​2.9​ Open Vocabulary

Type Name: open-vocab

The open-vocab type is represented as a string. For properties that use this type there will be a list of suggested values, known as the suggested vocabulary, that is identified in the definition for that property. The suggested vocabularies are defined in section 6. The value of the property SHOULD be chosen from the suggested vocabulary but MAY be any other string value. Values that are not from the suggested vocabulary SHOULD be all lowercase (where lowercase is defined by the locality conventions) and SHOULD use hyphens instead of spaces or underscores as word separators.

A consumer that receives STIX content with one or more open-vocab terms not defined in the suggested vocabulary MAY ignore those values.

The JSON MTI serialization uses the JSON string type [RFC7159] when representing open-vocab.

Examples

Example using value from the suggested vocabulary. In this example the Indicator labels property is an open vocabulary and we are using one of the suggested vocabulary values.

{

...,

"labels": ["malicious-activity"],

...

}

Example using a custom value. In this example, for the same Indicator labels property, we are not using a value in the suggested vocabulary.

{

...,

"labels": ["pbx-fraud-activity"],

...

}