3 Data Model

3.1 NetworkFlowObjectType Class

The NetworkFlowObjectType class specifies the properties necessary to summarize network traffic, expressed as flows of multiple packets. It does not include the packet payload data (i.e. the actual data that was uploaded/downloaded to and from the Dest IP to Source IP as included in packet monitoring tools, such as Wireshark).

The UML diagram corresponding to the NetworkFlowObjectType class is shown in Figure 3‑1.

Figure 3‑1. UML diagram of the NetworkFlowObjectType class

The property table of the NetworkFlowObjectType class is given in Table 3‑1.

Table 3‑1. Properties of the NetworkFlowObjectType class

Name

Type

Multiplicity

Description

Network_Flow_Label

NetworkFlowLabelType

0..1

The Network_Flow_Label property represents elements common to all flow records formats - either expressed as a 5-tuple or an extended 7-tuple (actually an 8-tuple because for organizational reasons, we include the egress interface index). Because these properties are defined here, they are excluded from the fields associated directly with each different flow record format type.

Has_Choice

NetworkFlowObjectChoiceType

0..1

The Has_Choice property is associated with the class NetworkFlowObjectChoiceType. It indicates that there is a choice between the Unidirectional_Flow_Record property or the Bidirectional_Flow_Record property.

Only one of the properties of NetworkFlowObjectChoiceType class can be populated at any time. See Section 1.2.3 for more detail.

The NetworkFlowObjectChoiceType class is the type of the Has_Choice property. In the UML model, this class is associated with the <<choice>> UML stereotype, which specifies that only one of the available properties of the NetworkFlowObjectChoiceType class can be populated at any time. The property table of the NetworkFlowObjectChoiceType class is given in Table 3‑2.

Table 3‑2. Properties of the NetworkFlowObjectChoiceType class

Name

Type

Multiplicity

Description

Unidirectional_Flow_Record

UnidirectionalRecordType

0..1

The Unidirectional_Flow_Record property represents flow-record formats that capture data in one direction only (e.g., Netflow v9).

Only one of the Unidirectional_Flow_Record and Bidirectional_Flow_Record properties can be populated.

Bidirectional_Flow_Record

BidirectionalRecordType

0..1

The Bidirectional_Flow_Record property represents flow-record formats that capture data in both directions (e.g., YAF).

Only one of the Unidirectional_Flow_Record and Bidirectional_Flow_Record properties can be populated.

3.2 NetworkLayerInfoType Class

The NetworkLayerInfoType class specifies the network layer information (relative to the OSI network model) which is typically captured in all class of network flow records.

The property table of the NetworkLayerInfoType class is given in Table 3‑3.

Table 3‑3. Properties of the NetworkLayerInfoType class

Name	Type	Multiplicity	Description
Src_Socket_Address	SocketAddressObj: SocketAddressObjectType	0..1	The Src_Socket_Address property represents the source IP socket address, consisting of an IP address and port number, for the network flow expressed. Note that not all flow protocols support IPv6 addresses.
Dest_Socket_Address	SocketAddressObj: SocketAddressObjectType	0..1	The Dest_Socket_Address property represents the destination IP socket address, consisting of an IP address and port number, for the network flow expressed. Note that not all flow protocols support IPv6 addresses.
IP_Protocol	PacketObj: IANAAssignedIPNumbersType	0..1	The IP_Protocol property specifies the IP Protocol of the network flow. This is usually TCP, UDP, or SCTP, but can include others as represented in Netflow as an integer from 0 to 255. Please refer to http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xml for reference.

3.3 NetworkFlowLabelType Class

The NetworkFlowLabelType class specifies properties that are common to all flow record formats. It builds off of the network layer information (a 5-tuple that commonly defines a flow) and includes ingress and egress interface indexes and IP protocol information (not present in all flow record formats). Egress information is usually not thought of as part of the extended 7-tuple, but we include it for organizational purposes. Because these fields are defined here, they are excluded from the fields associated directly with each different flow record format class.

The property table of the NetworkFlowLabelType class is given in Table 3‑4.

Table 3‑4. Properties of the NetworkFlowLabelType class

Name	Type	Multiplicity	Description
Ingress_Interface_Index	cyboxCommon: IntegerObjectPropertyType	0..1	The Ingress_Interface_Index property represents the index (in SNMP, by default) of the network interface card where the flows entered the router.
Egress_Interface_Index	cyboxCommon: IntegerObjectPropertyType	0..1	The Egress_Interface_Index property represents the index (in SNMP, by default) of the network interface card where the flows leave the router.
IP_Type_Of_Service	cyboxCommon: HexBinaryObjectPropertyType	0..1	The IP_Type_Of_Service property specifies the type of service (ToS) property from the IP header. See http://tools.ietf.org/html/rfc1349.txt for more information.

3.4 UnidirectionalRecordType Class

The UnidirectionalRecordType class specifies the netflow record formats that capture traffic in one direction. The UML diagram corresponding to the UnidirectionalRecordType class is shown in Figure 3‑1.

Name

Type

Multiplicity

Description

Has_Choice

UnidirectionalRecordChoiceType

0..1

The Has_Choice property is associated with the class UnidirectionalRecordChoiceType. It indicates that there is a choice among the various properties.

Only one of the properties of UnidirectionalRecordChoiceType class can be populated at any time. See Section 1.2.3 for more detail.

The UnidirectionalRecordChoiceType class is the type of the Has_Choice property. In the UML model, this class is associated with the <<choice>> UML stereotype, which specifies that only one of the available properties of the UnidirectionalRecordChoiceType class can be populated at any time. The property table of the UnidirectionalRecordChoiceType class is given in Table 3‑5.

Table 3‑5. Properties of the UnidirectionalRecordChoiceType class

Name	Type	Multiplicity	Description
IPFIX_Message	IPFIXMessageType	0..1	The IPFIX_Message property represents the Internet Protocol Flow Information eXport (IPFIX) protocol. IPFIX is based on Netflow v9. It has several extensions such as Enterprise-defined properties types and variable length fields. See http://tools.ietf.org/html/rfc5101.txt for more information. Only one of the UnidirectionalRecordChoiceType properties can be populated.
NetflowV9_Export_Packet	NetflowV9ExportPacketType	0..1	The NetflowV9_Export_Packet property represents the Netflow V9 flow record format. See https://www.ietf.org/rfc/rfc3954.txt (Netflow v9) for more information. Only one of the UnidirectionalRecordChoiceType properties can be populated.
NetflowV5_Packet	NetflowV5PacketType	0..1	The NetflowV5_Packet property represents the Netflow v5 flow record format, which is commonly used to represent network flow data. Only one of the UnidirectionalRecordChoiceType properties can be populated.
SiLK_Record	SiLKRecordType	0..1	The SiLK_Record property represents a network flow record in the System for Internet-Level Knowledge (SiLK) format, developed by CERT at Carnegie Mellon University (CMU)'s Software Engineering Institute (SEI) as part of the NetSA security suite. See http://tools.netsa.cert.org/silk/analysis-handbook.pdf for more information. Only one of the UnidirectionalRecordChoiceType properties can be populated.

3.5 BidirectionalRecordType Class

The BidirectionalRecordType class specifies the network record formats that capture traffic in both directions. In the future, we plan to add Argus as a network flow format class. Argus supports bidirectional flows, and as such, is usually used as an alternative to Netflow v5 analysis via SiLK (http://www.qosient.com/argus/).

The property table of the BidirectionalRecordType class is given in Table 3‑6.

Table 3‑6. Properties of the BidirectionalRecordType class

Name	Type	Multiplicity	Description
YAF_Record	YAFRecordType	0..1	The YAF_Record property represents flow records generated via YAF (Yet Another Flowmeter), a bidirectional network flow meter. See http://www.usenix.org/event/lisa10/tech/full_papers/Inacio.pdf or http://tools.netsa.cert.org/yaf/index.html for more information.

3.6 IPFIXMessageType Class

Figure 3‑2. UML diagram of the IPFIXMessageType class

The IPFIXMessageType class specifies the IPFIX protocol which provides IP flow information. See http://tools.ietf.org/html/rfc5101.txt for additional information.

The UML diagram corresponding to the IPFIXMessageType class is shown in Figure 3‑2.

The property table of the IPFIXMessageType class is given in Table 3‑7.

Table 3‑7. Properties of the IPFIXMessageType class

Name	Type	Multiplicity	Description
Message_Header	IPFIXMessageHeaderType	0..1	The Message_Header property is the first part of an IPFIX Message, which provides basic information about the message, such as the IPFIX version, length of the message, message sequence number, etc.
Set	IPFIXSetType	0..*	The Set property is a generic term for a collection of records that have a similar structure. In an IPFIX Message, one or more Sets follow the Message Header.

3.6.1 IPFIXMessageHeaderType Class

The IPFIXMessageHeaderType class represents the message header for the IPFIX format. For more information about each of the fields, please refer to http://tools.ietf.org/html/rfc5101.txt under the heading, "Message Header Field Descriptions." Note that common elements are included in the Network_Flow_Label.

The property table of the IPFIXMessageHeaderType class is given in Table 3‑8.

Table 3‑8. Properties of the IPFIXMessageHeaderType class

Name	Type	Multiplicity	Description
Version	cyboxCommon: HexBinaryObjectPropertyType	0..1	The Version property specifies the version number of Flow Record format exported in this message. The value of this property is 0x000a for the current version, incrementing by one the version used in the Netflow services export version 9 (see https://www.ietf.org/rfc/rfc3954.txt).
Byte_Length	cyboxCommon: HexBinaryObjectPropertyType	0..1	The Byte_Length property indicates the total byte length of the IPFIX Message, measured in octets, including Message Header and Set(s).
Export_Timestamp	cyboxCommon: IntegerObjectPropertyType	0..1	The Export_Timestamp property indicates the time, in seconds, since 0000 UTC Jan 1, 1970, at which the IPFIX message header leaves the Exporter.
Sequence_Number	cyboxCommon: IntegerObjectPropertyType	0..1	The Sequence_Number property indicates the incremental sequence counter modulo 2^32 of all IPFIX Data Records sent on this PR-SCTP stream from the current Observation Domain by the Exporting Process. This value SHOULD be used by the Collecting Process to identify whether any IPFIX Data Records have been missed. Template and Options Template Records do not increase the Sequence Number.
Observation_Domain_ID	cyboxCommon: IntegerObjectPropertyType	0..1	The Observation_Domain_ID property Indicates a 32-bit identifier of the Observation Domain that is locally unique to the Exporting Process. See http://tools.ietf.org/html/rfc5101.txt under Observation Domain ID for more information.

