Showing:

Annotations
Attributes
Diagrams
Source
Used by
Imported schema User_Account_Object.xsd
Namespace http://cybox.mitre.org/objects#UserAccountObject-2
Annotations
This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org.
Element UserAccountObj:UserAccountObjectType / UserAccountObj:Full_Name
Namespace http://cybox.mitre.org/objects#UserAccountObject-2
Annotations
The Full_Name field specifies the full name of the user for which this account was created.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype cybox_common_xsd.tmp#StringObjectPropertyType
Type cyboxCommon:StringObjectPropertyType
Type hierarchy
Attributes
QName Type Fixed Default Use Annotation
appears_random xs:boolean optional
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional
This attribute is optional and specifies the expected type for the value of the specified property.
defanging_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
has_changed xs:boolean optional
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional
The id field specifies a unique ID for this Object Property.
idref xs:QName optional
The idref field specifies a unique ID reference for this Object Property.
is_defanged xs:boolean optional
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
pattern_type cyboxCommon:PatternTypeEnum optional
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
					
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification. 
					
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not definied by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
<xs:element name="Full_Name" type="cyboxCommon:StringObjectPropertyType" minOccurs="0" maxOccurs="1">
  <xs:annotation>
    <xs:documentation>The Full_Name field specifies the full name of the user for which this account was created.</xs:documentation>
  </xs:annotation>
</xs:element>
Element UserAccountObj:UserAccountObjectType / UserAccountObj:Group_List
Namespace http://cybox.mitre.org/objects#UserAccountObject-2
Annotations
The Group_List field specifies the list of groups to which the user account belongs to.
Diagram
Diagram User_Account_Object_xsd.tmp#GroupListType_Group User_Account_Object_xsd.tmp#GroupListType
Type UserAccountObj:GroupListType
Children UserAccountObj:Group
Source
<xs:element name="Group_List" type="UserAccountObj:GroupListType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Group_List field specifies the list of groups to which the user account belongs to.</xs:documentation>
  </xs:annotation>
</xs:element>
Element UserAccountObj:GroupListType / UserAccountObj:Group
Namespace http://cybox.mitre.org/objects#UserAccountObject-2
Annotations
The Group field specifies a group that a user account belongs to. This is an abstract type since group IDs are operating-system specific, and is extended as needed in the derived CybOX object schemas.
Diagram
Diagram User_Account_Object_xsd.tmp#GroupType
Type UserAccountObj:GroupType
Source
<xs:element name="Group" type="UserAccountObj:GroupType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Group field specifies a group that a user account belongs to. This is an abstract type since group IDs are operating-system specific, and is extended as needed in the derived CybOX object schemas.</xs:documentation>
  </xs:annotation>
</xs:element>
Element UserAccountObj:UserAccountObjectType / UserAccountObj:Home_Directory
Namespace http://cybox.mitre.org/objects#UserAccountObject-2
Annotations
The Home_Directory field specifies the fully-qualified path to the home directory of the user account.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype cybox_common_xsd.tmp#StringObjectPropertyType
Type cyboxCommon:StringObjectPropertyType
Type hierarchy
Attributes
QName Type Fixed Default Use Annotation
appears_random xs:boolean optional
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional
This attribute is optional and specifies the expected type for the value of the specified property.
defanging_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
has_changed xs:boolean optional
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional
The id field specifies a unique ID for this Object Property.
idref xs:QName optional
The idref field specifies a unique ID reference for this Object Property.
is_defanged xs:boolean optional
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
pattern_type cyboxCommon:PatternTypeEnum optional
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
					
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification. 
					
