stix_schema_spy 1.0

data/config/1.0.1/stix/cybox/objects/Disk_Partition_Object.xsd

@@ -0,0 +1,199 @@
+<?xml version="1.0" encoding="utf-8"?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:DiskPartitionObj="http://cybox.mitre.org/objects#DiskPartitionObject-2" xmlns:cyboxCommon="http://cybox.mitre.org/common-2" targetNamespace="http://cybox.mitre.org/objects#DiskPartitionObject-2" elementFormDefault="qualified" attributeFormDefault="unqualified" version="2.0.1">
+	<xs:annotation>
+		<xs:documentation>This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org. </xs:documentation>
+		<xs:appinfo>
+			<schema>Disk_Partition_Object</schema>
+			<version>2.0.1</version>
+			<date>09/30/2013 9:00:00 AM</date>
+			<short_description>The following specifies the fields and types that compose this defined CybOX Object type. Each defined object is an extension of the abstract ObjectPropertiesType, defined in CybOX Common. For more information on this extension mechanism, please see the CybOX Specification. This document is intended for developers and assumes some familiarity with XML. </short_description>
+			<terms_of_use>Copyright (c) 2012-2013, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the CybOX License located at http://cybox.mitre.org/about/termsofuse.html. See the CybOX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the CybOX Schema, this license header must be included. </terms_of_use>
+		</xs:appinfo>
+	</xs:annotation>
+	<xs:import namespace="http://cybox.mitre.org/common-2" schemaLocation="../cybox_common.xsd"/>
+	<xs:element name="Disk_Partition" type="DiskPartitionObj:DiskPartitionObjectType" nillable="true">
+		<xs:annotation>
+			<xs:documentation>The Disk_Partition object is intended to characterize a single partition of a disk drive.</xs:documentation>
+		</xs:annotation>
+	</xs:element>
+	<xs:complexType name="DiskPartitionObjectType" mixed="false">
+		<xs:annotation>
+			<xs:documentation>The DiskPartitionType type is intended to characterize partitions of disk drives.</xs:documentation>
+		</xs:annotation>
+		<xs:complexContent>
+			<xs:extension base="cyboxCommon:ObjectPropertiesType">
+				<xs:sequence>
+					<xs:element name="Created" type="cyboxCommon:DateTimeObjectPropertyType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Created field specifies the date/time the partition was created.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Device_Name" type="cyboxCommon:NameObjectPropertyType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Device_Name field specifies the name of the device on which the partition resides.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Mount_Point" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Mount_Point field specifies the mount point of the partition.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Partition_ID" type="cyboxCommon:IntegerObjectPropertyType">
+						<xs:annotation>
+							<xs:documentation>The Partition_ID field specifies the numerical identifier of the partition.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Partition_Length" type="cyboxCommon:UnsignedLongObjectPropertyType" nillable="true" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Partition_Length field specifies the length of the partition, in bytes.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Partition_Offset" type="cyboxCommon:UnsignedLongObjectPropertyType" nillable="true" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Partition_Offset field specifies the starting offset of the partition, in bytes.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Space_Left" type="cyboxCommon:UnsignedLongObjectPropertyType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Space_Left field specifies the amount of space left on the partition, in bytes.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Space_Used" type="cyboxCommon:UnsignedLongObjectPropertyType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Space_Used field specifies the amount of space used on the partition, in bytes.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Total_Space" type="cyboxCommon:UnsignedLongObjectPropertyType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Total_Space field specifies the total amount of space available on the partition, in bytes.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Type" type="DiskPartitionObj:PartitionType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Type field specifies the type of partition being characterized. </xs:documentation>
+						</xs:annotation>
+					</xs:element>
+				</xs:sequence>
+			</xs:extension>
+		</xs:complexContent>
+	</xs:complexType>
+	<xs:complexType name="PartitionType">
+		<xs:annotation>
+			<xs:documentation>PartitionType specifies partition types, via a union of the PartitionTypeEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.</xs:documentation>
+		</xs:annotation>