3.6.2 IPFIXSetType Class

The IPFIXSetType class represents the possible sets of records that can be represented in an IPFIX message. See http://tools.ietf.org/html/rfc5101.txt under the terms "Template Set", "Options Template Set", and "Data Set", for more information.

The UML diagram corresponding to the IPFIXMessageType class is shown in Figure 3‑3.

The property table of the IPFIXSetType class is given in Table 3‑9.

Table 3‑9. Properties of the IPFIXSetType class

Name

Type

Multiplicity

Description

Has_Choice

IPFIXSetChoiceType

0..1

The Has_Choice property is associated with the class IPFIXSetChoiceType. It indicates that there is a choice among the Template_Set, Options_Template_Set, Data_Set properties.

Only one of the properties of IPFIXSetChoiceType class can be populated at any time. See Section 1.2.3 for more detail.

The IPFIXSetChoiceType class is the type of the Has_Choice property. In the UML model, this class is associated with the <<choice>> UML stereotype, which specifies that only one of the available properties of the IPFIXSetChoiceType class can be populated at any time. The property table of the IPFIXSetChoiceType class is given in Table 3‑10.

Table 3‑10. Properties of the IPFIXSetChoiceType class

Name	Type	Multiplicity	Description
Template_Set	IPFIXTemplateSetType	0..1	The Template_Set property indicates a collection of one or more Template Records that have been grouped together in an IPFIX message. Only one of the IPFIXSetChoiceType properties can be populated.
Options_Template_Set	IPFIXOptionsTemplateSetType	0..1	The Options_Template_Set property indicates a collection of one or more Options Template Records that have been grouped together in an IPFIX message. Only one of the IPFIXSetChoiceType properties can be populated.
Data_Set	IPFIXDataSetType	0..1	The Data_Set property indicates one or more Data Records, of the same type, that have been grouped together in an IPFIX message. Each Data Record is previously defined by a Template Record or an Options Template Record. Only one of the IPFIXSetChoiceType properties can be populated.

Figure 3‑3. UML diagram of the IPIFXSetType class

3.6.3 IPFIXTemplateSetType Class

The IPFIXTemplateSetType class specifies the regions of a Template Set, of which there are three: the Set Header, the collection of Template Records, and the optional padding at the end of the Template Set. See http://tools.ietf.org/html/rfc5101.txt under Set Format, which is section 3.3.1, for more information.

The property table of the IPFIXTemplateSetType class is given in Table 3‑11.

Table 3‑11. Properties of the IPFIXTemplateSetType class

Name	Type	Multiplicity	Description
Set_Header	IPFIXSetHeaderType	0..1	The Set_Header property indicates the Set Header region, which is 32-bit region containing the 16-bit properties Set ID and Length.
Template_Record	IPFIXTemplateRecordType	0..*	The Template_Record property indicates the region of Template Records. These are the same properties referenced in the IPFIXTemplateRecordType.
Padding	cyboxCommon: HexBinaryObjectPropertyType	0..1	The Padding property indicates the optional Padding at the end of a Template Set. The Exporting Process MAY insert some padding octets, so that the subsequent Set starts at an aligned boundary. For security reasons, the padding octet(s) MUST be composed of zero (0) valued octets, and the padding length MUST be shorter than any allowable record in this Set. For more information, see http://tools.ietf.org/html/rfc5101.txt under Padding.

3.6.4 IPFIXOptionsTemplateSetType Class

The IPFIXOptionsTemplateSetType specifies the regions of an Options Template Set, of which there are three: the Set Header, the collection of Options Template Records, and the optional padding at the end of the Options Template Set. See http://tools.ietf.org/html/rfc5101.txt under Set Format, which is section 3.3.1, for more information.

The property table of the IPFIXOptionsTemplateSetType class is given in Table 3‑12.

Table 3‑12. Properties of the IPFIXOptionsTemplateSetType class

Name	Type	Multiplicity	Description
Set_Header	IPFIXSetHeaderType	0..1	The Set_Header property indicates the Set Header region, which is 32-bit region containing the 16-bit properties Set ID and Length, in that order. These are the same fields referenced in the IPFIXSetHeaderType.
Options_Template_Record	IPFIXOptionsTemplateRecordType	0..*	The Options_Template_Record property indicates the region of Options Template Records. These are the same properties referenced in the IPFIXOptionsTemplateRecordType.
Padding	cyboxCommon: HexBinaryObjectPropertyType	0..1	The Padding property indicates the optional Padding at the end of an Options Template Set. The Exporting Process MAY insert some padding octets, so that the subsequent Set starts at an aligned boundary. For security reasons, the padding octet(s) MUST be composed of zero (0) valued octets, and the padding length MUST be shorter than any allowable record in this Set. For more information, see http://tools.ietf.org/html/rfc5101.txt under Padding.

3.6.5 IPFIXDataSetType Class

The IPFIXDataSetType class specifies the regions of a Data Set, of which there are three: the Set Header, the collection of Data Records, and the optional padding at the end of the Data Set. See http://tools.ietf.org/html/rfc5101.txt under Set Format, which is section 3.3.1, for more information.

The property table of the IPFIXDataSetType class is given in Table 3‑13.

Table 3‑13. Properties of the IPFIXDataSetType class

Name	Type	Multiplicity	Description
Set_Header	IPFIXSetHeaderType	0..1	The Set_Header property indicates the Set Header region, which is 32-bit region containing the 16-bit properties Set ID and Length, appended in that order. These are the same fields referenced in the IPFIXSetHeaderType.
Data_Record	IPFIXDataRecordType	0..*	The Data_Record property indicates the region of Data Records, which consist of a series of property values without a header.
Padding	cyboxCommon: HexBinaryObjectPropertyType	0..1	The Padding property indicates the optional Padding at the end of a Data Set. The Exporting Process MAY insert some padding octets, so that the subsequent Set starts at an aligned boundary. For security reasons, the padding octet(s) MUST be composed of zero (0) valued octets, and the padding length MUST be shorter than any allowable record in this Set. For more information, see http://tools.ietf.org/html/rfc5101.txt under Padding.

3.6.6 IPFIXSetHeaderType Class

The IPFIXSetHeaderType class specifies the properties of the IPFIX set header.

The property table of the IPFIXSetHeaderType class is given in Table 3‑14.

Table 3‑14. Properties of the IPFIXSetHeaderType class

Name

Type

Multiplicity

Description

Set_ID

cyboxCommon:

IntegerObjectPropertyType

0..1

The Set_ID property Indicates a 16-bit value that identifies the set. The values of 0 and 1 are not used for historical reasons according to https://www.ietf.org/rfc/rfc3954.txt. Otherwise, a value of 2 is reserved for the Template Set and 3 is reserved for the Option Template Set. All other values from 4 to 255 are reserved for future use.

Length

cyboxCommon:

IntegerObjectPropertyType

0..1

The Length property Total length of the set, in octets, including the set header, all records, and the optional padding. Because an individual Set MAY contain multiple records, the Length value MUST be used to determine the position of the next Set. See http://tools.ietf.org/html/rfc5101.txt for more information.

3.6.7 IPFIXTemplateRecordType Class

The IPFIXTemplateRecordType class specifies the regions of a Template Record, of which there are two: the Template Record Header, and the Field Specifiers. See http://tools.ietf.org/html/rfc5101.txt under Template Record Format, section 3.4.1, for more information.

The property table of the IPFIXTemplateRecordType class is given in Table 3‑15.

Table 3‑15. Properties of the IPFIXTemplateRecordType class

Name

Type

Multiplicity

Description

Template_Record_

Header

IPFIXTemplateRecordHeaderType

0..1

The Template_Record_Header property indicates the Template Record Header region, which is a 32-bit region containing the 16-bit properties Template ID (> 255) and Field Count, appended in that order. These are the same fields referenced in the IPFIXTemplateRecordHeaderType.

Field_Specifier

IPFIXTemplateRecordFieldSpecifiersType

0..*

The Field_Specifier property indicates the region of Field Specifiers. These are the same properties referenced in the IPFIXTemplateRecordFieldSpecifiersType.

3.6.8 IPFIXTemplateRecordHeaderType Class

The IPFIXTemplateRecordHeaderType class specifies the properties in a Template Record Header, Template_ID and Field_Count, as explained in http://tools.ietf.org/html/rfc5101.txt, section 3.4.1.

The property table of the IPFIXTemplateRecordHeaderType class is given in Table 3‑16.

Table 3‑16. Properties of the IPFIXTemplateRecordHeaderType class

Name

Type

Multiplicity

Description

Template_ID

cyboxCommon:

IntegerObjectPropertyType

0..1

The Template_ID property specifies a unique Template ID which is numbered 256-65535 since IDs 0-255 are reserved for Template Sets, Options Template Sets, and other reserved Sets yet to be created.

Field_Count

cyboxCommon:

HexBinaryObjectPropertyType

0..1

The Field_Count property specifies the number of properties in this Template Record.

3.6.9 IPFIXTemplateRecordFieldSpecifiersType Class

The IPFIXTemplateRecordFieldSpecifiersType class specifies the fields in a Template Record Field Specifier, as explained in http://tools.ietf.org/html/rfc5101.txt, section 3.2.

The property table of the IPFIXTemplateRecordFieldSpecifiersType class is given in Table 3‑17.