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not definied by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
<xs:element name="Home_Directory" type="cyboxCommon:StringObjectPropertyType" minOccurs="0" maxOccurs="1">
  <xs:annotation>
    <xs:documentation>The Home_Directory field specifies the fully-qualified path to the home directory of the user account.</xs:documentation>
  </xs:annotation>
</xs:element>
Element UserAccountObj:UserAccountObjectType / UserAccountObj:Last_Login
Namespace http://cybox.mitre.org/objects#UserAccountObject-2
Annotations
The Last_Login field specifies the date/time that the user account was last logged into.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#DateTimeObjectPropertyType_datatype cybox_common_xsd.tmp#DateTimeObjectPropertyType
Type cyboxCommon:DateTimeObjectPropertyType
Type hierarchy
Attributes
QName Type Fixed Default Use Annotation
appears_random xs:boolean optional
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum dateTime optional
This attribute is optional and specifies the expected type for the value of the specified property.
defanging_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
has_changed xs:boolean optional
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional
The id field specifies a unique ID for this Object Property.
idref xs:QName optional
The idref field specifies a unique ID reference for this Object Property.
is_defanged xs:boolean optional
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
pattern_type cyboxCommon:PatternTypeEnum optional
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
					
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification. 
					
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not definied by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
<xs:element name="Last_Login" type="cyboxCommon:DateTimeObjectPropertyType" nillable="true" minOccurs="0" maxOccurs="1">
  <xs:annotation>
    <xs:documentation>The Last_Login field specifies the date/time that the user account was last logged into.</xs:documentation>
  </xs:annotation>
</xs:element>
Element UserAccountObj:UserAccountObjectType / UserAccountObj:Privilege_List
Namespace http://cybox.mitre.org/objects#UserAccountObject-2
Annotations
The Privilege_List field specifies the privileges that the user account has.
Diagram
Diagram User_Account_Object_xsd.tmp#PrivilegeListType_Privilege User_Account_Object_xsd.tmp#PrivilegeListType
Type UserAccountObj:PrivilegeListType
Children UserAccountObj:Privilege
Source
<xs:element name="Privilege_List" type="UserAccountObj:PrivilegeListType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Privilege_List field specifies the privileges that the user account has.</xs:documentation>
  </xs:annotation>
</xs:element>
Element UserAccountObj:PrivilegeListType / UserAccountObj:Privilege
Namespace http://cybox.mitre.org/objects#UserAccountObject-2
Annotations
The Privilege field specifies a specific privilege that a user has. This is an abstract type since user privileges are operating-system specific, and is extended as needed in the derived CybOX object schemas.
Diagram
Diagram User_Account_Object_xsd.tmp#PrivilegeType
Type UserAccountObj:PrivilegeType
Source
<xs:element name="Privilege" type="UserAccountObj:PrivilegeType" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>The Privilege field specifies a specific privilege that a user has. This is an abstract type since user privileges are operating-system specific, and is extended as needed in the derived CybOX object schemas.</xs:documentation>
  </xs:annotation>
</xs:element>
Element UserAccountObj:UserAccountObjectType / UserAccountObj:Script_Path
Namespace http://cybox.mitre.org/objects#UserAccountObject-2
Annotations
The Script_Path field specifies the fully-qualified path to the directory where the logon script for the user account resides.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype cybox_common_xsd.tmp#StringObjectPropertyType
Type cyboxCommon:StringObjectPropertyType
Type hierarchy
Attributes
QName Type Fixed Default Use Annotation
appears_random xs:boolean optional
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional
This attribute is optional and specifies the expected type for the value of the specified property.
defanging_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
has_changed xs:boolean optional
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional
The id field specifies a unique ID for this Object Property.
idref xs:QName optional
The idref field specifies a unique ID reference for this Object Property.
is_defanged xs:boolean optional
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
pattern_type cyboxCommon:PatternTypeEnum optional
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
					
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification. 
					
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not definied by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
<xs:element name="Script_Path" type="cyboxCommon:StringObjectPropertyType" minOccurs="0" maxOccurs="1">
  <xs:annotation>
    <xs:documentation>The Script_Path field specifies the fully-qualified path to the directory where the logon script for the user account resides.</xs:documentation>
  </xs:annotation>
</xs:element>
Element UserAccountObj:UserAccountObjectType / UserAccountObj:Username
Namespace http://cybox.mitre.org/objects#UserAccountObject-2
Annotations
The Username field specifies the particular username of the user account.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#StringObjectPropertyType_datatype cybox_common_xsd.tmp#StringObjectPropertyType
Type cyboxCommon:StringObjectPropertyType
Type hierarchy
Attributes
QName Type Fixed Default Use Annotation
appears_random xs:boolean optional
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum string optional
This attribute is optional and specifies the expected type for the value of the specified property.
defanging_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
has_changed xs:boolean optional
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional
The id field specifies a unique ID for this Object Property.
idref xs:QName optional
The idref field specifies a unique ID reference for this Object Property.
is_defanged xs:boolean optional
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
pattern_type cyboxCommon:PatternTypeEnum optional
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
					
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification. 
					
