-
Notifications
You must be signed in to change notification settings - Fork 1
/
maec.dot
2420 lines (2420 loc) · 287 KB
/
maec.dot
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
digraph {
subgraph clusterSchemaImpl1530970753 { label="http://maec.mitre.org/XMLSchema/maec-core-2"
ElementDecl585406123 [shape="record", label="{Object|The Object element specifies\na single MAEC Object\nthat is being targeted\nby the indicator or signature.}", color="blue"];
ModelGroupImpl393978767 [shape="record", label="{sequence of}"];
ElementDecl2067921590 [shape="record", label="{Comments|The Comments element\ncontains any comments\nregarding the analysis\nthat was performed.}", color="blue"];
ModelGroupImpl748134027 [shape="record", label="{sequence of}"];
ElementDecl1028055937 [shape="record", label="{Associated_Code|The Associated_Code\nelement encompasses\nany code snippets that\nmay be associated with\nthe behavior.}", color="blue"];
ComplexTypeImpl1280543092 [shape="record", label="{(anonymous)}", color="red"];
ModelGroupImpl2096109425 [shape="record", label="{sequence of}"];
RestrictionSimpleTypeImpl1000613778 [shape="record", label="{IndicatorCollIDPattern|The IndicatorCollIDPattern\nsimple type defines the\nformat for acceptable\nMAEC indicator collection\nids.|{Variety|atomic}|{Facets|{{pattern|maec-\[A-Za-z0-9_\\-\\.\]+-indc-\[1-9\]\[0-9\]*}}}}", color="darkgreen"];
ComplexTypeImpl978777649 [shape="record", label="{RelatedObjectType|The RelatedObjectType\ncomplex type provides\na method for the characterization\nof relationships among\nMAEC Objects.|{Attrs|{{<AttributeUseImpl2106232034>Relationship: RelatedObjectType-Relationship}}}}", color="red"];
ElementDecl1872474714 [shape="record", label="{Affinity_Type|The Affinity_Type element\nprovides an abstract\nway of characterizing\nhow the objects in a\ncollection are related.|{Type|string}}", color="blue"];
ComplexTypeImpl198249052 [shape="record", label="{AssociatedObjectType|The AssociatedObjectType\ncomplex type represents\nthe characterization of\na malware Object associated\nwith a given malware Action.|{Attrs|{{<AttributeUseImpl826089942>AssociationType: AssociationObject-AssociationType}}}}", color="red"];
ElementDecl872752095 [shape="record", label="{Action}", color="blue"];
ElementDecl11555382 [shape="record", label="{Description|The Description element\ncontains a prose textual\ndescription of the\nbehavior.|{Type|string}}", color="blue"];
IdentityConstraintImpl249613347 [shape="record", label="{objectKey|Enforce uniqueness\namongst the ids differentiating\nthe individual object\nelements.|{Category|KEY}|{Selector|maec:Objects/*}|{Fields|{@id}}}"];
ElementDecl296737228 [shape="record", label="{Related_Object}", color="blue"];
ComplexTypeImpl754307120 [shape="record", label="{(anonymous)}", color="red"];
ComplexTypeImpl1629818866 [shape="record", label="{(anonymous)}", color="red"];
ComplexTypeImpl1656788308 [shape="record", label="{ActionImplementationType|The ActionImplementationType\ncomplex type serves as\na method for the characterization\nof action implementations.|{Attrs|{{<AttributeUseImpl23273958>id: ActionImpIDPattern}|{<AttributeUseImpl2054405154>type: ActionImpTypeEnum}}}}", color="red"];
ComplexTypeImpl211543962 [shape="record", label="{StatefulMeasureType|The StatefulMeasureType\nis a complex type representing\na cyber observable property\nthat is statically stateful\nin nature (e.}", color="red"];
ModelGroupImpl833984911 [shape="record", label="{sequence of}"];
ElementDecl1040288884 [shape="record", label="{Stateful_Measure|The Stateful Measure element\nenables specification of\na cyber observable property\nin the malware context that\nis statically stateful in\nnature (e.}", color="blue"];
ModelGroupImpl1931913930 [shape="record", label="{sequence of}"];
ComplexTypeImpl1653994128 [shape="record", label="{(anonymous)}", color="red"];
ComplexTypeImpl1084010740 [shape="record", label="{ObjectCollectionType|The ObjectCollectionType\ncomplex type provides\na mechanism for characterizing\ncollections of actions.|{Attrs|{{<AttributeUseImpl899933215>id: ObjectCollIDPattern}}}}", color="red"];
ElementDecl843627620 [shape="record", label="{Action}", color="blue"];
IdentityConstraintImpl1141180808 [shape="record", label="{actionCollectionKey|Enforce uniqueness\namongst the ids differentiating\nthe individual action\ncollection elements.|{Category|KEY}|{Selector|maec:Pools/maec:Action_Collection_Pool/*}|{Fields|{@id}}}"];
ElementDecl1837044219 [shape="record", label="{Associated_Objects|The Associated_Objects element\nis optional and enables the\ndescription/specification of\nother objects relevant (either\ninitiating or affected by)\nto this malware Action.}", color="blue"];
ModelGroupImpl845987535 [shape="record", label="{sequence of}"];
ElementDecl1324453175 [shape="record", label="{Object|The Object element\nspecifies a single\nMAEC object in the\ncollection.}", color="blue"];
ElementDecl1574091191 [shape="record", label="{Analysis_Systems|The Analysis_Systems element characterizes\nthe system(s) (real or virtual)\non which the actual analysis was\nperformed, including information\nabout both the hardware and software,\nsuch as the properties of its BIOS,\nprocessor architecture, and operat}", color="blue"];
RestrictionSimpleTypeImpl1726367366 [shape="record", label="{ActionIDPattern|The ActionIDPattern\nsimple type defines\nthe format for acceptable\nMAEC Action ids.|{Variety|atomic}|{Facets|{{pattern|maec-\[A-Za-z0-9_\\-\\.\]+-act-\[1-9\]\[0-9\]*}}}}", color="darkgreen"];
ElementDecl732753528 [shape="record", label="{Indicator_Collections}", color="blue"];
ComplexTypeImpl1227469025 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl1887707310 [shape="record", label="{Reference|The Reference element\nprovides an abstract\nway of specifying a\nreference name or ID\nfor the source.|{Type|string}}", color="blue"];
ModelGroupImpl876951439 [shape="record", label="{sequence of}"];
RestrictionSimpleTypeImpl774321798 [shape="record", label="{BundleIDPattern|The BundleIDPattern\nsimple type defines\nthe format for acceptable\nMAEC Bundle ids.|{Variety|atomic}|{Facets|{{pattern|maec-\[A-Za-z0-9_\\-\\.\]+-bnd-\[1-9\]\[0-9\]*}}}}", color="darkgreen"];
ElementDecl2103121779 [shape="record", label="{Purpose|The Purpose element\nencompasses the intended\npurpose of the behavior.}", color="blue"];
ElementDecl551922921 [shape="record", label="{URL|The URL element specifies\na URL that is the\nsubject of the analysis.}", color="blue"];
ComplexTypeImpl1958151752 [shape="record", label="{(anonymous)}", color="red"];
ModelGroupImpl538423986 [shape="record", label="{sequence of}"];
ComplexTypeImpl563929184 [shape="record", label="{IndicatorType|The IndicatorType complex type\nprovides a way of defining MAEC\nObject-based indicators for malware\nand related entities, such as\nActions and Behaviors, along\nwith any additional context behind\nthe indicator.|{Attrs|{{<AttributeUseImpl911838464>creation_datetime: dateTime}|{<AttributeUseImpl825759456>id: IndicatorIDPattern}|{<AttributeUseImpl817212460>idref: IndicatorIDREFPattern}|{<AttributeUseImpl926501147>importance: ImportanceTypeEnum}|{<AttributeUseImpl1263765186>lastupdate_datetime: dateTime}|{<AttributeUseImpl1488212272>numeric_importance: nonNegativeInteger}|{<AttributeUseImpl641618895>version: string}}}}", color="red"];
ElementDecl406406987 [shape="record", label="{Target|The Target element provides\na way of characterizing the\nparticular target of the\nindicator, whether it be\nan object, action, behavior,\nmalware instance, etc.}", color="blue"];
ComplexTypeImpl989080272 [shape="record", label="{CVEVulnerabilityType|The CVEVulnerabilityType complex\ntype provides a way of referencing\nspecific vulnerabilities that\nmalware exploits or attempts\nto exploit via a Common Vulnerabilities\nand Exposures (CPE) identifier.|{Attrs|{{<AttributeUseImpl109962338>cve_id: string}}}}", color="red"];
ModelGroupImpl1077500591 [shape="record", label="{sequence of}"];
ComplexTypeImpl844344251 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl812366436 [shape="record", label="{Object_Collection}", color="blue"];
IdentityConstraintImpl763970039 [shape="record", label="{behaviorKey|Enforce uniqueness\namongst the ids differentiating\nthe individual behavior\nelements.|{Category|KEY}|{Selector|maec:Behaviors/*}|{Fields|{@id}}}"];
ElementDecl1185716172 [shape="record", label="{Field_Data|This element contains\nany element data about\nthe analysis subject,\nsuch as prevalance information,\netc.}", color="blue"];
ElementDecl1034011695 [shape="record", label="{Comment}", color="blue"];
ElementDecl177822329 [shape="record", label="{Purpose|The Purpose element\nstates the intended\npurpose of the collection\nof behaviors.|{Type|string}}", color="blue"];
ComplexTypeImpl1450554350 [shape="record", label="{(anonymous)}", color="red"];
ModelGroupImpl2075111623 [shape="record", label="{sequence of}"];
ModelGroupImpl459973678 [shape="record", label="{sequence of}"];
ComplexTypeImpl1948703724 [shape="record", label="{ObjectType|The ObjectType complex type\nprovides a method for the\ncharacterization of any observable\nentities that actions and\nbehaviors operate on or are\nassociated with.|{Attrs|{{<AttributeUseImpl1544825066>id: ObjectIDPattern}|{<AttributeUseImpl536357250>idref: ObjectIDPattern}}}}", color="red"];
ModelGroupImpl1969544891 [shape="record", label="{sequence of}"];
ElementDecl836293175 [shape="record", label="{Discovery_Method|The Discovery_Method\nelement is used to\ncharacterize the method\nused to discover the\nbehavior.}", color="blue"];
ElementDecl1430534144 [shape="record", label="{Analysis}", color="blue"];
ElementDecl1177681699 [shape="record", label="{Indicator|The Indicator element\nspecifies a single\nMAEC Indicator in\nthe collection.}", color="blue"];
RestrictionSimpleTypeImpl404765745 [shape="record", label="{AnalysisTypeEnum|The AnalysisTypeEnum\nsimple type is an\nenumeration of types\nof malware analyses.|{Variety|atomic}|{Enum|{Triage|In-depth/Manual}}}", color="darkgreen"];
ElementDecl1809441479 [shape="record", label="{Behaviors|The Behaviors element specifies\nany MAEC Behaviors that\nwere observed for the analysis\nsubect (defined in the\nAnalysis_Subject element).}", color="blue"];
ModelGroupImpl2142386190 [shape="record", label="{sequence of}"];
ElementDecl443696330 [shape="record", label="{Implementation|The Implementation element\nis optional and serves to capture\nattributes that are relevant\nto how the action is actually\nimplemented in the malware,\nsuch as the specific API call\nused.}", color="blue"];
ModelGroupImpl1439145468 [shape="record", label="{sequence of}"];
ComplexTypeImpl1257515479 [shape="record", label="{(anonymous)}", color="red"];
ComplexTypeImpl1368125554 [shape="record", label="{CommentsType|The CommentsType complex\ntype provides a simple way\nof capturing any comments\nrelated malware associated\nentities, such as analyses\nand indicators.}", color="red"];
ComplexTypeImpl1144051757 [shape="record", label="{BundleType|The BundleType complex\ntype serves as the high-level\nconstruct which encapsulates\nall other MAEC elements.|{Attrs|{{<AttributeUseImpl1330867948>id: BundleIDPattern}|{<AttributeUseImpl409212430>schema_version: decimal|FIXED :2.0|FIXED :2.0}|{<AttributeUseImpl1390673316>timestamp: dateTime}}}}", color="red"];
ModelGroupImpl212165140 [shape="record", label="{sequence of}"];
ElementDecl1224680467 [shape="record", label="{Indicator|The Indicator element\nenables description/specification\nof a single malware\nindicator.}", color="blue"];
RestrictionSimpleTypeImpl254432682 [shape="record", label="{AnalysisMethodEnum|The AnalysisMethodEnum\nsimple type is an enumeration\nof malware analysis\nmethods.|{Variety|atomic}|{Enum|{Static|Dynamic|Combinatorial}}}", color="darkgreen"];
ElementDecl1580650567 [shape="record", label="{Old_State|The Old_State element\nspecifies the object\nand its attributes as\nthey were before the\nstate change effect.}", color="blue"];
ComplexTypeImpl169456094 [shape="record", label="{AnalysisSubjectType|The AnalysisSubjectType\ncomplex type provides\na method for characterizing\nthe particular subject\nof a malware analysis.}", color="red"];
ElementDecl2126058282 [shape="record", label="{Associated_Object}", color="blue"];
ModelGroupImpl2125221179 [shape="record", label="{sequence of}"];
ModelGroupImpl1360524062 [shape="record", label="{sequence of}"];
ComplexTypeImpl2056454348 [shape="record", label="{(anonymous)}", color="red"];
ComplexTypeImpl1318527689 [shape="record", label="{(anonymous)}", color="red"];
ComplexTypeImpl1214238505 [shape="record", label="{ObservableType|The ObservableType\nis a complex type representing\na description of a\nsingle cyber observable.}", color="red"];
ElementDecl440048570 [shape="record", label="{Targeted_Actions|The Targeted_Actions\nelement references\nany MAEC-defined Actions\nthat are being targeted.}", color="blue"];
ElementDecl2087463062 [shape="record", label="{Behavior|The Behavior element\nspecifies a single MAEC\nBehavior that is being\ntargeted by the indicator\nor signature.}", color="blue"];
ElementDecl1980322208 [shape="record", label="{Actions|The Actions element specifies\nany MAEC Actions that were\nobserved for the analysis\nsubect (defined in the\nAnalysis_Subject element).}", color="blue"];
ComplexTypeImpl1667550174 [shape="record", label="{(anonymous)|{Attrs|{{<AttributeUseImpl1727598666>known_vulnerability: boolean}}}}", color="red"];
ElementDecl1582031564 [shape="record", label="{Analysis_Environment|The Analysis_Environment\nelement contains attributes\nfor characterizing the\nanalysis environment in\nwhich the analysis was\nperformed.}", color="blue"];
ModelGroupImpl1645300503 [shape="record", label="{sequence of}"];
ComplexTypeImpl570110481 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl953169274 [shape="record", label="{Parameters|The Parameter element\nencompasses any name/value\npairs of the parameters\npassed into the API\ncall.}", color="blue"];
ComplexTypeImpl2036206635 [shape="record", label="{(anonymous)}", color="red"];
ModelGroupImpl1677170384 [shape="record", label="{sequence of}"];
ModelGroupImpl221200805 [shape="record", label="{sequence of}"];
ModelGroupImpl1863853962 [shape="record", label="{sequence of}"];
ComplexTypeImpl591210723 [shape="record", label="{StateChangeEffectType|The StateChangeEffectType\nis intended as a generic\nway of characterizing the\neffects of actions upon MAEC\nobjects where some state\nof the object is changed.}", color="red"];
IdentityConstraintImpl295726648 [shape="record", label="{analysisKey|Enforce uniqueness\namongst the ids differentiating\nthe individual analysis\nelements.|{Category|KEY}|{Selector|maec:Analyses/*}|{Fields|{@id}}}"];
ModelGroupImpl1516725303 [shape="record", label="{sequence of}"];
ElementDecl623540462 [shape="record", label="{Comments|The Comments element\nis used to capture\nany comments regarding\nor relevant to the\nindicator.}", color="blue"];
ModelGroupImpl1519664580 [shape="record", label="{sequence of}"];
ComplexTypeImpl1352848132 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl334810991 [shape="record", label="{Observables|The Observables element\nspecifies the actual\nobservables that the\nindicator is composed\nof.}", color="blue"];
ModelGroupImpl1688348273 [shape="record", label="{sequence of}"];
RestrictionSimpleTypeImpl880403204 [shape="record", label="{CodeIDPattern|The CodeIDPattern\nsimple type defines\nthe format for acceptable\nMAEC Code ids.|{Variety|atomic}|{Facets|{{pattern|maec-\[A-Za-z0-9_\\-\\.\]+-cde-\[1-9\]\[0-9\]*}}}}", color="darkgreen"];
ModelGroupImpl1802010236 [shape="record", label="{choice of}"];
ModelGroupImpl792382546 [shape="record", label="{sequence of}"];
ModelGroupImpl1229893321 [shape="record", label="{sequence of}"];
ComplexTypeImpl1389561565 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl591252775 [shape="record", label="{Object|The Object element allows\nfor the direct characterization\nof an object that is\nthe subject of the analysis.}", color="blue"];
ComplexTypeImpl2048500602 [shape="record", label="{(anonymous)|{Attrs|{{<AttributeUseImpl993374707>author: string}|{<AttributeUseImpl1110828771>timestamp: dateTime}}}}", color="red"];
ElementDecl509335928 [shape="record", label="{Exit_Code|The Exit_Code element\nspecifies the exit\ncode with which the\nsubject binary exited.|{Type|integer}}", color="blue"];
ElementDecl1170339250 [shape="record", label="{Discovery_Method|The Discovery_Method\nelement is intended to\ncharacterize the method\nand/or tool used to discover\nthe code.}", color="blue"];
ModelGroupImpl825032034 [shape="record", label="{sequence of}"];
ElementDecl1708778105 [shape="record", label="{Indicators|The Indicators element\ncontains 1-n IndicatorType\nobjects, representing\nany malware indicators\nthat were characterized.}", color="blue"];
ModelGroupImpl865040129 [shape="record", label="{sequence of}"];
ElementDecl1505888432 [shape="record", label="{Source|The Source element\ncontains information\nabout the external\nsource of the analysis,\nif applicable.}", color="blue"];
ComplexTypeImpl454719277 [shape="record", label="{(anonymous)}", color="red"];
RestrictionSimpleTypeImpl1418257117 [shape="record", label="{TargetTypeEnum|The TargetTypeEnum simple\ntype is an enumeration\nof the different types\nof entities that a malware\nindicator or signature\nmay target.|{Variety|atomic}|{Enum|{Instance|Class|Action|Packer}|{Family|Behavior|Anomaly|Other}}}", color="darkgreen"];
ElementDecl1695413474 [shape="record", label="{AV_Detection}", color="blue"];
ElementDecl324813035 [shape="record", label="{Code_Snippet}", color="blue"];
RestrictionSimpleTypeImpl475893892 [shape="record", label="{BehaviorRelationshipType-type|{Variety|atomic}|{Enum|{Preceded_By|Related_To}|{Followed_By|Dependent_On}}}", color="darkgreen"];
ModelGroupImpl63243527 [shape="record", label="{sequence of}"];
RestrictionSimpleTypeImpl1746807975 [shape="record", label="{ObjectCollIDPattern|The ObjectCollIDPattern\nsimple type defines\nthe format for acceptable\nMAEC Object Collection\nids.|{Variety|atomic}|{Facets|{{pattern|maec-\[A-Za-z0-9_\\-\\.\]+-objc-\[1-9\]\[0-9\]*}}}}", color="darkgreen"];
ElementDecl1329873750 [shape="record", label="{Name|The Name element\nrefers to the name\nof the person linked\nto the source.|{Type|string}}", color="blue"];
ElementDecl1320687469 [shape="record", label="{Behavior}", color="blue"];
ModelGroupImpl1701136111 [shape="record", label="{sequence of}"];
ElementDecl1520720420 [shape="record", label="{Behaviors|The Behaviors element contains\n1-n BehaviorType objects,\nrepresenting any malicious\nbehaviors that were observed\nfor a malware instance.}", color="blue"];
ElementDecl1993012929 [shape="record", label="{Description|The Description contains\nthe textual description\nof the vulnerability\nreferenced by the cve_id.|{Type|string}}", color="blue"];
ComplexTypeImpl1798675483 [shape="record", label="{ActionCollectionType|The ActionCollectionType\ncomplex type provides\na method for characterizing\ncollections of actions.|{Attrs|{{<AttributeUseImpl909053268>id: ActionCollIDPattern}}}}", color="red"];
ModelGroupImpl433076814 [shape="record", label="{sequence of}"];
ComplexTypeImpl71786792 [shape="record", label="{BehaviorCollectionType|The BehaviorCollectionType\ncomplex type provides\na mechanism for characterizing\ncollections of behaviors.|{Attrs|{{<AttributeUseImpl820233764>id: BehaviorCollIDPattern}}}}", color="red"];
ModelGroupImpl2013238005 [shape="record", label="{sequence of}"];
ComplexTypeImpl2074631480 [shape="record", label="{(anonymous)}", color="red"];
ModelGroupImpl517978947 [shape="record", label="{sequence of}"];
ComplexTypeImpl1692466348 [shape="record", label="{(anonymous)}", color="red"];