Table 3‑17. Properties of the IPFIXTemplateRecordFieldSpecifiersType class

Name	Type	Multiplicity	Description
Enterprise_Bit	basicDataTypes:Boolean	0..1	The Enterprise_Bit property specifies the Enterprise bit, either 0 or 1. If this bit is zero, the Information Element Identifier identifies an IETF-specified Information Element, and the four-octet Enterprise Number property SHOULD NOT be present. If this bit is one, the Information Element identifier identifies an enterprise-specific Information Element, and the Enterprise Number filed SHOULD be present. NOTE: While it is legal to use "true" and "false" here, this value SHOULD be set to 0 or 1 for consistency.
Information_Element_ID	cyboxCommon: StringObjectPropertyType	0..1	The Information_Element_ID property specifies the 15-bit (NOT 16-bit) Information Element ID referring to the type of Information Element, as shown in https://www.ietf.org/rfc/rfc5102.txt.
Field_Length	cyboxCommon: StringObjectPropertyType	0..1	The Field_Length property specifies the 16-bit Field Length, in octets, of the corresponding encoded Information Element as defined in The property length may be smaller if the reduced size encoding is used (see Section 6.2 of https://www.ietf.org/rfc/rfc5101.txt). The value 65535 is reserved for variable length Information Elements. See https://www.ietf.org/rfc/rfc5102.txt for more information.
Enterprise_Number	cyboxCommon: StringObjectPropertyType	0..1	The Enterprise_Number property specifies the 32-bit IANA Enterprise Number of the authority defining the Information Element identifier in this Template Record. Information Element Identifiers 1.2 and 2.1 are defined by the IETF (Enterprise bit = 0) and, therefore, do not need an Enterprise Number to identify them.

3.6.10 IPFIXOptionsTemplateRecordType Class

The IPFIXOptionsTemplateRecordType class specifies the regions of an Options Template Record, of which there are two: the Options Template Record Header, and the Field Specifiers. See http://tools.ietf.org/html/rfc5101.txt under Options Template Record Format, section 3.4.2.2, for more information.

The property table of the IPFIXOptionsTemplateRecordType class is given in Table 3‑18.

Table 3‑18. Properties of the IPFIXOptionsTemplateRecordType class

Name

Type

Multiplicity

Description

Options_Template_

Record_Header

IPFIXOptionsTemplateRecordHeaderType

0..1

The Options_Template_Record_Header property indicates the Options Template Record Header region, which is a 48-bit region containing the 16-bit properties Template ID, Field Count, and Scope Field Count, appended in that order.

Field_Specifier

IPFIXOptionsTemplateRecordFieldSpecifiersType

0..*

The Field_Specifier property indicates the region of Field Specifiers. These are the same properties referenced in the IPFIXOptionsTemplateRecordFieldSpecifiersType.

3.6.11 IPFIXOptionsTemplateRecordHeaderType Class

The IPFIXOptionsTemplateRecordHeaderType class specifies the header of an options template record.

The property table of the IPFIXOptionsTemplateRecordHeaderType class is given in Table 3‑19.

Table 3‑19. Properties of the IPFIXOptionsTemplateRecordHeaderType class

Name	Type	Multiplicity	Description
Template_ID	cyboxCommon: IntegerObjectPropertyType	0..1	The Template_ID property specifies a unique Template ID which is numbered 256-65535 since IDs 0-255 are reserved for Template Sets, Options Template Sets, and other reserved Sets yet to be created.
Field_Count	cyboxCommon: HexBinaryObjectPropertyType	0..1	The Field_Count property specifies the number of properties in this Options Template Record, INCLUDING the Scope Fields.
Scope_Field_Count	cyboxCommon: PositiveIntegerObjectPropertyType	0..1	The Scope_Field_Count property specifies the number of scope properties in this Options Template Record, which is NONZERO. The Scope Fields are normal Fields except that they are interpreted as scope at the Collector.

3.6.12 IPFIXOptionsTemplateRecordFieldSpecifiersType Class

The IPFIXOptionsTemplateRecordFieldSpecifiersType class specifies the properties in an Options Template Record Field Specifier, as explained in https://www.ietf.org/rfc/rfc5101.txt, sections 3.2 and 3.4.2.2. It consists of two sequences: Scope Fields and Option Fields, appended together.

The property table of the IPFIXOptionsTemplateRecordFieldSpecifiersType class is given in Table 3‑20.

Table 3‑20. Properties of the IPFIXOptionsTemplateRecordFieldSpecifiersType class

Name	Type	Multiplicity	Description
Scope_Enterprise_Bit	basicDataTypes:Boolean	0..1	The Scope_Enterprise_Bit property specifies the Scope Enterprise bit, either 0 or 1. If this bit is zero, the Information Element Identifier identifies an IETF-specified Information Element, and the four-octet Enterprise Number property SHOULD NOT be present. If this bit is one, the Information Element identifier identifies an enterprise-specific Information Element, and the Enterprise Number filed SHOULD be present. NOTE: While it is legal to use "true" and "false" here, this value SHOULD be set to 0 or 1.
Scope_Information_ Element_ID	cyboxCommon: StringObjectPropertyType	0..1	The Scope_Information_Element_ID property specifies the 15-bit (NOT 16-bit) Scope Information Element ID referring to the type of Information Element. See https://www.ietf.org/rfc/rfc5102.txt for more information.
Scope_Field_Length	cyboxCommon: IntegerObjectPropertyType	0..1	The Scope_Field_Length property specifies the corresponding encoded Information Element, as a 16-bit integer, in octets. The length may be smaller if the reduced size encoding is used (see Section 6.2 of https://www.ietf.org/rfc/rfc5101.txt). The value 65535 is reserved for variable length Information Elements. See https://www.ietf.org/rfc/rfc5102.txt for more information.
Scope_Enterprise_Number	cyboxCommon: StringObjectPropertyType	0..1	The Scope_Enterprise_Number property specifies the 32-bit IANA Scope Enterprise Number of the authority defining the Information Element identifier in this Template Record. Information Element Identifiers 1.2 and 2.1 are defined by the IETF (Enterprise bit = 0) and, therefore, do not need an Enterprise Number to identify them.
Option_Enterprise_Bit	basicDataTypes:Boolean	0..1	The Option_Enterprise_Bit property specifies the Option Enterprise bit, either 0 or 1. If this bit is zero, the Information Element Identifier identifies an IETF-specified Information Element, and the four-octet Enterprise Number property SHOULD NOT be present. If this bit is one, the Information Element identifier identifies an enterprise-specific Information Element, and the Enterprise Number filed SHOULD be present. NOTE: While it is legal to use "true" and "false" here, this value SHOULD be set to 0 or 1 for consistency.
Option_Information_ Element_ID	cyboxCommon: StringObjectPropertyType	0..1	The Option_Information_Element_ID property specifies the 15-bit (NOT 16-bit) Option Information Element ID referring to the type of Information Element. See https://www.ietf.org/rfc/rfc5102.txt for more information.
Option_Field_Length	cyboxCommon: IntegerObjectPropertyType	0..1	The Option_Field_Length property specifies the 16-bit Option Field Length, in octets, of the corresponding encoded Information. The property length may be smaller than if the reduced size encoding is used (see Section 6.2 of https://www.ietf.org/rfc/rfc5101.txt). The value 65535 is reserved for variable length Information Elements. See https://www.ietf.org/rfc/rfc5102.txt for more information.
Option_Enterprise_Number	cyboxCommon: StringObjectPropertyType	0..1	The Option_Enterprise_Number property Specifies the 32-bit IANA Option Enterprise Number of the authority defining the Information Element identifier in this Template Record. Information Element Identifiers 1.2 and 2.1 are defined by the IETF (Enterprise bit = 0) and, therefore, do not need an Enterprise Number to identify them.

3.6.13 IPFIXDataRecordType Class

The IPFIXDataRecordType class specifies the data records that are sent in data sets.

The property table of the IPFIXDataRecordType class is given in Table 3‑21.

Table 3‑21. Properties of the IPFIXDataRecordType class

Name

Type

Multiplicity

Description

Field_Value

cyboxCommon:

StringObjectPropertyType

0..*

The Field_Value property indicates the individual Field Value, which need not be 16-bit. The Template ID to which the Field Values belong to is encoded in the Data Set Header property "Set ID", i.e. "Set ID" = "Template ID".

3.7 NetflowV9ExportPacketType Class

Figure 3‑4. UML diagram of the NetworkV9ExportPacketType class

The NetworkFlowObjectType class specifies the Netflow v9 object and specifies the IP flow information. See http://www.ietf.org/rfc/rfc3954.txt for more information. It was developed by Cisco.

The UML diagram corresponding to the NetworkFlowObjectType class is shown in Figure 3‑4.

The property table of the NetflowV9ExportPacketType class is given in Table 3‑22.

Table 3‑22. Properties of the NetflowV9ExportPacketType class

Name	Type	Multiplicity	Description
Packet_Header	NetflowV9PacketHeaderType	0..1	The Packet_Header property specifies the Packet Header, which is the first part of an Export Packet. The Packet Header provides basic information about the packet such as the Netflow version, number of records contained within the packet, and sequence numbering.
Flow_Set	NetflowV9FlowSetType	0..*	The Flow_Set property specifies a FlowSet, which is a collection of Flow Records that have similar structure. In an Export Packet, one or more FlowSets follow the Packet Header. There are three different types of FlowSets: a Template FlowSet, Options Template FlowSet, and Data FlowSet.

3.7.1 NetflowV9PacketHeaderType Class

The NetflowV9PacketHeaderType class specifies the header properties defined for Netflow v9. Note that common elements are included in the Network_Flow_Label property.

See http://www.ietf.org/rfc/rfc3954.txt for more information.

The property table of the NetflowV9PacketHeaderType class is given in Table 3‑23.

