stix_schema_spy 1.0

data/config/1.0.1/stix/cybox/objects/API_Object.xsd

@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="utf-8"?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:APIObj="http://cybox.mitre.org/objects#APIObject-2" xmlns:cyboxCommon="http://cybox.mitre.org/common-2" targetNamespace="http://cybox.mitre.org/objects#APIObject-2" elementFormDefault="qualified" attributeFormDefault="unqualified" version="2.0.1">
+	<xs:annotation>
+		<xs:documentation>This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org. </xs:documentation>
+		<xs:appinfo>
+			<schema>API_Object</schema>
+			<version>2.0.1</version>
+			<date>09/30/2013 9:00:00 AM</date>
+			<short_description>The following specifies the fields and types that compose this defined CybOX Object type. Each defined object is an extension of the abstract ObjectPropertiesType, defined in CybOX Common. For more information on this extension mechanism, please see the CybOX Specification. This document is intended for developers and assumes some familiarity with XML. </short_description>
+			<terms_of_use>Copyright (c) 2012-2013, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the CybOX License located at http://cybox.mitre.org/about/termsofuse.html. See the CybOX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the CybOX Schema, this license header must be included. </terms_of_use>
+		</xs:appinfo>
+	</xs:annotation>
+	<xs:import namespace="http://cybox.mitre.org/common-2" schemaLocation="../cybox_common.xsd"/>
+	<xs:element name="API" type="APIObj:APIObjectType">
+		<xs:annotation>
+			<xs:documentation>The API element is intended to characterize a single Application Programming Interface.</xs:documentation>
+		</xs:annotation>
+	</xs:element>
+	<xs:complexType name="APIObjectType">
+		<xs:annotation>
+			<xs:documentation>The APIObjectType type is intended to characterize a specific Application Programming Interface.</xs:documentation>
+		</xs:annotation>
+		<xs:complexContent>
+			<xs:extension base="cyboxCommon:ObjectPropertiesType">
+				<xs:sequence>
+					<xs:element name="Description" type="cyboxCommon:StructuredTextType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Description property is intended for use in providing a brief description of the API.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Function_Name" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The function_name property contains the exact name of the API function called, e.g. CreateFileEx.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Normalized_Function_Name" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The normalized_function_name property contains the normalized name of the API function called, e.g. CreateFile.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Platform" type="cyboxCommon:PlatformSpecificationType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Platform property specifies the relevant platform for this API.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Address" type="cyboxCommon:HexBinaryObjectPropertyType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Address property contains the address of the API call in the binary.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+				</xs:sequence>
+			</xs:extension>
+		</xs:complexContent>
+	</xs:complexType>
+</xs:schema>

data/config/1.0.1/stix/cybox/objects/Account_Object.xsd

@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="utf-8"?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:AccountObj="http://cybox.mitre.org/objects#AccountObject-2" xmlns:cyboxCommon="http://cybox.mitre.org/common-2" targetNamespace="http://cybox.mitre.org/objects#AccountObject-2" elementFormDefault="qualified" attributeFormDefault="unqualified" version="2.0.1">
+	<xs:annotation>
+		<xs:documentation>This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org. </xs:documentation>
+		<xs:appinfo>
+			<schema>Account_Object</schema>
+			<version>2.0.1</version>
+			<date>09/30/2013 9:00:00 AM</date>
+			<short_description>The following specifies the fields and types that compose this defined CybOX Object type. Each defined object is an extension of the abstract ObjectPropertiesType, defined in CybOX Common. For more information on this extension mechanism, please see the CybOX Specification. This document is intended for developers and assumes some familiarity with XML. </short_description>
+			<terms_of_use>Copyright (c) 2012-2013, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the CybOX License located at http://cybox.mitre.org/about/termsofuse.html. See the CybOX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the CybOX Schema, this license header must be included. </terms_of_use>
+		</xs:appinfo>
+	</xs:annotation>
+	<xs:import namespace="http://cybox.mitre.org/common-2" schemaLocation="../cybox_common.xsd"/>
+	<xs:element name="Account" type="AccountObj:AccountObjectType" nillable="true">
+		<xs:annotation>
+			<xs:documentation>The Account object is intended to characterize generic accounts.</xs:documentation>
+		</xs:annotation>
+	</xs:element>
+	<xs:complexType name="AccountObjectType" mixed="false">
+		<xs:annotation>