ModelGroupImpl2001431298 [shape="record", label="{sequence of}"];
ElementDecl1712817749 [shape="record", label="{Indicator}", color="blue"];
ElementDecl284322014 [shape="record", label="{Virtual_Machine|The Virtual_Machine element\nrefers to the virtual machine\nused to host the OS on which\nthe analysis was performed,\nif applicable, via a Common\nPlatform Enumeration (CPE)\nidentifier.}", color="blue"];
ModelGroupImpl1134979151 [shape="record", label="{sequence of}"];
ElementDecl1422844529 [shape="record", label="{Behavior_Collections}", color="blue"];
ModelGroupImpl911285770 [shape="record", label="{choice of}"];
ComplexTypeImpl135370635 [shape="record", label="{APICallType|The APICallType complex\ntype provides a method\nfor the characterization\nof API calls, including\nfunctions and their parameters.|{Attrs|{{<AttributeUseImpl1266620481>function_name: string}|{<AttributeUseImpl85031456>normalized_function_name: string}}}}", color="red"];
ModelGroupImpl1022257878 [shape="record", label="{sequence of}"];
IdentityConstraintImpl649388699 [shape="record", label="{indicatorKey|Enforce uniqueness\namongst the ids differentiating\nthe individual indicator\nelements.|{Category|KEY}|{Selector|maec:Indicators/*}|{Fields|{@id}}}"];
ElementDecl669588045 [shape="record", label="{Action_Collection}", color="blue"];
ModelGroupImpl1239943370 [shape="record", label="{sequence of}"];
ElementDecl344883028 [shape="record", label="{Description|The Description element\nprovides a brief\ndescription of the\nindicator.|{Type|string}}", color="blue"];
ModelGroupImpl1937516689 [shape="record", label="{sequence of}"];
ModelGroupImpl279807577 [shape="record", label="{sequence of}"];
ElementDecl2089015486 [shape="record", label="{Code_Snippet}", color="blue"];
ModelGroupImpl2124414527 [shape="record", label="{sequence of}"];
ModelGroupImpl689037010 [shape="record", label="{sequence of}"];
ElementDecl1946294814 [shape="record", label="{Platform|The Platform element contains\na specific platform(s) for\nwhich the action implementation\nis applicable, by way of\na Common Platform Enumeration\n(CPE) identifier.}", color="blue"];
ModelGroupImpl2137731611 [shape="record", label="{sequence of}"];
ComplexTypeImpl1761750500 [shape="record", label="{(anonymous)}", color="red"];
ComplexTypeImpl485255936 [shape="record", label="{TargetType|The TargetType complex type provides\na mechanism for characterizing\nthe particular entity being targeted\nby an indicator or signature, whether\nit is a particular malware instance,\nobject, action, behavior, family,\nclass, or other.|{Attrs|{{<AttributeUseImpl1884243356>type: TargetTypeEnum}}}}", color="red"];
ModelGroupImpl842999387 [shape="record", label="{sequence of}"];
ElementDecl1651235296 [shape="record", label="{Action_Sub-Collection|The Action_Sub-Collection\nelement specifies a\nsub-collection of MAEC\nActions in the collection.}", color="blue"];
ElementDecl875509103 [shape="record", label="{Code_Segment_XOR|The Code_Segment_XOR\nelement encompasses any\narbitrary code segment\nof the type specified\nby the codetype attribute.|{Type|hexBinary}}", color="blue"];
ElementDecl1946166549 [shape="record", label="{Address|The Address element\ncontains the address\nof the API call in\nthe binary.|{Type|hexBinary}}", color="blue"];
ElementDecl1072877218 [shape="record", label="{Targeted_Behaviors|The Targeted_Behaviors\nelement references\nany MAEC-defined Behaviors\nthat are being targeted.}", color="blue"];
ComplexTypeImpl254232091 [shape="record", label="{(anonymous)}", color="red"];
RestrictionSimpleTypeImpl1817166166 [shape="record", label="{ObjectIDPattern|The ObjectIDPattern\nsimple type defines\nthe format for acceptable\nMAEC Object ids.|{Variety|atomic}|{Facets|{{pattern|maec-\[A-Za-z0-9_\\-\\.\]+-obj-\[1-9\]\[0-9\]*}}}}", color="darkgreen"];
ElementDecl691773358 [shape="record", label="{Code_Segment|The Code_Segment element\nencompasses any arbitrary\ncode segment in un-encoded\n(plaintext) format.|{Type|string}}", color="blue"];
ElementDecl2076141737 [shape="record", label="{Action|The Action element specifies\na single MAEC Action\nthat is being targeted\nby the indicator or signature.}", color="blue"];
ElementDecl489398036 [shape="record", label="{Program}", color="blue"];
ComplexTypeImpl1782287177 [shape="record", label="{CodeType|CodeType is intended to\nprovide a way of characterizing\nsegments of code that are\nextracted or otherwise\nretrieved from malware.|{Attrs|{{<AttributeUseImpl828048179>id: CodeIDPattern}|{<AttributeUseImpl2022149196>processor_family: ProcessorTypeEnum}|{<AttributeUseImpl1153890100>programming_language: ProgrammingLanguageEnum}|{<AttributeUseImpl1104444203>start_address: hexBinary}|{<AttributeUseImpl1692558800>type: CodeType-type}|{<AttributeUseImpl876256661>xor_pattern: hexBinary|DEFAULT :55AA55AA55AA55BB|DEFAULT :55AA55AA55AA55BB}}}}", color="red"];
ElementDecl1178644865 [shape="record", label="{Indicator_Sub_Collection|The Indicator_Sub-Collection\nelement specifies a sub-collection\nof MAEC Indicators in\nthe collection.}", color="blue"];
ElementDecl72288339 [shape="record", label="{Action}", color="blue"];
ModelGroupImpl1154734929 [shape="record", label="{sequence of}"];
ElementDecl470484122 [shape="record", label="{Organization|The Organization element\nspecifies the name\nof the organization\nfrom which the source\noriginated.|{Type|string}}", color="blue"];
RestrictionSimpleTypeImpl1331353030 [shape="record", label="{BehaviorIDREFPattern|The BehaviorIDPattern\nsimple type defines\nthe format for acceptable\nMAEC Behavior id references.|{Variety|atomic}|{Facets|{{pattern|maec-\[A-Za-z0-9_\\-\\.\]+-bhv-\[1-9\]\[0-9\]*}}}}", color="darkgreen"];
ComplexTypeImpl208688853 [shape="record", label="{(anonymous)}", color="red"];
ModelGroupImpl1953619005 [shape="record", label="{sequence of}"];
ModelGroupImpl1950076528 [shape="record", label="{choice of}"];
ElementDecl2144898487 [shape="record", label="{Findings|The Findings element encompasses\nthe behavioral, action, and\nobject-oriented findings\nof the analysis via references\nto their corresponding MAEC\nconstructs.}", color="blue"];
ModelGroupImpl881708381 [shape="record", label="{choice of}"];
ModelGroupImpl1083557356 [shape="record", label="{sequence of}"];
ModelGroupImpl1159963529 [shape="record", label="{sequence of}"];
ElementDecl1742296210 [shape="record", label="{Action|The Action element\nenables description/specification\nof a single malware\naction.}", color="blue"];
IdentityConstraintImpl1192696614 [shape="record", label="{indicatorCollectionKey|Enforce uniqueness\namongst the ids differentiating\nthe individual indicator\ncollection elements.|{Category|KEY}|{Selector|maec:Pools/maec:Indicator_Collection_Pool/*}|{Fields|{@id}}}"];
ElementDecl323199107 [shape="record", label="{Analysis_System}", color="blue"];
ComplexTypeImpl1112461277 [shape="record", label="{AnalysisType|The AnalysisType complex type\nprovides a way of encapsulating\ntypical information associated\nwith the analysis of a malware\ninstance, such as the subject,\nauthors, start datetime, and\nother relevant data.|{Attrs|{{<AttributeUseImpl763161750>complete_datetime: dateTime}|{<AttributeUseImpl1687192366>id: AnalysisIDPattern}|{<AttributeUseImpl2138196637>idref: AnalysisIDPattern}|{<AttributeUseImpl528574181>lastupdate_datetime: dateTime}|{<AttributeUseImpl1753896075>method: AnalysisMethodEnum}|{<AttributeUseImpl726882005>start_datetime: dateTime}|{<AttributeUseImpl1818873899>type: AnalysisTypeEnum}}}}", color="red"];
RestrictionSimpleTypeImpl1883584519 [shape="record", label="{BehaviorIDPattern|The BehaviorIDPattern\nsimple type defines\nthe format for acceptable\nMAEC Behavior ids.|{Variety|atomic}|{Facets|{{pattern|maec-\[A-Za-z0-9_\\-\\.\]+-bhv-\[1-9\]\[0-9\]*}}}}", color="darkgreen"];
ElementDecl1139718681 [shape="record", label="{Installed_Programs|The Installed_Programs\nelement refers to information\nabout the software installed\non the OS used to perform\nthe analysis.}", color="blue"];
ModelGroupImpl144310161 [shape="record", label="{sequence of}"];
ModelGroupImpl938286526 [shape="record", label="{sequence of}"];
ElementDecl994682772 [shape="record", label="{Host_System|The Host_System element\ncharacterizes the (physical)\nhost system used in the\nanalysis, typically in\nconjunction with a virtual\nmachine.}", color="blue"];
RestrictionSimpleTypeImpl371327189 [shape="record", label="{IndicatorIDREFPattern|The IndicatorIDPattern\nsimple type defines\nthe format for acceptable\nMAEC indicator id references.|{Variety|atomic}|{Facets|{{pattern|maec-\[A-Za-z0-9_\\-\\.\]+-ind-\[1-9\]\[0-9\]*}}}}", color="darkgreen"];
ElementDecl1657006569 [shape="record", label="{Report|The Report element\ncontains the textual\nreport regarding the\nanalysis performed\non the malware.}", color="blue"];
ElementDecl775541541 [shape="record", label="{Behavior_Collection}", color="blue"];
ComplexTypeImpl590388871 [shape="record", label="{ActionType|The ActionType complex type\nis one of the foundational\nMAEC types, and serves as\na method for the characterization\nof actions found or observed\nin malware.|{Attrs|{{<AttributeUseImpl546909102>id: ActionIDPattern}|{<AttributeUseImpl1272266587>idref: ActionIDPattern}}}}", color="red"];
ElementDecl1287251034 [shape="record", label="{Description|The Description element\ncontains a textual\ndescription of the\ncollection.|{Type|string}}", color="blue"];
ModelGroupImpl1257121291 [shape="record", label="{sequence of}"];
ElementDecl1523242039 [shape="record", label="{Object_Sub_Collection|The Object_Sub-Collection\nelement specifies a\nsub-collection of MAEC\nObjects in the collection.}", color="blue"];
ElementDecl1213059092 [shape="record", label="{API_Call|The API_Call element\nallows for the characterization\nof a system-level API\ncall that was used to\nimplement the action.}", color="blue"];
ElementDecl458872080 [shape="record", label="{Return_Value|The Return_Value\nelement contains\nthe return value\nof the API call.|{Type|string}}", color="blue"];
ComplexTypeImpl1291305757 [shape="record", label="{AnalysisEnvironmentType|The AnalysisEnvironmentType\ncomplex type provides mechanisms\nfor characterizing the particular\nhardware/software environment\nused in analyzing a malware\ninstance.}", color="red"];
ModelGroupImpl546495707 [shape="record", label="{sequence of}"];
ModelGroupImpl665360297 [shape="record", label="{sequence of}"];
ElementDecl362078102 [shape="record", label="{Tool}", color="blue"];
ModelGroupImpl308118879 [shape="record", label="{sequence of}"];
SchemaImpl1530970753 [shape="record", label="{http://maec.mitre.org/XMLSchema/maec-core-2|The following is a description\nof the elements, types,\nand attributes that compose\nMalware Attribute Enumeration\nand Characterization (MAEC).}"];
ComplexTypeImpl161288908 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl1376681299 [shape="record", label="{Detected_By|The Detected_By element\nreferences any indicators\nor tools that may have\nbeen used to detect the\nobject.}", color="blue"];
ElementDecl1441471922 [shape="record", label="{Source|The Source element\nprovides information\nthe source of the\nindicator.}", color="blue"];
ElementDecl278604369 [shape="record", label="{Relationships|The Relationships element\nis optional and enables\nthe description of other\nbehaviors that are related\nto this malware Behavior.}", color="blue"];
ModelGroupImpl796347291 [shape="record", label="{sequence of}"];
ModelGroupImpl268283341 [shape="record", label="{sequence of}"];
ElementDecl1841186403 [shape="record", label="{Behavior}", color="blue"];
ElementDecl1150322817 [shape="record", label="{Tools|The Tools element contains\ninformation about the tool(s)\nused in the analysis, either\nin the form of a new Tool\nelement or a Tool_Reference.}", color="blue"];
RestrictionSimpleTypeImpl352697688 [shape="record", label="{ActionCollIDPattern|The ActionCollIDPattern\nsimple type defines\nthe format for acceptable\nMAEC Action Collection\nids.|{Variety|atomic}|{Facets|{{pattern|maec-\[A-Za-z0-9_\\-\\.\]+-actc-\[1-9\]\[0-9\]*}}}}", color="darkgreen"];
ModelGroupImpl664112322 [shape="record", label="{sequence of}"];
ElementDecl1353906974 [shape="record", label="{Command_Line|The Command_Line element\nspecifies the command\nline used to launch\nthe subject binary.|{Type|string}}", color="blue"];
ElementDecl133441329 [shape="record", label="{Code_Snippets|The Code_Snippets element\nencompasses any code\nsnippets that may have\nbeen extracted from the\nobject.}", color="blue"];
ComplexTypeImpl1864729679 [shape="record", label="{BaseCollectionType|The BaseCollectionType\ncomplex type is the\nbase type for other\nMAEC collection types.|{Attrs|{{<AttributeUseImpl1090831733>name: string}}}}", color="red"];
RestrictionSimpleTypeImpl1348570406 [shape="record", label="{BehaviorCollIDPattern|The BehaviorCollIDPattern\nsimple type defines the\nformat for acceptable\nMAEC Behavior Collection\nids.|{Variety|atomic}|{Facets|{{pattern|maec-\[A-Za-z0-9_\\-\\.\]+-bhvc-\[1-9\]\[0-9\]*}}}}", color="darkgreen"];
ModelGroupImpl686923118 [shape="record", label="{sequence of}"];
ElementDecl881373670 [shape="record", label="{New_State|The New_State element\nspecifies the object\nand its attributes as\nthey are after the state\nchange effect.}", color="blue"];
ComplexTypeImpl259984788 [shape="record", label="{(anonymous)|{Attrs|{{<AttributeUseImpl674932625>Name: string}|{<AttributeUseImpl584004921>XPath: string}}}}", color="red"];
ModelGroupImpl543998628 [shape="record", label="{sequence of}"];
ElementDecl200426125 [shape="record", label="{Indicator}", color="blue"];
ElementDecl1142087030 [shape="record", label="{Object}", color="blue"];
ComplexTypeImpl20566293 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl2002331072 [shape="record", label="{Object_Collections}", color="blue"];
ElementDecl1721336021 [shape="record", label="{Behavior|The Behavior element\nenables description/specification\nof a single malware\nbehavior.}", color="blue"];
ComplexTypeImpl300533806 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl1159139518 [shape="record", label="{Action|The Action element\nspecifies a single\nMAEC Action in the\ncolleciton.}", color="blue"];
ElementDecl86823325 [shape="record", label="{Actions|The Actions element\nencompasses the action\nor actions that constitute\nthe behavior.}", color="blue"];
ElementDecl540485573 [shape="record", label="{Objects|The Objects element contains\n1-n ObjectType objects,\nrepresenting any objects\nassociated with a malware\ninstance.}", color="blue"];
ElementDecl1896005138 [shape="record", label="{Author|The Author element\nis used to indicate\nthe author of the\nindicator.|{Type|string}}", color="blue"];
ModelGroupImpl480476266 [shape="record", label="{sequence of}"];
ElementDecl4508606 [shape="record", label="{Summary|The Description element\ncontains a summary\nof the analysis that\nwas performed.|{Type|string}}", color="blue"];
ModelGroupImpl818048143 [shape="record", label="{sequence of}"];
ElementDecl1671818348 [shape="record", label="{Parameter}", color="blue"];
ComplexTypeImpl1839367010 [shape="record", label="{IndicatorCollectionType|The IndicatorCollectionType\ncomplex type provides\na mechanism for characterizing\ncollections of indicators.|{Attrs|{{<AttributeUseImpl1286943672>id: IndicatorCollIDPattern}}}}", color="red"];
IdentityConstraintImpl1039630400 [shape="record", label="{objectCollectionKey|Enforce uniqueness\namongst the ids differentiating\nthe individual object\ncollection elements.|{Category|KEY}|{Selector|maec:Pools/maec:Object_Collection_Pool/*}|{Fields|{@id}}}"];
ModelGroupImpl27134372 [shape="record", label="{sequence of}"];
ElementDecl2060219449 [shape="record", label="{Vulnerability_Exploit|This element contains a CVE\nidentifier for specifying a\nvulnerability that a behavior\nmay have attempted to exploit,\nand was either unsuccessful\nor the success of the exploitation\nis unknown.}", color="blue"];
ModelGroupImpl690611689 [shape="record", label="{sequence of}"];
ComplexTypeImpl506121317 [shape="record", label="{BehaviorRelationshipType|The BehaviorRelationshipType\ncomplex type provides a\nmethod for the characterization\nof relationships among\nMAEC Behaviors.|{Attrs|{{<AttributeUseImpl2069520425>type: BehaviorRelationshipType-type}}}}", color="red"];
ElementDecl464425887 [shape="record", label="{Action_Collections}", color="blue"];
ElementDecl1832874625 [shape="record", label="{MAEC_Bundle|The MAEC_Bundle element\nis the root element\nof this schema, and\nis of type BundleType.}", color="blue"];
ElementDecl1070253050 [shape="record", label="{Action-Pertinent_Object_Attributes|The Action-Pertinent_Object_Attributes\nelement is optional and identifies\nwhich of the Attributes of\nthis Object are specifically\npertinent to this Action.}", color="blue"];
ElementDecl553138527 [shape="record", label="{Behavior|The Behavior element\nspecifies a single\nMAEC Behavior in\nthe relationship.}", color="blue"];
ElementDecl130672250 [shape="record", label="{Analysts|The Analysts element\ncontains the analyst(s)\nwho performed the\nanalysis.}", color="blue"];
ComplexTypeImpl1914295983 [shape="record", label="{(anonymous)}", color="red"];
ComplexTypeImpl266913157 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl454514340 [shape="record", label="{Subject|The Subject element\nis intended to characterize\nthe primary subject\nof the analysis.}", color="blue"];
ElementDecl927591327 [shape="record", label="{Name|The Name element refers\nto the name of the Malware\nInstance, Malware Family,\nor Malware Class being\ntargeted.|{Type|string}}", color="blue"];
ComplexTypeImpl1056794277 [shape="record", label="{(anonymous)|{Attrs|{{<AttributeUseImpl1206877668>name: string}|{<AttributeUseImpl1009920161>ordinal_position: positiveInteger}|{<AttributeUseImpl17400039>value: string}}}}", color="red"];
ElementDecl1528079110 [shape="record", label="{Analysis_Duration|The Analysis_Duration\nelement specifies the\nduration of the overall\ndynamic analysis process,\nin seconds.|{Type|float}}", color="blue"];
ElementDecl1641449698 [shape="record", label="{URL|The URL element specifies\nthe URl of the external\nsource, if applicable.}", color="blue"];
RestrictionSimpleTypeImpl475911554 [shape="record", label="{ActionImpTypeEnum|The AnalysisMethodEnum\nsimple type is an enumeration\nof action implementation\ntypes.|{Variety|atomic}|{Enum|{API_Call|Code|Other}}}", color="darkgreen"];
ElementDecl975740206 [shape="record", label="{Description|The Description element\nis intended to provide\na brief description of\nthe entity that is being\ntargeted.|{Type|string}}", color="blue"];
ComplexTypeImpl1321312491 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl1255543553 [shape="record", label="{Method|The Method element provides\nan abstract way of specifying\nthe method used to obtain\nthe data that the Source\nelement refers to.|{Type|string}}", color="blue"];
RestrictionSimpleTypeImpl275558166 [shape="record", label="{ProcessorTypeEnum|The ProcessorTypeEnum\nsimple type is an (non-exhaustive)\nenumeration of computer\nprocessor architectures.|{Variety|atomic}|{Enum|{x86-32|IA-64|ARM|SPARC|eSi-RISC|Motorola 68k}|{x86-64|PowerPC|Alpha|z/Architecture|MIPS|Other}}}", color="darkgreen"];
ElementDecl1806393359 [shape="record", label="{Description|This element contains\na prose text description\nof the purpose of the\nbehavior, whether it\nwas successful or not.|{Type|string}}", color="blue"];
ElementDecl1231288225 [shape="record", label="{Targeted_Objects|The Targeted_Objects\nelement references\nany MAEC-defined Objects\nthat are being targeted.}", color="blue"];
ComplexTypeImpl1701108693 [shape="record", label="{SourceType|The SourceType complex\ntype provides a way of\ncharacterizing the external\nsource of a relevant MAEC\nentity, such as an analysis\nor indicator.}", color="red"];