Table 3‑23. Properties of the NetflowV9PacketHeaderType class

Name	Type	Multiplicity	Description
Version	cyboxCommon: HexBinaryObjectPropertyType	0..1	The Version property specifies the version of flow record format exported in this packet. The value of this property is 9 for the Netflow v9.
Record_Count	cyboxCommon: IntegerObjectPropertyType	0..1	The Record_Count property specifies the total number of records in the Export Packet, which is the sum of Options FlowSet records, Template FlowSet records, and Data FlowSet records. See http://www.ietf.org/rfc/rfc3954.txt.
Sys_Up_Time	cyboxCommon: IntegerObjectPropertyType	0..1	The Sys_Up_Time property specifies the time in milliseconds since this device was first booted.
Unix_Secs	cyboxCommon: IntegerObjectPropertyType	0..1	The Unix_Secs property specifies the time in seconds since 0000 UTC 1970 at which the Export Packet leaves the Exporter.
Sequence_Number	cyboxCommon: IntegerObjectPropertyType	0..1	The Sequence_Number property is an incremental sequence counter of all Export Packets sent from the current Observation Domain by the Exporter. This value MUST be cumulative, and SHOULD be used by the Collector to identify whether any Export Packets have been missed.
Source_ID	cyboxCommon: HexBinaryObjectPropertyType	0..1	The Source_ID property is a 32-bit value that specifies the Exporter Observation Domain. Netflow Collectors SHOULD use the combination of the source IP address and the Source ID property to separate different export streams originating from the same Exporter.

3.7.2 NetflowV9FlowSetType Class

The NetflowV9FlowSetType class specifies that one or more in an Export Packet FlowSets follow the Packet Header. There are three different classes of FlowSets, as defined in RFC 3954: Template FlowSet, Options Template FlowSet, and Data FlowSet.

The property table of the NetflowV9FlowSetType class is given in Table 3‑24.

Table 3‑24. Properties of the NetflowV9FlowSetType class

Name

Type

Multiplicity

Description

Has_Choice

NetflowV9FlowSetChoiceType

0..1

The Has_Choice property is associated with the class NetflowV9FlowSetChoiceType. It indicates that there is a choice among the Template_Flow_Set, Options_Template_Flow_Set, and Data_Flow_Set properties.

Only one of the properties of NetflowV9FlowSetChoiceType class can be populated at any time. See Section 1.2.3 for more detail.

The NetflowV9FlowSetChoiceType class is the type of the Has_Choice property. In the UML model, this class is associated with the <<choice>> UML stereotype, which specifies that only one of the available properties of the NetflowV9FlowSetChoiceType class can be populated at any time. The property table of the NetflowV9FlowSetChoiceType class is given in Table 3‑25.

Table 3‑25. Properties of the NetflowV9FlowSetChoiceType class

Name	Type	Multiplicity	Description
Template_Flow_Set	NetflowV9TemplateFlowSetType	0..1	The Template_Flow_Set property specifies one of the essential elements in the Netflow format is the Template FlowSet. Templates greatly enhance the flexibility of the Flow Record format because they allow the Netflow Collector to process Flow Records without necessarily knowing the interpretation of all the data in the Flow Record. Only one of the NetflowV9FlowSetChoiceType properties can be populated.
Options_Template_ Flow_Set	NetflowV9OptionsTemplateFlowSetType	0..1	The Options_Template_Flow_Set property specifies an Options Template FlowSet, which is one or more Options Template Records that have been grouped together in an Export Packet. Only one of the NetflowV9FlowSetChoiceType properties can be populated.
Data_Flow_Set	NetflowV9DataFlowSetType	0..1	The Data_Flow_Set property specifies a Data FlowSet which is one or more records of the same type that are grouped together in an Export Packet. Each record is either a Flow Data Record or an Options Data Record previously defined by a Template Record or an Options Template Record. Only one of the NetflowV9FlowSetChoiceType properties can be populated.

3.7.3 NetflowV9TemplateFlowSetType Class

The NetflowV9TemplateFlowSetType class specifies the format of the Template FlowSet.

The property table of the NetflowV9TemplateFlowSetType class is given in Table 3‑26.

Table 3‑26. Properties of the NetflowV9TemplateFlowSetType class

Name	Type	Multiplicity	Description
Flow_Set_ID	cyboxCommon: HexBinaryObjectPropertyType	0..1	The Flow_Set_ID property specifies the FlowSet ID, which is fixed to 0 for the Template FlowSet.
Length	cyboxCommon: IntegerObjectPropertyType	0..1	The Length property specifies the sum of the lengths of the FlowSet ID, the Length itself, and all Template Records within this FlowSet.
Template_Record	NetflowV9TemplateRecordType	0..*	The Template_Record property specifies the Template Record region, which includes the template ID, property count, field type, and field length.

3.7.4 NetflowV9TemplateRecordType Class

The NetflowV9TemplateRecordType class specifies the Template Record, which includes the template ID, field count, field class, and field length. See http://www.ietf.org/rfc/rfc3954.txt for more information.

The property table of the NetflowV9TemplateRecordType class is given in Table 3‑27.

Table 3‑27. Properties of the NetflowV9TemplateRecordType class

Name	Type	Multiplicity	Description
Template_ID	cyboxCommon: IntegerObjectPropertyType	0..1	The Template_ID property specifies a unique Template ID for the Template Record. IDs in the range 0-255 are reserved for Template FlowSets, Options FlowSets, and other reserved Sets yet to be created.
Field_Count	cyboxCommon: IntegerObjectPropertyType	0..1	The Field_Count property specifies the number of properties in this Template Record.
Field_Type	NetflowV9FieldType	0..1	The Field_Type property specifies a numeric value that represents the type of the property. Refer to the "Field Type Definitions" section in http://www.ietf.org/rfc/rfc3954.txt for descriptions of these types.
Field_Length	cyboxCommon: HexBinaryObjectPropertyType	0..1	The Field_Length property specifies the length of the corresponding property type, in bytes.

3.7.5 NetflowV9FieldType Data Type

The NetflowV9FieldType data type specifies the field. Its core value SHOULD be a literal found in the NetflowV9FieldTypeEnum enumeration. Its base type is the BaseObjectPropertyType data type, in order to permit complex (i.e. regular-expression based) specifications.

3.7.6 NetflowV9OptionsTemplateFlowSetType Class

The NetflowV9OptionsTemplateFlowSetType class specifies an Options Template FlowSet, which is one or more Options Template Records that have been grouped together in an Export Packet.

The property table of the NetflowV9OptionsTemplateFlowSetType class is given in Table 3‑28.

Table 3‑28. Properties of the NetflowV9OptionsTemplateFlowSetType class

Name	Type	Multiplicity	Description
Flow_Set_ID	cyboxCommon: HexBinaryObjectPropertyType	0..1	The Flow_Set_ID property specifies the FlowSet ID, which is fixed to 1 for the Options Template FlowSet.
Length	cyboxCommon: IntegerObjectPropertyType	0..1	The Length property specifies the total length of this FlowSet in octets, including the set header, all records, and the optional padding.
Options_Template_ Record	NetflowV9OptionsTemplateRecordType	0..*	The Options_Template_Record property specifies the Options Template Record region which includes the Option Scope Length, Option Length, and properties specifying the Scope field type and Scope field length.
Padding	cyboxCommon: HexBinaryObjectPropertyType	0..1	The Padding property specifies the number of padding bytes to be inserted so that the subsequent FlowSet starts at a 4-byte aligned boundary. It is important to note that the Length property includes the padding bytes. Padding SHOULD be using zeros.

3.7.7 NetflowV9OptionsTemplateRecordType Class

The NetflowV9OptionsTemplateRecordType class specifies the Options Template Record which includes the Option Scope Length, Option Length, and fields specifying the Scope field class and Scope field length.

The property table of the NetflowV9OptionsTemplateRecordType class is given in Table 3‑29.

Table 3‑29. Properties of the NetflowV9OptionsTemplateRecordType class

Name	Type	Multiplicity	Description
Template_ID	cyboxCommon: IntegerObjectPropertyType	0..1	The Template_ID property specifies the template ID of this Options Template, which must be greater than 255.
Option_Scope_Length	cyboxCommon: HexBinaryObjectPropertyType	0..1	The Option_Scope_Length property specifies the length of bytes of any Scope property definition contained in the Options Template Record.
Option_Length	cyboxCommon: HexBinaryObjectPropertyType	0..1	The Option_Length property specifies the length of bytes of any options property definitions contained in this Options Template Record.
Scope_Field_Type	NetflowV9ScopeFieldType	0..1	The Scope_Field_Type property specifies the relevant portion of the Exporter/Netflow process to which the Options Template Record refers. Currently defined values include 1 for System, 2 for Interface, 3 for Line Card, 4 for Cache, and 5 for Template. See http://www.ietf.org/rfc/rfc3954.txt for more information.
Scope_Field_Length	cyboxCommon: HexBinaryObjectPropertyType	0..1	The Scope_Field_Length property specifies the length (in bytes) of the Scope property as it would appear in an Options Data Record.
Option_Field_Type	NetflowV9FieldType	0..1	The Option_Field_Type property specifies the type of property that would appear in the Options Template Record. See http://www.ietf.org/rfc/rfc3954.txt for more information.
Option_Field_Length	cyboxCommon: HexBinaryObjectPropertyType	0..1	The Option_Field_Length property specifies the length (in bytes) of the Option property.

3.7.8 NetflowV9ScopeFieldType Data Type

The NetflowV9ScopeFieldType data type specifies the scope field. Its core value SHOULD be a literal found in the NetflowV9ScopeFieldTypeEnum enumeration. Its base type is the BaseObjectPropertyType data type, in order to permit complex (i.e. regular-expression based) specifications.

3.7.9 NetflowV9DataFlowSetType Class

The NetflowV9DataFlowSetType class specifies a Data FlowSet, which is one or more records of the same class that are grouped together in an Export Packet. Each record is either a Flow Data Record or an Options Data Record previously defined by a Template Record or an Options Template Record. See http://www.ietf.org/rfc/rfc3954.txt for more information.

The property table of the NetflowV9DataFlowSetType class is given in Table 3‑30.