+		<xs:simpleContent>
+			<xs:restriction base="cyboxCommon:BaseObjectPropertyType">
+				<xs:simpleType>
+					<xs:union memberTypes="DiskPartitionObj:PartitionTypeEnum xs:string"/>
+				</xs:simpleType>
+				<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" fixed="string">
+					<xs:annotation>
+						<xs:documentation>This attribute is optional and specifies the expected type for the value of the specified property.</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+			</xs:restriction>
+		</xs:simpleContent>
+	</xs:complexType>
+	<xs:simpleType name="PartitionTypeEnum">
+		<xs:annotation>
+			<xs:documentation>The PartitionTypeEnum type is a non-exhaustive enumeration of partition types. See http://www.win.tue.nl/~aeb/partitions/partition_types-1.html for more information about the various partition types.</xs:documentation>
+		</xs:annotation>
+		<xs:restriction base="xs:string">
+			<xs:enumeration value="PARTITION_ENTRY_UNUSED">
+				<xs:annotation>
+					<xs:documentation>Indicates an unused partition entry.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="PARTITION_FAT_12">
+				<xs:annotation>
+					<xs:documentation>Indicates a FAT 12 partition.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="PARTITION_XENIX_1">
+				<xs:annotation>
+					<xs:documentation>Indicates a XENIX type 1 partition.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="PARTITION_XENIX_2">
+				<xs:annotation>
+					<xs:documentation>Indicates a XENIX type 2 partition.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="PARTITION_FAT_16">
+				<xs:annotation>
+					<xs:documentation>Indicates a XENIX FAT 16 partition.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="PARTITION_EXTENDED">
+				<xs:annotation>
+					<xs:documentation>Indicates a XENIX extended partition.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="PARTITION_HUGE">
+				<xs:annotation>
+					<xs:documentation>Specifies an MS-DOS V4 huge partition. This value indicates that there is no Microsoft file system on the partition. Use this value when creating a logical volume.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="PARTITION_IFS">
+				<xs:annotation>
+					<xs:documentation>Indicates an IFS partition.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="PARTITION_OS2BOOTMGR">
+				<xs:annotation>
+					<xs:documentation>Indicates an OS/2 boot manager partition.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="PARTITION_FAT32">
+				<xs:annotation>
+					<xs:documentation>Indicates a FAT32 partition.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="PARTITION_FAT32_XINT13">
+				<xs:annotation>
+					<xs:documentation>Indicates a FAT32 Extended-INT13 equivalent partition to the FAT32 partition.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="PARTITION_XINT13">
+				<xs:annotation>
+					<xs:documentation>Indicates an XINT13 partition.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="PARTITION_XINT13_EXTENDED">
+				<xs:annotation>
+					<xs:documentation>Indicates an extended XINT13 partition.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="PARTITION_PREP">
+				<xs:annotation>
+					<xs:documentation>Indicates a PReP (Power PC Reference Platform) partition.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="PARTITION_LDM">
+				<xs:annotation>
+					<xs:documentation>Indicates an LDM partition.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="PARTITION_UNIX">
+				<xs:annotation>
+					<xs:documentation>Indicates a UNIX partition.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="VALID_NTFT">
+				<xs:annotation>
+					<xs:documentation>Specifies a valid NTFT partition. The high bit of a partition type code indicates that a partition is part of an NTFT mirror or striped array.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="PARTITION_NTFT">
+				<xs:annotation>
+					<xs:documentation>Specifies an NTFT partition.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="UNKNOWN">
+				<xs:annotation>
+					<xs:documentation>Refers to an unknown partition or a partition other than those listed.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+		</xs:restriction>
+	</xs:simpleType>
+</xs:schema>

data/config/1.0.1/stix/cybox/objects/Email_Message_Object.xsd

@@ -0,0 +1,273 @@
+<?xml version="1.0" encoding="utf-8"?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:EmailMessageObj="http://cybox.mitre.org/objects#EmailMessageObject-2" xmlns:cyboxCommon="http://cybox.mitre.org/common-2" xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2" targetNamespace="http://cybox.mitre.org/objects#EmailMessageObject-2" elementFormDefault="qualified" attributeFormDefault="unqualified" version="2.0.1">
+	<xs:annotation>
+		<xs:documentation>This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org. </xs:documentation>
+		<xs:appinfo>
+			<schema>Email_Message_Object</schema>