ComplexTypeImpl55447184 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl865211569 [shape="record", label="{Related_Objects|The Related_Objects\nelement characterizes\nany relationships to\nother MAEC objects.}", color="blue"];
IdentityConstraintImpl1215960438 [shape="record", label="{behaviorCollectionKey|Enforce uniqueness\namongst the ids differentiating\nthe individual behavior\ncollection elements.|{Category|KEY}|{Selector|maec:Pools/maec:Behavior_Collection_Pool/*}|{Fields|{@id}}}"];
RestrictionSimpleTypeImpl610145197 [shape="record", label="{MalcodeTypeEnum|The MalcodeTypeEnum\nsimple type is a non-exhaustive\nenumeration of types\nof malicious code.|{Variety|atomic}}", color="darkgreen"];
ElementDecl1877093493 [shape="record", label="{Action_Collection}", color="blue"];
ElementDecl925451180 [shape="record", label="{Actions|The Actions element contains\n1-n ActionType objects,\nrepresenting any actions\nthat were observed for\na malware instance.}", color="blue"];
RestrictionSimpleTypeImpl1416386650 [shape="record", label="{ProgrammingLanguageEnum|The ProgrammingLanguageEnum\nsimple type is an (non-exhaustive)\nenumeration of computer\nprogramming languages.|{Variety|atomic}|{Enum|{C|Java|ASP.NET|Perl|Ruby|.NET|HTML}|{C++|JSP|SQL|PHP|Shell|Assembly|}|{C#|Javascript|Python|SOAP|PseudoCode|XML|}}}", color="darkgreen"];
ModelGroupImpl728275102 [shape="record", label="{choice of}"];
ElementDecl1163904012 [shape="record", label="{Behavior|The Behavior element\nspecifies a single\nMAEC Behavior in\nthe collection.}", color="blue"];
ComplexTypeImpl822056113 [shape="record", label="{(anonymous)}", color="red"];
ModelGroupImpl156178214 [shape="record", label="{choice of}"];
ElementDecl1418303441 [shape="record", label="{Description|The Description element\nis intended for use in\nproviding a brief description\nof the code that is encapsulated\nin this element.|{Type|string}}", color="blue"];
RestrictionSimpleTypeImpl1834491520 [shape="record", label="{CodeType-type|{Variety|atomic}|{Enum|{Shellcode|Unknown}|{Exploit_Code|Other}}}", color="darkgreen"];
IdentityConstraintImpl239720060 [shape="record", label="{actionKey|Enforce uniqueness\namongst the ids differentiating\nthe individual action\nelements.|{Category|KEY}|{Selector|maec:Actions/*}|{Fields|{@id}}}"];
ElementDecl205498061 [shape="record", label="{Relationship}", color="blue"];
RestrictionSimpleTypeImpl354199555 [shape="record", label="{ImportanceTypeEnum|The ImportanceTypeEnum\nsimple type is an enumeration\nof relative importance\nmeasures.|{Variety|atomic}|{Enum|{High|Low|Numeric}|{Medium|Informational|Unknown}}}", color="darkgreen"];
ElementDecl2128222380 [shape="record", label="{Behavior_Sub_Collection|The Behavior_Sub-Collection\nelement specifies a\nsub-collection of MAEC\nBehaviors in the collection.}", color="blue"];
ModelGroupImpl1716894611 [shape="record", label="{sequence of}"];
ModelGroupImpl208924888 [shape="record", label="{choice of}"];
ComplexTypeImpl2074982328 [shape="record", label="{(anonymous)}", color="red"];
ComplexTypeImpl2079310344 [shape="record", label="{(anonymous)}", color="red"];
ModelGroupImpl1171248050 [shape="record", label="{sequence of}"];
ElementDecl1490360916 [shape="record", label="{Attribute|The Attribute element\nidentifies a single Object\nAttribute that is specifically\npertinent to this Action.}", color="blue"];
ComplexTypeImpl74484107 [shape="record", label="{(anonymous)}", color="red"];
ModelGroupImpl2035159355 [shape="record", label="{sequence of}"];
ModelGroupImpl16772849 [shape="record", label="{sequence of}"];
RestrictionSimpleTypeImpl308587341 [shape="record", label="{IndicatorIDPattern|The IndicatorIDPattern\nsimple type defines\nthe format for acceptable\nMAEC indicator ids.|{Variety|atomic}|{Facets|{{pattern|maec-\[A-Za-z0-9_\\-\\.\]+-ind-\[1-9\]\[0-9\]*}}}}", color="darkgreen"];
RestrictionSimpleTypeImpl147407825 [shape="record", label="{RelatedObjectType-Relationship|{Variety|atomic}}", color="darkgreen"];
ElementDecl357393821 [shape="record", label="{Indicator_Collection}", color="blue"];
RestrictionSimpleTypeImpl207251401 [shape="record", label="{AnalysisIDPattern|The AnalysisIDPattern\nsimple type defines\nthe format for acceptable\nMAEC Analysis ids.|{Variety|atomic}|{Facets|{{pattern|maec-\[A-Za-z0-9_\\-\\.\]+-ana-\[1-9\]\[0-9\]*}}}}", color="darkgreen"];
RestrictionSimpleTypeImpl55821173 [shape="record", label="{ActionImpIDPattern|The ActionImpIDPattern\nsimple type defines the\nformat for acceptable\nMAEC Action Implementation\nids.|{Variety|atomic}|{Facets|{{pattern|maec-\[A-Za-z0-9_\\-\\.\]+-imp-\[1-9\]\[0-9\]*}}}}", color="darkgreen"];
ComplexTypeImpl2016197766 [shape="record", label="{(anonymous)|{Attrs|{{<AttributeUseImpl1215748873>behavioral_ordering: positiveInteger}}}}", color="red"];
ComplexTypeImpl1333933549 [shape="record", label="{BehaviorType|The BehaviorType complex type\nis one of the MAEC foundational\ntypes, and serves as a method\nfor the characterization of\nmalicious behaviors found or\nobserved in malware.|{Attrs|{{<AttributeUseImpl1469937134>duration: duration}|{<AttributeUseImpl581536050>id: BehaviorIDPattern}|{<AttributeUseImpl1594536095>idref: BehaviorIDREFPattern}|{<AttributeUseImpl108966758>ordinal_position: positiveInteger}|{<AttributeUseImpl1748234462>status: ActionStatusTypeEnum}}}}", color="red"];
ModelGroupImpl1992677825 [shape="record", label="{sequence of}"];
ElementDecl138583065 [shape="record", label="{Tool}", color="blue"];
ModelGroupImpl163905324 [shape="record", label="{sequence of}"];
ElementDecl9052195 [shape="record", label="{Analyses|The Analyses element\ncontains 1-n AnalysisType\nobjects, representing\nany analyses performed\non a piece of malware.}", color="blue"];
ElementDecl501583032 [shape="record", label="{Affinity_Degree|The Affinity_Degree element\nis intended to provide an\nabstract way of characterizing\nthe degree to which the objects\nin a collection are related.|{Type|string}}", color="blue"];
ElementDecl104197840 [shape="record", label="{AV_Detections|The AV_Detections element\nreferences any Anti-Virus\n(AV) tool classifications\nof the object.}", color="blue"];
RestrictionSimpleTypeImpl1670734737 [shape="record", label="{AssociationObject-AssociationType|{Variety|atomic}|{Enum|{Initiating|Utilized}|{Affected|Returned}}}", color="darkgreen"];
ElementDecl1618389807 [shape="record", label="{Object|The Object element identifies\nand specificies the characteristics\nof a specific cyber-relevant\nobject (e.}", color="blue"];
ElementDecl1822435385 [shape="record", label="{Code|The Code element contains\nany form of code that\nwas used to implement\nthe action.}", color="blue"];
ElementDecl771314021 [shape="record", label="{Collections|The Collections element\ncontains the collection\nelement types for Behaviors,\nActions, Objects, and\nIndicators.}", color="blue"];
ModelGroupImpl1139996426 [shape="record", label="{choice of}"];
ModelGroupImpl1408647512 [shape="record", label="{choice of}"];
}
subgraph clusterSchemaImpl177506381 { label="http://xml/metadataSharing.xsd"
ComplexTypeImpl1939873418 [shape="record", label="{ASNObject|Object used to\nhold information\non Autonomous System\nNumbers.|{Attrs|{{<AttributeUseImpl443350971>id: int}}}}", color="red"];
ElementDecl1845867084 [shape="record", label="{protocol|Protocol, for\nexample http,\nftp.|{Type|string}}", color="blue"];
ComplexTypeImpl1592762244 [shape="record", label="{(anonymous)}", color="red"];
RestrictionSimpleTypeImpl104416559 [shape="record", label="{PropertyTypeEnum|Property types\nallowed in an\nobjectProperty.|{Variety|atomic}|{Enum|{filename|isKernel|isPolymorphic|isDamaged|postData|ownerAddress|nameServer|countryCodeFIPS|isp|operatingSystem|comment}|{filepath|isParasitic|isVirus|registryValueData|registrant|adminContact|countryCodeISO3166-2|city|httpMethod|userAgent|}|{locationUrl|isStealth|isNonReplicating|urlParameterString|registrationDate|technicalContact|countryCodeISO3166-3|region|referrer|browser|}}}", color="darkgreen"];
ElementDecl2098993638 [shape="record", label="{origin|An enumeration of common\nsources or origins\nof data associated\nwith the field data.}", color="blue"];
ElementDecl900532540 [shape="record", label="{registry|Configuration information\nfrom the registry on\nMicrosoft Windows operating\nsystems.}", color="blue"];
ComplexTypeImpl314335239 [shape="record", label="{entityObject|Entity\nObject.|{Attrs|{{<AttributeUseImpl57521298>id: string}}}}", color="red"];
ElementDecl1326046395 [shape="record", label="{edition|{Type|string}}", color="blue"];
ElementDecl1348062170 [shape="record", label="{companyName|{Type|string}}", color="blue"];
ElementDecl373277820 [shape="record", label="{productName|The name of the\nproduct the file\nbelongs to, if\napplicable.|{Type|string}}", color="blue"];
ElementDecl1510923692 [shape="record", label="{taggant|Information on\nthe taggant used\nto tag the file,\nif applicable.}", color="blue"];
ElementDecl2094184728 [shape="record", label="{volume|Quantitive measurements\nof prevalence.}", color="blue"];
ElementDecl488448102 [shape="record", label="{startDate|The start date for this\nfield data entry - the\nstart date of the period\nover which the prevalence\n(commonality) and importance\nis measured.|{Type|dateTime}}", color="blue"];
ElementDecl267301746 [shape="record", label="{md5|{Type|hexBinary}}", color="blue"];
ElementDecl117321903 [shape="record", label="{file|Files or\nsamples}", color="blue"];
ElementDecl721886738 [shape="record", label="{version|{Type|string}}", color="blue"];
ComplexTypeImpl322714437 [shape="record", label="{softwarePackageObject|Software package object,\nused to store information\nabout a software package,\nsuch as the vendor and\nversion.|{Attrs|{{<AttributeUseImpl1900096353>id: string}}}}", color="red"];
ElementDecl275980095 [shape="record", label="{fieldDataEntry}", color="blue"];
ElementDecl1999186855 [shape="record", label="{certificateValidity|{Type|boolean}}", color="blue"];
ElementDecl321706196 [shape="record", label="{ref}", color="blue"];
ComplexTypeImpl355807572 [shape="record", label="{objectProperty|Property; a reference\nto the object, a timestamp\nand an unbounded set\nof properties.|{Attrs|{{<AttributeUseImpl284848237>id: anySimpleType}}}}", color="red"];
ComplexTypeImpl1465333984 [shape="record", label="{taggantObject|Taggant object, for use\nin characterizing the\nsoftware taggant that\nmay be associated with\na file or multiple files.|{Attrs|{{<AttributeUseImpl1816677483>id: string}}}}", color="red"];
ElementDecl773454885 [shape="record", label="{product|{Type|string}}", color="blue"];
ElementDecl1497718991 [shape="record", label="{product|{Type|string}}", color="blue"];
ComplexTypeImpl157869097 [shape="record", label="{relationship|Relationships are\nused to express relationships\nbetween objects,\nand dates.|{Attrs|{{<AttributeUseImpl1772195554>id: anySimpleType}|{<AttributeUseImpl1839975835>type: RelationshipTypeEnum}}}}", color="red"];
ElementDecl1366242841 [shape="record", label="{comment|A human readable\ncomment.|{Type|string}}", color="blue"];
ComplexTypeImpl267522134 [shape="record", label="{(anonymous)|{Attrs|{{<AttributeUseImpl110687058>type: string}}}}", color="red"];
ElementDecl935521285 [shape="record", label="{hostname|{Type|string}}", color="blue"];
ModelGroupImpl1438105478 [shape="record", label="{sequence of}"];
ElementDecl21845470 [shape="record", label="{vendor|{Type|string}}", color="blue"];
ModelGroupImpl449250684 [shape="record", label="{sequence of}"];
ElementDecl1680287410 [shape="record", label="{port|{Type|int}}", color="blue"];
ElementDecl764954107 [shape="record", label="{path|{Type|string}}", color="blue"];
ElementDecl1704883006 [shape="record", label="{objectProperty}", color="blue"];
ElementDecl81249983 [shape="record", label="{buildTimeDateStamp|The build timestamp\nof the file,\nif applicable.|{Type|dateTime}}", color="blue"];
RestrictionSimpleTypeImpl960861909 [shape="record", label="{LocationTypeEnum|A list of the various\nways that geographical\nlocation can be represented.|{Variety|atomic}|{Enum|{countryCodeISO3166-2|countryCodeFIPS|region}|{countryCodeISO3166-3|city|isp}}}", color="darkgreen"];
ElementDecl1251696669 [shape="record", label="{vendor|The name of the\nvendor, if extractable\nfrom the file.|{Type|string}}", color="blue"];
ElementDecl1728182942 [shape="record", label="{productgroup|The product group\nthat the product\nbelongs to, e.|{Type|string}}", color="blue"];
ElementDecl1735677628 [shape="record", label="{sha512|{Type|hexBinary}}", color="blue"];
ElementDecl935543594 [shape="record", label="{sha1|{Type|hexBinary}}", color="blue"];
RestrictionSimpleTypeImpl1842275169 [shape="record", label="{OriginTypeEnum|A list of origins,\nused in fieldData,\nto show where objects\noriginated.|{Variety|atomic}|{Enum|{user|lan|isp|collection|wan|partner}|{desktop|gateway|honeypot|spam|internal|unknown}}}", color="darkgreen"];
RestrictionSimpleTypeImpl1780374768 [shape="record", label="{NoQuestionMark|Utility type for\na string not including\na question mark (?)\nfor uri objects.|{Variety|atomic}|{Facets|{{pattern|\[^?\]+}}}}", color="darkgreen"];
ElementDecl920911225 [shape="record", label="{relationships|Relationships\nbetween objects.}", color="blue"];
ElementDecl1756723953 [shape="record", label="{signingTimestamp}", color="blue"];
ComplexTypeImpl709611891 [shape="record", label="{(anonymous)|{Attrs|{{<AttributeUseImpl905375489>cpeVersion: string}}}}", color="red"];
ElementDecl126228093 [shape="record", label="{crc32|{Type|string}}", color="blue"];
ElementDecl1148960696 [shape="record", label="{filename|{Type|string}}", color="blue"];
ElementDecl1119720397 [shape="record", label="{detectionShippedTimeStamp|{Type|dateTime}}", color="blue"];
ElementDecl1950702248 [shape="record", label="{name|{Type|string}}", color="blue"];
ElementDecl250605560 [shape="record", label="{size|The file\nsize in bytes.|{Type|int}}", color="blue"];
ElementDecl1686581432 [shape="record", label="{signingTimestamp}", color="blue"];
ElementDecl1645408661 [shape="record", label="{uriString}", color="blue"];
ElementDecl1652000677 [shape="record", label="{location|Geolocation information\nfor prevalence.}", color="blue"];
ComplexTypeImpl2085703551 [shape="record", label="{(anonymous)}", color="red"];
ComplexTypeImpl1797792093 [shape="record", label="{uriObject|Uri object.|{Attrs|{{<AttributeUseImpl1904394969>id: NoQuestionMark}}}}", color="red"];
ElementDecl288976631 [shape="record", label="{certificateIssuer|{Type|string}}", color="blue"];
ElementDecl2063387354 [shape="record", label="{classificationName|{Type|string}}", color="blue"];
ComplexTypeImpl222590253 [shape="record", label="{property|A property.|{Attrs|{{<AttributeUseImpl1461723831>type: PropertyTypeEnum}}}}", color="red"];
ElementDecl2129429343 [shape="record", label="{certificateRevocationTimestamp|{Type|dateTime}}", color="blue"];
ComplexTypeImpl544685315 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl7224872 [shape="record", label="{CPEname|The Common Platform\nEnumeration, or CPE,\nname of the package\nif one exists.}", color="blue"];
RestrictionSimpleTypeImpl976017192 [shape="record", label="{RelationshipTypeEnum|All the different\ntypes of relationship\nthat are possible.|{Variety|atomic}|{Enum|{relatedTo|installed|downloads|isNameServerOf|isServerOfService|downloadedFrom|sourcedFrom|hasTaggant}|{isClassifiedAs|isParentOf|runs|resolvesTo|hasAssociatedConfiguration|contactedBy|createdBy|}|{hosts|causesToInstall|usesCNC|verifiedBy|operatedByEntity|partOfPackage|hasSignature|}}}", color="darkgreen"];
ElementDecl473237696 [shape="record", label="{entity|A corporation\nor other entity.}", color="blue"];
ModelGroupImpl948576262 [shape="record", label="{sequence of}"];
ElementDecl1661120132 [shape="record", label="{language|{Type|string}}", color="blue"];
ComplexTypeImpl43984264 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl1051344475 [shape="record", label="{taggantValidity|{Type|boolean}}", color="blue"];
ElementDecl1494136117 [shape="record", label="{relationship}", color="blue"];
ElementDecl831285673 [shape="record", label="{productVersion|The version of\nthe product the\nfile belongs to,\nif applicable.|{Type|string}}", color="blue"];
ModelGroupImpl553402542 [shape="record", label="{sequence of}"];
ElementDecl584886224 [shape="record", label="{asn|Autonomous\nSystem (AS).}", color="blue"];
ComplexTypeImpl226195878 [shape="record", label="{(anonymous)|{Attrs|{{<AttributeUseImpl77481349>id: string}|{<AttributeUseImpl853942561>version: decimal|FIXED :1.2|FIXED :1.2}}}}", color="red"];
ModelGroupImpl715732941 [shape="record", label="{sequence of}"];
ElementDecl1721051397 [shape="record", label="{productVersion|{Type|string}}", color="blue"];
ElementDecl1334375686 [shape="record", label="{uri|URI (Uniform\nResource Identifier)\nobjects.}", color="blue"];
ElementDecl2061171244 [shape="record", label="{endDate|The end date for this field\ndata entry - the end date\nof the period over which\nthe prevalence (commonality)\nand importance is measured.|{Type|dateTime}}", color="blue"];
RestrictionSimpleTypeImpl1343001934 [shape="record", label="{IPRange|Utility type\nfor ip ranges,\nfor example 111.|{Variety|atomic}|{Facets|{{pattern|\[0-9\\.\]+-\[0-9\\.\]+}}}}", color="darkgreen"];
ElementDecl181072003 [shape="record", label="{importance|Qualitative measurement\nof risk associated\nwith the object.}", color="blue"];
ModelGroupImpl423699250 [shape="record", label="{sequence of}"];
ModelGroupImpl1220772183 [shape="record", label="{sequence of}"];
ModelGroupImpl2009270675 [shape="record", label="{sequence of}"];
RestrictionSimpleTypeImpl1037878477 [shape="record", label="{ClassificationTypeEnum|Top level types\nof classification.|{Variety|atomic}|{Enum|{clean|unknown|neutral}|{dirty|unwanted|}}}", color="darkgreen"];
ModelGroupImpl996318870 [shape="record", label="{sequence of}"];
ElementDecl332322849 [shape="record", label="{fileType|String describing\nthe type of file,\nfor example executable,\nscript etc.|{Type|string}}", color="blue"];
ElementDecl1492390803 [shape="record", label="{target|References to objects\nat the child end\nof the relationship.}", color="blue"];
ElementDecl108426146 [shape="record", label="{compilerVersion|The version of the\ncompiler used to\ncompile the file,\nif applicable.|{Type|string}}", color="blue"];
ElementDecl993312934 [shape="record", label="{ip|Internet Protocol\n(IP) addresses,\nboth ipv4 and ipv6.}", color="blue"];
ElementDecl905654009 [shape="record", label="{linkerVersion|The version of\nthe linker used\nto link the file,\nif applicable.|{Type|float}}", color="blue"];
ElementDecl1088549637 [shape="record", label="{extraHash|Element for inserting\nfuzzy hashes for\nexample pehash,\nssdeep.}", color="blue"];
ElementDecl783814428 [shape="record", label="{language|The language(s)\nthe file is\nin.|{Type|string}}", color="blue"];
ModelGroupImpl1028147850 [shape="record", label="{sequence of}"];
ElementDecl1506565411 [shape="record", label="{softwarePackage|Software packages,\ntypically used for\nassociating with the\nfiles that they install\nor create.}", color="blue"];
RestrictionSimpleTypeImpl949835667 [shape="record", label="{intBetween0and100|Utility type\nfor integers\nbetween 0 and\n100.|{Variety|atomic}|{Facets|{{minInclusive|0}|{maxInclusive|100}}}}", color="darkgreen"];
ComplexTypeImpl2018414300 [shape="record", label="{(anonymous)|{Attrs|{{<AttributeUseImpl2085585752>valid: boolean}}}}", color="red"];
ComplexTypeImpl526362387 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl1216074858 [shape="record", label="{architecture|The processor architecture\nof the file, if\napplicable.|{Type|string}}", color="blue"];