Table 3‑30. Properties of the NetflowV9DataFlowSetType class

Name	Type	Multiplicity	Description
Flow_Set_ID_Template_ID	cyboxCommon: IntegerObjectPropertyType	0..1	The Flow_Set_ID_Template_ID property specifies the FlowSet ID, which corresponds to the Template ID from a Template Flow Set or an Options Template Flow Set.
Length	cyboxCommon: IntegerObjectPropertyType	0..1	The Length property specifies the length of this FlowSet.
Data_Record	NetflowV9DataRecordType	0..*	The Data_Record property contains a collection of Flow Data Record(s), each containing a set of property values. The Type and Length of the fields have been previously defined in the Template Record referenced by the FlowSet ID or Template ID. The data record specifies either a template flow set or an options template flow set.
Padding	cyboxCommon: HexBinaryObjectPropertyType	0..1	The Padding property specifies the padding bytes used so that the subsequent FlowSet starts at a 4-byte aligned boundary. It is important to note that the Length property includes the padding bytes. Padding SHOULD be using zeros.

3.7.10 NetflowV9DataRecordType Class

The NetflowV9DataRecordType class specifies a Data FlowSet, which is one or more records of the same class that are grouped together in an Export Packet. Each record is either a Flow Data Record or an Options Data Record previously defined by a Template Record or an Options Template Record. See http://www.ietf.org/rfc/rfc3954.txt. The UML diagram corresponding to the NetworkFlowObjectType class is shown in Figure 3‑5.

Figure 3‑5. UML diagram of the NetworkV9DataRecordType class

The property table of the NetflowV9DataRecordType class is given in Table 3‑31.

Table 3‑31. Properties of the NetflowV9DataRecordType class

Name

Type

Multiplicity

Description

Has_Choice

NetflowV9DataRecordChoiceType

0..1

The Has_Choice property is associated with the class NetflowV9DataRecordChoiceType. It indicates that there is a choice between the Flow_Data_Record property and the Options_Data_Record property.

Only one of the properties of NetflowV9DataRecordChoiceType class can be populated at any time. See Section 1.2.3 for more detail.

The NetflowV9DataRecordChoiceType class is the type of the Has_Choice property. In the UML model, this class is associated with the <<choice>> UML stereotype, which specifies that only one of the available properties of the NetflowV9DataRecordChoiceType class can be populated at any time. The property table of the NetflowV9DataRecordChoiceType class is given in Table 3‑32.

Table 3‑32. Properties of the NetflowV9DataRecordChoiceType class

Name

Type

Multiplicity

Description

Flow_Data_Record

FlowDataRecordType

0..*

The Flow_Data_Record property specifies a Flow Data Record, which corresponds to a FieldType defined in the Template Record. Each one will have multiple values associated with it.

The Flow_Data_Record and Options_Data_Record properties MUST NOT both have a value.

Options_Data_Record

OptionsDataRecordType

0..*

The Options_Data_Record property specifies an Options Data Record, which corresponds to a previously defined Options Template Record.

The Flow_Data_Record and Options_Data_Record properties MUST NOT both have a value.

3.7.11 FlowDataRecordType Class

The FlowDataRecordType class specifies a data record that contains values of the Flow parameters corresponding to a Template Record.

The property table of the FlowDataRecordType class is given in Table 3‑33.

Table 3‑33. Properties of the FlowDataRecordType class

Name	Type	Multiplicity	Description
Flow_Record_Collection_Element	FlowCollectionElementType	0..*	The Flow_Record_Collection_Element property specifies property values for each flow record.

3.7.12 FlowCollectionElementType Class

The FlowCollectionElementType class specifies the values that are associated with each record in the collection of a flow data record.

The property table of the FlowCollectionElementType class is given in Table 3‑34.

Table 3‑34. Properties of the FlowCollectionElementType class

Name

Type

Multiplicity

Description

Flow_Record_Field_Value

cyboxCommon:

StringObjectPropertyType

0..*

The Flow_Record_Field_Value property specifies the set of property values for a given Flow Data Record.

3.7.13 OptionsDataRecordType Class

The OptionsDataRecordType class specifies the data record that contains values and scope information of the Flow measurement parameters, corresponding to an Options Template Record.

The property table of the OptionsDataRecordType class is given in Table 3‑35.

Table 3‑35. Properties of the OptionsDataRecordType class

Name

Type

Multiplicity

Description

Scope_Field_Value

cyboxCommon:

StringObjectPropertyType

0..1

The Scope_Field_Value property corresponds to a previously defined Options Template Record.

Option_Record_

Collection_Element

OptionCollectionElementType

0..*

The Option_Record_Collection_Element property specifies property values for each flow record.

3.7.14 OptionCollectionElementType Class

The OptionCollectionElementType class specifies the property values that are associated with each option in the collection of an option data record.

The property table of the OptionCollectionElementType class is given in Table 3‑36.

Table 3‑36. Properties of the OptionCollectionElementType class

Name

Type

Multiplicity

Description

Option_Record_Field_Value

cyboxCommon:

StringObjectPropertyType

0..*

The Option_Record_Field_Value property specifies the set of property values for a given Option Data Record.

3.8 NetflowV5PacketType Class

Figure 3‑6. UML diagram of the NetworkV5PacketType class

The NetflowV5PacketType class specifies the contents of a Netflow v5 packet. As of 2012, Netflow v5 is still the most commonly used network flow format. Netflow v5 was developed by Cisco. See http://netflow.caligare.com/netflow_v5.htm for more information.

The UML diagram corresponding to the NetworkFlowObjectType class is shown in Figure 3‑6.

The property table of the NetflowV5PacketType class is given in Table 3‑37.

Table 3‑37. Properties of the NetflowV5PacketType class

Name	Type	Multiplicity	Description
Flow_Header	NetflowV5FlowHeaderType	0..1	The Flow_Header property specifies properties of a Netflow v5 header.
Flow_Record	NetflowV5FlowRecordType	1..30	The Flow_Record property specifies the elements of a Netflow v5 flow record. See http://netflow.caligare.com/netflow_v5.htm or http://tools.netsa.cert.org/silk/faq.html#ipfix-fields for more information.

3.8.1 NetflowV5FlowHeaderType Class

The NetflowV5FlowHeaderType class specifies properties of a Netflow v5 header. See http://netflow.caligare.com/netflow_v5.htm for more information.

The property table of the NetflowV5FlowHeaderType class is given in Table 3‑38.

Table 3‑38. Properties of the NetflowV5FlowHeaderType class

Name	Type	Multiplicity	Description
Version	cyboxCommon: HexBinaryObjectPropertyType	0..1	The Version property specifies the Netflow export format version number, which defaults to 5 in this case.
Count	cyboxCommon: IntegerObjectPropertyType	0..1	The Count property specifies the number of flows exported in the packet (1-30).
Sys_Up_Time	cyboxCommon: IntegerObjectPropertyType	0..1	The Sys_Up_Time property specifies the current time in milliseconds since the export device booted.
Unix_Secs	cyboxCommon: IntegerObjectPropertyType	0..1	The Unix_Secs property specifies the current time in milliseconds since 0000 UTC 1970.
Unix_Nsecs	cyboxCommon: IntegerObjectPropertyType	0..1	The Unix_Nsecs property specifies the residual in nanoseconds since 0000 UTC 1970.
Flow_Sequence	cyboxCommon: IntegerObjectPropertyType	0..1	The Flow_Sequence property specifies the sequence counter of total flows seen.
Engine_Type	cyboxCommon: StringObjectPropertyType	0..1	The Engine_Type property specifies the type of flow-switching engine.
Engine_ID	cyboxCommon: IntegerObjectPropertyType	0..1	The Engine_ID property specifies the slot number of the flow-switching engine.
Sampling_Interval	cyboxCommon: HexBinaryObjectPropertyType	0..1	The Sampling_Interval property specifies the first two bits holding the sampling mode, with the remaining 14 bits holding the value of the sampling interval.

3.8.2 NetflowV5FlowRecordType Class

The NetflowV5FlowRecordType class specifies properties of a Netflow v5 flow record. Recall that the seven elements that define the flow itself (e.g., source IP address) are provided in NetworkFlowLabelType. See https://bto.bluecoat.com/packetguide/8.6/info/netflow5-records.htm for more information.

The property table of the NetflowV5FlowRecordType class is given in Table 3‑39.

Table 3‑39. Properties of the NetflowV5FlowRecordType class

Name	Type	Multiplicity	Description
Nexthop_IPv4_Addr	AddressObj: AddressObjectType	0..1	The Nexthop_IPv4_Addr property represents the IP address of the next hop router.
Packet_Count	cyboxCommon: IntegerObjectPropertyType	0..1	The Packet_Count property represents the number of packets in the flow.
Byte_Count	cyboxCommon: IntegerObjectPropertyType	0..1	The Byte_Count property represents the total number of bytes in the flow.
SysUpTime_Start	cyboxCommon: IntegerObjectPropertyType	0..1	The SysUpTime_Start property represents the SysUpTime at start of flow: the total time in milliseconds starting from when the first packet in the flow was seen.
SysUpTime_End	cyboxCommon: IntegerObjectPropertyType	0..1	The SysUpTime_End property represents the SysUpTime at end of flow: when the last packet in the flow was seen.
Padding1	cyboxCommon: HexBinaryObjectPropertyType	0..1	The Padding1 property specifies one byte of padding.
TCP_Flags	cyboxCommon: HexBinaryObjectPropertyType	0..1	The TCP_Flags property specifies the union of all TCP flags observed over the life of the flow.
Src_Autonomous_System	cyboxCommon: IntegerObjectPropertyType	0..1	The Src_Autonomous_System property specifies the source autonomous system number, either origin or peer.
Dest_Autonomous_System	cyboxCommon: IntegerObjectPropertyType	0..1	The Dest_Autonomous_System property specifies the destination autonomous system number, either origin or peer.
Src_IP_Mask_Bit_Count	cyboxCommon: StringObjectPropertyType	0..1	The Src_IP_Mask_Bit_Count property specifies the source address prefix mask bits.
Dest_IP_Mask_Bit_Count	cyboxCommon: StringObjectPropertyType	0..1	The Dest_IP_Mask_Bit_Count property specifies the destination address prefix mask bits.
Padding2	cyboxCommon: HexBinaryObjectPropertyType	0..1	The Padding2 property specifies the unused (zero) bytes, which is used for purposes of padding.