+			<xs:documentation>The AccountObjectType type is intended to characterize generic accounts.</xs:documentation>
+		</xs:annotation>
+		<xs:complexContent>
+			<xs:extension base="cyboxCommon:ObjectPropertiesType">
+				<xs:sequence>
+					<xs:element name="Description" type="cyboxCommon:StringObjectPropertyType" minOccurs="0" maxOccurs="1">
+						<xs:annotation>
+							<xs:documentation>The Description property is used for providing a description of the account, if applicable.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Domain" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Domain property is used for specifying the domain that the account belongs to.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+				</xs:sequence>
+				<xs:attribute name="disabled" type="xs:boolean">
+					<xs:annotation>
+						<xs:documentation>The disabled field specifies whether or not the account is disabled.</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+				<xs:attribute name="locked_out" type="xs:boolean">
+					<xs:annotation>
+						<xs:documentation>The locked_out field specifies whether or not the account is locked out.</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+			</xs:extension>
+		</xs:complexContent>
+	</xs:complexType>
+</xs:schema>

data/config/1.0.1/stix/cybox/objects/Address_Object.xsd

@@ -0,0 +1,122 @@
+<?xml version="1.0" encoding="utf-8"?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2" xmlns:cyboxCommon="http://cybox.mitre.org/common-2" targetNamespace="http://cybox.mitre.org/objects#AddressObject-2" elementFormDefault="qualified" attributeFormDefault="unqualified" version="2.0.1">
+	<xs:annotation>
+		<xs:documentation>This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org. </xs:documentation>
+		<xs:appinfo>
+			<schema>Address_Object</schema>
+			<version>2.0.1</version>
+			<date>09/30/2013 9:00:00 AM</date>
+			<short_description>The following specifies the fields and types that compose this defined CybOX Object type. Each defined object is an extension of the abstract ObjectPropertiesType, defined in CybOX Common. For more information on this extension mechanism, please see the CybOX Specification. This document is intended for developers and assumes some familiarity with XML. </short_description>
+			<terms_of_use>Copyright (c) 2012-2013, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the CybOX License located at http://cybox.mitre.org/about/termsofuse.html. See the CybOX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the CybOX Schema, this license header must be included. </terms_of_use>
+		</xs:appinfo>
+	</xs:annotation>
+	<xs:import namespace="http://cybox.mitre.org/common-2" schemaLocation="../cybox_common.xsd"/>
+	<xs:element name="Address" type="AddressObj:AddressObjectType">
+		<xs:annotation>
+			<xs:documentation>The Address object is intended to specify a cyber address.</xs:documentation>
+		</xs:annotation>
+	</xs:element>
+	<xs:complexType name="AddressObjectType">
+		<xs:annotation>
+			<xs:documentation>The AddressObjectType is intended to characterize cyber addresses.</xs:documentation>
+		</xs:annotation>
+		<xs:complexContent>
+			<xs:extension base="cyboxCommon:ObjectPropertiesType">
+				<xs:sequence>
+					<xs:element name="Address_Value" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The required Address_Value construct specifies the actual value of the address.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="VLAN_Name" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The VLAN_Name property specifies the name of the Virtual LAN to which the address belongs.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="VLAN_Num" type="cyboxCommon:IntegerObjectPropertyType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The VLAN_Num property specifies the number of the Virtual LAN to which the address belongs.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+				</xs:sequence>
+				<xs:attribute name="category" type="AddressObj:CategoryTypeEnum" default="ipv4-addr">
+					<xs:annotation>
+						<xs:documentation>The category field specifies the address category that is being defined. </xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+				<xs:attribute name="is_source" type="xs:boolean">
+					<xs:annotation>
+						<xs:documentation>The is_source field specifies if this is a "Source" address</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+				<xs:attribute name="is_destination" type="xs:boolean">
+					<xs:annotation>
+						<xs:documentation>The is_destination field specifies if this is a "Destination" address</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+			</xs:extension>
+		</xs:complexContent>
+	</xs:complexType>
+	<xs:simpleType name="CategoryTypeEnum">
+		<xs:annotation>
+			<xs:documentation>The CategoryTypeEnum type is an enumeration of address types.</xs:documentation>
+		</xs:annotation>
+		<xs:restriction base="xs:NMTOKEN">
+			<xs:enumeration value="asn">
+				<xs:annotation>
+					<xs:documentation>The asn value specifies an identifier for an Autonomous System Number.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="atm">
+				<xs:annotation>
+					<xs:documentation>The atm value specifies an Asynchronous Transfer Mode address.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="cidr">