ElementDecl1922152880 [shape="record", label="{references|The objects the\nproperties pertain\nto.}", color="blue"];
RestrictionSimpleTypeImpl1440850158 [shape="record", label="{IPTypeEnum|Types of\nIP addresses|{Variety|atomic}|{Enum|{ipv4|ipv6}}}", color="darkgreen"];
ComplexTypeImpl591783334 [shape="record", label="{classificationObject|Classification object,\nused to hold names\nor classifications\nof objects.|{Attrs|{{<AttributeUseImpl3743136>id: string}|{<AttributeUseImpl633860989>type: ClassificationTypeEnum}}}}", color="red"];
ModelGroupImpl612549181 [shape="record", label="{sequence of}"];
ElementDecl1700675012 [shape="record", label="{objectProperties|Properties of objects\nthat do not make\nsense as relationships.}", color="blue"];
ComplexTypeImpl1893321675 [shape="record", label="{reference|Reference element used\nto hold xpath expressions\nto objects, for example\nfile\[@id=\"12345\"\].}", color="red"];
ElementDecl2123942903 [shape="record", label="{property}", color="blue"];
ElementDecl1861447257 [shape="record", label="{certificateSubject|{Type|string}}", color="blue"];
ElementDecl340736930 [shape="record", label="{key|{Type|string}}", color="blue"];
ModelGroupImpl316985549 [shape="record", label="{sequence of}"];
ElementDecl238140616 [shape="record", label="{valueName|{Type|string}}", color="blue"];
ElementDecl572151664 [shape="record", label="{internalName|The internal\nname(s) of hte\nfile, if applicable.|{Type|string}}", color="blue"];
ElementDecl1821500193 [shape="record", label="{vendorID|{Type|string}}", color="blue"];
ElementDecl1052060200 [shape="record", label="{definitionVersion|{Type|string}}", color="blue"];
ElementDecl1087605110 [shape="record", label="{taggant|Digital signatures,\nfor use in assocating\nwith \>1 binaries that\nmay have the same signature.}", color="blue"];
ElementDecl1506367663 [shape="record", label="{detectionAddedTimeStamp|{Type|dateTime}}", color="blue"];
ComplexTypeImpl1333291928 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl1823775513 [shape="record", label="{company|The company name for\nthe entity generating\nthe xml document, for\nexample \"AVG Technologies\".|{Type|string}}", color="blue"];
ModelGroupImpl138914035 [shape="record", label="{sequence of}"];
ElementDecl396793761 [shape="record", label="{malwareMetaData|This is the top\nlevel element for\nthe xml document.}", color="blue"];
ElementDecl1266484165 [shape="record", label="{domain|{Type|string}}", color="blue"];
ModelGroupImpl1147066451 [shape="record", label="{sequence of}"];
ElementDecl1838117532 [shape="record", label="{digitalSignature|Digital signatures,\nfor use in assocating\nwith \>1 binaries that\nmay have the same signature.}", color="blue"];
ElementDecl570824606 [shape="record", label="{ipProtocol|IP protocol,\nfor example.|{Type|string}}", color="blue"];
ComplexTypeImpl1901865027 [shape="record", label="{fieldDataEntry|Data structure\nto hold prevalence\ninformation.}", color="red"];
ElementDecl1007379802 [shape="record", label="{commonality|Qualitative measurements\nof prevalence.}", color="blue"];
ComplexTypeImpl1710542290 [shape="record", label="{(anonymous)|{Attrs|{{<AttributeUseImpl2081210258>valid: boolean}}}}", color="red"];
ElementDecl985069557 [shape="record", label="{source|References to objects\nat the parent end\nof the relationship.}", color="blue"];
ComplexTypeImpl903758710 [shape="record", label="{(anonymous)}", color="red"];
ModelGroupImpl47889642 [shape="record", label="{sequence of}"];
RestrictionSimpleTypeImpl1515591727 [shape="record", label="{(anonymous)|{Variety|atomic}|{Enum|{CatalogSigned|CodeSigned}}}", color="darkgreen"];
ElementDecl616259718 [shape="record", label="{references|The objects the\nprevalence information\npertains to.}", color="blue"];
ComplexTypeImpl1163609234 [shape="record", label="{IPObject|IP object.|{Attrs|{{<AttributeUseImpl1457099383>id: IPRange}}}}", color="red"];
ElementDecl1713279871 [shape="record", label="{classification|Labels or names,\nfor example detection\nnames associated\nwith malware samples.}", color="blue"];
ElementDecl1944359640 [shape="record", label="{MIMEType|{Type|string}}", color="blue"];
ComplexTypeImpl54697201 [shape="record", label="{registryObject|Registry\nobject.|{Attrs|{{<AttributeUseImpl631885650>id: string}}}}", color="red"];
ElementDecl1261696733 [shape="record", label="{checksum|The checksum\nof the file,\nif applicable.|{Type|hexBinary}}", color="blue"];
ModelGroupImpl516061365 [shape="record", label="{sequence of}"];
ElementDecl106704878 [shape="record", label="{author|The author of the\ndocument, for example\n\"Matt Williamson\"\nor \"Igor Muttik\".|{Type|string}}", color="blue"];
ElementDecl618337492 [shape="record", label="{as-number|{Type|int}}", color="blue"];
ElementDecl619463392 [shape="record", label="{domain|Domain names\nas administered\nby ICANN.}", color="blue"];
ModelGroupImpl1097429027 [shape="record", label="{sequence of}"];
ModelGroupImpl1821943992 [shape="record", label="{sequence of}"];
ModelGroupImpl1759554982 [shape="record", label="{sequence of}"];
ElementDecl1184762925 [shape="record", label="{domain|{Type|string}}", color="blue"];
ElementDecl260440278 [shape="record", label="{category|Category is\n\"companyname:category\".|{Type|string}}", color="blue"];
ComplexTypeImpl217401080 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl1730233894 [shape="record", label="{fileVersion|{Type|string}}", color="blue"];
ComplexTypeImpl1794306256 [shape="record", label="{IPAddress|ip address - string\nfor the actual address\nand attribute either\nipv4, ipv6.|{Attrs|{{<AttributeUseImpl944419850>type: IPTypeEnum}}}}", color="red"];
ElementDecl1592409311 [shape="record", label="{developmentEnvironment|The development environment\nused to build the\nfile, if applicable.|{Type|string}}", color="blue"];
ElementDecl1665033030 [shape="record", label="{ref}", color="blue"];
ComplexTypeImpl1741604980 [shape="record", label="{(anonymous)|{Attrs|{{<AttributeUseImpl646703599>units: VolumeUnitsEnum}}}}", color="red"];
ElementDecl358310166 [shape="record", label="{minOSVersionCPE|The minimum operating\nsystem version needed\nto run the file, specifeid\nas a CPE name.|{Type|string}}", color="blue"];
RestrictionSimpleTypeImpl1869072125 [shape="record", label="{RegionTypeEnum|A list of regions, currently\nnot used, but encouraged\nas values for \'region\'\nwhen describing location.|{Variety|atomic}|{Enum|{NorthAmerica|CentralAmerica|Africa}|{SouthAmerica|Europe|APAC}}}", color="darkgreen"];
ComplexTypeImpl1463389356 [shape="record", label="{domainObject|Domain object,\nused to hold\ninternet domains,\ne.|{Attrs|{{<AttributeUseImpl646054311>id: string}}}}", color="red"];
ElementDecl902068574 [shape="record", label="{firstSeenDate|The date that the\nobject was first\nseen by the reporting\nentity.|{Type|dateTime}}", color="blue"];
ElementDecl583737052 [shape="record", label="{timestamp|{Type|dateTime}}", color="blue"];
ElementDecl1513655412 [shape="record", label="{numberOfSections|The number of sections\nin the file, if\napplicable.|{Type|int}}", color="blue"];
ComplexTypeImpl525805292 [shape="record", label="{fileObject|Object definition\nfor files.|{Attrs|{{<AttributeUseImpl1443407612>id: hexBinary}}}}", color="red"];
ComplexTypeImpl1980984405 [shape="record", label="{(anonymous)|{Attrs|{{<AttributeUseImpl1485083064>type: LocationTypeEnum}}}}", color="red"];
ElementDecl142310161 [shape="record", label="{sha256|{Type|hexBinary}}", color="blue"];
ModelGroupImpl647256981 [shape="record", label="{sequence of}"];
ElementDecl1315792650 [shape="record", label="{fieldData|Prevalence\ndata.}", color="blue"];
ElementDecl661890634 [shape="record", label="{timestamp|{Type|dateTime}}", color="blue"];
RestrictionSimpleTypeImpl2140365031 [shape="record", label="{VolumeUnitsEnum|A list of the various\nunits allowed to\nbe used in volume\ntag in fieldDataEntry.|{Variety|atomic}|{Enum|{numberUsersAffected|numberSeenInSpam|numberOfWebsitesHosting}|{numberMachinesAffected|numberSeenInMalwareSamples|numberOfWebsitesRedirecting}}}", color="darkgreen"];
ElementDecl1051606440 [shape="record", label="{endAddress}", color="blue"];
ElementDecl1707803790 [shape="record", label="{filenameWithinInstaller|The name of the\nfile within an\ninstaller or archive.|{Type|string}}", color="blue"];
ElementDecl1321288348 [shape="record", label="{normalizedNativePath|The normalized native\npath of the file, using\nstandardized system path\nvariables (for Windows\nsee http://en.|{Type|string}}", color="blue"];
ElementDecl1758027178 [shape="record", label="{startAddress}", color="blue"];
SchemaImpl177506381 [shape="record", label="{http://xml/metadataSharing.xsd|A schema for sharing\ndata associated\nwith malicious\nsoftware.}"];
ComplexTypeImpl172856291 [shape="record", label="{digitalSignatureObject|Digital signature object,\nused to hold information\nabout digitally signed\nbinaries with regards to\nthe certificate used and\nits validity.|{Attrs|{{<AttributeUseImpl1950123753>id: string}|{<AttributeUseImpl834496157>type}}}}", color="red"];
ElementDecl797952442 [shape="record", label="{timestamp|The time that\nthe document\nwas created.|{Type|dateTime}}", color="blue"];
ComplexTypeImpl1932654873 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl801472670 [shape="record", label="{ref}", color="blue"];
ElementDecl1731742314 [shape="record", label="{update|{Type|string}}", color="blue"];
ModelGroupImpl1141445920 [shape="record", label="{sequence of}"];
ElementDecl239468736 [shape="record", label="{classificationDetails|Details of the classification,\ngiving product details,\nparticularly useful for\nanti-virus scanner detections.}", color="blue"];
ModelGroupImpl1203326626 [shape="record", label="{sequence of}"];
ElementDecl1422598533 [shape="record", label="{ref}", color="blue"];
ModelGroupImpl1966850826 [shape="record", label="{sequence of}"];
ModelGroupImpl540841494 [shape="record", label="{sequence of}"];
ElementDecl567189405 [shape="record", label="{objects|Objects are globally\nunique files, urls,\ndomain, registry,\nipAddress etc.}", color="blue"];
ElementDecl255800459 [shape="record", label="{folderWithinInstaller|The folder the\nfile resides in\nwithin an installer\nor archive.|{Type|string}}", color="blue"];
ElementDecl859944758 [shape="record", label="{requiredPrivilege|The minimum required\nto run the file,\ne.|{Type|string}}", color="blue"];
ElementDecl843167285 [shape="record", label="{digitalSignature|Information on the\ndigital signature\nof the file, if applicable.}", color="blue"];
}
subgraph clusterSchemaImpl1289955330 { label="http://cybox.mitre.org/XMLSchema/cybox_v0.7"
ElementDecl1956297961 [shape="record", label="{Item_Value|This field contains\nthe value of this\nconfiguration setting\ninstance.|{Type|string}}", color="blue"];
ElementDecl1277899933 [shape="record", label="{Build_ID|This field contains\na unique identifier\nof this build of this\napplication instance.|{Type|string}}", color="blue"];
ElementDecl2067115646 [shape="record", label="{Item_Name|This field contains the\nname of the configuration\nitem referenced by this\nconfiguration setting\ninstance.|{Type|string}}", color="blue"];
ComplexTypeImpl1947740113 [shape="record", label="{(anonymous)}", color="red"];
ComplexTypeImpl1615404108 [shape="record", label="{DataType|DataType is intended to provide\na relatively abstract way of\ncharacterizing data segments\nthat may be written/read/transmitted\nor otherwise utilized in actions\nor behaviors.|{Attrs|{{<AttributeUseImpl1065524847>format}|{<AttributeUseImpl696318316>id: ID}|{<AttributeUseImpl1383544509>offset: int}}}}", color="red"];
UnionSimpleTypeImpl1268038167 [shape="record", label="{(anonymous)|{Variety|list}}", color="darkgreen"];
RestrictionSimpleTypeImpl1589111901 [shape="record", label="{SourceTypeEnum|SourceTypeEnum is a\n(non-exhaustive) enumeration\nof cyber observation\nsource types.|{Variety|atomic}|{Enum|{Tool|Analysis|InformationSource}}}", color="darkgreen"];
ModelGroupImpl1007740960 [shape="record", label="{sequence of}"];
ModelGroupImpl748372710 [shape="record", label="{sequence of}"];
SchemaImpl1289955330 [shape="record", label="{http://cybox.mitre.org/XMLSchema/cybox_v0.7}"];
ElementDecl1837007962 [shape="record", label="{Name|This field contains\nthe name of the\ntool leveraged.|{Type|string}}", color="blue"];
ElementDecl115841081 [shape="record", label="{Reference_Link|This element should\nhold the URL for the\nmaterial being referenced,\nif one exists.|{Type|string}}", color="blue"];
ComplexTypeImpl866838863 [shape="record", label="{UnsignedLongObjectAttributeType|The UnsignedLongObjectAttributeType\nis a complex type (extended\nfrom BaseObjectAttributeType)\nrepresenting the specification\nof a single Object attribute\nwhose core value is of type\nUnsignedLong.|{Attrs|{{<AttributeUseImpl2055000954>Datatype: DatatypeEnum|FIXED :UnsignedLong|FIXED :UnsignedLong}}}}", color="red"];
ComplexTypeImpl394215580 [shape="record", label="{StatefulMeasureType|The StatefulMeasureType\nis a complex type representing\na cyber observable property\nthat is statically stateful\nin nature (e.|{Attrs|{{<AttributeUseImpl1681582401>Name: anySimpleType}}}}", color="red"];
ElementDecl1477356634 [shape="record", label="{Reference_Publication|This element identifies\nthe publication source\nof the reference material,\nif one exists.|{Type|string}}", color="blue"];
ElementDecl1398577124 [shape="record", label="{Time|The Time element is optional\nand enables description\nof various time-related\nattributes for this cyber\nobservation source instance.}", color="blue"];
RestrictionSimpleTypeImpl2020116820 [shape="record", label="{(anonymous)|{Variety|atomic}|{Enum|{High|Medium|Low}}}", color="darkgreen"];
ElementDecl1474560628 [shape="record", label="{Attribute|{Type|anyType}}", color="blue"];
ModelGroupImpl1868012080 [shape="record", label="{choice of}"];
ElementDecl2007882585 [shape="record", label="{Reference_Publisher|This element identifies\nthe publisher of\nthe reference material,\nif one exists.|{Type|string}}", color="blue"];
ElementDecl139032836 [shape="record", label="{Build_Configuration|This field describes\nhow the build utility\nwas configured for\nthis build of this\napplication.}", color="blue"];
ComplexTypeImpl257798932 [shape="record", label="{EventType|The EventType is a complex\ntype representing a cyber observable\nevent that is dynamic in nature\nwith specific action(s) taken\nagainst specific cyber relevant\nobjects (e.|{Attrs|{{<AttributeUseImpl1615593067>ID: ID}|{<AttributeUseImpl489444401>IDREF: IDREF}|{<AttributeUseImpl1229679597>Type: EventTypeEnum}}}}", color="red"];
ComplexTypeImpl1505169310 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl1690464956 [shape="record", label="{Images}", color="blue"];
ModelGroupImpl378630016 [shape="record", label="{sequence of}"];
RestrictionSimpleTypeImpl1929901890 [shape="record", label="{(anonymous)|{Variety|atomic}}", color="darkgreen"];
ElementDecl808992869 [shape="record", label="{Defined_Effect|The Defined_Effect element\nis an abstract placeholder\nfor various predefined\nObject Effect types (e.}", color="blue"];
ComplexTypeImpl627418050 [shape="record", label="{StructuredTextType|The StructuredTextType is\na complex type representing\na generalized structure for\ncapturing structured textual\ninformation such as descriptions\nof things.}", color="red"];
ModelGroupImpl774209307 [shape="record", label="{sequence of}"];
RestrictionSimpleTypeImpl381312122 [shape="record", label="{ActionStatusTypeEnum|ActionStatusTypeEnum\nis a (non-exhaustive)\nenumeration of cyber\nobservable action status\ntypes.|{Variety|atomic}|{Enum|{Success|Error|Pending|Unknown}|{Fail|Complete/Finish|Ongoing|}}}", color="darkgreen"];
ElementDecl280236390 [shape="record", label="{Configuration_Setting_Description|This field contains the\ndescription of the configuration\nsettings for this build\nof this application instance.|{Type|string}}", color="blue"];
ModelGroupImpl1630553042 [shape="record", label="{sequence of}"];
ModelGroupImpl950886315 [shape="record", label="{sequence of}"];
ElementDecl606389874 [shape="record", label="{Reference|Each Reference subelement should\nprovide a single source from\nwhich more information and\ndeeper insight can be obtained,\nsuch as a research paper or\nan excerpt from a publication.}", color="blue"];
ElementDecl2003560079 [shape="record", label="{Values|The Values element specifies\nthe values that were\nenumerated as a result\nof the action on the\nobject.}", color="blue"];
ElementDecl1512109123 [shape="record", label="{Relationships|The Relationships element\nis optional and enables\ndescription of other cyber\nobservable actions that\nare related to this Action.}", color="blue"];
ElementDecl1309828059 [shape="record", label="{Platform|The Platform element is\noptional and enables a\nformal, standardized specification\nof the platform for this\ncyber observation srouce.}", color="blue"];
ElementDecl60863806 [shape="record", label="{Tools|The Tools element is\noptional and enables\ndescription of the tools\nutilized for this cyber\nobservation source.}", color="blue"];
ModelGroupImpl1544213635 [shape="record", label="{sequence of}"];
ElementDecl2137222734 [shape="record", label="{Keywords|The Keywords element\nenables capture of\nrelevant keywords for\nthis cyber observable.|{Type|string}}", color="blue"];
ElementDecl176271867 [shape="record", label="{Reference_Date|This element identifies\nthe date when the\nreference was included\nin the entry.|{Type|date}}", color="blue"];
ComplexTypeImpl1055389419 [shape="record", label="{(anonymous)}", color="red"];
ComplexTypeImpl1660604171 [shape="record", label="{ToolInformationType|ToolInformationType\nis a complex type representing\na description of a\nsingle automated tool.|{Attrs|{{<AttributeUseImpl1253122721>ID: string}|{<AttributeUseImpl861445718>IDREF: string}}}}", color="red"];
ModelGroupImpl1747306536 [shape="record", label="{sequence of}"];
ComplexTypeImpl1440914329 [shape="record", label="{(anonymous)|{Attrs|{{<AttributeUseImpl185195573>Name: string}|{<AttributeUseImpl878190908>XPath: string}}}}", color="red"];
ComplexTypeImpl1753301011 [shape="record", label="{IntObjectAttributeType|The IntObjectAttributeType\nis a complex type (extended\nfrom BaseObjectAttributeType)\nrepresenting the specification\nof a single Object attribute\nwhose core value is of type\nInt.|{Attrs|{{<AttributeUseImpl1886014746>Datatype: DatatypeEnum|FIXED :Int|FIXED :Int}}}}", color="red"];
ComplexTypeImpl1380290369 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl460910552 [shape="record", label="{Data|The Data element specifies\nthe data that was written\nto the object by the\naction.}", color="blue"];
ComplexTypeImpl1692369893 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl1682756992 [shape="record", label="{Data_Segment|The Data_Segment element\ncontains the actual\nsegment of data being\ncharacterized.|{Type|string}}", color="blue"];
ElementDecl1805640785 [shape="record", label="{Build_Information|This field contains\ninformation describing\nhow this tool was\nbuilt.}", color="blue"];
ElementDecl900256864 [shape="record", label="{Contributors|The Contributors element\nis optional and enables\ndescription of the individual\ncontributors involved in\nthis cyber observation\nsource.}", color="blue"];
ModelGroupImpl1482981398 [shape="record", label="{sequence of}"];
RestrictionSimpleTypeImpl698841244 [shape="record", label="{(anonymous)|{Variety|atomic}|{Enum|{Anomaly Detection}}}", color="darkgreen"];
RestrictionSimpleTypeImpl589734556 [shape="record", label="{(anonymous)|{Variety|atomic}}", color="darkgreen"];
ElementDecl1844438133 [shape="record", label="{Value|{Type|string}}", color="blue"];