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not definied by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
<xs:element name="Username" type="cyboxCommon:StringObjectPropertyType" minOccurs="0" maxOccurs="1">
  <xs:annotation>
    <xs:documentation>The Username field specifies the particular username of the user account.</xs:documentation>
  </xs:annotation>
</xs:element>
Element UserAccountObj:UserAccountObjectType / UserAccountObj:User_Password_Age
Namespace http://cybox.mitre.org/objects#UserAccountObject-2
Annotations
The User_Password_Age field specifies the current age of the user account's password.
Diagram
Diagram cybox_common_xsd.tmp#BaseObjectPropertyGroup cybox_common_xsd.tmp#PatternFieldGroup cybox_common_xsd.tmp#BaseObjectPropertyType cybox_common_xsd.tmp#DurationObjectPropertyType_datatype cybox_common_xsd.tmp#DurationObjectPropertyType
Type cyboxCommon:DurationObjectPropertyType
Type hierarchy
Attributes
QName Type Fixed Default Use Annotation
appears_random xs:boolean optional
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
apply_condition cyboxCommon:ConditionApplicationEnum ANY optional
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
bit_mask xs:hexBinary optional
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
condition cyboxCommon:ConditionTypeEnum optional
This field is optional and defines the relevant condition to apply to the value.
datatype cyboxCommon:DatatypeEnum duration optional
This attribute is optional and specifies the expected type for the value of the specified property.
defanging_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
has_changed xs:boolean optional
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
id xs:QName optional
The id field specifies a unique ID for this Object Property.
idref xs:QName optional
The idref field specifies a unique ID reference for this Object Property.
is_defanged xs:boolean optional
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
is_obfuscated xs:boolean optional
This field is optional and conveys whether the associated Object property has been obfuscated.
obfuscation_algorithm_ref xs:anyURI optional
This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
pattern_type cyboxCommon:PatternTypeEnum optional
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
refanging_transform xs:string optional
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
refanging_transform_type xs:string optional
This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
regex_syntax xs:string optional
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
					
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification. 
					