+				<xs:annotation>
+					<xs:documentation>The CIDR value specifies an address in Classless Interdomain Routing notation (the IP address and its associated routing prefix).</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="e-mail">
+				<xs:annotation>
+					<xs:documentation>The e-mail value specifies an e-mail address.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="mac">
+				<xs:annotation>
+					<xs:documentation>The mac value specifies a system's MAC address.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="ipv4-addr">
+				<xs:annotation>
+					<xs:documentation>The IPV4-addr value specifies an IPV4 address.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="ipv4-net">
+				<xs:annotation>
+					<xs:documentation/>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="ipv4-net-mask">
+				<xs:annotation>
+					<xs:documentation>The IPV4-net-mask value specifies an IPV4 bitwise netmask.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="ipv6-addr">
+				<xs:annotation>
+					<xs:documentation>The IPV4-addr value specifies an IPV6 address.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="ipv6-net">
+				<xs:annotation>
+					<xs:documentation/>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="ipv6-net-mask">
+				<xs:annotation>
+					<xs:documentation>The IPV6-net-mask value specifies an IPV6 bitwise netmask.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+		</xs:restriction>
+	</xs:simpleType>
+</xs:schema>

data/config/1.0.1/stix/cybox/objects/Artifact_Object.xsd

@@ -0,0 +1,206 @@
+<?xml version="1.0" encoding="utf-8"?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:ArtifactObj="http://cybox.mitre.org/objects#ArtifactObject-2" xmlns:cyboxCommon="http://cybox.mitre.org/common-2" targetNamespace="http://cybox.mitre.org/objects#ArtifactObject-2" elementFormDefault="qualified" attributeFormDefault="unqualified" version="2.0.1">
+	<xs:annotation>
+		<xs:documentation>This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org. </xs:documentation>
+		<xs:appinfo>
+			<schema>Artifact_Object</schema>
+			<version>2.0.1</version>
+			<date>09/30/2013 9:00:00 AM</date>
+			<short_description>The following specifies the fields and types that compose this defined CybOX Object type. Each defined object is an extension of the abstract ObjectPropertiesType, defined in CybOX Common. For more information on this extension mechanism, please see the CybOX Specification. This document is intended for developers and assumes some familiarity with XML. </short_description>
+			<terms_of_use>Copyright (c) 2012-2013, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the CybOX License located at http://cybox.mitre.org/about/termsofuse.html. See the CybOX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the CybOX Schema, this license header must be included. </terms_of_use>
+		</xs:appinfo>
+	</xs:annotation>
+	<xs:import namespace="http://cybox.mitre.org/common-2" schemaLocation="../cybox_common.xsd"/>
+	<xs:element name="Artifact" type="ArtifactObj:ArtifactObjectType">
+		<xs:annotation>
+			<xs:documentation>The Artifact object is intended to encapsulate and convey the content of a Raw Artifact.</xs:documentation>
+		</xs:annotation>
+	</xs:element>
+	<xs:complexType name="ArtifactObjectType">
+		<xs:annotation>
+			<xs:documentation>The ArtifactObjectType type is intended to encapsulate and convey the content of a Raw Artifact.</xs:documentation>
+		</xs:annotation>
+		<xs:complexContent>
+			<xs:extension base="cyboxCommon:ObjectPropertiesType">
+				<xs:sequence>
+					<xs:element name="Hashes" type="cyboxCommon:HashListType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Hashes field is optional and specifies hashes for the Raw_Artifact content.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Packaging" type="ArtifactObj:PackagingType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Packaging field is optional and characterizes packaging layers (e.g. compression, encryption, encoding) applied to the original content to generate the content of the Raw_Artifact field of this Object. The ordering of entries in this sequence implicitly denotes the ordering of packaging layer operations applied.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:choice>
+						<xs:element name="Raw_Artifact" type="ArtifactObj:RawArtifactType" minOccurs="0">
+							<xs:annotation>
+								<xs:documentation>The Raw_Artifact field contains the raw content of a cyber artifact (rather than simply analysis of that artifact). It is conveyed within a string-based field and should be further enclosed in a CDATA section within the string-based field.</xs:documentation>
+							</xs:annotation>
+						</xs:element>
+						<xs:element name="Raw_Artifact_Reference" type="xs:anyURI" minOccurs="0">
+							<xs:annotation>
+								<xs:documentation>The Raw_Artifact_Reference field contains a reference to an external instance of the raw content of a cyber artifact (rather than simply analysis of that artifact).</xs:documentation>
+							</xs:annotation>
+						</xs:element>
+					</xs:choice>
+				</xs:sequence>
