ================================  ID PATTERNS  ================================ -->
+    <!-- =============================================================================== -->
+    <xsd:simpleType name="namePattern">
+        <xsd:union memberTypes="cpe-name:cpe22Type cpe-name:cpe23Type"/>
+    </xsd:simpleType>
+    <!-- ================================================== -->
+    <!-- =====  Change History  -->
+    <!-- ================================================== -->
+    <!--
+        v2.2 - Initial working version
+        v2.3 - Various refactoring of types to use element refs.  This enables more fine-grained reuse of this schema and allows XSD substitution to be possible.
+                Updated the name pattern.
+    -->
+</xsd:schema>

data/config/1.0.1/stix/cybox/extensions/platform/cpe-naming_2.3.xsd

@@ -0,0 +1,45 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/naming/2.0"
+    targetNamespace="http://cpe.mitre.org/naming/2.0" elementFormDefault="qualified" attributeFormDefault="unqualified"
+    version="2.3">
+    <xsd:annotation>
+        <xsd:documentation xml:lang="en"> </xsd:documentation>
+        <xsd:appinfo>
+            <schema>CPE 2.3 Naming</schema>
+            <author>Adam Halbardier</author>
+            <version>2.3</version>
+            <date>2011-07-29</date>
+        </xsd:appinfo>
+    </xsd:annotation>
+
+    <xsd:simpleType name="cpe22Type">
+        <xsd:annotation>
+            <xsd:documentation xml:lang="en">Define the format for acceptable CPE Names. A URN format is used with the
+                id starting with the word cpe followed by :/ and then some number of individual components separated by
+                colons.</xsd:documentation>
+        </xsd:annotation>
+        <xsd:restriction base="xsd:anyURI">
+            <xsd:pattern value="[c][pP][eE]:/[AHOaho]?(:[A-Za-z0-9\._\-~%]*){0,6}"/>
+        </xsd:restriction>
+    </xsd:simpleType>
+    <xsd:simpleType name="cpe23Type">
+        <xsd:annotation>
+            <xsd:documentation xml:lang="en">Define the format for acceptable CPE Names. A string format is used with
+                the id starting with the word cpe:2.3 followed by : and then some number of individual components
+                separated by colons.</xsd:documentation>
+        </xsd:annotation>
+        <xsd:restriction base="xsd:string">
+            <xsd:pattern
+                value="cpe:2\.3:[aho\*\-](:(((\?*|\*?)([a-zA-Z0-9\-\._]|(\\[\\\*\?!&quot;#$$%&amp;'\(\)\+,/:;&lt;=&gt;@\[\]\^`\{\|}~]))+(\?*|\*?))|[\*\-])){5}(:(([a-zA-Z]{2,3}(-([a-zA-Z]{2}|[0-9]{3}))?)|[\*\-]))(:(((\?*|\*?)([a-zA-Z0-9\-\._]|(\\[\\\*\?!&quot;#$$%&amp;'\(\)\+,/:;&lt;=&gt;@\[\]\^`\{\|}~]))+(\?*|\*?))|[\*\-])){4}"
+            />
+        </xsd:restriction>
+    </xsd:simpleType>
+
+    <!-- ================================================== -->
+    <!-- =====  Change History  -->
+    <!-- ================================================== -->
+    <!--
+        v2.3 - Initial release 
+    -->
+
+</xsd:schema>

