​7.1​ Custom Properties

There will be cases where certain information exchanges can be improved by adding properties that are neither specified nor reserved in this document; these properties are called Custom Properties. This section provides guidance and requirements for how producers can use Custom Properties and how consumers should interpret them in order to extend STIX in an interoperable manner.

​7.1.1​ Requirements

• A STIX Object MAY have any number of Custom Properties.
• Custom Property names MUST be in ASCII and MUST only contain the characters a–z (lowercase ASCII), 0–9, and underscore (_).
• Custom Property names SHOULD start with “x_” followed by a source unique identifier (such as a domain name with dots replaced by underscores), an underscore and then the name. For example, x_example_com_customfield.
• Custom Property names MUST have a minimum length of 3 ASCII characters.
• Custom Property names MUST be no longer than 250 ASCII characters in length.
• Custom Property names that do not start with “x” may be used in a future version of the specification for a different meaning. If compatibility with future versions of this specification is required, the “x” prefix MUST be used.
• Custom Properties SHOULD only be used when there is no existing properties defined by the STIX specification that fulfils that need.

Examples

{

...,

"x_acme_org_confidence": 10,

"x_acme_org_scoring": {

"impact": "high",

"probability": "low"

},

...

}