+				<xs:attribute name="type" type="ArtifactObj:ArtifactTypeEnum">
+					<xs:annotation>
+						<xs:documentation>The type field specifies the general type of the artifact contained in this Defined Object.</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+				<xs:attribute name="content_type" type="xs:string">
+					<xs:annotation>
+						<xs:documentation>The content_type field is optional and specifies the Internet Media Type of the artifact contained in this Defined Object.</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+				<xs:attribute name="content_type_version" type="xs:string">
+					<xs:annotation>
+						<xs:documentation>The content_type_version field is optional and specifies the content type version of the artifact contained in this Defined Object.</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+				<xs:attribute name="suspected_malicious" type="xs:boolean">
+					<xs:annotation>
+						<xs:documentation>The suspected_malicious field is optional and conveys whether the content of the Raw_Artifact is believed to be malicoius.</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+			</xs:extension>
+		</xs:complexContent>
+	</xs:complexType>
+	<xs:complexType name="RawArtifactType">
+		<xs:annotation>
+			<xs:documentation>The RawArtifactType is intended to convey, with minimal characterization, the content of the Raw Artifact itself.</xs:documentation>
+		</xs:annotation>
+		<xs:complexContent>
+			<xs:extension base="cyboxCommon:StringObjectPropertyType"/>
+		</xs:complexContent>
+	</xs:complexType>
+	<xs:complexType name="PackagingType">
+		<xs:annotation>
+			<xs:documentation>The PackagingType captures any packaging layers applied to an artifact.</xs:documentation>
+		</xs:annotation>
+		<xs:sequence>
+			<xs:choice maxOccurs="unbounded">
+				<xs:element name="Compression" type="ArtifactObj:CompressionType" minOccurs="0">
+					<xs:annotation>
+						<xs:documentation>The Compression field is optional and specifies details for a compression layer applied to the content of the Raw_Artifact.</xs:documentation>
+					</xs:annotation>
+				</xs:element>
+				<xs:element name="Encryption" type="ArtifactObj:EncryptionType" minOccurs="0">
+					<xs:annotation>
+						<xs:documentation>The Encryption field is optional and specifies details for an encryption layer applied to the content of the Raw_Artifact.</xs:documentation>
+					</xs:annotation>
+				</xs:element>
+				<xs:element name="Encoding" type="ArtifactObj:EncodingType" minOccurs="0">
+					<xs:annotation>
+						<xs:documentation>The Encoding field is optional and specifies details for an encoding layer applied to the content of the Raw_Artifact.</xs:documentation>
+					</xs:annotation>
+				</xs:element>
+			</xs:choice>
+		</xs:sequence>
+		<xs:attribute name="is_encrypted" type="xs:boolean">
+			<xs:annotation>
+				<xs:documentation>The is_encrypted field is optional and specifies whether the Raw_Artifact content is protected/encrypted.</xs:documentation>
+			</xs:annotation>
+		</xs:attribute>
+		<xs:attribute name="is_compressed" type="xs:boolean">
+			<xs:annotation>
+				<xs:documentation>The is_compressed field is optional and specifies whether the Raw_Artifact content is compressed.</xs:documentation>
+			</xs:annotation>
+		</xs:attribute>
+	</xs:complexType>
+	<xs:complexType name="CompressionType">
+		<xs:annotation>
+			<xs:documentation>The CompressionType captures any compression packaging details for an artifact.</xs:documentation>
+		</xs:annotation>
+		<xs:attribute name="compression_mechanism" type="xs:string">
+			<xs:annotation>
+				<xs:documentation>The compression_mechanism field is optional and specifies the compression algorithm utilized to protect the Raw_Artifact content.</xs:documentation>
+			</xs:annotation>
+		</xs:attribute>
+		<xs:attribute name="compression_mechanism_ref" type="xs:anyURI">
+			<xs:annotation>
+				<xs:documentation>The compression_mechanism_ref field is optional and conveys a reference to a description of the compression algorithm utilized to protect the Raw_Artifact content.</xs:documentation>
+			</xs:annotation>
+		</xs:attribute>
+	</xs:complexType>
+	<xs:complexType name="EncryptionType">
+		<xs:annotation>
+			<xs:documentation>The EncryptionType captures any encryption packaging details for an artifact.</xs:documentation>
+		</xs:annotation>
+		<xs:attribute name="encryption_mechanism" type="xs:string">
+			<xs:annotation>
+				<xs:documentation>The encryption_mechanism field is optional and specifies the protection/encryption algorithm utilized to protect the Raw_Artifact content.</xs:documentation>
+			</xs:annotation>
+		</xs:attribute>
+		<xs:attribute name="encryption_mechanism_ref" type="xs:anyURI">
+			<xs:annotation>
+				<xs:documentation>The encryption_mechanism_ref field is optional and conveys a reference to a description of the protection/encryption algorithm utilized to protect the Raw_Artifact content.</xs:documentation>
+			</xs:annotation>
+		</xs:attribute>
+		<xs:attribute name="encryption_key" type="xs:string">
+			<xs:annotation>
+				<xs:documentation>The encryption_key field is optional and locally specifies the password for unprotecting/decrypting the Raw_Artifact content. </xs:documentation>