data/config/1.0.1/stix/cybox/extensions/platform/cpe2.3.xsd

@@ -0,0 +1,40 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
+    xmlns="http://cybox.mitre.org/extensions/platform#CPE2.3-1"
+    xmlns:cpe23="http://cpe.mitre.org/language/2.0"
+    xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
+    targetNamespace="http://cybox.mitre.org/extensions/platform#CPE2.3-1"
+    elementFormDefault="qualified" version="1.0.1">
+    <xs:annotation>
+        <xs:documentation>This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org. </xs:documentation>
+        <xs:appinfo>
+            <schema>CPE2.3</schema>
+            <version>1.0.1</version>
+            <date>09/30/2013 9:00:00 AM</date>
+            <short_description>Cyber Observable eXpression (CybOX) Extension - CPE 2.3 Platform Instance - Schematic implementation for using the CPE 2.3 Applicablity Language to describe a Platform within the CybOX observable expression language. It extends the PlatformSpecificationType defined in the CybOX common schema. (cybox_common.xsd) For more information on this extension mechanism, please see the CybOX Specification. This document is intended for developers and assumes some familiarity with XML.</short_description>
+            <terms_of_use>Copyright (c) 2012-2013, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the CybOX License located at http://cybox.mitre.org/about/termsofuse.html. See the CybOX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the CybOX Schema, this license header must be included. </terms_of_use>
+            <reference>http://scap.nist.gov/specifications/cpe/</reference>
+        </xs:appinfo>
+    </xs:annotation>
+    
+    <xs:import namespace="http://cpe.mitre.org/language/2.0"
+        schemaLocation="cpe-language_2.3.xsd"/>
+    <xs:import namespace="http://cybox.mitre.org/common-2" schemaLocation="../../cybox_common.xsd"/>
+    
+    <xs:complexType name="CPE23PlatformSpecificationType">
+        <xs:annotation>
+            <xs:documentation>The CPE23PlatformSpecificationType provides an extension of the PlatformSpecificationType that imports and leverages the CPE 2.3 applicability language schema for structured characterization of a platform or platform combination.</xs:documentation>
+        </xs:annotation>
+        <xs:complexContent> 
+            <xs:extension base="cyboxCommon:PlatformSpecificationType"> 
+                <xs:sequence> 
+                    <xs:element ref="cpe23:platform-specification" >
+                        <xs:annotation>
+                            <xs:documentation>The platform-specification element, defined in the CPE 2.3 Applicability Language schema, supports a structured characterization of a platform or combination of platforms.</xs:documentation>
+                        </xs:annotation>
+                    </xs:element> 
+                </xs:sequence> 
+            </xs:extension> 
+        </xs:complexContent> 
+    </xs:complexType>
+</xs:schema>