+			<version>2.0.1</version>
+			<date>09/30/2013 9:00:00 AM</date>
+			<short_description>The following specifies the fields and types that compose this defined CybOX Object type. Each defined object is an extension of the abstract ObjectPropertiesType, defined in CybOX Common. For more information on this extension mechanism, please see the CybOX Specification. This document is intended for developers and assumes some familiarity with XML. </short_description>
+			<terms_of_use>Copyright (c) 2012-2013, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the CybOX License located at http://cybox.mitre.org/about/termsofuse.html. See the CybOX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the CybOX Schema, this license header must be included. </terms_of_use>
+		</xs:appinfo>
+	</xs:annotation>
+	<xs:import namespace="http://cybox.mitre.org/common-2" schemaLocation="../cybox_common.xsd"/>
+	<xs:import namespace="http://cybox.mitre.org/objects#AddressObject-2" schemaLocation="Address_Object.xsd"/>
+	<xs:element name="Email_Message" type="EmailMessageObj:EmailMessageObjectType">
+		<xs:annotation>
+			<xs:documentation>The Email_Message object is intended to characterize an individual email message.</xs:documentation>
+		</xs:annotation>
+	</xs:element>
+	<xs:complexType name="EmailMessageObjectType" mixed="false">
+		<xs:annotation>
+			<xs:documentation>The EmailMessageObjectType type is intended to characterize an individual email message.</xs:documentation>
+		</xs:annotation>
+		<xs:complexContent>
+			<xs:extension base="cyboxCommon:ObjectPropertiesType">
+				<xs:sequence>
+					<xs:element name="Header" type="EmailMessageObj:EmailHeaderType" minOccurs="0" maxOccurs="1">
+						<xs:annotation>
+							<xs:documentation>The Header field specifies a variety of common headers that may be included in the email message.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Email_Server" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Email_Server field is optional and specifies the relevant email server.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Raw_Body" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Raw_Body field specifies the complete (raw) body of the email message.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Raw_Header" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Raw_Header field specifies the complete (raw) headers of the email message.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Attachments" type="EmailMessageObj:AttachmentsType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Attachments field specifies any files that were attached to the email message. It imports and uses the CybOX FileObjectType from the File_Object to do so.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Links" minOccurs="0" type="EmailMessageObj:LinksType">
+						<xs:annotation>
+							<xs:documentation>The Links field specifies any URL links contained within the email message. It imports and uses the CybOX LinkObjectType from the Link_Object to do so.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+				</xs:sequence>
+			</xs:extension>
+		</xs:complexContent>
+	</xs:complexType>
+	<xs:complexType name="AttachmentsType">
+		<xs:annotation>
+			<xs:documentation>The AttachmenstType captures a list of attachments for an email message.</xs:documentation>
+		</xs:annotation>
+		<xs:sequence>
+			<xs:element name="File" type="EmailMessageObj:AttachmentReferenceType" maxOccurs="unbounded">
+				<xs:annotation>
+					<xs:documentation>The File field specifies a file that was attached to the email message, via a reference to an Object included elsewhere in the document.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+		</xs:sequence>
+	</xs:complexType>
+	<xs:complexType name="EmailHeaderType">
+		<xs:annotation>
+			<xs:documentation>The EmailHeaderType captures a representation of a standard email header.</xs:documentation>
+		</xs:annotation>
+		<xs:sequence>
+			<xs:element minOccurs="0" name="Received_Lines" type="EmailMessageObj:EmailReceivedLineListType">
+				<xs:annotation>
+					<xs:documentation>The Received_Lines field specifies one or more 'Received' lines that may be included in the email header.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element name="To" type="EmailMessageObj:EmailRecipientsType" minOccurs="0">
+				<xs:annotation>
+					<xs:documentation>The To field specifies the email addresses of the recipients of the email message.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element name="CC" type="EmailMessageObj:EmailRecipientsType" minOccurs="0">
+				<xs:annotation>
+					<xs:documentation>The CC field specifies the email addresses of any recipients that were included in the carbon copy header of the email message.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element name="BCC" type="EmailMessageObj:EmailRecipientsType" minOccurs="0">
+				<xs:annotation>