+			</xs:annotation>
+		</xs:attribute>
+		<xs:attribute name="encryption_key_ref" type="xs:anyURI">
+			<xs:annotation>
+				<xs:documentation>The encryption_key_ref field is optional and specifies a reference to a remote specification of the password for unprotecting/decrypting the Raw_Artifact content. </xs:documentation>
+			</xs:annotation>
+		</xs:attribute>
+	</xs:complexType>
+	<xs:complexType name="EncodingType">
+		<xs:annotation>
+			<xs:documentation>The EncodingType captures any encoding packaging details for an artifact.</xs:documentation>
+		</xs:annotation>
+		<xs:attribute name="algorithm" type="xs:string" default="Base64">
+			<xs:annotation>
+				<xs:documentation>The algorithm field is optional and specifies the encoding algorithm utilized to encode the Raw_Artifact.</xs:documentation>
+			</xs:annotation>
+		</xs:attribute>
+		<xs:attribute name="character_set" type="xs:string">
+			<xs:annotation>
+				<xs:documentation>The character_set field is optional and specifies the character set utilized in the Raw_Artifact content encoding.</xs:documentation>
+			</xs:annotation>
+		</xs:attribute>
+		<xs:attribute name="custom_character_set_ref" type="xs:anyURI">
+			<xs:annotation>
+				<xs:documentation>The custom_character_set_ref field is optional and conveys a reference to a specification of the custom character set used to encode the Raw_Artifact.</xs:documentation>
+			</xs:annotation>
+		</xs:attribute>
+	</xs:complexType>
+	<xs:simpleType name="ArtifactTypeEnum">
+		<xs:annotation>
+			<xs:documentation>The ArtifactTypeEnum is a (non-exhaustive) enumeration of cyber raw artifact types.</xs:documentation>
+		</xs:annotation>
+		<xs:restriction base="xs:string">
+			<xs:enumeration value="File">
+				<xs:annotation>
+					<xs:documentation>The File value specifies that the artifact is a file.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="Memory Region">
+				<xs:annotation>
+					<xs:documentation>The Memory Region value specifies that the artifact is a block of data from a region of memory.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="File System Fragment">
+				<xs:annotation>
+					<xs:documentation>The File System Fragment value specifies that the artifact is a block of data from a file system.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="Network Traffic">
+				<xs:annotation>
+					<xs:documentation>The Network Traffic value specifies that the artifact is a block of network traffic data such as PCAP.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="Generic Data Region">
+				<xs:annotation>
+					<xs:documentation>The Generic Data Region value specifies that the artifact is a block of data from an unknown source.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+		</xs:restriction>
+	</xs:simpleType>
+</xs:schema>

data/config/1.0.1/stix/cybox/objects/Code_Object.xsd

@@ -0,0 +1,417 @@
+<?xml version="1.0" encoding="utf-8"?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:CodeObj="http://cybox.mitre.org/objects#CodeObject-2" xmlns:cyboxCommon="http://cybox.mitre.org/common-2" targetNamespace="http://cybox.mitre.org/objects#CodeObject-2" elementFormDefault="qualified" attributeFormDefault="unqualified" version="2.0.1">
+	<xs:annotation>
+		<xs:documentation>This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org. </xs:documentation>
+		<xs:appinfo>
+			<schema>Code_Object</schema>
+			<version>2.0.1</version>
+			<date>02/11/2013 9:00:00 AM</date>
+			<short_description>The following specifies the fields and types that compose this defined CybOX Object type. Each defined object is an extension of the abstract ObjectPropertiesType, defined in CybOX Common. For more information on this extension mechanism, please see the CybOX Specification. This document is intended for developers and assumes some familiarity with XML. </short_description>
+			<terms_of_use>Copyright (c) 2012-2013, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the CybOX License located at http://cybox.mitre.org/about/termsofuse.html. See the CybOX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the CybOX Schema, this license header must be included. </terms_of_use>
+		</xs:appinfo>
+	</xs:annotation>
+	<xs:import namespace="http://cybox.mitre.org/common-2" schemaLocation="../cybox_common.xsd"/>
+	<xs:element name="Code_Object" type="CodeObj:CodeObjectType">
+		<xs:annotation>
+			<xs:documentation>The Code object is intended to characterize a body of computer code.</xs:documentation>
+		</xs:annotation>
+	</xs:element>
+	<xs:complexType name="CodeObjectType">
+		<xs:annotation>
+			<xs:documentation>The CodeObjectType type is intended to characterize a body of computer code.</xs:documentation>
+		</xs:annotation>
+		<xs:complexContent>
+			<xs:extension base="cyboxCommon:ObjectPropertiesType">
+				<xs:sequence>