ComplexTypeImpl1738275632 [shape="record", label="{ActionType|The ActionType is\na complex type representing\na single cyber observable\naction.|{Attrs|{{<AttributeUseImpl426164500>Action_Status: ActionStatusTypeEnum}|{<AttributeUseImpl1535747955>Context: ActionContextTypeEnum}|{<AttributeUseImpl313727612>ID: ID}|{<AttributeUseImpl747621499>IDREF: IDREF}|{<AttributeUseImpl347715096>NetworkProtocol: NetworkProtocolEnum}|{<AttributeUseImpl1356841826>Type: ActionTypeEnum}|{<AttributeUseImpl1400534790>ordinal_position: positiveInteger}|{<AttributeUseImpl219960763>timestamp: time}}}}", color="red"];
ComplexTypeImpl664219194 [shape="record", label="{(anonymous)}", color="red"];
ModelGroupImpl1788255273 [shape="record", label="{sequence of}"];
ElementDecl494299142 [shape="record", label="{Reference_Section|This element is intended to provide\na means of identifying the exact\nlocation of the material inside\nof the publication source, such\nas the relevant pages of a research\npaper, the appropriate chapters\nfrom a book, etc.|{Type|string}}", color="blue"];
ComplexTypeImpl790899473 [shape="record", label="{NonNegativeIntegerObjectAttributeType|The NonNegativeIntegerObjectAttributeType\nis a complex type (extended from\nBaseObjectAttributeType) representing\nthe specification of a single\nObject attribute whose core value\nis of type nonNegativeInteger.|{Attrs|{{<AttributeUseImpl1129851516>Datatype: DatatypeEnum|FIXED :NonNegativeInteger|FIXED :NonNegativeInteger}}}}", color="red"];
ComplexTypeImpl690485778 [shape="record", label="{AnyURIObjectAttributeType|The AnyURIObjectAttributeType\nis a complex type (extended\nfrom BaseObjectAttributeType)\nrepresenting the specification\nof a single Object attribute\nwhose core value is of type\nanyURI.|{Attrs|{{<AttributeUseImpl1859093149>Datatype: DatatypeEnum|FIXED :AnyURI|FIXED :AnyURI}}}}", color="red"];
ElementDecl1400469397 [shape="record", label="{Pools|The Pools element enables the\ndescription of Events, Actions,\nObjects and Attributes in a space-efficient\npooled manner with the actual Observable\nstructures defined in the CybOX\nschema containing references to\nthe pooled elements.}", color="blue"];
RestrictionSimpleTypeImpl1784954589 [shape="record", label="{(anonymous)|{Variety|atomic}}", color="darkgreen"];
ComplexTypeImpl594202065 [shape="record", label="{PropertiesEnumeratedEffectType|The PropertiesEnumeratedEffectType\ntype is intended to characterize\nthe effects of actions upon objects\nwhere some properties of the\nobject are enumerated, such as\nthe startup parameters for a\nprocess.}", color="red"];
RestrictionSimpleTypeImpl1542508369 [shape="record", label="{(anonymous)|{Variety|atomic}}", color="darkgreen"];
ElementDecl2119047503 [shape="record", label="{meta-item-metadata|This field aggregates\nthe descriptive metadata\nfor this CPE Name\ninstance.}", color="blue"];
ElementDecl1322078637 [shape="record", label="{Undefined_Name|The Undefined_Name element\nis optional and utilizes\na non-standardized undefined\nname to identify/characterize\nthe specific action performed.|{Type|string}}", color="blue"];
ElementDecl135635873 [shape="record", label="{Object_IDRef|{Type|IDREF}}", color="blue"];
ElementDecl1086354727 [shape="record", label="{Compiler_Name|{Type|string}}", color="blue"];
ElementDecl1188739161 [shape="record", label="{Build_Utility_Name|This field contains the\ninformally defined name\nof the utility used to\nbuild this application\ninstance.|{Type|string}}", color="blue"];
ModelGroupImpl1866162779 [shape="record", label="{sequence of}"];
ComplexTypeImpl1147380142 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl1960929157 [shape="record", label="{Action_Pool|The Action_Pool element enables\nthe description of CybOX Actions\nin a space-efficient pooled manner\nwith the actual Observable structures\ndefined in the CybOX schema containing\nreferences to the pooled Action\nelements.}", color="blue"];
ElementDecl833898193 [shape="record", label="{Reference_Author|This element identifies\nan individual author\nof the material being\nreferenced.|{Type|string}}", color="blue"];
ModelGroupImpl1540815795 [shape="record", label="{sequence of}"];
ComplexTypeImpl2140326105 [shape="record", label="{ReferenceType|The ReferenceType is\na complex type representing\na single reference\nto a source of information.|{Attrs|{{<AttributeUseImpl1598675078>Reference_ID: anySimpleType}}}}", color="red"];
ElementDecl528297742 [shape="record", label="{Object}", color="blue"];
ComplexTypeImpl261989628 [shape="record", label="{NameObjectAttributeType|The NameObjectAttributeType\nis a complex type (extended\nfrom BaseObjectAttributeType)\nrepresenting the specification\nof a single Object attribute\nwhose core value is of type\nName.|{Attrs|{{<AttributeUseImpl2002021820>Datatype: DatatypeEnum|FIXED :Name|FIXED :Name}}}}", color="red"];
UnionSimpleTypeImpl1461837610 [shape="record", label="{(anonymous)|{Variety|list}}", color="darkgreen"];
ElementDecl2084240281 [shape="record", label="{Usage_Context_Assumptions|This field contains\ndescriptions of the\nvarious relevant usage\ncontext assumptions\nfor this tool .}", color="blue"];
ElementDecl88773511 [shape="record", label="{Content|This field contains\nthe actual content\nof this internal\nstring instance.|{Type|string}}", color="blue"];
ModelGroupImpl1741612946 [shape="record", label="{sequence of}"];
ComplexTypeImpl1983049639 [shape="record", label="{MetadataType|{Attrs|{{<AttributeUseImpl426901684>Type: string}}}}", color="red"];
ElementDecl1930362236 [shape="record", label="{Delta}", color="blue"];
ModelGroupImpl817138449 [shape="record", label="{sequence of}"];
ElementDecl530654357 [shape="record", label="{Reference_Description}", color="blue"];
ModelGroupImpl1458590421 [shape="record", label="{choice of}"];
RestrictionSimpleTypeImpl500470343 [shape="record", label="{(anonymous)|{Variety|atomic}}", color="darkgreen"];
ComplexTypeImpl1648576638 [shape="record", label="{(anonymous)}", color="red"];
RestrictionSimpleTypeImpl1774197673 [shape="record", label="{(anonymous)|{Variety|list}}", color="darkgreen"];
ElementDecl1603665700 [shape="record", label="{Event|This Event element\nis included recursively\nto enable description/specification\nof composite Events.}", color="blue"];
ComplexTypeImpl870459580 [shape="record", label="{LongObjectAttributeType|The LongObjectAttributeType\nis a complex type (extended\nfrom BaseObjectAttributeType)\nrepresenting the specification\nof a single Object attribute\nwhose core value is of type\nlong.|{Attrs|{{<AttributeUseImpl1488264233>Datatype: DatatypeEnum|FIXED :Long|FIXED :Long}}}}", color="red"];
RestrictionSimpleTypeImpl2134934309 [shape="record", label="{(anonymous)|{Variety|atomic}|{Enum|{Good_Code|Mitigation_Code|Result}|{Bad_Code|Attack|List}}}", color="darkgreen"];
RestrictionSimpleTypeImpl984103443 [shape="record", label="{(anonymous)|{Variety|list}}", color="darkgreen"];
ElementDecl928813722 [shape="record", label="{Attribute|The Attribute element\nidentifies a single Object\nAttribute that is specifically\npertinent to this Action.}", color="blue"];
ElementDecl1932951080 [shape="record", label="{Observable|The Observable element\nrepresents a description\nof a single cyber\nobservable.}", color="blue"];
ElementDecl2022356744 [shape="record", label="{Block|Block is a Structured_Text\nelement consisting of one\nof Text_Title,\nText, Code_Example_Language,\nor Code followed by another\nBlock element.}", color="blue"];
ElementDecl1560601227 [shape="record", label="{Build_Script|This field contains\nthe actual build script\nfor this build of this\napplication instance.|{Type|string}}", color="blue"];
ComplexTypeImpl2109759485 [shape="record", label="{AttributeType|The AttibuteType is\na complext type representing\nthe specification of\na single Object Attribute.|{Attrs|{{<AttributeUseImpl1361940173>Name: anySimpleType}}}}", color="red"];
RestrictionSimpleTypeImpl1509960108 [shape="record", label="{(anonymous)|{Variety|atomic}}", color="darkgreen"];
ElementDecl372491238 [shape="record", label="{Actions|The Actions element\nenables description/specification\nof one or more cyber\nobservable actions.}", color="blue"];
RestrictionSimpleTypeImpl307988519 [shape="record", label="{DefinedActionNameEnum|The DefinedActionNameEnum\ntype is an enumeration\nof defined action\nnames.|{Variety|atomic}|{Enum|{Accept Socket Connection|Close Registry Key|Control Service|Create Mutex|Create Service|Delete Registry Key Value|Enumerate Registry Key Values|Flush Process Instruction Cache|Get File Attributes|Get Library Handle|Get Service Status|Get Windows Directory|Listen on Socket|Move File|Open Service Control Manager|Receive Data from Socket|Set Process Current Directory|Start Service}|{Add Scheduled Task|Close Socket|Copy File|Create Named Pipe|Create Socket|Delete Service|Enumerate Services|Free Library|Get Function Address|Get NetBIOS Name|Get System Host Name|Get Windows System Directory|Load Driver|Open File|Query Disk Attributes|Release Mutex|Set Process Environment Variable|Unlock File}|{Allocate Virtual Memory|Configure Service|Create Dialog Box|Create Process|Create Thread|Disconnect from Named Pipe|Enumerate Threads|Free Virtual Memory|Get Host By Address|Get Process Current Directory|Get System Network Parameters|Get Windows Temporary Files Directory|Load Library|Open Mutex|Queue APC in Thread|Send Data on Socket|Set System Host Name|Unmap File}|{Bind Address to Socket|Connect to Named Pipe|Create Event|Create Process as User|Create Window|Disconnect from Socket|Enumerate Windows|Get Disk Free Space|Get Host By Name|Get Process Environment Variable|Get System Time|Kill Process|Lock File|Open Process|Read File|Send Data to Address on Socket|Set System Time|Write Registry Key Value}|{Change Service Configuration|Connect to Socket|Create File|Create Registry Key|Delete File|Enumerate Protocols|Find File|Get Disk Type|Get Host Name|Get Process Startup Information|Get Thread Context|Kill Thread|Map File|Open Registry Key|Read from Process|Set File Attributes|Set Thread Context|Write to File}|{Check For Remote Debugger|Control Driver|Create Mailslot|Create Remote Thread|Delete Registry Key|Enumerate Registry Key Subkeys|Find Window|Get Elapsed System Up Time|Get Library File Name|Get Processes Snapshot|Get Thread Username|Kill Window|Monitor Registry Key|Open Service|Read Registry Key Value|Set NetBIOS Name|Show Window|Write to Process}}}", color="darkgreen"];
ModelGroupImpl1738223535 [shape="record", label="{sequence of}"];
ElementDecl576300853 [shape="record", label="{Tool|The Tool element is optional\nand enables description\nof a single tool utilized\nfor this cyber observation\nsource.}", color="blue"];
ComplexTypeImpl587205583 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl372984606 [shape="record", label="{Action_Alias|The Action_Alias element\nis optional and enables\nidentification of a single\nother potentially used\nname for this Action.|{Type|string}}", color="blue"];
ElementDecl894261275 [shape="record", label="{Associated_Object|The Associated_Object\nelement enables the\ndescription of cyber\nObjects associated\nwith this Action.}", color="blue"];
ComplexTypeImpl254300116 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl1779280140 [shape="record", label="{Action_Arguments|The Action_Arguments\nelement is optional and\nenables the specification\nof relevant arguments/parameters\nfor this Action.}", color="blue"];
RestrictionSimpleTypeImpl726853985 [shape="record", label="{(anonymous)|{Variety|list}}", color="darkgreen"];
ComplexTypeImpl896472140 [shape="record", label="{DurationObjectAttributeType|The DurationObjectAttributeType\nis a complex type (extended\nfrom BaseObjectAttributeType)\nrepresenting the specification\nof a single Object attribute\nwhose core value is of type\nduration.|{Attrs|{{<AttributeUseImpl1331829131>Datatype: DatatypeEnum|FIXED :Duration|FIXED :Duration}}}}", color="red"];
ElementDecl1800743798 [shape="record", label="{Noisiness|The Noisiness element\nis optional and enables\nsimple characterization\nof how noisy this Observable\ntypically could be.}", color="blue"];
ModelGroupImpl1775852968 [shape="record", label="{sequence of}"];
ComplexTypeImpl1362913826 [shape="record", label="{Base64BinaryObjectAttributeType|The Base64BinaryObjectAttributeType\nis a complex type (extended\nfrom BaseObjectAttributeType)\nrepresenting the specification\nof a single Object attribute\nwhose core value is of type\nbase64Binary.|{Attrs|{{<AttributeUseImpl1026179434>Datatype: DatatypeEnum|FIXED :Base64Binary|FIXED :Base64Binary}}}}", color="red"];
ComplexTypeImpl234146798 [shape="record", label="{ObjectType|The ObjectType is a complex\ntype representing the\ncharacteristics of a\nspecific cyber-relevant\nobject (e.|{Attrs|{{<AttributeUseImpl88416491>ID: ID}|{<AttributeUseImpl2104764160>IDREF: IDREF}|{<AttributeUseImpl1420603736>Object_State: ObjectStateTypeEnum}|{<AttributeUseImpl1399618007>Type: ObjectTypeEnum}}}}", color="red"];
ComplexTypeImpl431709193 [shape="record", label="{ObservableType|The ObservableType\nis a complex type representing\na description of a\nsingle cyber observable.|{Attrs|{{<AttributeUseImpl464554138>ID: ID}|{<AttributeUseImpl1658340521>IDREF: IDREF}|{<AttributeUseImpl1686365681>Operator: OperatorTypeEnum}}}}", color="red"];
ModelGroupImpl84277798 [shape="record", label="{sequence of}"];
ElementDecl1827130956 [shape="record", label="{Obfuscation_Technique|The Obfuscation_Technique element\nis optional and enables the\ndescription of a single potential\ntechnique an attacker could\nleverage to obfuscate the observability\nof this Observable.}", color="blue"];
ModelGroupImpl939842843 [shape="record", label="{sequence of}"];
ModelGroupImpl959580737 [shape="record", label="{sequence of}"];
ModelGroupImpl1692950636 [shape="record", label="{sequence of}"];
ElementDecl1026683572 [shape="record", label="{Contribution_Location|This field contains\ninformation describing\nthe location at which\nthe contributory activity\noccured.|{Type|string}}", color="blue"];
RestrictionSimpleTypeImpl1590505011 [shape="record", label="{RegexSyntaxEnum|The RegexSyntaxEnum\ntype is a non-exhaustive\nenumeration of Regular\nExpression (Regex)\nsyntaxes.|{Variety|atomic}|{Enum|{POSIX BRE|Perl 5.x|.NET|PCRE|Python|Tcl ARE|GNU ERE|XPath}|{POSIX ERE|JGSoft|Java|ECMA|Ruby|GNU BRE|XML|}}}", color="darkgreen"];
ComplexTypeImpl1586086166 [shape="record", label="{(anonymous)}", color="red"];
ComplexTypeImpl1753137192 [shape="record", label="{(anonymous)}", color="red"];
ModelGroupImpl93343904 [shape="record", label="{sequence of}"];
ModelGroupImpl496432309 [shape="record", label="{sequence of}"];
ComplexTypeImpl765432035 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl1526115339 [shape="record", label="{Object|The Object element identifies\nand specificies the characteristics\nof a specific cyber-relevant\nobject (e.}", color="blue"];
RestrictionSimpleTypeImpl927449563 [shape="record", label="{ToolTypeEnum|ToolTypeEnum is a (non-exhaustive)\nenumeration of cyber\nobservation source\ntool types.|{Variety|atomic}|{Enum|{NIDS|HIPS|Proxy|A/V|Configuration Scanner|SEM}|{NIPS|Firewall|Gateway|DBMS Monitor|Asset Scanner|}|{HIDS|Router|SNMP/MIBS|Vulnerability Scanner|SIM|}}}", color="darkgreen"];
ElementDecl984779136 [shape="record", label="{Observables|The Observables element is\noptional and enables description\nof potential cyber observables\nthat could indicate the use\nof this particular obfuscation\ntechnique.}", color="blue"];
ElementDecl1979873666 [shape="record", label="{Action_Aliases|The Action_Aliases element\nis optional and enables\nidentification of other\npotentially used names\nfor this Action.}", color="blue"];
RestrictionSimpleTypeImpl1416444818 [shape="record", label="{(anonymous)|{Variety|atomic}}", color="darkgreen"];
RestrictionSimpleTypeImpl1742814727 [shape="record", label="{(anonymous)|{Variety|atomic}}", color="darkgreen"];
RestrictionSimpleTypeImpl1677679768 [shape="record", label="{(anonymous)|{Variety|atomic}}", color="darkgreen"];
ModelGroupImpl2137048240 [shape="record", label="{sequence of}"];
ElementDecl1289702396 [shape="record", label="{Argument_Value|The Argument_Value\nattribute specifies\nthe value for this\naction argument/parameter.|{Type|string}}", color="blue"];
ElementDecl1067398966 [shape="record", label="{Reference_PubDate|This field describes\nthe date when the\nreference was published\nYYYY.|{Type|string}}", color="blue"];
ElementDecl943980654 [shape="record", label="{Dependency_Type|This field describes\nthe type of this\ndependency instance.|{Type|string}}", color="blue"];
ModelGroupImpl10577597 [shape="record", label="{sequence of}"];
RestrictionSimpleTypeImpl282106579 [shape="record", label="{EffectTypeEnum|EffectTypeEnum is\na (non-exhaustive)\nenumeration of effect\ntypes.|{Variety|atomic}|{Enum|{State_Changed|Data_Written|Data_Received|Properties_Enumerated|ControlCode_Sent}|{Data_Read|Data_Sent|Properties_Read|Values_Enumerated|}}}", color="darkgreen"];
ModelGroupImpl2092807029 [shape="record", label="{sequence of}"];
ComplexTypeImpl1076825585 [shape="record", label="{HexBinaryObjectAttributeType|The HexBinaryObjectAttributeType\nis a complex type (extended\nfrom BaseObjectAttributeType)\nrepresenting the specification\nof a single Object attribute\nwhose core value is of type\nhexBinary.|{Attrs|{{<AttributeUseImpl804385678>Datatype: DatatypeEnum|FIXED :BinHex|FIXED :BinHex}}}}", color="red"];
ElementDecl71149648 [shape="record", label="{Data|The Data element specifies\nthe data that was sent\non the object, or from\nthe object, by the\naction.}", color="blue"];
RestrictionSimpleTypeImpl1280551684 [shape="record", label="{(anonymous)|{Variety|atomic}}", color="darkgreen"];
ElementDecl1563763559 [shape="record", label="{Action_Argument|The Action_Argument element\nis optional and enables\nthe specification of a\nsingle relevant argument/parameter\nfor this Action.}", color="blue"];
ComplexTypeImpl64212394 [shape="record", label="{(anonymous)}", color="red"];
ComplexTypeImpl101901517 [shape="record", label="{(anonymous)|{Attrs|{{<AttributeUseImpl462245018>lang: string}}}}", color="red"];
ElementDecl1501740254 [shape="record", label="{Related_Objects|The Related_Objects element\nis optional and enables the\nidentification and/or specification\nof Objects with relevant\nrelationships with this Object.}", color="blue"];
ElementDecl808021878 [shape="record", label="{Observables|The Observables element\nrepresents a collection\nof cyber observables.}", color="blue"];
RestrictionSimpleTypeImpl666249899 [shape="record", label="{(anonymous)|{Variety|atomic}}", color="darkgreen"];
ElementDecl1351477618 [shape="record", label="{Related_Object|The Related_Object element\nis optional and enables the\nidentification and/or specification\nof a single Object with a\nrelevant relationship with\nthis Object.}", color="blue"];
ElementDecl1898280583 [shape="record", label="{Action-Pertinent_Object_Attributes|The Action-Pertinent_Object_Attributes\nelement is optional and identifies\nwhich of the Attributes of\nthis Object are specifically\npertinent to this Action.}", color="blue"];
ModelGroupImpl2049101312 [shape="record", label="{sequence of}"];
ComplexTypeImpl1432094680 [shape="record", label="{DataSentEffectType|The DataSentEffectType type\nis intended to characterize\nthe effects of actions upon\nobjects where some data is\nsent, such as a byte sequence\non a socket.}", color="red"];
ComplexTypeImpl181278381 [shape="record", label="{(anonymous)}", color="red"];
ComplexTypeImpl1220876398 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl1263643664 [shape="record", label="{Phone|This field contains\na telephone number\nof this contributor.|{Type|string}}", color="blue"];
ElementDecl2092152486 [shape="record", label="{Value|The Value element\nspecifies the value\nof the property being\nread.|{Type|string}}", color="blue"];