+					<xs:documentation>The BCC field specifies the email addresses of any recipients that were included in the blind carbon copy header of the email message.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element name="From" type="AddressObj:AddressObjectType" minOccurs="0">
+				<xs:annotation>
+					<xs:documentation>The From field specifies the email address of the sender of the email message.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element name="Subject" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
+				<xs:annotation>
+					<xs:documentation>The Subject field specifies the subject (a brief summary of the message topic) of the email message.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element name="In_Reply_To" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
+				<xs:annotation>
+					<xs:documentation>The In_Reply_To field specifies the message ID of the message that this email is a reply to.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element name="Date" type="cyboxCommon:DateTimeObjectPropertyType" minOccurs="0">
+				<xs:annotation>
+					<xs:documentation>The Date field specifies the date/time that the email message was sent.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element name="Message_ID" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
+				<xs:annotation>
+					<xs:documentation>The Message_ID field specifies the automatically generated ID of the email message.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element name="Sender" type="AddressObj:AddressObjectType" minOccurs="0">
+				<xs:annotation>
+					<xs:documentation>The Sender field specifies the email address of the sender who is acting on behalf of the author listed in the From: field.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element name="Reply_To" type="AddressObj:AddressObjectType" minOccurs="0">
+				<xs:annotation>
+					<xs:documentation>The Reply_To field specifies the email address that should be used when replying to the email message.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element name="Errors_To" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
+				<xs:annotation>
+					<xs:documentation>The Errors_To field specifies the entry in the (deprecated) errors_to header of the email message.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element name="Boundary" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
+				<xs:annotation>
+					<xs:documentation>The Boundary field specifies a boundary tag that may be included in a MIME multipart message. This boundary tag is used to indicate the parts of a multipart message.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element name="Content_Type" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
+				<xs:annotation>
+					<xs:documentation>The Content-Type field specifies the internet media, or MIME, type of the email message content. </xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element name="MIME_Version" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
+				<xs:annotation>
+					<xs:documentation>The MIME-Version field specifies the version of the MIME formatting used in the email message.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element name="Precedence" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
+				<xs:annotation>
+					<xs:documentation>The Precedence field specifies the (non-standard) priority value of the message, which can influence transmission speed and delivery. Use of this field is typically discouraged, as per IETF RFC2076 (http://www.faqs.org/rfcs/rfc2076.html). </xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element minOccurs="0" name="User_Agent" type="cyboxCommon:StringObjectPropertyType">
+				<xs:annotation>
+					<xs:documentation>The User-Agent field specifies the identity of the email user agent software that may have been used to send the email message.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element name="X_Mailer" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
+				<xs:annotation>
+					<xs:documentation>The X-Mailer field specifies the software used to send the email message. This field is non-standard.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element name="X_Originating_IP" type="AddressObj:AddressObjectType" minOccurs="0">
+				<xs:annotation>
+					<xs:documentation>The X-Originating-IP field specifies the originating IP Address of the email sender, in terms of their connection to the mail server used to send the email message. This field is non-standard.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element name="X_Priority" type="cyboxCommon:PositiveIntegerObjectPropertyType" minOccurs="0">
+				<xs:annotation>
+					<xs:documentation>The X-Priority field specifies the numerical priority of the email message. This is a non-standard field, but typically a value of '1' is considered the highest priority, '3' is normal, and '5' is the lowest priority.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+		</xs:sequence>