+					<xs:element name="Description" type="cyboxCommon:StructuredTextType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Description field is intended for use in providing a brief description of the code that is encapsulated in this field.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Type" type="CodeObj:CodeTypeType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The type field is intended to provide a way of specifying the type of code being characterized.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Purpose" type="CodeObj:CodePurposeType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The type field is intended to provide a way of specifying the purpose or flavor of code being characterized.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Code_Language" type="CodeObj:CodeLanguageType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The code_language field refers to the code language used in the code characterized in this field.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Targeted_Platforms" type="CodeObj:TargetedPlatformsType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Targeted_Platforms field specifies a list platforms that this code is targeted for.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Processor_Family" type="CodeObj:ProcessorTypeType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The processor_family field specifies the class of processor that the code snippet is targeting. Possible values: x86-32, x86-64, IA-64, PowerPC, ARM, Alpha, SPARC, z/Architecture, eSi-RISC, MIPS, Motorola 68k, Other.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Discovery_Method" type="cyboxCommon:MeasureSourceType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Discovery_Method field is intended to characterize the method and/or tool used to discover the code.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Start_Address" type="cyboxCommon:HexBinaryObjectPropertyType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The start_address field can be used to reference the start address of the code, if it was discovered inside a binary.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Code_Segment" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Code_Segment field encompasses any arbitrary code segment in un-encoded (plaintext or binary) format. Code would typically be included here within a CDATA section.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Code_Segment_XOR" type="CodeObj:CodeSegmentXORType" form="qualified" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Code_Segment_XOR field encompasses any arbitrary code segment. Its contents should contain the actual code segment XORed with the pattern defined in the xorpattern property. This is so that the code contained in the pattern does not trigger IDS, AV, or other signature-based scanners. XOR'd Code would typically be included here within a CDATA section.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Digital_Signatures" type="cyboxCommon:DigitalSignaturesType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Digital_Signatures field is optional and captures one or more digital signatures for the code.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Extracted_Features" type="cyboxCommon:ExtractedFeaturesType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>A description of features extracted from this code segment.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+				</xs:sequence>
+			</xs:extension>
+		</xs:complexContent>
+	</xs:complexType>
+	<xs:complexType name="CodeTypeType">
+		<xs:annotation>
+			<xs:documentation>CodeTypeType specifies types of code, via a union of the CodeTypeEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.</xs:documentation>
+		</xs:annotation>
+		<xs:simpleContent>
+			<xs:restriction base="cyboxCommon:BaseObjectPropertyType">
+				<xs:simpleType>
+					<xs:union memberTypes="CodeObj:CodeTypeEnum xs:string"/>
+				</xs:simpleType>
+				<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" fixed="string">
+					<xs:annotation>
+						<xs:documentation>This field is optional and specifies the expected type for the value of the specified field.</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+			</xs:restriction>
+		</xs:simpleContent>
+	</xs:complexType>
+	<xs:complexType name="CodeSegmentXORType">
+		<xs:annotation>
+			<xs:documentation>Used to encapsulate a segment of code that has been XORed with a pattern in order to avoid tripping anti-virus detection.</xs:documentation>
+		</xs:annotation>
+		<xs:simpleContent>
+			<xs:extension base="cyboxCommon:StringObjectPropertyType">
+				<xs:attribute name="xor_pattern" type="xs:hexBinary" default="55AA55AA55AA55BB" use="optional">
+					<xs:annotation>
+						<xs:documentation>The xor_pattern field contains a 16-hexadecimal-character hex string, which represents the pattern that the Code_Segment_XOR field should be XORed with in order to recover the actual code. The default value is 55AA55AA55AA55BB, as specified by IETF RFC 5901.</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+			</xs:extension>
+		</xs:simpleContent>
+	</xs:complexType>
+	<xs:simpleType name="CodeTypeEnum">
+		<xs:annotation>
+			<xs:documentation>CodeTypeEnum is a (non-exhaustive) enumeration of code types.</xs:documentation>
+		</xs:annotation>
+		<xs:restriction base="xs:string">
+			<xs:enumeration value="Source_Code">
+				<xs:annotation>
+					<xs:documentation>The code represented is in the form of Source Code</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="Byte_Code">