3.9 SiLKRecordType Class

Figure 3‑7. UML diagram of the SiLKRecordType class

The SiLKRecordType class, specifies the System for Internet-Level Knowledge (CMU/SEI) record type. The properties are taken from a list shown in http://tools.netsa.cert.org/silk/rwcut.html. Fields common to all network flows are defined in NetworkFlowLabelType class (e.g., source IP, SNMP ingress, etc.). For additional references, see http://tools.netsa.cert.org/silk/analysis-handbook.pdf and http://tools.netsa.cert.org/silk/faq.html#ipfix-fields.

The UML diagram corresponding to the NetworkFlowObjectType class is shown in Figure 3‑7.

The property table of the SiLKRecordType class is given in Table 3‑40.

Table 3‑40. Properties of the SiLKRecordType class

Name	Type	Multiplicity	Description
Packet_Count	cyboxCommon: IntegerObjectPropertyType	0..1	The Packet_Count property represents the number of packets in the flow.
Byte_Count	cyboxCommon: IntegerObjectPropertyType	0..1	The Byte_Count property represents the number of Layer 3 bytes in the packets of the flow.
TCP_Flags	cyboxCommon: HexBinaryObjectPropertyType	0..1	The TCP_Flags property specifies the union of all TCP flags observed over the life of the flow.
Start_Time	cyboxCommon: IntegerObjectPropertyType	0..1	The Start_Time property represents the SysUpTime at start of flow, i.e. the total time in milliseconds starting from when the router booted. There is another element "Start_Time + msec" which is the starting time of flow including milliseconds, but milliseconds are the resolution of Start_Time unless the -legacy-timestamps switch is specified, so "Start_Time + msec" is not defined separately.
Duration	cyboxCommon: IntegerObjectPropertyType	0..1	The Duration property specifies the duration of the flow. There is another element "Duration + msec" which is the starting time of flow including milliseconds, but milliseconds are the resolution of Duration unless the -legacy-timestamps switch is specified, so "Duration + msec" is not defined separately.
End_Time	cyboxCommon: IntegerObjectPropertyType	0..1	The End_Time property represents the SysUpTime at end of flow. There is another element "End_Time + msec" which is the starting time of flow including milliseconds, but milliseconds are the resolution of End_Time unless the -legacy-timestamps switch is specified, so "End_Time + msec" is not defined separately.
Sensor_Info	SiLKSensorInfoType	0..1	The Sensor_Info property defines the properties associated with the sensor at the collection point.
ICMP_Type	cyboxCommon: IntegerObjectPropertyType	0..1	The ICMP_Type property specifies the type for ICMP flows. It is empty for non-ICMP flows.
ICMP_Code	cyboxCommon: IntegerObjectPropertyType	0..1	The ICMP_Code property specifies the code for ICMP flows. It is empty for non-ICMP flows.
Router_Next_Hop_IP	AddressObj: AddressObjectType	0..1	The Router_Next_Hop_IP property specifies the router next hop IP.
Initial_TCP_Flags	PacketObj:TCPFlagsType	0..1	The Initial_TCP_Flags property specifies the TCP flags on first packet in the flow.
Session_TCP_Flags	cyboxCommon: HexBinaryObjectPropertyType	0..1	The Session_TCP_Flags property specifies the bit-wise OR of TCP flags over all packets except the first in the flow.
Flow_Attributes	SiLKFlowAttributesType	0..1	The Flow_Attributes property specifies the flow attributes set by the flow generator.
Flow_Application	PacketObj: IANAPortNumberRegistryType	0..1	The Flow_Application property is based on an examination of payload contents. The value is equal to the port number traditionally used for that type of traffic (21 for FTP traffic even if actually routed over port 80). Documentation (http://tools.netsa.cert.org/silk/rwcut.html) says this is a "guess as to the content of the flow".
Src_IP_Type	SiLKAddressType	0..1	The Src_IP_Type property specifies the type of the source IP in terms of whether the address is routable, external, etc.
Dest_IP_Type	SiLKAddressType	0..1	The Dest_IP_Type property specifies the type of the destination IP in terms of whether the address is routable, external, etc.
Src_Country_Code	SiLKCountryCodeType	0..1	The Src_Country_Code property specifies a two-letter country code denoting the country of location of the source IP address.
Dest_Country_Code	SiLKCountryCodeType	0..1	The Dest_Country_Code property specifies a two-letter country code denoting the country of location of the destination IP address.
Src_MAPNAME	cyboxCommon: StringObjectPropertyType	0..1	The Src_MAPNAME property specifies the user defined string for integrating external information into SiLK records. See documentation on SiLK pmap filter for details (defined in the prefix map associated with MAPNAME).
Dest_MAPNAME	cyboxCommon: StringObjectPropertyType	0..1	The Dest_MAPNAME property specifies the user defined string for integrating external information into SiLK records. See documentation on SiLK pmap filter for details (defined in the prefix map associated with MAPNAME).

3.9.1 SiLKFlowAttributesType Data Type

The SiLKFlowAttributesType data type specifies the SiLK flow attributes. Its core value SHOULD be a literal found in the SiLKFlowAttributesTypeEnum enumeration. Its base type is the BaseObjectPropertyType data type, in order to permit complex (i.e. regular-expression based) specifications.

3.9.2 SiLKAddressType Data Type

The SiLKAddressType data type specifies the SiLK address type. Its core value SHOULD be a literal found in the SiLKAddressTypeEnum enumeration. Its base type is the BaseObjectPropertyType data type, in order to permit complex (i.e. regular-expression based) specifications.

3.9.3 SiLKCountryCodeType Class

The SiLKCountryCodeType data type specifies the country codes used. Its core value SHOULD be a literal found in the SiLKCountryCodeTypeEnum enumeration. Its base type is the BaseObjectPropertyType data type, in order to permit complex (i.e. regular-expression based) specifications.

3.9.4 SiLKSensorInfoType Class

The SiLKSensorInfoType class specifies properties associated with a SiLK sensor.

The property table of the SiLKSensorInfoType class is given in Table 3‑41.

Table 3‑41. Properties of the SiLKSensorInfoType class

Name	Type	Multiplicity	Description
Sensor_ID	cyboxCommon: StringObjectPropertyType	0..1	The Sensor_ID property specifies the name or ID of sensor at the collection point.
Class	SiLKSensorClassType	0..1	The Class property specifies the sensor class. By default, the "all" class. Others can be configured.
Type	SiLKDirectionType	0..1	The Type property specifies the direction of traffic, which is enumerated by SiLKDirectionType.

3.9.5 SiLKDirectionType Class

The SiLKDirectionType data type specifies the direction of SiLK traffic. Its core value SHOULD be a literal found in the SiLKDirectionTypeEnum enumeration. Its base type is the BaseObjectPropertyType data type, in order to permit complex (i.e. regular-expression based) specifications.

3.9.6 SiLKSensorClassType Class

The SiLKSensorClassType data type specifies the sensor type. Its core value SHOULD be a literal found in the SiLKSensorClassTypeEnum enumeration. Its base type is the BaseObjectPropertyType data type, in order to permit complex (i.e. regular-expression based) specifications.

3.10 YAFRecordType Class

Figure 3‑8. UML diagram of the YAFRecordType class

The YAFRecordType class specifies the YAF (Yet Another Flowmeter) record type, which is a bidirectional network flow meter. It processes packet data from pcap(3) dumpfiles as generated by tcpdump(1) or via live capture from an interface using pcap(3) into bidirectional flows, then exports those flows to IPFIX. See http://www.usenix.org/event/lisa10/tech/full_papers/Inacio.pdf for more information.

The UML diagram corresponding to the NetworkFlowObjectType class is shown in Figure 3‑8.

The property table of the YAFRecordType class is given in Table 3‑42.

Table 3‑42. Properties of the YAFRecordType class

Name	Type	Multiplicity	Description
Flow	YAFFlowType	0..1	The Flow property specifies the properties in a YAF record that have been separated based on flow direction. These properties are defined for the general forward flow.
Reverse_Flow	YAFReverseFlowType	0..1	The Reverse_Flow property specifies some of the properties in a YAF record which correspond to the reverse flow.

3.10.1 YAFFlowType Class

The YAFFlowType class specifies the properties of a YAF record correspond to the flow generally or to the forward portion of the flow. Properties common to all network flow objects are defined in the NetworkFlowLabelType class (src ip address, ingress/egress interface).

The property table of the YAFFlowType class is given in Table 3‑43.

