Indicator

Indicators contain a pattern that can be used to detect suspicious or malicious cyber activity. For example, an Indicator may be used to represent a set of malicious domains and use the STIX Patterning Language (see section 9) to specify these domains.

The Indicator SDO contains a simple textual description, the Kill Chain Phases that it detects behavior in, a time window for when the Indicator is valid or useful, and a required pattern property to capture a structured detection pattern. Conforming STIX implementations MUST support the STIX Patterning Language as defined in section 9.

Relationships from the Indicator can describe the malicious or suspicious behavior that it directly detects (Malware, Tool, and Attack Pattern). In addition, it may also imply the presence of a Campaigns, Intrusion Sets, and Threat Actors, etc.

Properties

Property	Type	Description
typeoptional	string	The type of this object, which MUST be the literal `indicator`.
indicator_typesoptional	list of string	This field is an Open Vocabulary that specifies the type of indicator. Open vocab - indicator-type-ov
nameoptional	string	The name used to identify the Indicator.
descriptionoptional	string	A description that provides the recipient with context about this Indicator potentially including its purpose and its key characteristics.
patternrequired	string	The detection pattern for this indicator.
pattern_typerequired	string	The type of pattern used in this indicator.
pattern_versionoptional	string	The version of the pattern that is used.
valid_fromrequired	string	Represents timestamps across the CTI specifications. The format is an RFC3339 timestamp, with a required timezone specification of 'Z'.
valid_untiloptional	string	Represents timestamps across the CTI specifications. The format is an RFC3339 timestamp, with a required timezone specification of 'Z'.
kill_chain_phasesoptional	list of object	The phases of the kill chain that this indicator detects.

Relationships

These are the relationships explicitly defined between the Indicator object and other STIX Objects. The first section lists the embedded relationships by property name along with their corresponding target. The rest of the table identifies the relationships that can be made from this object type to another object type by way of the Relationship object. The reverse relationships section illustrates the relationships targeting this object type from another object type. They are included here for convenience. For their definitions, please see the "Source" object.

Relationships are not restricted to those listed below. Relationships can be created between any objects using the related-to relationship type or, as with open vocabularies, user-defined names.