+				<xs:annotation>
+					<xs:documentation>The code represented is in the form of Byte Code</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="Binary_Code">
+				<xs:annotation>
+					<xs:documentation>The code represented is in the form of Binar Code</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+		</xs:restriction>
+	</xs:simpleType>
+	<xs:complexType name="CodePurposeType">
+		<xs:annotation>
+			<xs:documentation>CodePurposeType specifies intended purposes of code, via a union of the CodePurposeEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.</xs:documentation>
+		</xs:annotation>
+		<xs:simpleContent>
+			<xs:restriction base="cyboxCommon:BaseObjectPropertyType">
+				<xs:simpleType>
+					<xs:union memberTypes="CodeObj:CodePurposeEnum xs:string"/>
+				</xs:simpleType>
+				<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" fixed="string">
+					<xs:annotation>
+						<xs:documentation>This field is optional and specifies the expected type for the value of the specified field.</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+			</xs:restriction>
+		</xs:simpleContent>
+	</xs:complexType>
+	<xs:simpleType name="CodePurposeEnum">
+		<xs:annotation>
+			<xs:documentation>CodePurposeEnum is a (non-exhaustive) enumeration of classes of code intended purposes.</xs:documentation>
+		</xs:annotation>
+		<xs:restriction base="xs:string">
+			<xs:enumeration value="Application_Code">
+				<xs:annotation>
+					<xs:documentation>The code represented is intended as application code.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="Library_Code">
+				<xs:annotation>
+					<xs:documentation>The code represented is intended as library code.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="Shellcode">
+				<xs:annotation>
+					<xs:documentation>The code represented is intended as shell code.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="Exploit_Code">
+				<xs:annotation>
+					<xs:documentation>The code represented is intended as exploit code.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="Unknown">
+				<xs:annotation>
+					<xs:documentation>The code represented is intended for unknown purposes.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="Other">
+				<xs:annotation>
+					<xs:documentation>The code represented is intended for a purpose other than thos listed in this enumeration.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+		</xs:restriction>
+	</xs:simpleType>
+	<xs:complexType name="CodeLanguageType">
+		<xs:annotation>
+			<xs:documentation>CodeLanguageType specifies languages of code, via a union of the CodeLanguageEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.</xs:documentation>
+		</xs:annotation>
+		<xs:simpleContent>
+			<xs:restriction base="cyboxCommon:BaseObjectPropertyType">
+				<xs:simpleType>
+					<xs:union memberTypes="CodeObj:CodeLanguageEnum xs:string"/>
+				</xs:simpleType>
+				<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" fixed="string">
+					<xs:annotation>
+						<xs:documentation>This field is optional and specifies the expected type for the value of the specified field.</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+			</xs:restriction>
+		</xs:simpleContent>
+	</xs:complexType>
+	<xs:simpleType name="CodeLanguageEnum">
+		<xs:annotation>
+			<xs:documentation>The CodeLanguageEnum simple type is an (non-exhaustive) enumeration of computer code languages.</xs:documentation>
+		</xs:annotation>
+		<xs:restriction base="xs:string">
+			<xs:enumeration value="C">
+				<xs:annotation>
+					<xs:documentation>Indicates the code is written in the C programming language</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="C++">
+				<xs:annotation>
+					<xs:documentation>Indicates the code is written in the C++ programming language</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="C#">
+				<xs:annotation>
+					<xs:documentation>Indicates the code is written in the C# programming language</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="Java">
+				<xs:annotation>
+					<xs:documentation>Indicates the code is written in the Java programming language</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="JSP">
+				<xs:annotation>
+					<xs:documentation>Indicates the code is written in the JSP (Java Server Pages) language</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="Javascript">
+				<xs:annotation>
+					<xs:documentation>Indicates the code is written in the Javascript programming language</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="ASP.NET">
+				<xs:annotation>
+					<xs:documentation>Indicates the code is written in the ASP.NET programming language</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="SQL">
+				<xs:annotation>
+					<xs:documentation>Indicates the code is written in SQL (Standard Query Language)</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="Python">
+				<xs:annotation>
+					<xs:documentation>Indicates the code is written in the Python programming language</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="Perl">
+				<xs:annotation>