Table 3‑43. Properties of the YAFFlowType class

Name	Type	Multiplicity	Description
Flow_Start_Milliseconds	cyboxCommon: IntegerObjectPropertyType	0..1	The Flow_Start_Milliseconds property specifies the flow start time in milliseconds since 1970-01-01 00:00:00 UTC.
Flow_End_Milliseconds	cyboxCommon: IntegerObjectPropertyType	0..1	The Flow_End_Milliseconds property specifies the flow end time in milliseconds since 1970-01-01 00:00:00 UTC.
Octet_Total_Count	cyboxCommon: IntegerObjectPropertyType	0..1	The Octet_Total_Count property specifies the number of octets in packets in forward direction of flow. May be encoded in 4 octets using IPFIX reduced-length encoding.
Packet_Total_Count	cyboxCommon: IntegerObjectPropertyType	0..1	The Packet_Total_Count property specifies the number of packets in forward direction of flow.
Flow_End_Reason	cyboxCommon: HexBinaryObjectPropertyType	0..1	The Flow_End_Reason property specifies the reason for Flow termination. It may contain SiLK-specific tags. The range of values may include the following: · 0x01: idle timeout (the Flow was terminated because it was considered to be idle). · 0x02: active timeout (the Flow was terminated for reporting purposes while it was still active, for example, after the maximum lifetime of unreported Flows was reached). · 0x03: end of Flow detected (the Flow was terminated because the Metering Process detected signals indicating the end of the Flow, for example, the TCP FIN flag.) · 0x04: forced end (the Flow was terminated because of some external event, for example, a shutdown of the Metering Process initiated by a network management application.) · 0x05: lack of resources (the Flow was terminated because of lack of resources available to the Metering Process and/or the Exporting Process.) See http://www.iana.org/assignments/ipfix/ipfix.xml for more information.
SiLK_App_Label	cyboxCommon: IntegerObjectPropertyType	0..1	The SiLK_App_Label property specifies the port number that is traditionally used for that type of traffic (see the /etc/services file on most UNIX systems). For example, traffic that the flow generator recognizes as FTP will have a value of 21, even if that traffic is being routed through the standard HTTP/web port (80).
Payload_Entropy	cyboxCommon: IntegerObjectPropertyType	0..1	The Payload_Entropy property specifies the Shannon Entropy calculation of the forward payload data. The calculation generates a real number value between 0.0 and 8.0. That number is then converted into an 8-bit integer value between 0 and 255. Roughly, numbers above 230 are generally compressed (or encrypted) and numbers centered around approximately 140 are English text. Lower numbers carry even less information content.
ML_App_Label	cyboxCommon: HexBinaryObjectPropertyType	0..1	The ML_App_Label property specifies the machine-learning app label.
TCP_Flow	YAFTCPFlowType	0..1	The TCP_Flow property specifies the TCP-related information of the network flow.
Vlan_ID_MAC_Addr	AddressObj:AddressObjectType	0..1	The Vlan_ID_MAC_Addr property specifies the MAC address.
Passive_OS_Fingerprinting	cyboxCommon: PlatformSpecificationType	0..1	The Passive_OS_Fingerprinting property specifies the OS name and version.
First_Packet_Banner	cyboxCommon: HexBinaryObjectPropertyType	0..1	The First_Packet_Banner property specifies the first forward packet IP payload.
Second_Packet_Banner	cyboxCommon: HexBinaryObjectPropertyType	0..1	The Second_Packet_Banner property specifies the second forward packet IP payload.
N_Bytes_Payload	cyboxCommon: HexBinaryObjectPropertyType	0..1	The N_Bytes_Payload property specifies the initial n bytes of forward direction of applications payload.

3.10.2 YAFReverseFlowType Class

The YAFReverseFlowType class specifies the properties that correspond to the reverse flow captured by a YAF record.

The property table of the YAFReverseFlowType class is given in Table 3‑44.

Table 3‑44. Properties of the YAFReverseFlowType class

Name	Type	Multiplicity	Description
Reverse_Octet_ Total_Count	cyboxCommon: IntegerObjectPropertyType	0..1	The Reverse_Octet_Total_Count property specifies the number of octets in packets in reverse direction of flow. May be encoded in 4 octets using IPFIX reduced-length encoding.
Reverse_Packet_ Total_Count	cyboxCommon: IntegerObjectPropertyType	0..1	The Reverse_Packet_Total_Count property specifies the number of packets in reverse direction of flow.
Reverse_Payload_ Entropy	cyboxCommon: IntegerObjectPropertyType	0..1	The Reverse_Payload_Entropy property specifies the Shannon Entropy calculation of the reverse payload data. The calculation generates a real number value between 0.0 and 8.0. That number is then converted into an 8-bit integer value between 0 and 255. Roughly, numbers above 230 are generally compressed (or encrypted) and numbers centered around approximately 140 are English text. Lower numbers carry even less information content.
Reverse_Flow_Delta_ Milliseconds	cyboxCommon: IntegerObjectPropertyType	0..1	The Reverse_Flow_Delta_Milliseconds property specifies the RTT of initial handshake.
TCP_Reverse_Flow	YAFTCPFlowType	0..1	The TCP_Reverse_Flow property specifies the associated properties related to the reverse packets of the flow.
Reverse_Vlan_ID_ MAC_Addr	AddressObj:AddressObjectType	0..1	The Reverse_Vlan_ID_MAC_Addr property specifies the reverse MAC address.
Reverse_Passive_ OS_Fingerprinting	cyboxCommon: PlatformSpecificationType	0..1	The Reverse_Passive_OS_Fingerprinting property specifies the OS name and version of the reverse flow.
Reverse_First_Packet	cyboxCommon: HexBinaryObjectPropertyType	0..1	The Reverse_First_Packet property specifies First reverse packet IP payload.
Reverse_N_Bytes_ Payload	cyboxCommon: HexBinaryObjectPropertyType	0..1	The Reverse_N_Bytes_Payload property specifies the initial n bytes of reverse direction of flow payload.

3.10.3 YAFTCPFlowType Class

The YAFTCPFlowType class specifies the TCP-related information of the network flow.

The property table of the YAFTCPFlowType class is given in Table 3‑45.

Table 3‑45. Properties of the YAFTCPFlowType class

Name	Type	Multiplicity	Description
TCP_Sequence_Number	cyboxCommon: IntegerObjectPropertyType	0..1	The TCP_Sequence_Number property specifies the TCP sequence number.
Initial_TCP_Flags	PacketObj:TCPFlagsType	0..1	The Initial_TCP_Flags property specifies the TCP flags of the first packet.
Union_TCP_Flags	cyboxCommon: HexBinaryObjectPropertyType	0..1	The Union_TCP_Flags property specifies the union of the TCP flags of the 2...nth packet.

3.11 NetflowV9FieldTypeEnum Enumeration

The literals of the NetflowV9FieldTypeEnum enumeration are given in Table 3‑46.

Table 3‑46. Literals of the NetflowV9FieldTypeEnum enumeration

Enumeration Literal	Description
IN_BYTES(1)	The IN_BYTES(1) field represents the incoming counter with length N x 8 bits for number of bytes associated with an IP Flow.
IN_PKTS(2)	The IN_PKTS(2) field represents the incoming counter with length N x 8 bits for the number of packets associated with an IP Flow.
FLOWS(3)	The FLOWS(3) field represents the number of flows that were aggregated; default for N is 4.
PROTOCOL(4)	The PROTOCOL(4) field represents the IP protocol byte.
SRC_TOS(5)	The TOS(5) field represents the Type of Service byte setting when entering incoming interface.
TCP_FLAGS(6)	The TCP_FLAGS(6) field is cumulative of all the TCP flags seen for this flow.
L4_SRC_PORT(7)	The L4_SRC_PORT(7) field represents the TCP/UDP source port number i.e.: FTP, Telnet, or equivalent.
IPV4_SRC_ADDR(8)	The IPV4_SRC_ADDR(8) field represents the IPv4 source address.
SRC_MASK(9)	The SRC_MASK(9) field represents the number of contiguous bits in the source address subnet mask i.e.: the submask in slash notation.
INPUT_SNMP(10)	The INPUT_SNMP(10) field represents the number of contiguous bits in the source address subnet mask i.e.: the submask in slash notation.
L4_DST_PORT(11)	The LP_DST_PORT(11) field represents the TCP/UDP destination port number i.e.: FTP, Telnet, or equivalent.
IPV4_DST_ADDR(12)	The IPV4_DST_ADDR(12) field represents the IPv4 destination address.
DST_MASK(13)	The DST_MASK(13) field represents the number of contiguous bits in the destination address subnet mask i.e.: the submask in slash notation.
OUTPUT_SNMP(14)	The OUTPUT_SNMP(14) field represents the output interface index; default for N is 2 but higher values could be used.
IPV4_NEXT_HOP(15)	The IPV4_NEXT_HOP(15) field represents the IPv4 address of next-hop router.
SRC_AS(16)	The SRC_AS(16) field represents the source BGP autonomous system number where N could be 2 or 4.
DST_AS(17)	The DST_AS(17) field represents the destination BGP autonomous system number where N could be 2 or 4.
BGP_IPV4_NEXT_HOP(18)	The BGP_IPV4_NEXT_HOP(18) field represents the next-hop router's IP in the BGP domain.
MUL_DST_PKTS(19)	The MUL_DST_PKTS(19) field represents the IP multicast outgoing packet counter with length N x 8 bits for packets associated with the IP Flow.
MUL_DST_BYTES(20)	The MUL_DST_BYTES(20) field represents the IP multicast outgoing byte counter with length N x 8 bits for bytes associated with the IP Flow.

3.12 NetflowV9ScopeFieldTypeEnum Enumeration

The literals of the NetflowV9ScopeFieldTypeEnum enumeration are given in Table 3‑47.

Table 3‑47. Literals of the NetflowV9ScopeFieldTypeEnum enumeration

Enumeration Literal	Description
System(1)	Indicates the System scope field type.
Interface(2)	Indicates the Interface scope field type.
LineCard(3)	Indicates the Line Card scope field type.
Cache(4)	Indicates the Netflow Cache scope field type.
Template(5)	Describes the Template scope field type.

3.13 SiLKFlowAttributesTypeEnum Enumeration

The literals of the SiLKFlowAttributesTypeEnum enumeration are given in Table 3‑48.

Table 3‑48. Literals of the SiLKFlowAttributesTypeEnum enumeration

Enumeration Literal	Description
F (FIN flag)	Indicates that the flow generator saw additional packets in this flow following a packet with a FIN flag (excluding ACK packets).
T (Timeout)	Indicates that the flow generator prematurely created a record for a long-running connection due to a timeout. (When the flow generator yaf(1) is run with the --silk switch, it will prematurely create a flow and mark it with T if the byte count of the flow cannot be stored in a 32-bit value.).
C (Continuation)	Indicates that the flow generator created this flow as a continuation of long-running connection, where the previous flow for this connection met a timeout (or a byte threshold in the case of yaf).

3.14 SiLKAddressTypeEnum Enumeration

The literals of the SiLKAddressTypeEnum enumeration are given in Table 3‑49.

Table 3‑49. Literals of the SiLKAddressTypeEnum enumeration

Enumeration Literal	Description
non-routable (0)	Denotes a (non-routable) IP address.
internal(1)	Denotes an IP address internal to the monitored network.
routable_external(2)	Denotes an IP address external to the monitored network.

