STIX Wiki
STIX Wiki

Overview

IntroductionGetting StartedWalkthrough

Reference

Domain Objects
Relationship Objects
Cyber-observable Objects
ArtifactAutonomous System (AS)DirectoryDomain NameEmail AddressEmail MessageFileIPv4 AddressIPv6 AddressMAC AddressMutexNetwork TrafficProcessSoftwareURLUser AccountWindows™ Registry Key ObjectX.509 Certificate
Meta Objects
Bundle Object
Cyber-observable Objects

Artifact

The Artifact object permits capturing an array of bytes (8-bits), as a base64-encoded string, or linking to a file-like payload.

One of payload_bin or url MUST be provided. It is incumbent on object creators to ensure that the URL is accessible for downstream consumers.

Properties

Required Common Properties
typeid
Optional Common Properties
spec_versionobject_marking_refsgranular_markingsdefangedextensions
Not Applicable
created_by_refrevokedlabelsconfidencelangexternal_references
Artifact Specific
mime_typepayload_binurlhashesencryption_algorithmdecryption_key
PropertyTypeDescription
typeoptional
stringThe value of this property MUST be `artifact`.
mime_typeoptional
stringThe value of this property MUST be a valid MIME type as specified in the IANA Media Types registry.
payload_binoptional
stringThe ​binary data type represents a sequence of bytes. In order to allow pattern matching on custom objects, for all properties that use the binary type, the property name MUST end with '_bin'. The JSON MTI serialization represents this as a base64-­encoded string as specified in RFC4648​. Other serializations SHOULD use a native binary type, if available.
urloptional
stringThe value of this property MUST be a valid URL that resolves to the unencoded content.
hashesoptional
objectSpecifies a dictionary of hashes for the contents of the url or the payload_bin. This MUST be provided when the url property is present.
encryption_algorithmoptional
stringIf the artifact is encrypted, specifies the type of encryption algorithm the binary data (either via payload_bin or url) is encoded in.
decryption_keyoptional
stringSpecifies the decryption key for the encrypted binary data (either via payload_bin or url).

Examples

{
  "type": "artifact",
  "spec_version": "2.1",
  "id": "artifact--ca17bcf8-9846-5ab4-8662-75c1bf6e63ee",
  "mime_type": "image/jpeg",
  "payload_bin": "VBORw0KGgoAAAANSUhEUgAAADI== ..."
}
{
  "type": "artifact",
  "spec_version": "2.1",
  "id": "artifact--6f437177-6e48-5cf8-9d9e-872a2bddd641",
  "mime_type": "application/zip",
  "payload_bin": "ZX7HIBWPQA99NSUhEUgAAADI== ...",
  "encryption_algorithm": "mime-type-indicated",
  "decryption_key": "My voice is my passport"
}

Cyber-observable Objects

Previous Page

Autonomous System (AS)

Next Page

On this page

PropertiesExamples