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not definied by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
trend xs:boolean optional
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
<xs:element name="User_Password_Age" type="cyboxCommon:DurationObjectPropertyType" minOccurs="0" maxOccurs="1">
  <xs:annotation>
    <xs:documentation>The User_Password_Age field specifies the current age of the user account's password.</xs:documentation>
  </xs:annotation>
</xs:element>
Element UserAccountObj:User_Account
Namespace http://cybox.mitre.org/objects#UserAccountObject-2
Annotations
The User_Account object is intended to characterize generic user accounts.
Diagram
Diagram cybox_common_xsd.tmp#ObjectPropertiesType_object_reference cybox_common_xsd.tmp#ObjectPropertiesType_Custom_Properties cybox_common_xsd.tmp#ObjectPropertiesType Account_Object_xsd.tmp#AccountObjectType_disabled Account_Object_xsd.tmp#AccountObjectType_locked_out Account_Object_xsd.tmp#AccountObjectType_Description Account_Object_xsd.tmp#AccountObjectType_Domain Account_Object_xsd.tmp#AccountObjectType User_Account_Object_xsd.tmp#UserAccountObjectType_password_required User_Account_Object_xsd.tmp#UserAccountObjectType_Full_Name User_Account_Object_xsd.tmp#UserAccountObjectType_Group_List User_Account_Object_xsd.tmp#UserAccountObjectType_Home_Directory User_Account_Object_xsd.tmp#UserAccountObjectType_Last_Login User_Account_Object_xsd.tmp#UserAccountObjectType_Privilege_List User_Account_Object_xsd.tmp#UserAccountObjectType_Script_Path User_Account_Object_xsd.tmp#UserAccountObjectType_Username User_Account_Object_xsd.tmp#UserAccountObjectType_User_Password_Age User_Account_Object_xsd.tmp#UserAccountObjectType
Type UserAccountObj:UserAccountObjectType
Type hierarchy
Children AccountObj:Description, AccountObj:Domain, UserAccountObj:Full_Name, UserAccountObj:Group_List, UserAccountObj:Home_Directory, UserAccountObj:Last_Login, UserAccountObj:Privilege_List, UserAccountObj:Script_Path, UserAccountObj:User_Password_Age, UserAccountObj:Username, cyboxCommon:Custom_Properties
Attributes
QName Type Use Annotation
disabled xs:boolean optional
The disabled field specifies whether or not the account is disabled.
locked_out xs:boolean optional
The locked_out field specifies whether or not the account is locked out.
object_reference xs:QName optional
The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
password_required xs:boolean optional
The password_required field specifies whether a password is required for this user account.
Source
<xs:element name="User_Account" type="UserAccountObj:UserAccountObjectType" nillable="true">
  <xs:annotation>
    <xs:documentation>The User_Account object is intended to characterize generic user accounts.</xs:documentation>
  </xs:annotation>
</xs:element>
Complex Type UserAccountObj:UserAccountObjectType
Namespace http://cybox.mitre.org/objects#UserAccountObject-2
Annotations
The UserAccountObjectType type is intended to characterize generic user accounts.
Diagram
Diagram cybox_common_xsd.tmp#ObjectPropertiesType_object_reference cybox_common_xsd.tmp#ObjectPropertiesType_Custom_Properties cybox_common_xsd.tmp#ObjectPropertiesType Account_Object_xsd.tmp#AccountObjectType_disabled Account_Object_xsd.tmp#AccountObjectType_locked_out Account_Object_xsd.tmp#AccountObjectType_Description Account_Object_xsd.tmp#AccountObjectType_Domain Account_Object_xsd.tmp#AccountObjectType User_Account_Object_xsd.tmp#UserAccountObjectType_password_required User_Account_Object_xsd.tmp#UserAccountObjectType_Full_Name User_Account_Object_xsd.tmp#UserAccountObjectType_Group_List User_Account_Object_xsd.tmp#UserAccountObjectType_Home_Directory User_Account_Object_xsd.tmp#UserAccountObjectType_Last_Login User_Account_Object_xsd.tmp#UserAccountObjectType_Privilege_List User_Account_Object_xsd.tmp#UserAccountObjectType_Script_Path User_Account_Object_xsd.tmp#UserAccountObjectType_Username User_Account_Object_xsd.tmp#UserAccountObjectType_User_Password_Age
Type extension of AccountObj:AccountObjectType
Type hierarchy
Used by
Children AccountObj:Description, AccountObj:Domain, UserAccountObj:Full_Name, UserAccountObj:Group_List, UserAccountObj:Home_Directory, UserAccountObj:Last_Login, UserAccountObj:Privilege_List, UserAccountObj:Script_Path, UserAccountObj:User_Password_Age, UserAccountObj:Username, cyboxCommon:Custom_Properties
Attributes
QName Type Use Annotation
disabled xs:boolean optional
The disabled field specifies whether or not the account is disabled.
locked_out xs:boolean optional
The locked_out field specifies whether or not the account is locked out.
object_reference xs:QName optional
The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
password_required xs:boolean optional
The password_required field specifies whether a password is required for this user account.
Source
<xs:complexType name="UserAccountObjectType" mixed="false">
  <xs:annotation>
    <xs:documentation>The UserAccountObjectType type is intended to characterize generic user accounts.</xs:documentation>
  </xs:annotation>
  <xs:complexContent>
    <xs:extension base="AccountObj:AccountObjectType">
      <xs:sequence>