ModelGroupImpl428746269 [shape="record", label="{choice of}"];
ModelGroupImpl950119045 [shape="record", label="{sequence of}"];
RestrictionSimpleTypeImpl561263033 [shape="record", label="{ObjectStateTypeEnum|ObjectStateTypeEnum\nis a (non-exhaustive)\nenumeration of cyber\nobservable object states.|{Variety|atomic}|{Enum|{Exists|Open|Active|Locked|Started}|{Does Not Exist|Closed|Inactive|Unlocked|Stopped}}}", color="darkgreen"];
ComplexTypeImpl1951783229 [shape="record", label="{PropertyReadEffectType|The PropertyReadEffectType type\nis intended to characterize the\neffects of actions upon objects\nwhere some specific property\nis read from an object, such\nas the current running state\nof a process.}", color="red"];
RestrictionSimpleTypeImpl257820787 [shape="record", label="{AnalysisMethodTypeEnum|AnalysisMethodTypeEnum\nis a (non-exhaustive)\nenumeration of cyber\nobservation source analysis\nmethods.|{Variety|atomic}|{Enum|{Static Analysis|Dynamic Analysis|Other}}}", color="darkgreen"];
ModelGroupImpl441502220 [shape="record", label="{sequence of}"];
ModelGroupImpl234367668 [shape="record", label="{sequence of}"];
RestrictionSimpleTypeImpl906872446 [shape="record", label="{FrequencyType|The FrequencyType is\na simple type representing\nthe characterization\nof how frequently a given\nevent/condition occurs.|{Variety|atomic}|{Enum|{Often|Sometimes|Rarely}}}", color="darkgreen"];
ComplexTypeImpl161910521 [shape="record", label="{MeasureSourceType|MeasureSourceType is a complex\ntype representing a description\nof a single cyber observation\nsource for a cyber observable\ninstance or a cyber observable\npattern.|{Attrs|{{<AttributeUseImpl71257789>AnalysisMethod: AnalysisMethodTypeEnum}|{<AttributeUseImpl2046621584>AnalysisType}|{<AttributeUseImpl836722465>Class: SourceClassTypeEnum}|{<AttributeUseImpl721120351>InformationSourceType: InformationSourceTypeEnum}|{<AttributeUseImpl2052057374>Name: string}|{<AttributeUseImpl340913998>SourceType: SourceTypeEnum}|{<AttributeUseImpl523908271>ToolType: ToolTypeEnum}}}}", color="red"];
ElementDecl1410600942 [shape="record", label="{Compiler_Informal_Description|This field contains\nthe informal description\nof this compiler\ninstance.}", color="blue"];
RestrictionSimpleTypeImpl1449171289 [shape="record", label="{DefinedArgumentNameEnum|The DefinedArgumentNameEnum\ntype is an enumeration\nof defined argument\nnames.|{Variety|atomic}|{Enum|{API|Share Mode|Destination Addresss|Control Parameter|Function Address|Control Code|Base Address}|{Creation Flags|Callback Address|Starting Address|Host Name|Options|APC Mode|}|{Access Mode|Source Address|Size (bytes)|Function Name|Transfer Flags|APC Address|}}}", color="darkgreen"];
ElementDecl248521228 [shape="record", label="{Service_Pack|This field contains\nan appropriate service\npack descriptor for\nthis tool.|{Type|string}}", color="blue"];
ComplexTypeImpl1392287019 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl240567247 [shape="record", label="{Defined_Object}", color="blue"];
RestrictionSimpleTypeImpl2138123066 [shape="record", label="{NetworkProtocolEnum|NetworkProtocolEnum\nis a (non-exhaustive)\nenumeration of network\nprotocols.|{Variety|atomic}|{Enum|{TCP/IP|DNS|HTTP|IRC|POP|SMB}|{UDP|TELNET|FTP|IDENT|IMAP|ARP}}}", color="darkgreen"];
RestrictionSimpleTypeImpl1358590116 [shape="record", label="{(anonymous)|{Variety|atomic}}", color="darkgreen"];
RestrictionSimpleTypeImpl2059580150 [shape="record", label="{LanguageType|The LanguageType is a\nsimple type representing\nthe specification of\na relevant programming\nlanguage.|{Variety|atomic}|{Enum|{C|Java|ASP.NET|Perl|Ruby|.NET|HTML}|{C++|JSP|SQL|PHP|Shell|Assembly|}|{C#|Javascript|Python|SOAP|PseudoCode|XML|}}}", color="darkgreen"];
ComplexTypeImpl1162942631 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl1864311781 [shape="record", label="{Errors|This field captures\nany errors generated\nduring the run of\nthe tool.}", color="blue"];
ElementDecl1567531625 [shape="record", label="{Relationship|The Relationship element\nis optional and enables\ndescription of a single\nother cyber observable\naction that is related\nto this Action.}", color="blue"];
ModelGroupImpl596695265 [shape="record", label="{sequence of}"];
ElementDecl1921296898 [shape="record", label="{Error_Type|This field specifies\nthe the type for\nthis tool run error.|{Type|string}}", color="blue"];
ModelGroupImpl605324898 [shape="record", label="{sequence of}"];
ElementDecl1969464096 [shape="record", label="{Build_Utility_CPE_Specification|This field contains the\nCPE specification data\nto formally define the\nbuild utility used to\nbuild this application.}", color="blue"];
ModelGroupImpl1389017172 [shape="record", label="{choice of}"];
ElementDecl123234458 [shape="record", label="{Instance}", color="blue"];
ElementDecl669870223 [shape="record", label="{Value|{Type|string}}", color="blue"];
ModelGroupDeclImpl2023306452 [shape="record", label="{Structured_Text_Group}"];
ComplexTypeImpl646286321 [shape="record", label="{DataReceivedEffectType|The DataReceivedEffectType\ntype is intended to characterize\nthe effects of actions upon\nobjects where some data is\nreceived, such as a byte\nsequence on a socket.}", color="red"];
ElementDecl67455012 [shape="record", label="{Usage_Context_Assumption|This field contains\na single usage context\nassumption for this\ntool.}", color="blue"];
ElementDecl1262404317 [shape="record", label="{Argument_Name-Undefined|The Argument_Name-Undefined\nelement is optional and utilizes\na non-standardized undefined\nname to identify/characterize\nthe specific action argument\nutilized.|{Type|string}}", color="blue"];
RestrictionSimpleTypeImpl1113757163 [shape="record", label="{PatternTypeEnum|The PatternTypeEnum\ntype is a non-exhaustive\nenumeration of potentially\nrelevant pattern types.|{Variety|atomic}|{Enum|{Regex|Binary|XPath}}}", color="darkgreen"];
ComplexTypeImpl827506119 [shape="record", label="{(anonymous)}", color="red"];
ComplexTypeImpl186829279 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl1958735194 [shape="record", label="{Start_Time|The Start_Time element\nis optional and describes\nthe starting time for\nthis cyber observation\nsource instance.|{Type|dateTime}}", color="blue"];
ComplexTypeImpl1793249458 [shape="record", label="{(anonymous)}", color="red"];
ModelGroupImpl2048950396 [shape="record", label="{sequence of}"];
ElementDecl595066677 [shape="record", label="{Dependency_Description|This field contains\na description of\nthis dependency\ninstance.}", color="blue"];
ElementDecl882055641 [shape="record", label="{Old_State|The Old_State element\nspecifies the object\nand its attributes as\nthey were before the\nstate change effect occurred.}", color="blue"];
ElementDecl729155693 [shape="record", label="{Code_Example_Language|Presentation Element: This\nelement is used to identify\nthe programming language\nbeing used in the following\nblock of Code}", color="blue"];
ElementDecl1313946977 [shape="record", label="{Discovery_Method|The Discovery_Method element is\noptional and enables descriptive\nspecification of how this Object\nwas observed (in the case of a\nCyber Observable Object instance)\nor could potentially be observed\n(in the case of a Cyber Observable\nObject pattern).}", color="blue"];
ElementDecl264587158 [shape="record", label="{Action_Name|The Action_Name element\nis optional and identifies/characterizes\nthe specific action\nperformed.}", color="blue"];
ElementDecl357784152 [shape="record", label="{Title|This field contains\nthe plain language\ndescriptive title of\nthe relevant platform.}", color="blue"];
ModelGroupImpl1253685456 [shape="record", label="{sequence of}"];
ComplexTypeImpl1701909002 [shape="record", label="{(anonymous)|{Attrs|{{<AttributeUseImpl841687127>Block_Nature}}}}", color="red"];
ComplexTypeImpl1074859057 [shape="record", label="{DataWrittenEffectType|The DataWrittenEffectType\ntype is intended to characterize\nthe effects of actions upon\nobjects where some data is\nwritten, such as to a file\nor a pipe.}", color="red"];
ComplexTypeImpl204425426 [shape="record", label="{AssociatedObjectType|The AssociatedObjectType\nis a complex type representing\nthe characterization of a\ncyber observable Object associated\nwith a given cyber observable\nAction.|{Attrs|{{<AttributeUseImpl1809025927>AssociationType}}}}", color="red"];
ElementDecl1377542617 [shape="record", label="{Event_Pool|The Event_Pool element enables\nthe description of CybOX Events\nin a space-efficient pooled manner\nwith the actual Observable structures\ndefined in the CybOX schema containing\nreferences to the pooled Event\nelements.}", color="blue"];
ElementDecl170258291 [shape="record", label="{Stateful_Measure|The Stateful Measure element\nenables specification of\na cyber observable property\nthat is statically stateful\nin nature (e.}", color="blue"];
ElementDecl2117846131 [shape="record", label="{Custom_Attributes|The Custom_Attributes element\nis optional and enables the\nspecification of a set of\ncustom Object Attributes\nthat may not be defined in\nexisting Defined_Object schemas.}", color="blue"];
ElementDecl1288520654 [shape="record", label="{Control_Code|The Control_Code element\nspecifies the actual\ncontrol code that was\nsent to the object.|{Type|string}}", color="blue"];
ModelGroupImpl1083655680 [shape="record", label="{sequence of}"];
ComplexTypeImpl1763576851 [shape="record", label="{DateTimeObjectAttributeType|The DateTimeObjectAttributeType\nis a complex type (extended\nfrom BaseObjectAttributeType)\nrepresenting the specification\nof a single Object attribute\nwhose core value is of type\nDateTime.|{Attrs|{{<AttributeUseImpl1532712380>Datatype: DatatypeEnum|FIXED :DateTime|FIXED :DateTime}}}}", color="red"];
RestrictionSimpleTypeImpl1609813596 [shape="record", label="{SourceClassTypeEnum|SourceClassTypeEnum\nis a (non-exhaustive)\nenumeration of cyber\nobservation source\nclasses.|{Variety|atomic}|{Enum|{Network|System|Software}}}", color="darkgreen"];
RestrictionSimpleTypeImpl2083397407 [shape="record", label="{AttributeTypeEnum|AttributeTypeEnum\nis a (non-exhaustive)\nenumeration of attribute\ntypes.|{Variety|atomic}|{Enum|{String|IPv4 Address|MAC Address|URI|Boolean|Hex|Subnet Mask|CVE#|CCE#}|{Int|IPv6 Address|Domain Name|Date|Duration|Octal|UUID/GUID|CWE#|CPE#}|{Float|Host Name|Path|DateTime|TimeZone|Binary|Collections|CAPEC#|Complex}}}", color="darkgreen"];
ElementDecl1115416770 [shape="record", label="{Data_Size|The Data_Size element\ncontains the size\nof the data contained\nin this element.}", color="blue"];
ElementDecl1528316710 [shape="record", label="{Defined_Name|The Defined_Name element\nis optional and utilizes\na standardized defined\nname to identify/characterize\nthe specific action performed.}", color="blue"];
RestrictionSimpleTypeImpl617839495 [shape="record", label="{(anonymous)|{Variety|atomic}}", color="darkgreen"];
ModelGroupImpl360777192 [shape="record", label="{sequence of}"];
ElementDecl1369543768 [shape="record", label="{Tool_Hash|This field contains a\nhash value computed on\nthe tool file content\nin order to verify its\nintegrity.|{Type|string}}", color="blue"];
ComplexTypeImpl218571184 [shape="record", label="{FloatObjectAttributeType|The FloatObjectAttributeType\nis a complex type (extended\nfrom BaseObjectAttributeType)\nrepresenting the specification\nof a single Object attribute\nwhose core value is of type\nFloat.|{Attrs|{{<AttributeUseImpl1832199239>Datatype: DatatypeEnum|FIXED :Float|FIXED :Float}}}}", color="red"];
ElementDecl78045353 [shape="record", label="{New_State|The New_State element\nspecifies the object\nand its attributes as\nthey are after the state\nchange effect occurred.}", color="blue"];
ElementDecl17131806 [shape="record", label="{Tool_Configuration|This field contains\ninformation describing\nthe configuration and\nusage of the tool.}", color="blue"];
ModelGroupImpl513470641 [shape="record", label="{sequence of}"];
ModelGroupImpl1431628409 [shape="record", label="{choice of}"];
ModelGroupImpl177786494 [shape="record", label="{sequence of}"];
ElementDecl1993838064 [shape="record", label="{Compiler_Version|{Type|string}}", color="blue"];
ElementDecl1131236176 [shape="record", label="{Description|The Description element\ncaptures a structured\ntext description of\nthe obfuscation technique.}", color="blue"];
ElementDecl1309293022 [shape="record", label="{Change|{Type|boolean}}", color="blue"];
RestrictionSimpleTypeImpl1732104712 [shape="record", label="{(anonymous)|{Variety|atomic}|{Enum|{Bytes|Kilobytes|Megabytes}}}", color="darkgreen"];
RestrictionSimpleTypeImpl1234403385 [shape="record", label="{(anonymous)|{Variety|list}}", color="darkgreen"];
ComplexTypeImpl1871151428 [shape="record", label="{CPESpecificationType|CPESpecificationType is a modularized\ndata type to provide a consistent\napproach to uniquesly specifying\nthe identity of a specific platform\nusing the Common Platform Enumeration\n(CPE) naming standard.|{Attrs|{{<AttributeUseImpl907851681>Name: string}|{<AttributeUseImpl391890632>xmlns_value: string}}}}", color="red"];
RestrictionSimpleTypeImpl297900313 [shape="record", label="{(anonymous)|{Variety|atomic}}", color="darkgreen"];
ComplexTypeImpl730578010 [shape="record", label="{ReferenceListType|The References_List_Type\ncontains one or more Reference\nelements, each\nof which provide further\nreading and insight into\nthe item.}", color="red"];
RestrictionSimpleTypeImpl127368091 [shape="record", label="{OperatorTypeEnum|OperatorTypeEnum\nis a (non-exhaustive)\nenumeration of operators.|{Variety|atomic}|{Enum|{AND|OR|NOT}}}", color="darkgreen"];
ComplexTypeImpl779185335 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl707051434 [shape="record", label="{Error_Count|This field specifies\nthe count of instances\nfor this error in\nthe tool run.|{Type|anyType}}", color="blue"];
ComplexTypeImpl733847011 [shape="record", label="{(anonymous)}", color="red"];
ComplexTypeImpl1608577782 [shape="record", label="{DefinedEffectType|{Attrs|{{<AttributeUseImpl418521695>EffectType: EffectTypeEnum}}}}", color="red"];
RestrictionSimpleTypeImpl1046574468 [shape="record", label="{(anonymous)|{Variety|list}}", color="darkgreen"];
ComplexTypeImpl1781335171 [shape="record", label="{(anonymous)}", color="red"];
ComplexTypeImpl169776139 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl1854022989 [shape="record", label="{Compiler_CPE_Specification|This field contains\nthe CPE specification\ndata to formally define\nthis compiler instance.}", color="blue"];
ElementDecl1564907096 [shape="record", label="{System}", color="blue"];
ComplexTypeImpl534956479 [shape="record", label="{(anonymous)}", color="red"];
ComplexTypeImpl691523728 [shape="record", label="{PersonnelType|PersonnelType is an\nabstracted data type\nto standardize the\ndescription of sets\nof personnel.}", color="red"];
RestrictionSimpleTypeImpl1781793025 [shape="record", label="{InformationSourceTypeEnum|InformationSourceTypeEnum\nis a (non-exhaustive)\nenumeration of cyber\nobservation information\nsource types.|{Variety|atomic}|{Enum|{Comm Logs|Web Logs|OS/Device Driver APIs|VM Hypervisor|Application Framework|Incident Management|TIPS}|{Application Logs|DBMS Log|Frameworks|TPM|Help Desk|CDS|IAVM}}}", color="darkgreen"];
ComplexTypeImpl249333483 [shape="record", label="{(anonymous)|{Attrs|{{<AttributeUseImpl433647970>units}}}}", color="red"];
UnionSimpleTypeImpl1406417406 [shape="record", label="{(anonymous)|{Variety|list}}", color="darkgreen"];
ElementDecl1233188165 [shape="record", label="{Email|This field contains\nthe email of this\ncontributor.|{Type|string}}", color="blue"];
ElementDecl1792263773 [shape="record", label="{Properties|The Properties element\nspecifies the properties\nthat were enumerated\nas a result of the action\non the object.}", color="blue"];
ElementDecl1120194637 [shape="record", label="{Internationalization_Settings|This field contains\ninformation describing\nrelevant internationalization\nsetting for this tool\n.}", color="blue"];
ElementDecl2131684134 [shape="record", label="{Dependency|This field contains\ninformation describing\na single dependency\nfor this tool.}", color="blue"];
UnionSimpleTypeImpl134154804 [shape="record", label="{(anonymous)|{Variety|list}}", color="darkgreen"];
ComplexTypeImpl249253794 [shape="record", label="{ConfigurationSettingsType|Configuration_SettingsType is a\nmodularized data type used throughout\nthe SAFES schema to provide a consistent\napproach to describing configuration\nsettings for a piece of the piece\nof software such as the application\ncomponents (framework, web server}", color="red"];
ElementDecl504396287 [shape="record", label="{Role|This field describes\nthe role played\nby this contributor.|{Type|string}}", color="blue"];
ModelGroupImpl873551122 [shape="record", label="{sequence of}"];
ModelGroupImpl1424720911 [shape="record", label="{choice of}"];
UnionSimpleTypeImpl1208495415 [shape="record", label="{RangeValueType|The RangeValueType simple\ntype is a union of datatypes\napplicable for use in\nspecifiying a value range.|{Variety|list}}", color="darkgreen"];
ElementDecl1101730224 [shape="record", label="{Obfuscation_Techniques|The Obfuscation_Techniques\nelement is optional and enables\nthe description of potential\ntechniques an attacker could\nleverage to obfuscate the observability\nof this Observable.}", color="blue"];
ModelGroupImpl1083228271 [shape="record", label="{sequence of}"];
ComplexTypeImpl1155557696 [shape="record", label="{DataReadEffectType|The DataReadEffectType type\nis intended to characterize\nthe effects of actions upon\nobjects where some data is\nread, such as from a file\nor a pipe.}", color="red"];
ComplexTypeImpl367145653 [shape="record", label="{StateChangeEffectType|The StateChangeEffectType\nis intended as a generic\nway of characterizing the\neffects of actions upon objects\nwhere the some state of the\nobject is changed.}", color="red"];
ComplexTypeImpl213438621 [shape="record", label="{(anonymous)}", color="red"];
ModelGroupImpl1285541986 [shape="record", label="{sequence of}"];
ElementDecl666652360 [shape="record", label="{Received_Time|The Received_Time element\nis optional and describes\nthe time that this cyber\nobservation source instance\nwas received.|{Type|dateTime}}", color="blue"];
ModelGroupImpl572511714 [shape="record", label="{sequence of}"];
RestrictionSimpleTypeImpl1774239462 [shape="record", label="{(anonymous)|{Variety|list}}", color="darkgreen"];
ElementDecl1023038718 [shape="record", label="{SubDatum}", color="blue"];
ElementDecl673532189 [shape="record", label="{Text_Title|Presentation Element:\nThis element is used\nto definebold-faced title\nfor a subsequent block\nof text.|{Type|string}}", color="blue"];
RestrictionSimpleTypeImpl1870207216 [shape="record", label="{(anonymous)|{Variety|atomic}}", color="darkgreen"];
ElementDecl1156207713 [shape="record", label="{Build_Version|This field contains\nthe appropriate version\ndescriptor of this\nbuild of this application\ninstance.|{Type|string}}", color="blue"];
ComplexTypeImpl2010296347 [shape="record", label="{TimeObjectAttributeType|The TimeObjectAttributeType\nis a complex type (extended\nfrom BaseObjectAttributeType)\nrepresenting the specification\nof a single Object attribute\nwhose core value is of type\ntime.|{Attrs|{{<AttributeUseImpl1230588552>Datatype: DatatypeEnum|FIXED :DateTime|FIXED :DateTime}}}}", color="red"];
ComplexTypeImpl1909350010 [shape="record", label="{(anonymous)}", color="red"];
ComplexTypeImpl1684172754 [shape="record", label="{(anonymous)}", color="red"];
ModelGroupImpl665861146 [shape="record", label="{sequence of}"];
ModelGroupImpl988943951 [shape="record", label="{sequence of}"];