+					<xs:documentation>Indicates the code is written in the Perl programming language</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="PHP">
+				<xs:annotation>
+					<xs:documentation>Indicates the code is written in the PHP programming language</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="SOAP">
+				<xs:annotation>
+					<xs:documentation>Indicates the code is written as a SOAP message</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="Ruby">
+				<xs:annotation>
+					<xs:documentation>Indicates the code is written in the Ruby programming language</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="Shell">
+				<xs:annotation>
+					<xs:documentation>Indicates the code is written as a Shell script</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="PseudoCode">
+				<xs:annotation>
+					<xs:documentation>Indicates the code is written as psuedo code</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value=".NET">
+				<xs:annotation>
+					<xs:documentation>Indicates the code utilizes the .NET framework</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="Assembly">
+				<xs:annotation>
+					<xs:documentation>Indicates the code is written in an assembly language</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="XML">
+				<xs:annotation>
+					<xs:documentation>Indicates the code is written in XML (eXtensible Markup Language)</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="HTML">
+				<xs:annotation>
+					<xs:documentation>Indicates the code is written in HTML (HyperText Markup Language)</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="Other">
+				<xs:annotation>
+					<xs:documentation>Indicates the code is written in a language not found in this enumeration</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+		</xs:restriction>
+	</xs:simpleType>
+	<xs:complexType name="ProcessorTypeType">
+		<xs:annotation>
+			<xs:documentation>ProcessorTypeType specifies relevant processor families, via a union of the ProcessorTypeEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.</xs:documentation>
+		</xs:annotation>
+		<xs:simpleContent>
+			<xs:restriction base="cyboxCommon:BaseObjectPropertyType">
+				<xs:simpleType>
+					<xs:union memberTypes="CodeObj:ProcessorTypeEnum xs:string"/>
+				</xs:simpleType>
+				<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" fixed="string">
+					<xs:annotation>
+						<xs:documentation>This attribute is optional and specifies the expected type for the value of the specified property.</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+			</xs:restriction>
+		</xs:simpleContent>
+	</xs:complexType>
+	<xs:simpleType name="ProcessorTypeEnum">
+		<xs:annotation>
+			<xs:documentation>The ProcessorTypeEnum simple type is an (non-exhaustive) enumeration of computer processor architectures.</xs:documentation>
+		</xs:annotation>
+		<xs:restriction base="xs:string">
+			<xs:enumeration value="x86-32">
+				<xs:annotation>
+					<xs:documentation>Indicates a x86 32bit processor</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="x86-64">
+				<xs:annotation>
+					<xs:documentation>Indicates a x86 64bit processor</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="IA-64">
+				<xs:annotation>
+					<xs:documentation>Indicates an IA (Intel Itanium) 64bit processor</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="PowerPC">
+				<xs:annotation>
+					<xs:documentation>Indicates a PowerPC processor</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="ARM">
+				<xs:annotation>
+					<xs:documentation>Indicates an ARM processor</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="Alpha">
+				<xs:annotation>
+					<xs:documentation>Indicates an Alpha processor</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="SPARC">
+				<xs:annotation>
+					<xs:documentation>Indicates a SPARC processor</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="z/Architecture">
+				<xs:annotation>
+					<xs:documentation>Indicates a z/Architecture (IBM) processor</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="eSi-RISC">
+				<xs:annotation>
+					<xs:documentation>Indicates an eSi-RISC processor</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="MIPS">
+				<xs:annotation>
+					<xs:documentation>Indicates a MIPS processor</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="Motorola 68k">
+				<xs:annotation>
+					<xs:documentation>Indicates a Motorola 68k processor</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="Other">
+				<xs:annotation>
+					<xs:documentation>Indicates a processor outside of this enumeration</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+		</xs:restriction>
+	</xs:simpleType>
+	<xs:complexType name="TargetedPlatformsType">
+		<xs:annotation>
+			<xs:documentation>A list of targeted platforms</xs:documentation>
+		</xs:annotation>
+		<xs:sequence>
+			<xs:element name="Targeted_Platform" type="cyboxCommon:PlatformSpecificationType" maxOccurs="unbounded">
+				<xs:annotation>
+					<xs:documentation>The Targeted_Platform field specifies a particular platform that this code is targeted for.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+		</xs:sequence>
+	</xs:complexType>
+</xs:schema>