+	</xs:complexType>
+	<xs:complexType name="EmailRecipientsType">
+		<xs:annotation>
+			<xs:documentation>The EmailRecipientsType captures a list of recipients for an email message.</xs:documentation>
+		</xs:annotation>
+		<xs:sequence>
+			<xs:element name="Recipient" type="AddressObj:AddressObjectType" maxOccurs="unbounded">
+				<xs:annotation>
+					<xs:documentation>The Recipient field represents a single recipient for an email message.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+		</xs:sequence>
+	</xs:complexType>
+	<xs:complexType name="LinksType">
+		<xs:annotation>
+			<xs:documentation>The LinksType captures a list of URIs, representing the links contained in the message.</xs:documentation>
+		</xs:annotation>
+		<xs:sequence>
+			<xs:element name="Link" type="EmailMessageObj:LinkReferenceType" maxOccurs="unbounded">
+				<xs:annotation>
+					<xs:documentation>The Link field specifies a single URL link contained within the email message, via a reference to an Object included elsewhere in the document.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+		</xs:sequence>
+	</xs:complexType>
+	<xs:complexType name="EmailReceivedLineType">
+		<xs:annotation>
+			<xs:documentation>The EmailReceivedLineType captures a single 'Received' line in an email message header.</xs:documentation>
+		</xs:annotation>
+		<xs:sequence>
+			<xs:element minOccurs="0" name="From" type="cyboxCommon:StringObjectPropertyType">
+				<xs:annotation>
+					<xs:documentation>The From field captures the 'from' portion of the Received line, if applicable.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element minOccurs="0" name="By" type="cyboxCommon:StringObjectPropertyType">
+				<xs:annotation>
+					<xs:documentation>The By field captures the 'by' portion of the Received line, if applicable.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element minOccurs="0" name="With" type="cyboxCommon:StringObjectPropertyType">
+				<xs:annotation>
+					<xs:documentation>The With field captures the 'with' portion of the Received line, if applicable.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element minOccurs="0" name="For" type="cyboxCommon:StringObjectPropertyType">
+				<xs:annotation>
+					<xs:documentation>The For field captures the 'for' portion of the Received line, if applicable.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element minOccurs="0" name="ID" type="cyboxCommon:StringObjectPropertyType">
+				<xs:annotation>
+					<xs:documentation>The ID field captures the 'id' portion of the Received line, if applicable.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element minOccurs="0" name="Timestamp" type="cyboxCommon:DateTimeObjectPropertyType">
+				<xs:annotation>
+					<xs:documentation>The Timestamp field captures the timestamp portion of the Received line, if applicable.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+		</xs:sequence>
+	</xs:complexType>
+	<xs:complexType name="EmailReceivedLineListType">
+		<xs:annotation>
+			<xs:documentation>The EmailReceivedLineListType captures a list of 'Received' lines in an email message header.</xs:documentation>
+		</xs:annotation>
+		<xs:sequence>
+			<xs:element maxOccurs="unbounded" name="Received" type="EmailMessageObj:EmailReceivedLineType">
+				<xs:annotation>
+					<xs:documentation>The Received field captures a single Received line in the list.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+		</xs:sequence>
+	</xs:complexType>
+	<xs:complexType name="AttachmentReferenceType">
+		<xs:annotation>
+			<xs:documentation>The AttachmentReferenceType specifies a reference to an Object defined elsewhere in the document which characterizes an attachment included in the email message.</xs:documentation>
+		</xs:annotation>
+		<xs:attribute name="object_reference" type="xs:QName">
+			<xs:annotation>
+				<xs:documentation>The object_reference field specifies a reference to an file-oriented (i.e., the File Object or one its derivations such as the Windows File Object) Object defined elsewhere in the document, via its id. </xs:documentation>
+			</xs:annotation>
+		</xs:attribute>
+	</xs:complexType>
+	<xs:complexType name="LinkReferenceType">
+		<xs:annotation>
+			<xs:documentation>The LinkReferenceType specifies a reference to a URI Object defined elsewhere in the document which characterizes a hyperlink embedded in the body of the email message.</xs:documentation>
+		</xs:annotation>
+		<xs:attribute name="object_reference" type="xs:QName">
+			<xs:annotation>
+				<xs:documentation>The object_reference field specifies a reference to a URI Object defined elsewhere in the document, via its id.</xs:documentation>
+			</xs:annotation>
+		</xs:attribute>
+	</xs:complexType>
+</xs:schema>