        <xs:element name="Full_Name" type="cyboxCommon:StringObjectPropertyType" minOccurs="0" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>The Full_Name field specifies the full name of the user for which this account was created.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Group_List" type="UserAccountObj:GroupListType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Group_List field specifies the list of groups to which the user account belongs to.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Home_Directory" type="cyboxCommon:StringObjectPropertyType" minOccurs="0" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>The Home_Directory field specifies the fully-qualified path to the home directory of the user account.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Last_Login" type="cyboxCommon:DateTimeObjectPropertyType" nillable="true" minOccurs="0" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>The Last_Login field specifies the date/time that the user account was last logged into.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Privilege_List" type="UserAccountObj:PrivilegeListType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Privilege_List field specifies the privileges that the user account has.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Script_Path" type="cyboxCommon:StringObjectPropertyType" minOccurs="0" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>The Script_Path field specifies the fully-qualified path to the directory where the logon script for the user account resides.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Username" type="cyboxCommon:StringObjectPropertyType" minOccurs="0" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>The Username field specifies the particular username of the user account.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="User_Password_Age" type="cyboxCommon:DurationObjectPropertyType" minOccurs="0" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>The User_Password_Age field specifies the current age of the user account's password.</xs:documentation>
          </xs:annotation>
        </xs:element>
      </xs:sequence>
      <xs:attribute name="password_required" type="xs:boolean">
        <xs:annotation>
          <xs:documentation>The password_required field specifies whether a password is required for this user account.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:extension>
  </xs:complexContent>
</xs:complexType>
Complex Type UserAccountObj:GroupListType
Namespace http://cybox.mitre.org/objects#UserAccountObject-2
Annotations
The GroupListType type specifies the groups that the user account belongs to.
Diagram
Diagram User_Account_Object_xsd.tmp#GroupListType_Group
Used by
Children UserAccountObj:Group
Source
<xs:complexType name="GroupListType">
  <xs:annotation>
    <xs:documentation>The GroupListType type specifies the groups that the user account belongs to.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Group" type="UserAccountObj:GroupType" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Group field specifies a group that a user account belongs to. This is an abstract type since group IDs are operating-system specific, and is extended as needed in the derived CybOX object schemas.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type UserAccountObj:GroupType
Namespace http://cybox.mitre.org/objects#UserAccountObject-2
Annotations
The GroupType type specifies a group that a user account belongs to. This is an abstract type since group IDs are operating-system specific, and is extended as needed in the derived CybOX object schemas.
Diagram
Diagram
Used by
Source
<xs:complexType name="GroupType" abstract="true">
  <xs:annotation>
    <xs:documentation>The GroupType type specifies a group that a user account belongs to. This is an abstract type since group IDs are operating-system specific, and is extended as needed in the derived CybOX object schemas.</xs:documentation>
  </xs:annotation>
</xs:complexType>
Complex Type UserAccountObj:PrivilegeListType
Namespace http://cybox.mitre.org/objects#UserAccountObject-2
Annotations
The PrivilegeListType type specifies the list of privileges that the user account has.
Diagram
Diagram User_Account_Object_xsd.tmp#PrivilegeListType_Privilege
Used by
Children UserAccountObj:Privilege
Source
<xs:complexType name="PrivilegeListType">
  <xs:annotation>
    <xs:documentation>The PrivilegeListType type specifies the list of privileges that the user account has.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Privilege" type="UserAccountObj:PrivilegeType" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>The Privilege field specifies a specific privilege that a user has. This is an abstract type since user privileges are operating-system specific, and is extended as needed in the derived CybOX object schemas.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
Complex Type UserAccountObj:PrivilegeType
Namespace http://cybox.mitre.org/objects#UserAccountObject-2
Annotations
The PrivilegeType type specifies a specific privilege that a user has. This is an abstract type since user privileges are operating-system specific, and is extended as needed in the derived CybOX object schemas.
Diagram
Diagram
Used by
Source
<xs:complexType name="PrivilegeType" abstract="true">
  <xs:annotation>
    <xs:documentation>The PrivilegeType type specifies a specific privilege that a user has. This is an abstract type since user privileges are operating-system specific, and is extended as needed in the derived CybOX object schemas.</xs:documentation>
  </xs:annotation>
</xs:complexType>
Attribute UserAccountObj:UserAccountObjectType / @password_required
Namespace No namespace
Annotations
The password_required field specifies whether a password is required for this user account.
Type xs:boolean
Used by
Source
<xs:attribute name="password_required" type="xs:boolean">
  <xs:annotation>
    <xs:documentation>The password_required field specifies whether a password is required for this user account.</xs:documentation>
  </xs:annotation>
</xs:attribute>