ElementDecl1549737032 [shape="record", label="{Description|The Description element\nprovides a mechanism\nto specify a structured\ntext description of this\nEvent.}", color="blue"];
ElementDecl1884603565 [shape="record", label="{Action|The Action element\nenables description/specification\nof a single cyber observable\naction.}", color="blue"];
ElementDecl2017787826 [shape="record", label="{Name|This field contains\nthe name of this\ncontributor.|{Type|string}}", color="blue"];
ModelGroupImpl1974044733 [shape="record", label="{sequence of}"];
UnionSimpleTypeImpl1862532266 [shape="record", label="{(anonymous)|{Variety|list}}", color="darkgreen"];
ElementDecl263851830 [shape="record", label="{Version|This field contains\nan appropriate version\ndescriptor of this\ntool.|{Type|string}}", color="blue"];
ElementDecl46712790 [shape="record", label="{Configuration_Setting|This field contains\na single configuration\nsetting instance.}", color="blue"];
ComplexTypeImpl1625168778 [shape="record", label="{ValuesEnumeratedEffectType|The ValuesEnumeratedEffectType\ntype is intended to characterize\nthe effects of actions upon\nobjects where some values of\nthe object are enumerated,\nsuch as the values of a registry\nkey.}", color="red"];
RestrictionSimpleTypeImpl1550766882 [shape="record", label="{(anonymous)|{Variety|atomic}}", color="darkgreen"];
RestrictionSimpleTypeImpl939355114 [shape="record", label="{EventTypeEnum|EventTypeEnum is\na (non-exhaustive)\nenumeration of cyber\nobservable event\ntypes.|{Variety|atomic}|{Enum|{File Ops (CRUD)|Thread Mgt|Port Scan|IPC|HTTP Traffic|Anomoly Events|Autorun|Redirection|Basic System Ops}|{Registry Ops|Service Mgt|IP Ops|Configuration Management|App Layer Traffic|Technical Compliance|USB/Media Detection|Authentication Ops|Signature Detection}|{Memory Ops|Session Mgt|DNS Lookup Ops|User/Password Mgt|Packet Traffic|Procedural Compliance|SQL|Authorization (ACL)|Auto-update Ops}|{Process Mgt|API Calls|Socket Ops|Account Ops (App Layer)|Data Flow|GUI/KVM|DHCP|Privilege Ops|Application Logic}}}", color="darkgreen"];
ModelGroupImpl1893413681 [shape="record", label="{sequence of}"];
ElementDecl1210507212 [shape="record", label="{Organization|This field contains\nthe organization\nname of this contributor.|{Type|string}}", color="blue"];
ElementDecl342983234 [shape="record", label="{Dependencies|This field contains\ninformation describing\nthe relevant dependencies\nfor this tool.}", color="blue"];
ComplexTypeImpl2066253024 [shape="record", label="{BaseObjectAttributeType|The BaseObjectAttibuteType\nis a complex type representing\na common typing foundation\nfor the specification of\na single Object Attribute.|{Attrs|{{<AttributeUseImpl1224577418>Condition: ConditionTypeEnum}|{<AttributeUseImpl2091197094>Datatype: DatatypeEnum|DEFAULT :String|DEFAULT :String}|{<AttributeUseImpl678984726>EndRange: RangeValueType}|{<AttributeUseImpl88119371>ID: ID}|{<AttributeUseImpl1406035614>IDREF: IDREF}|{<AttributeUseImpl330512910>PatternType: PatternTypeEnum}|{<AttributeUseImpl288109351>RegexSyntax: RegexSyntaxEnum}|{<AttributeUseImpl1661944297>StartRange: RangeValueType}|{<AttributeUseImpl1813612981>ValueSet: string}}}}", color="red"];
ModelGroupImpl921745400 [shape="record", label="{sequence of}"];
ElementDecl1008714150 [shape="record", label="{Configuration_Settings|This field describes\nthe configuration\nsettings of this\ntool instance.}", color="blue"];
RestrictionSimpleTypeImpl621631806 [shape="record", label="{ObjectRelationshipEnum|ObjectRelationshipEnum\nis a (non-exhaustive)\nenumeration of interobject\nrelationships.|{Variety|atomic}|{Enum|{Created_By|Written_To_By|Uploaded_By|Closed_By|Moved_To|Initialized_To|Received_From|Properties_Queried_By|Killed_By|Unpacked_By|Compressed_By|Merged_Into|Unhooked_By|Renamed_To|Deleted_From|Parent_Of|Installed_By}|{Deleted_By|Downloaded_From|Suspended_By|Copied_From|Moved_By|Initialized_By|Received_By|Values_Enumerated|Encrypted_By|Packed_By|Decompressed_Into|Merged_By|Monitored_By|Renamed_By|Loaded_Into|Child_Of|}|{Properties_Modified_By|Downloaded_To|Paused_By|Copied_To|Searched_For|Sent_To|Mapped_Into|Values_Enumerated_By|Encrypted_To|Encoded_By|Decompressed_By|Locked_By|Listened_On|Injected_Into|Loaded_From|Related_To|}|{Read_From|Downloaded_By|Resumed_By|Copied_By|Searched_For_By|Sent_From|Mapped_By|Bound_By|Decrypted_By|Decoded_By|Joined_By|Unlocked_By|Listened_On_By|Injected_As|Set_To|Dropped_By|}|{Read_From_By|Uploaded_To|Opened_By|Moved_From|Allocated_By|Sent_By|Properties_Queried|Freed_By|Decrypted_To|Compressed_Into|Joined_Into|Hooked_By|Renamed_From|Injected_By|Resolved_To|Contained_Within|}}}", color="darkgreen"];
RestrictionSimpleTypeImpl2097086015 [shape="record", label="{RelationshipTypeEnum|RelationshipTypeEnum\nis a (non-exhaustive)\nenumeration of types\nof relationships between\ncyber observable elements.|{Variety|atomic}|{Enum|{Parent_Of|Preceded_By|Downloaded_From|Dropped_By|Installed_By|Resolves_To}|{Child_Of|Followed_By|Related_To|Contained_Within|Dependent_On|}}}", color="darkgreen"];
RestrictionSimpleTypeImpl1223039541 [shape="record", label="{EmptyStringType|The EmptyStringType\nsimple type is a restriction\nof the built-in string\nsimpleType.|{Variety|atomic}|{Facets|{{maxLength|0}}}}", color="darkgreen"];
ElementDecl148643588 [shape="record", label="{Code|Presentation Element:\nThis element is used\nto define a line\nof code.|{Type|string}}", color="blue"];
ElementDecl1818470177 [shape="record", label="{Action_Reference|The Action_Reference\nelement captures\nreferences to other\nActions.}", color="blue"];
ElementDecl572844677 [shape="record", label="{Frequency}", color="blue"];
ComplexTypeImpl1328853118 [shape="record", label="{DoubleObjectAttributeType|The DoubleObjectAttributeType\nis a complex type (extended\nfrom BaseObjectAttributeType)\nrepresenting the specification\nof a single Object attribute\nwhose core value is of type\nDouble.|{Attrs|{{<AttributeUseImpl1191940729>Datatype: DatatypeEnum|FIXED :Double|FIXED :Double}}}}", color="red"];
ModelGroupImpl2081655907 [shape="record", label="{sequence of}"];
UnionSimpleTypeImpl1454691228 [shape="record", label="{(anonymous)|{Variety|list}}", color="darkgreen"];
ComplexTypeImpl271544990 [shape="record", label="{(anonymous)}", color="red"];
ModelGroupImpl1860295362 [shape="record", label="{choice of}"];
ElementDecl1760388653 [shape="record", label="{Reference_Edition|This element identifies\nthe edition of the material\nbeing\nreferenced in the event\nthat multiple editions\nof the material exist.|{Type|string}}", color="blue"];
ElementDecl281756367 [shape="record", label="{Produced_Time|The Produced_Time element\nis optional and describes\nthe time that this cyber\nobservation source instance\nwas produced.|{Type|dateTime}}", color="blue"];
ElementDecl1002500837 [shape="record", label="{Attribute|The Attribute element\nenables the specification\nof a single Object\nAttribute.}", color="blue"];
UnionSimpleTypeImpl1691703686 [shape="record", label="{(anonymous)|{Variety|list}}", color="darkgreen"];
ModelGroupImpl1686296067 [shape="record", label="{sequence of}"];
ComplexTypeImpl1027361801 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl1295807352 [shape="record", label="{Event|The Event element enables\nspecification of a cyber\nobservable event that is\ndynamic in nature with specific\naction(s) taken against specific\ncyber relevant objects (e.}", color="blue"];
ModelGroupImpl108681753 [shape="record", label="{sequence of}"];
ComplexTypeImpl368345698 [shape="record", label="{UnsignedIntObjectAttributeType|The UnsignedIntObjectAttributeType\nis a complex type (extended\nfrom BaseObjectAttributeType)\nrepresenting the specification\nof a single Object attribute\nwhose core value is of type\nUnsignedInt.|{Attrs|{{<AttributeUseImpl1925661675>Datatype: DatatypeEnum|FIXED :UnsignedInt|FIXED :UnsignedInt}}}}", color="red"];
RestrictionSimpleTypeImpl839710315 [shape="record", label="{DatatypeEnum|DataTypeEnum is\na (non-exhaustive)\nenumeration of\ndata types.|{Variety|atomic}|{Enum|{String|IPv6 Address|Path|UnsignedInt|Long|TimeZone|Octal|UUID/GUID|CAPEC#|Base64Binary}|{Int|Host Name|URI|DateTime|UnsignedLong|NonNegativeInteger|Binary|Collections|CCE#|}|{Float|MAC Address|Date|Boolean|Duration|Hex|BinHex|CVE#|CPE#|}|{IPv4 Address|Domain Name|PositiveInteger|Name|Double|AnyURI|Subnet Mask|CWE#|Complex|}}}", color="darkgreen"];
ElementDecl533262289 [shape="record", label="{Description|The Description element\nprovides a mechanism\nto specify a structured\ntext description of this\nObservable.}", color="blue"];
ElementDecl499054983 [shape="record", label="{Event}", color="blue"];
RestrictionSimpleTypeImpl926681939 [shape="record", label="{(anonymous)|{Variety|list}}", color="darkgreen"];
ElementDecl107586763 [shape="record", label="{Compiler|This field describes\na single compiler utilized\nduring this build of\nthis application.}", color="blue"];
ComplexTypeImpl1054706169 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl1920333239 [shape="record", label="{Item_Description|This field contains a\ndescription of the configuration\nitem referenced in this\nconfiguration setting\ninstance.|{Type|string}}", color="blue"];
ComplexTypeImpl2106971390 [shape="record", label="{SendControlCodeEffectType|The SendControlCodeEffectType\nis intended to characterize\nthe effects of actions upon\nobjects where some control\ncode, or other control-oriented\ncommunication signal, is sent\nto the object.}", color="red"];
ComplexTypeImpl1536647185 [shape="record", label="{ActionRelationshipType|The ActionRelationshipType\nis a complex type characterizing\na relationship between a\nspecified cyber observable\naction and another cyber\nobservable action.|{Attrs|{{<AttributeUseImpl666157527>Type}}}}", color="red"];
ElementDecl1408732008 [shape="record", label="{Data|The Data element specifies\nthe data that was received\non the object, or from\nthe object, by the action.}", color="blue"];
ElementDecl786665924 [shape="record", label="{Description|The Description element\nprovides a mechanism\nto specify a structured\ntext description of this\nStateful Measure.}", color="blue"];
ComplexTypeImpl378423301 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl36987345 [shape="record", label="{Object_Pool|The Object_Pool element enables\nthe description of CybOX Objects\nin a space-efficient pooled manner\nwith the actual Observable structures\ndefined in the CybOX schema containing\nreferences to the pooled Object\nelements.}", color="blue"];
RestrictionSimpleTypeImpl1888765668 [shape="record", label="{ActionTypeEnum|ActionTypeEnum is a\n(non-exhaustive) enumeration\nof cyber observable\naction types.|{Variety|atomic}|{Enum|{Accept|Assign|Call|Compress|Create|Depress|Drop|Filter|Hook|Kill|Logout/Logoff|Pack|Read|Restore|Search|Stop|Unhook|Update}|{Access/Open|Audit|Clean|Configure|Decode|Detect|Encode|Find|Initialize|Listen|Map|Press|Receive|Resume|Send|Suspend/Pause|Unload|Upgrade}|{Alert|Backup|Click|Connect|Decompress|Disconnect|Encrypt|Fork|Install|Load|Merge|Quarantine|Release|Save|Set|Synchronize|Unlock|Upload}|{Allocate|Bind|Close|Control|Decrypt|Download|Enumerate|Free|Interleave|Lock|Modify|Query|Remove/Delete|Scan|Snapshot|Throw/Raise|Unmap|Wipe/Destroy/Purge}|{Archive|Block|Compare|Copy/Duplicate|Deny|Draw|Execute|Get|Join|Login/Logon|Move|Queue|Replicate|Schedule|Start|Transmit|Unpack|Write}}}", color="darkgreen"];
ElementDecl211201404 [shape="record", label="{Internal_Strings|This field contains a\nsingle internal string\ninstance for this internationalization\nsetting instance.}", color="blue"];
ElementDecl843607261 [shape="record", label="{Producer-Observer|The Producer-Observer element\nis optional and enables descriptive\nspecification of how this Event\nwas observed (in the case of a\nCyber Observable Event instance)\nor could potentially be observed\n(in the case of a Cyber Observable\nEvent pattern).}", color="blue"];
ElementDecl2018147830 [shape="record", label="{Associated_Objects|The Associated_Objects element\nis optional and enables the\ndescription/specification\nof cyber Objects relevant\n(either initiating or affected\nby) this Action.}", color="blue"];
ElementDecl1237624300 [shape="record", label="{Name|The Name element\nspecifies the Name\nof the property\nbeing read.|{Type|string}}", color="blue"];
ComplexTypeImpl955147905 [shape="record", label="{ObservablesType|The ObservablesType\nis a complex type representing\na collection of cyber\nobservables.}", color="red"];
ElementDecl1241553584 [shape="record", label="{Error|This field captures\na single type of\nerror generated during\nthe run of the tool.}", color="blue"];
ComplexTypeImpl50600054 [shape="record", label="{(anonymous)}", color="red"];
RestrictionSimpleTypeImpl1409826334 [shape="record", label="{(anonymous)|{Variety|atomic}|{Enum|{Preceded_By|Related_To}|{Followed_By|Dependent_On}}}", color="darkgreen"];
ModelGroupImpl1206375683 [shape="record", label="{sequence of}"];
ElementDecl828432489 [shape="record", label="{Contributor|This field contains information\ndescribing the identify,\nresources and timing\nof involvement for a\nsingle contributor.}", color="blue"];
RestrictionSimpleTypeImpl1258351596 [shape="record", label="{(anonymous)|{Variety|atomic}|{Enum|{Binary|Text}|{Hexadecimal|Other}}}", color="darkgreen"];
ModelGroupImpl259650411 [shape="record", label="{choice of}"];
ModelGroupImpl1726531547 [shape="record", label="{sequence of}"];
ComplexTypeImpl523732435 [shape="record", label="{RelatedObjectType|{Attrs|{{<AttributeUseImpl832310230>Relationship}}}}", color="red"];
ElementDecl211225614 [shape="record", label="{Compilers|This field describes\nthe compilers utilized\nduring this build of\nthis application.}", color="blue"];
ModelGroupImpl305666716 [shape="record", label="{sequence of}"];
ElementDecl1755221044 [shape="record", label="{Image_Title|This element\nprovides a title\nfor the image.|{Type|string}}", color="blue"];
ComplexTypeImpl918201446 [shape="record", label="{PositiveIntegerObjectAttributeType|The PositiveIntegerObjectAttributeType\nis a complex type (extended from\nBaseObjectAttributeType) representing\nthe specification of a single\nObject attribute whose core value\nis of type PositveInteger.|{Attrs|{{<AttributeUseImpl1347941759>Datatype: DatatypeEnum|FIXED :PositiveInteger|FIXED :PositiveInteger}}}}", color="red"];
ModelGroupImpl1327161015 [shape="record", label="{sequence of}"];
ModelGroupImpl547527790 [shape="record", label="{sequence of}"];
ComplexTypeImpl1244375180 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl259549756 [shape="record", label="{Image_Location|This element provides\nthe location of\nthe image file.|{Type|string}}", color="blue"];
ModelGroupImpl1068896286 [shape="record", label="{sequence of}"];
ElementDecl424581201 [shape="record", label="{Error_Instance|This field captures\nthe actual error output\nfor a single instance\nof this type of error.|{Type|string}}", color="blue"];
RestrictionSimpleTypeImpl281794780 [shape="record", label="{(anonymous)|{Variety|atomic}|{Enum|{Initiating|Utilized}|{Affected|Returned}}}", color="darkgreen"];
ElementDecl1134827548 [shape="record", label="{Argument_Name-Defined|The Argument_Name-Defined\nelement is optional and utilizes\na standardized defined name\nto identify/characterize\nthe specific action argument\nutilized.}", color="blue"];
ElementDecl311732802 [shape="record", label="{Trend}", color="blue"];
ElementDecl46635017 [shape="record", label="{Defined_Object|The Defined_Object element\nis an abstract placeholder\nfor various predefined\nObject type schemas (e.}", color="blue"];
ComplexTypeImpl574472509 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl1406860207 [shape="record", label="{Build_Project|This field contains\nthe project name\nof this build of\nthis application\ninstance.|{Type|string}}", color="blue"];
ComplexTypeImpl169081233 [shape="record", label="{DefinedObjectType}", color="red"];
ComplexTypeImpl1352134125 [shape="record", label="{DateObjectAttributeType|The DateObjectAttributeType\nis a complex type (extended\nfrom BaseObjectAttributeType)\nrepresenting the specification\nof a single Object attribute\nwhose core value is of type\nDate.|{Attrs|{{<AttributeUseImpl1957655256>Datatype: DatatypeEnum|FIXED :Date|FIXED :Date}}}}", color="red"];
ModelGroupImpl817101240 [shape="record", label="{sequence of}"];
ElementDecl1720854532 [shape="record", label="{Vendor|This field contains\ninformation identifying\nthe vendor organization\nfor this tool.|{Type|string}}", color="blue"];
ElementDecl2000442639 [shape="record", label="{Key|This field contains\nthe actual key of\nthis internal string\ninstance.|{Type|string}}", color="blue"];
ElementDecl2097953288 [shape="record", label="{End_Time|The End_Time element\nis optional and describes\nthe ending time for this\ncyber observation source\ninstance.|{Type|dateTime}}", color="blue"];
ModelGroupImpl936197591 [shape="record", label="{sequence of}"];
ElementDecl424838461 [shape="record", label="{Date|This field contains\na description (bounding)\nof the timing of this\ncontributor\'s involvement.}", color="blue"];
ComplexTypeImpl511811991 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl1833210619 [shape="record", label="{End_Date|This field contains\nthe end date for\nthis contributor\'s\ninvolvement.|{Type|date}}", color="blue"];
RestrictionSimpleTypeImpl1830423861 [shape="record", label="{(anonymous)|{Variety|atomic}}", color="darkgreen"];
RestrictionSimpleTypeImpl1868864324 [shape="record", label="{ConditionTypeEnum|ConditionTypeEnum\nis a (non-exhaustive)\nenumeration of condition\ntypes.|{Variety|atomic}|{Enum|{Equals|DoesNotContain|GreaterThan|LessThanOrEqual|IsInSet|BitwiseAnd}|{DoesNotEqual|StartsWith|GreaterThanOrEqual|IsInRange|IsNotInSet|BitwiseOr}|{Contains|EndsWith|LessThan|IsNotInRange|FitsPattern|}}}", color="darkgreen"];
RestrictionSimpleTypeImpl1719451110 [shape="record", label="{ActionContextTypeEnum|ActionContextTypeEnum\nis a (non-exhaustive)\nenumeration of cyber\nobservable action contexts.|{Variety|atomic}|{Enum|{Host|Network}}}", color="darkgreen"];
ComplexTypeImpl1848378367 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl1586831707 [shape="record", label="{Item_Type|This field contains the\ntype of the configuration\nitem referenced in this\nconfiguration setting\ninstance.|{Type|string}}", color="blue"];
ElementDecl1147629119 [shape="record", label="{Description|The Description element\ncontains a textual\ndescription of the\naction.}", color="blue"];
ElementDecl1182379154 [shape="record", label="{Attribute_Pool|The Attribute_Pool element enables\nthe description of CybOX Attributes\nin a space-efficient pooled manner\nwith the actual Observable structures\ndefined in the CybOX schema containing\nreferences to the pooled Attributes\nelements.}", color="blue"];
ModelGroupImpl1062244145 [shape="record", label="{sequence of}"];
ModelGroupImpl303556117 [shape="record", label="{sequence of}"];
ElementDecl176065613 [shape="record", label="{Metadata|This field captures\nother relevant metadata\nincluding tool-specific\nfields.}", color="blue"];
ElementDecl1265370845 [shape="record", label="{Property|{Type|string}}", color="blue"];
ElementDecl220467482 [shape="record", label="{Discovery_Method|The Discovery_Method element is\noptional and enables descriptive\nspecification of how this Action\nwas observed (in the case of a\nCyber Observable Action instance)\nor could potentially be observed\n(in the case of a Cyber Observable\nAction pattern).}", color="blue"];
ElementDecl647750325 [shape="record", label="{Image|Presentation Element:\nThis element is\nused to define\nan image.}", color="blue"];
ModelGroupImpl2102860018 [shape="record", label="{sequence of}"];
ModelGroupImpl864950435 [shape="record", label="{sequence of}"];
