cyber:CyberIndicatorPattern (NIEM Wayfarer 5.1)

cyber:CyberIndicatorPattern (cyber:CyberIndicatorPatternType)

A pattern that can be used to detect suspicious or malicious cyber activity; false otherwise

cyber:CyberIndicatorPattern can contain:

cyber:CyberIndicatorPatternDefensiveMeasureText
An action taken to counteract the indicator of compromise
cyber:CyberIndicatorPatternDefensiveMeasureComplianceIndicator
True if the cyber threat indicator or defensive measure submitted by a non-federal entity to the U.S. Federal Government is to be considered commercial, financial, and proprietary information in compliance with the Cybersecurity Information Sharing Act of 2015; false otherwise
cyber:CyberIndicatorPatternName
A name of a pattern that can be used to detect suspicious or malicious cyber activity
cyber:CyberIndicatorPatternDescriptionText
A description that provides more details and context about an Indicator, potentially including its purpose and its key characteristics
cyber:CyberIndicatorPatternDiamondModelClassificationCode
A classification of a cyber indicator by kind of Diamond Model component
cyber:TrafficLightProtocolCode
A statement of the permitted redistribution of received information
cyber:KillChainPhase
A phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives

Everything cyber:CyberIndicatorPattern can contain:

cyber:CyberIndicatorPatternDefensiveMeasureText An action taken to counteract the indicator of compromise
cyber:CyberIndicatorPatternDefensiveMeasureComplianceIndicator True if the cyber threat indicator or defensive measure submitted by a non-federal entity to the U.S. Federal Government is to be considered commercial, financial, and proprietary information in compliance with the Cybersecurity Information Sharing Act of 2015; false otherwise
cyber:CyberIndicatorPatternName A name of a pattern that can be used to detect suspicious or malicious cyber activity
cyber:CyberIndicatorPatternDescriptionText A description that provides more details and context about an Indicator, potentially including its purpose and its key characteristics
cyber:CyberIndicatorPatternDiamondModelClassificationCode A classification of a cyber indicator by kind of Diamond Model component
cyber:TrafficLightProtocolCode A statement of the permitted redistribution of received information
cyber:KillChainPhase A phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives