Identity
Identities can represent actual individuals, organizations, or groups (e.g., ACME, Inc.) as well as classes of individuals, organizations, systems or groups (e.g., the finance sector).
The Identity SDO can capture basic identifying information, contact information, and the sectors that the Identity belongs to. Identity is used in STIX to represent, among other things, targets of attacks, information sources, object creators, and threat actor identities.
Properties
| Property | Type | Description |
|---|---|---|
typeoptional | string | The type of this object, which MUST be the literal `identity`. |
rolesoptional | list of string | The list of roles that this Identity performs (e.g., CEO, Domain Administrators, Doctors, Hospital, or Retailer). No open vocabulary is yet defined for this property. |
namerequired | string | The name of this Identity. |
descriptionoptional | string | A description that provides more details and context about the Identity. |
identity_classoptional | string | The type of entity that this Identity describes, e.g., an individual or organization. Open Vocab - identity-class-ov |
sectorsoptional | list of string | The list of sectors that this Identity belongs to. Open Vocab - industry-sector-ov |
contact_informationoptional | string | The contact information (e-mail, phone number, etc.) for this Identity. |
Relationships
These are the relationships explicitly defined between the Identity object and other STIX Objects. The first section lists the embedded relationships by property name along with their corresponding target. The rest of the table identifies the relationships that can be made from this object type to another object type by way of the Relationship object. The reverse relationships section illustrates the relationships targeting this object type from another object type. They are included here for convenience. For their definitions, please see the "Source" object.
Relationships are not restricted to those listed below. Relationships can be created between any objects using the related-to relationship type or, as with open vocabularies, user-defined names.