ModelGroupImpl1330945259 [shape="record", label="{sequence of}"];
ElementDecl1776893953 [shape="record", label="{Observable|The Observable element\nrepresents a description\nof a single cyber\nobservable.}", color="blue"];
ElementDecl22106538 [shape="record", label="{Object}", color="blue"];
ComplexTypeImpl1970237604 [shape="record", label="{(anonymous)}", color="red"];
ModelGroupImpl986381142 [shape="record", label="{sequence of}"];
ElementDecl825245763 [shape="record", label="{Text|Presentation Element:\nThis element is used\nto define a paragraph\nof text.|{Type|string}}", color="blue"];
ModelGroupImpl21006994 [shape="record", label="{sequence of}"];
ComplexTypeImpl990266173 [shape="record", label="{(anonymous)|{Attrs|{{<AttributeUseImpl1902196464>Rate: float}|{<AttributeUseImpl626917559>Scale: string}|{<AttributeUseImpl1048641931>Units: string}}}}", color="red"];
ModelGroupImpl336880250 [shape="record", label="{sequence of}"];
ComplexTypeImpl538794282 [shape="record", label="{(anonymous)|{Attrs|{{<AttributeUseImpl228832089>modification-date: dateTime}|{<AttributeUseImpl1985191693>nvd-id: integer}|{<AttributeUseImpl1810844459>status: string}|{<AttributeUseImpl724577129>xmlns-meta: string}}}}", color="red"];
RestrictionSimpleTypeImpl1902942311 [shape="record", label="{ObjectTypeEnum|ObjectTypeEnum is a\n(non-exhaustive) enumeration\nof cyber observable\nobject types.|{Variety|atomic}|{Enum|{File|Hive|Service/Daemon|IP Address|Host|Handle|Dialog|Protocol Header|ACL|Channel|Configuration|Email Message|Event|WaitableTimer}|{Directory|Process|Library|Port|Session|Heap|Parameter|Protocol Field|Role|API Call|Policy|Media|Critical Section|Volume}|{Module|Thread|Package|Protocol|Session Token|Memory Address|Authentication Token|Link|System|Environment Variable|Task|Operating System|Mailslot|Disk}|{Packet|Mutex|Pipe|AS|Account|Memory Page|Encryption Token|SQL Query|VM|Application|Malware|Query|NamedPipe|DiskPartition}|{Key/Key Group|Event|Socket|URI|Device (physical)|Window|Web Query|Database|Signature|Network|Message|Domain|Semaphore|Other}}}", color="darkgreen"];
ElementDecl1836994030 [shape="record", label="{Build_Utility|This field contains\ninformation identifying\nthe utility used to\nbuild this application.}", color="blue"];
RestrictionSimpleTypeImpl1834517285 [shape="record", label="{(anonymous)|{Variety|atomic}}", color="darkgreen"];
ElementDecl738223973 [shape="record", label="{Object}", color="blue"];
ComplexTypeImpl103468119 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl1812053476 [shape="record", label="{Reference_Title|This element identifies\nthe title of the\nmaterial beingreferenced.|{Type|string}}", color="blue"];
ModelGroupImpl198203102 [shape="record", label="{sequence of}"];
ElementDecl1224217602 [shape="record", label="{Object_IDRef|{Type|IDREF}}", color="blue"];
ElementDecl432598870 [shape="record", label="{Ease_of_Obfuscation|The Ease_of_Obfuscation element\nis optional and enables simple\ncharacterization of how easy\nit would be for an attacker\nto obfuscate the observability\nof this Observable.}", color="blue"];
ElementDecl931090363 [shape="record", label="{Data|The Data element\nspecifies the data\nthat was read from\nthe object by the\naction.}", color="blue"];
ElementDecl1267140342 [shape="record", label="{Start_Date|This field contains\nthe start date for\nthis contributor\'s\ninvolvement.|{Type|date}}", color="blue"];
ComplexTypeImpl847446306 [shape="record", label="{(anonymous)}", color="red"];
ModelGroupImpl2071611785 [shape="record", label="{sequence of}"];
ComplexTypeImpl1851406627 [shape="record", label="{(anonymous)}", color="red"];
ElementDecl1653416576 [shape="record", label="{Action}", color="blue"];
ElementDecl1230704172 [shape="record", label="{Build_Output_Log|This field contains\na capture of the\noutput log of the\nbuild process.|{Type|string}}", color="blue"];
AttGroupDeclImpl1108319296 [shape="record", label="{ObjectAttributeGroup|The ObjectAttributeGroup\nis a simple attribute\ngroup aggregating a set\nof attributes for Object\nAttributes.|{Attrs|{{<AttributeUseImpl1224577418>Condition: ConditionTypeEnum}|{<AttributeUseImpl2091197094>Datatype: DatatypeEnum|DEFAULT :String|DEFAULT :String}|{<AttributeUseImpl678984726>EndRange: RangeValueType}|{<AttributeUseImpl88119371>ID: ID}|{<AttributeUseImpl1406035614>IDREF: IDREF}|{<AttributeUseImpl330512910>PatternType: PatternTypeEnum}|{<AttributeUseImpl288109351>RegexSyntax: RegexSyntaxEnum}|{<AttributeUseImpl1661944297>StartRange: RangeValueType}|{<AttributeUseImpl1813612981>ValueSet: string}}}}"];
RestrictionSimpleTypeImpl1428983720 [shape="record", label="{(anonymous)|{Variety|atomic}}", color="darkgreen"];
ElementDecl1928066032 [shape="record", label="{Configuration_Settings|This field contains\nthe configuration settings\nfor this build of this\napplication instance.}", color="blue"];
ElementDecl1571558359 [shape="record", label="{Error_Instances|This field captures\nthe actual error output\nfor each instance of\nthis type of error.}", color="blue"];
ElementDecl995807706 [shape="record", label="{Defined_Object}", color="blue"];
ComplexTypeImpl695149991 [shape="record", label="{ActionReferenceType|ActionReferenceType\nis intended to serve\nas a method for linking\nto actions.|{Attrs|{{<AttributeUseImpl587476940>action_id: anySimpleType}}}}", color="red"];
ElementDecl433982302 [shape="record", label="{Build_Label|This field contains\nany relevant label\nfor this build of this\napplication instance.|{Type|string}}", color="blue"];
ModelGroupImpl1037994664 [shape="record", label="{sequence of}"];
ModelGroupImpl918808619 [shape="record", label="{sequence of}"];
ModelGroupImpl132863590 [shape="record", label="{sequence of}"];
UnionSimpleTypeImpl1109622806 [shape="record", label="{(anonymous)|{Variety|list}}", color="darkgreen"];
ModelGroupImpl1180694806 [shape="record", label="{sequence of}"];
RestrictionSimpleTypeImpl127861719 [shape="record", label="{(anonymous)|{Variety|list}}", color="darkgreen"];
RestrictionSimpleTypeImpl1884473012 [shape="record", label="{(anonymous)|{Variety|atomic}|{Enum|{High|Medium|Low}}}", color="darkgreen"];
ComplexTypeImpl249765427 [shape="record", label="{(anonymous)}", color="red"];
ComplexTypeImpl831013236 [shape="record", label="{StringObjectAttributeType|The StringObjectAttributeType\nis a complex type (extended\nfrom BaseObjectAttributeType)\nrepresenting the specification\nof a single Object attribute\nwhose core value is of type\nString.|{Attrs|{{<AttributeUseImpl835845122>Datatype: DatatypeEnum|FIXED :String|FIXED :String}}}}", color="red"];
RestrictionSimpleTypeImpl1572590979 [shape="record", label="{(anonymous)|{Variety|atomic}|{Enum|{Increasing|Decreasing}}}", color="darkgreen"];
ComplexTypeImpl1320403535 [shape="record", label="{(anonymous)}", color="red"];
}
subgraph clusterSchemaImpl1431814845 { label="http://cybox.mitre.org/XMLSchema/objects#SystemObject"
ModelGroupImpl356593269 [shape="record", label="{sequence of}"];
ComplexTypeImpl1393000393 [shape="record", label="{Network_Interface_Type|The Network_Interface_Type\ntype specifies information\nabout a network interface,\nsuch as its MAC address.}", color="red"];
ElementDecl1129698211 [shape="record", label="{Username|The Username element\nspecifies the name\nof the user currently\nlogged into the system.}", color="blue"];
ElementDecl1141024511 [shape="record", label="{System_Time|The System_Time element\nspecifies the system,\nor hardware, time\non the system.}", color="blue"];
ModelGroupImpl1677842826 [shape="record", label="{sequence of}"];
RestrictionSimpleTypeImpl559514551 [shape="record", label="{(anonymous)|{Variety|list}}", color="darkgreen"];
ElementDecl154082288 [shape="record", label="{Adapter|The Adapter element\nspecifies the name\nof the network adapter\nused by the network\ninterface.}", color="blue"];
ElementDecl2015820261 [shape="record", label="{BIOS_Version|The BIOS_Version\nelement specifies\nthe version of\nthe BIOS.}", color="blue"];
ModelGroupImpl2133762525 [shape="record", label="{sequence of}"];
ModelGroupImpl1572973638 [shape="record", label="{sequence of}"];
RestrictionSimpleTypeImpl1675131781 [shape="record", label="{(anonymous)|{Variety|list}}", color="darkgreen"];
ElementDecl1542466437 [shape="record", label="{DHCP_Lease_Expires|The DHCP_Lease_Expires\nelement specifies the\ndate/time that the DHCP\nlease obtained on the\nnetwork interface expires.}", color="blue"];
ElementDecl1092998686 [shape="record", label="{Total_Physical_Memory|The Total_Physical_Memory\nelement specifies the\ntotal amount of physical\nmemory present on the\nsystem, in bytes.}", color="blue"];
ElementDecl1965645800 [shape="record", label="{DHCP_Server_Address}", color="blue"];
ModelGroupImpl1359920664 [shape="record", label="{sequence of}"];
ElementDecl1342217997 [shape="record", label="{Processor_Architecture|The Processor_Architecture\nelement specifies\nthe specific architecture\n(e.}", color="blue"];
ComplexTypeImpl1240775927 [shape="record", label="{BIOS_Info_Type|The BIOS_Info_Type\ntype specifies information\nabout a system\'s\nBIOS.}", color="red"];
ElementDecl404454518 [shape="record", label="{Network_Interface}", color="blue"];
ComplexTypeImpl1579795854 [shape="record", label="{Processor_Arch_Type|Processor_Arch_Type specifies\nCPU architecture types,\nvia a union of the Processor_Arch_Enum\ntype and the atomic xs:string\ntype.|{Attrs|{{<AttributeUseImpl2077652091>Datatype: DatatypeEnum|FIXED :String|FIXED :String}}}}", color="red"];
ElementDecl2112927699 [shape="record", label="{IP_Gateway_List|The IP_Gateway_List\nelement specifies the\nlist of IP Gateways\nused by the network\ninterface.}", color="blue"];
ElementDecl915085903 [shape="record", label="{BIOS_Manufacturer|The BIOS_Manufacturer\nelement specifies\nthe manufacturer\nof the BIOS.}", color="blue"];
UnionSimpleTypeImpl1349006843 [shape="record", label="{(anonymous)|{Variety|list}}", color="darkgreen"];
ElementDecl597299179 [shape="record", label="{Install_Date|The Install_Date\nelement specifies\nthe date the operating\nsystem was installed.}", color="blue"];
SchemaImpl1431814845 [shape="record", label="{http://cybox.mitre.org/XMLSchema/objects#SystemObject}"];
ElementDecl2036741132 [shape="record", label="{Date|The Date element\nspecifies the current\ndate on the system.}", color="blue"];
ComplexTypeImpl567038057 [shape="record", label="{Bitness_Type|Bitness_Type specifies\nCPU architecture bitness,\nvia a union of the Bitness_Enum\ntype and the atomic xs:string\ntype.|{Attrs|{{<AttributeUseImpl429231097>Datatype: DatatypeEnum|FIXED :String|FIXED :String}}}}", color="red"];
ElementDecl184937327 [shape="record", label="{BIOS_Date|The BIOS_Date element\nspecifies the date\nof the bios (e.}", color="blue"];
ElementDecl1170987530 [shape="record", label="{IP_Address}", color="blue"];
ModelGroupImpl857966469 [shape="record", label="{sequence of}"];
ComplexTypeImpl290885557 [shape="record", label="{Network_Interface_List_Type|The Network_Interface_List_Type\ntype specifies information\nabout the network interfaces\npresent on the system.}", color="red"];
ElementDecl1288118851 [shape="record", label="{Uptime|The Uptime element specifies\nthe duration that represents\nthe current amount of\ntime that the system\nhas been up.}", color="blue"];
ElementDecl1377851222 [shape="record", label="{BIOS_Release_Date|The BIOS_Release_Date\nelement specifies\nthe date the BIOS\nwas released.}", color="blue"];
RestrictionSimpleTypeImpl40515936 [shape="record", label="{Bitness_Enum|The Bitness_Enum type\nis an enumeration of\nword sizes that define\nclasses of computer architectures.|{Variety|atomic}|{Enum|{32|64}}}", color="darkgreen"];
ComplexTypeImpl546579839 [shape="record", label="{System_Object_Type|The System_Object_Type\ntype is intended to characterize\ncomputer systems (as a\ncombination of both software\nand hardware).}", color="red"];
ElementDecl1913537093 [shape="record", label="{MAC|The MAC element specifies\nthe MAC or hardware\naddress of the physical\nnetwork card.}", color="blue"];
ElementDecl2041998086 [shape="record", label="{Processor|The Processor element\nspecifies the name\nof the CPU used by\nthe system.}", color="blue"];
ElementDecl846275759 [shape="record", label="{Timezone_DST|The Timezone_DST element\nspecifies the time zone\nused by the system, taking\ndaylight savings time\n(DST) into account.}", color="blue"];
ElementDecl1355224018 [shape="record", label="{IP_Gateway_Address}", color="blue"];
ComplexTypeImpl1823682260 [shape="record", label="{DHCP_Server_List_Type|The DHCP_Server_List_Type\ntype specifies a list\nof DHCP Servers, via\ntheir IP addresses.}", color="red"];
ModelGroupImpl631120219 [shape="record", label="{sequence of}"];
ElementDecl1755659748 [shape="record", label="{DHCP_Server_List|The DHCP_Server_List\nelement specifies the\nlist of DHCP servers\nused by the network\ninterface.}", color="blue"];
ElementDecl1654792719 [shape="record", label="{System}", color="blue"];
ElementDecl1069531064 [shape="record", label="{Timezone_Standard|The Timezone_Standard element\nspecifies the time zone\nused by the system, wihtout\ntaking daylight savings\ntime (DST) into account.}", color="blue"];
ComplexTypeImpl1741133836 [shape="record", label="{IP_Info_List_Type|The IP_Info_List_Type\ntype specifies a list\nof IP address/subnet\nmask pairs associated\nwith a network interface.}", color="red"];
ModelGroupImpl780638304 [shape="record", label="{sequence of}"];
ElementDecl1033806195 [shape="record", label="{Bitness|The Bitness element\nspecifies the bitness\nof the operating\nsystem (i.}", color="blue"];
ElementDecl1902059420 [shape="record", label="{Local_Time|The Local_Time\nelement specifies\nthe local time\non the system.}", color="blue"];
ModelGroupImpl223489506 [shape="record", label="{sequence of}"];
ElementDecl70630159 [shape="record", label="{IP_List|The IP_List element\nspecifies the list\nof IP addresses used\nby the network interface.}", color="blue"];
ElementDecl1604848362 [shape="record", label="{Available_Physical_Memory|The Available_Physical_Memory\nelement specifies the\namount of physical memory\navailable on the system,\nin bytes.}", color="blue"];
ElementDecl283980484 [shape="record", label="{BIOS_Serial_Number|The BIOS_Serial_Number\nelement specifies\nthe serial number\nof the BIOS.}", color="blue"];
ElementDecl1373164447 [shape="record", label="{Subnet_Mask}", color="blue"];
ElementDecl556204295 [shape="record", label="{Build_Number|The Build_Number\nelement specifies\nthe build number\nof the operating\nsystem.}", color="blue"];
ComplexTypeImpl141106670 [shape="record", label="{OS_Type|The OS_Type type\nspecifies information\nabout an operating\nsystem.}", color="red"];
ElementDecl408693285 [shape="record", label="{IP_Info|The IP_Info element\nspecifies an IP Address/Subnet\nmask entry in the\nlist.}", color="blue"];
RestrictionSimpleTypeImpl199020253 [shape="record", label="{Processor_Arch_Enum|The Processor_Arch_Enum\ntype is a (non-exhaustive)\nenumeration of computer\nprocessor architectures.|{Variety|atomic}|{Enum|{x86-32|IA-64|ARM|SPARC|eSi-RISC|Motorola 68k}|{x86-64|PowerPC|Alpha|z/Architecture|MIPS|Other}}}", color="darkgreen"];
ElementDecl1858409007 [shape="record", label="{Patch_Level|The Patch_Level element\nspecifies the patch\nlevel of the operating\nsystem.}", color="blue"];
ComplexTypeImpl1624207630 [shape="record", label="{IP_Info|The IP_Info type specifies\ninformation about the\nIP address and its associated\nsubnet mask used by a\nnetwork interface.}", color="red"];
ElementDecl1124183187 [shape="record", label="{Hostname|The Hostname element\nspecifies the hostname\nof the system.}", color="blue"];
ElementDecl1546250801 [shape="record", label="{Environment_Variable_List|The Environment_Variable_List\nelement specifies a list\nof environment variables\npresent on the operating\nsystem.}", color="blue"];
ElementDecl1809605797 [shape="record", label="{BIOS_Info|The BIOS_Info element\nspecifies information\nabout the BIOS on\nthe system.}", color="blue"];
ModelGroupImpl462947888 [shape="record", label="{sequence of}"];
UnionSimpleTypeImpl568432173 [shape="record", label="{(anonymous)|{Variety|list}}", color="darkgreen"];
ElementDecl876281732 [shape="record", label="{DHCP_Lease_Obtained|The DHCP_Lease_Obtained\nelement specifies the\ndate/time that the DHCP\nlease was obtained on\nthe network interface.}", color="blue"];
ComplexTypeImpl757856402 [shape="record", label="{IP_Gateway_List_Type|The IP_Gateway_List_Type\ntype specifies the\nIP Addresses of the\ngateways used by the\nsystem.}", color="red"];
ElementDecl1952576819 [shape="record", label="{OS|The OS element specifies\ninformation about the\noperating system installed\non the system.}", color="blue"];
ElementDecl50838797 [shape="record", label="{Network_Interface_List|The Network_Interface_List\nelement specifies the\nlist of network interfaces\npresent on the system.}", color="blue"];
ElementDecl763555691 [shape="record", label="{Description|The Description element\nspecifies the description\nof the network interface.}", color="blue"];
}
subgraph clusterSchemaImpl1500389297 { label="http://cybox.mitre.org/XMLSchema/objects#Common"
ComplexTypeImpl1205215856 [shape="record", label="{Digital_Signature_Info_Type|The Digital_Signature_Info_Type\ntype is used as a way to\nrepresent some of the basic\ninformation about a digital\nsignature.|{Attrs|{{<AttributeUseImpl1543511728>signatureexists: boolean}|{<AttributeUseImpl199156736>signatureverified: boolean}}}}", color="red"];
ElementDecl917483082 [shape="record", label="{Hash_Value|The Hash_Value\nelement specifies\nthe actual value\nof the hash.}", color="blue"];
ElementDecl1485335248 [shape="record", label="{Status|The status element\ncontains the internal\nNVD status of a\nCPE.}", color="blue"];
ModelGroupImpl344078580 [shape="record", label="{sequence of}"];
ModelGroupImpl1564136253 [shape="record", label="{sequence of}"];
ElementDecl1336205011 [shape="record", label="{Hash}", color="blue"];
ComplexTypeImpl861427365 [shape="record", label="{Hash_Type|The Hash_Type type\nis intended to\ncharacterize hash\nvalues.}", color="red"];
RestrictionSimpleTypeImpl1822459128 [shape="record", label="{Hash_Name_Enum|Hash_Name_Enum is\na (non-exhaustive)\nenumeration of hashing\nalgorithm names.|{Variety|atomic}|{Enum|{MD5|SHA1|Other}|{MD6|SHA256|}}}", color="darkgreen"];
ElementDecl1281688764 [shape="record", label="{Type|The type element\nspecifies the type\nof hash used in the\nHash_Value element.}", color="blue"];
ComplexTypeImpl752978331 [shape="record", label="{Hash_Name_Type|Hash_Name_Type specifies\nthe name of hashing algorithms,\nvia a union of the Hash_Name_Enum\ntype and the atomic xs:string\ntype.|{Attrs|{{<AttributeUseImpl2010005445>Datatype: DatatypeEnum|FIXED :String|FIXED :String}}}}", color="red"];
ElementDecl569201753 [shape="record", label="{Other_Type|The Other_Type element is used\nto specify the type of hash\nused in the Hash_Value element\nif a non-standard hashing algorithm,\none which cannot be specified\nusing the Type element, is\nused.}", color="blue"];
ElementDecl544589709 [shape="record", label="{meta-item-metadata|The meta-item-metadata\nelement aggregates the\ndescriptive metadata\nfor this CPE\nName instance.}", color="blue"];
ElementDecl1433442380 [shape="record", label="{Modification_Date|The modification-date\nelement specifies the\nlast time that any\nCPE property has been\nmodified.}", color="blue"];
ComplexTypeImpl185677346 [shape="record", label="{Environment_Variable_Type|The Environment_Variable_Type\ntype is used for representing\nenvironment variables\nusing a name/value pair.}", color="red"];
ElementDecl2083747981 [shape="record", label="{Value|The Value element\nspecifies the value\nof the environment\nvariable.}", color="blue"];