data/config/1.0.1/stix/cybox/extensions/platform/xml.xsd

@@ -0,0 +1,145 @@
+<?xml version='1.0'?>
+<xs:schema targetNamespace="http://www.w3.org/XML/1998/namespace" xmlns:xs="http://www.w3.org/2001/XMLSchema" xml:lang="en">
+
+ <xs:annotation>
+  <xs:documentation>
+   See http://www.w3.org/XML/1998/namespace.html and
+   http://www.w3.org/TR/REC-xml for information about this namespace.
+
+    This schema document describes the XML namespace, in a form
+    suitable for import by other schema documents.  
+
+    Note that local names in this namespace are intended to be defined
+    only by the World Wide Web Consortium or its subgroups.  The
+    following names are currently defined in this namespace and should
+    not be used with conflicting semantics by any Working Group,
+    specification, or document instance:
+
+    base (as an attribute name): denotes an attribute whose value
+         provides a URI to be used as the base for interpreting any
+         relative URIs in the scope of the element on which it
+         appears; its value is inherited.  This name is reserved
+         by virtue of its definition in the XML Base specification.
+
+    id   (as an attribute name): denotes an attribute whose value
+         should be interpreted as if declared to be of type ID.
+         This name is reserved by virtue of its definition in the
+         xml:id specification.
+
+    lang (as an attribute name): denotes an attribute whose value
+         is a language code for the natural language of the content of
+         any element; its value is inherited.  This name is reserved
+         by virtue of its definition in the XML specification.
+  
+    space (as an attribute name): denotes an attribute whose
+         value is a keyword indicating what whitespace processing
+         discipline is intended for the content of the element; its
+         value is inherited.  This name is reserved by virtue of its
+         definition in the XML specification.
+
+    Father (in any context at all): denotes Jon Bosak, the chair of 
+         the original XML Working Group.  This name is reserved by 
+         the following decision of the W3C XML Plenary and 
+         XML Coordination groups:
+
+             In appreciation for his vision, leadership and dedication
+             the W3C XML Plenary on this 10th day of February, 2000
+             reserves for Jon Bosak in perpetuity the XML name
+             xml:Father
+  </xs:documentation>
+ </xs:annotation>
+
+ <xs:annotation>
+  <xs:documentation>This schema defines attributes and an attribute group
+        suitable for use by
+        schemas wishing to allow xml:base, xml:lang, xml:space or xml:id
+        attributes on elements they define.
+
+        To enable this, such a schema must import this schema
+        for the XML namespace, e.g. as follows:
+        &lt;schema . . .>
+         . . .
+         &lt;import namespace="http://www.w3.org/XML/1998/namespace"
+                    schemaLocation="http://www.w3.org/2001/xml.xsd"/>
+
+        Subsequently, qualified reference to any of the attributes
+        or the group defined below will have the desired effect, e.g.
+
+        &lt;type . . .>
+         . . .
+         &lt;attributeGroup ref="xml:specialAttrs"/>
+ 
+         will define a type which will schema-validate an instance
+         element with any of those attributes</xs:documentation>
+ </xs:annotation>
+
+ <xs:annotation>
+  <xs:documentation>In keeping with the XML Schema WG's standard versioning
+   policy, this schema document will persist at
+   http://www.w3.org/2007/08/xml.xsd.
+   At the date of issue it can also be found at
+   http://www.w3.org/2001/xml.xsd.
+   The schema document at that URI may however change in the future,
+   in order to remain compatible with the latest version of XML Schema
+   itself, or with the XML namespace itself.  In other words, if the XML
+   Schema or XML namespaces change, the version of this document at
+   http://www.w3.org/2001/xml.xsd will change
+   accordingly; the version at
+   http://www.w3.org/2007/08/xml.xsd will not change.
+  </xs:documentation>
+ </xs:annotation>
+
+ <xs:attribute name="lang">
+  <xs:annotation>
+   <xs:documentation>Attempting to install the relevant ISO 2- and 3-letter
+         codes as the enumerated possible values is probably never
+         going to be a realistic possibility.  See
+         RFC 3066 at http://www.ietf.org/rfc/rfc3066.txt and the IANA registry
+         at http://www.iana.org/assignments/lang-tag-apps.htm for
+         further information.
+
+         The union allows for the 'un-declaration' of xml:lang with
+         the empty string.</xs:documentation>
+  </xs:annotation>
+  <xs:simpleType>
+   <xs:union memberTypes="xs:language">
+    <xs:simpleType>    
+     <xs:restriction base="xs:string">
+      <xs:enumeration value=""/>
+     </xs:restriction>
+    </xs:simpleType>
+   </xs:union>
+  </xs:simpleType>
+ </xs:attribute>
+
+ <xs:attribute name="space">
+  <xs:simpleType>
+   <xs:restriction base="xs:NCName">
+    <xs:enumeration value="default"/>
+    <xs:enumeration value="preserve"/>
+   </xs:restriction>
+  </xs:simpleType>
+ </xs:attribute>
+
+ <xs:attribute name="base" type="xs:anyURI">
+  <xs:annotation>
+   <xs:documentation>See http://www.w3.org/TR/xmlbase/ for
+                     information about this attribute.</xs:documentation>
+  </xs:annotation>
+ </xs:attribute>
+ 
+ <xs:attribute name="id" type="xs:ID">
+  <xs:annotation>
+   <xs:documentation>See http://www.w3.org/TR/xml-id/ for
+                     information about this attribute.</xs:documentation>
+  </xs:annotation>
+ </xs:attribute>
+
+ <xs:attributeGroup name="specialAttrs">
+  <xs:attribute ref="xml:base"/>
+  <xs:attribute ref="xml:lang"/>
+  <xs:attribute ref="xml:space"/>
+  <xs:attribute ref="xml:id"/>
+ </xs:attributeGroup>
+
+</xs:schema>