3.15 SiLKDirectionTypeEnum Enumeration

The literals of the SiLKDirectionTypeEnum enumeration are given in Table 3‑50.

Table 3‑50. Literals of the SiLKDirectionTypeEnum enumeration

Enumeration Literal	Description
in	Denotes inbound traffic relative to a sensor.
inweb	Denotes inbound web traffic relative to a sensor. SiLK categorizes a flow as web if the protocol is TCP and either the source port or destination port is one of 80, 443, or 8080.
innull	Denotes null inbound traffic relative to a sensor.
out	Denotes outbound traffic relative to a sensor.
outweb	Denotes outbound web traffic relative to a sensor. SiLK categorizes a flow as web if the protocol is TCP and either the source port or destination port is one of 80, 443, or 8080.
outnull	Denotes null outbound traffic relative to a sensor.

3.16 SiLKSensorClassTypeEnum Enumeration

The literals of the SiLKSensorClassTypeEnum enumeration are given in Table 3‑51.

Table 3‑51. Literals of the SiLKSensorClassTypeEnum enumeration

Enumeration Literal	Description
all	Defines sensor class "all".

4 Conformance

Implementations have discretion over which parts (components, properties, extensions, controlled vocabularies, etc.) of CybOX they implement (e.g., Observable/Object).

[1] Conformant implementations must conform to all normative structural specifications of the UML model or additional normative statements within this document that apply to the portions of CybOX they implement (e.g., implementers of the entire Observable class must conform to all normative structural specifications of the UML model regarding the Observable class or additional normative statements contained in the document that describes the Observable class).

[2] Conformant implementations are free to ignore normative structural specifications of the UML model or additional normative statements within this document that do not apply to the portions of CybOX they implement (e.g., non-implementers of any particular properties of the Observable class are free to ignore all normative structural specifications of the UML model regarding those properties of the Observable class or additional normative statements contained in the document that describes the Observable class).

The conformance section of this document is intentionally broad and attempts to reiterate what already exists in this document.

Appendix A. Acknowledgments

The following individuals have participated in the creation of this specification and are gratefully acknowledged:

Aetna

David Crawford

AIT Austrian Institute of Technology

Roman Fiedler

Florian Skopik

Australia and New Zealand Banking Group (ANZ Bank)

Dean Thompson

Blue Coat Systems, Inc.

Owen Johnson

Bret Jordan

Century Link

Cory Kennedy

CIRCL

Alexandre Dulaunoy

Andras Iklody

Raphaël Vinot

Citrix Systems

Joey Peloquin

Dell

Will Urbanski

Jeff Williams

DTCC

Dan Brown

Gordon Hundley

Chris Koutras

EMC

Robert Griffin

Jeff Odom

Ravi Sharda

Financial Services Information Sharing and Analysis Center (FS-ISAC)

David Eilken

Chris Ricard

Fortinet Inc.

Gavin Chow

Kenichi Terashita

Fujitsu Limited

Neil Edwards

Frederick Hirsch

Ryusuke Masuoka

Daisuke Murabayashi

Google Inc.

Mark Risher

Hitachi, Ltd.

Kazuo Noguchi

Akihito Sawada

Masato Terada

iboss, Inc.

Paul Martini

Individual

Jerome Athias

Peter Brown

Elysa Jones

Sanjiv Kalkar

Bar Lockwood

Terry MacDonald

Alex Pinto

Intel Corporation

Tim Casey

Kent Landfield

JPMorgan Chase Bank, N.A.

Terrence Driscoll

David Laurance

LookingGlass

Allan Thomson

Lee Vorthman

Mitre Corporation

Greg Back

Jonathan Baker

Sean Barnum

Desiree Beck

Nicole Gong

Jasen Jacobsen

Ivan Kirillov

Richard Piazza

Jon Salwen

Charles Schmidt

Emmanuelle Vargas-Gonzalez

John Wunder

National Council of ISACs (NCI)

Scott Algeier

Denise Anderson

Josh Poster

NEC Corporation

Takahiro Kakumaru

North American Energy Standards Board

David Darnell

Object Management Group

Cory Casanave

Palo Alto Networks

Vishaal Hariprasad

Queralt, Inc.

John Tolbert

Resilient Systems, Inc.

Ted Julian

Securonix

Igor Baikalov

Siemens AG

Bernd Grobauer

Soltra

John Anderson

Aishwarya Asok Kumar

Peter Ayasse

Jeff Beekman

Michael Butt

Cynthia Camacho

Aharon Chernin

Mark Clancy

Brady Cotton

Trey Darley

Mark Davidson

Paul Dion

Daniel Dye

Robert Hutto

Raymond Keckler

Ali Khan

Chris Kiehl

Clayton Long

Michael Pepin

Natalie Suarez

David Waters

Benjamin Yates

Symantec Corp.

Curtis Kostrosky

The Boeing Company

Crystal Hayes

ThreatQuotient, Inc.

Ryan Trost

U.S. Bank

Mark Angel

Brad Butts

Brian Fay

Mona Magathan

Yevgen Sautin

US Department of Defense (DoD)

James Bohling

Eoghan Casey

Gary Katz

Jeffrey Mates

VeriSign

Robert Coderre

Kyle Maxwell

Eric Osterweil

Airbus Group SAS

Joerg Eschweiler

Marcos Orallo

Anomali

Ryan Clough

Wei Huang

Hugh Njemanze

Katie Pelusi

Aaron Shelmire

Jason Trost

Bank of America

Alexander Foley

Center for Internet Security (CIS)

Sarah Kelley

Check Point Software Technologies

Ron Davidson

Cisco Systems

Syam Appala

Ted Bedwell

David McGrew

Pavan Reddy

Omar Santos

Jyoti Verma

Cyber Threat Intelligence Network, Inc. (CTIN)

Doug DePeppe

Jane Ginn

Ben Othman

DHS Office of Cybersecurity and Communications (CS&C)

Richard Struse

Marlon Taylor

EclecticIQ

Marko Dragoljevic

Joep Gommers

Sergey Polzunov

Rutger Prins

Andrei Sîrghi

Raymon van der Velde

eSentire, Inc.

Jacob Gajek

FireEye, Inc.

Phillip Boles

Pavan Gorakav

Anuj Kumar

Shyamal Pandya

Paul Patrick

Scott Shreve

Fox-IT

Sarah Brown

Georgetown University

Eric Burger

Hewlett Packard Enterprise (HPE)

Tomas Sander

IBM

Peter Allor

Eldan Ben-Haim

Sandra Hernandez

Jason Keirstead

John Morris

Laura Rusu

Ron Williams

IID

Chris Richardson

Integrated Networking Technologies, Inc.

Patrick Maroney

Johns Hopkins University Applied Physics Laboratory

Karin Marr

Julie Modlin

Mark Moss

Pamela Smith

Kaiser Permanente

Russell Culpepper

Beth Pumo

Lumeta Corporation

Brandon Hoffman

MTG Management Consultants, LLC.

James Cabral

National Security Agency

Mike Boyle

Jessica Fitzgerald-McKay

New Context Services, Inc.

John-Mark Gurney

Christian Hunt

James Moler

Daniel Riedel

Andrew Storms

OASIS

James Bryce Clark

Robin Cover

Chet Ensign

Open Identity Exchange

Don Thibeau

PhishMe Inc.

Josh Larkins

Raytheon Company-SAS

Daniel Wyschogrod

Retail Cyber Intelligence Sharing Center (R-CISC)

Brian Engle

Semper Fortis Solutions

Joseph Brand

Splunk Inc.

Cedric LeRoux

Brian Luger

Kathy Wang

TELUS

Greg Reaume

Alan Steer

Threat Intelligence Pty Ltd

Tyron Miller

Andrew van der Stock

ThreatConnect, Inc.

Wade Baker

Cole Iliff

Andrew Pendergast

Ben Schmoker

Jason Spies

TruSTAR Technology

Chris Roblee

United Kingdom Cabinet Office

Iain Brown

Adam Cooper

Mike McLellan

Chris O’Brien

James Penman

Howard Staple

Chris Taylor

Laurie Thomson

Alastair Treharne

Julian White

Bethany Yates

US Department of Homeland Security

Evette Maynard-Noel

Justin Stekervetz

ViaSat, Inc.

Lee Chieffalo

Wilson Figueroa

Andrew May

Yaana Technologies, LLC

Anthony Rutkowski

The authors would also like to thank the larger CybOX Community for its input and help in reviewing this document.

Appendix B. Revision History

Revision	Date	Editor	Changes Made
wd01	15 December 2015	Desiree Beck Trey Darley Ivan Kirillov Rich Piazza	Initial transfer to OASIS template

Icon	Description
	This diagram icon indicates a class. If the name is in italics, it is an abstract class.
	This diagram icon indicates an enumeration.
	This diagram icon indicates a data type.
	This decorator icon indicates an attribute of a class. The green circle means its visibility is public. If the circle is red or yellow, it means its visibility is private or protected.
	This decorator icon indicates an enumeration literal.
	This arrow type indicates a directed association relationship.
	This arrow type indicates a generalization relationship.

Verb	CybOX Definition
captures	Used to record and preserve information without implying anything about the structure of a class or property. Often used for properties that encompass general content. This is the least precise of the three verbs.
	Examples: The Observable_Source property characterizes the source of the Observable information. Examples of details captured include identifying characteristics, time-related attributes, and a list of the tools used to collect the information. The Description property captures a textual description of the Action.
characterizes	Describes the distinctive nature or features of a class or property. Often used to describe classes and properties that themselves comprise one or more other properties.
	Examples: The Action property characterizes a cyber observable Action. The Obfuscation_Technique property characterizes a technique an attacker could potentially leverage to obfuscate the Observable.
specifies	Used to clearly and precisely identify particular instances or values associated with a property. Often used for properties that are defined by a controlled vocabulary or enumeration; typically used for properties that take on only a single value.
	Example: The cybox_major_version property specifies the major version of the CybOX language used for the set of Observables.

1.4 Normative References