software-security
type: Ontology
identifier: software-security
version: 0.4.0
description: Software-security domain ontology — the software-facing slice of security: threats, vulnerabilities, controls, actors, indicators, supply-chain, incidents, frameworks
has namespace:
  semantic memory: semantic
  episodic memory: episodic
  procedural memory: procedural
defines entity type: attack-tactic
defines entity type: attack-mitigation
defines entity type: malware
defines entity type: vulnerability
defines entity type: weakness
defines entity type: security-control
defines entity type: threat-actor
defines entity type: attack-campaign
defines entity type: indicator-of-compromise
defines entity type: security-infrastructure
defines entity type: security-tool
defines entity type: threat-intelligence-report
defines entity type: supply-chain-risk
defines entity type: security-policy
defines entity type: security-assessment
defines entity type: poam
defines entity type: security-threat
defines entity type: security-framework
defines entity type: security-incident
defines relationship:
  attributed to: attributed_to
  categorizes: categorizes
  defines: defines
  documents: documents
  exploits: exploits
  hosts: hosts
  indicates: indicates
  mitigates threat: mitigates_threat
  mitigates: mitigates
  realizes: realizes
  tracks: tracks
  uses: uses
discovery config:
  discovery enabled: true
  confidence threshold: 0.8
  has discovery pattern: https://mif-spec.dev/ns/pattern/0
  has discovery pattern: https://mif-spec.dev/ns/pattern/1
  has discovery pattern: https://mif-spec.dev/ns/pattern/2
  has discovery pattern: https://mif-spec.dev/ns/pattern/3
  has discovery pattern: https://mif-spec.dev/ns/pattern/4
  has discovery pattern: https://mif-spec.dev/ns/pattern/5
  has discovery pattern: https://mif-spec.dev/ns/pattern/6
  has discovery pattern: https://mif-spec.dev/ns/pattern/7
  has discovery pattern: https://mif-spec.dev/ns/pattern/8
  has discovery pattern: https://mif-spec.dev/ns/pattern/9

semantic
type: Namespace
has child namespace:
  threats: threats
  vulnerabilities: vulnerabilities
  weaknesses: weaknesses
  controls: controls
  actors: actors
  indicators: indicators
  supply-chain: supply-chain

threats
type: Namespace
description: Attack tactics, malware, and threat techniques
type hint: semantic

vulnerabilities
type: Namespace
description: CVE vulnerability instances
type hint: semantic

weaknesses
type: Namespace
description: CWE weakness classes
type hint: semantic

controls
type: Namespace
description: Security controls and safeguards
type hint: semantic

actors
type: Namespace
description: Threat actors and intrusion sets
type hint: semantic

indicators
type: Namespace
description: Indicators of compromise
type hint: semantic

supply-chain
type: Namespace
description: Supply-chain (C-SCRM) risks
type hint: semantic

episodic
type: Namespace
has child namespace:
  campaigns: campaigns
  assessments: assessments

campaigns
type: Namespace
description: Attack campaigns and threat-intelligence reports
type hint: episodic

assessments
type: Namespace
description: Security assessments and audits
type hint: episodic

procedural
type: Namespace
has child namespace:
  policies: policies

policies
type: Namespace
description: Security policies and plans of action
type hint: procedural

attack-tactic
type: EntityType
base type: SemanticMemory
description: An adversary tactical objective (the why of a technique)
defines trait: mif:trait/cited
schema.org:
  required: tactic_id
  required: name
  properties:
    name:
      type: string
    tactic id:
      type: string
    shortname:
      type: string
    description:
      type: string
    external references:
      type: array
      items:
        type: string
    techniques count:
      type: integer

attack-mitigation
type: EntityType
base type: ProceduralMemory
description: A course of action that mitigates one or more ATT&CK techniques
negative example: Describes the range of techniques adversaries commonly employ to gain initial entry into a network, from social engineering via phishing to exploitation of unpatched systems and abuse of legitimate credentials.
defines trait: mif:trait/cited
schema.org:
  required: mitigation_id
  required: name
  properties:
    mitigation id:
      type: string
    name:
      type: string
    description:
      type: string
    mitigates techniques:
      type: array
      items:
        type: string
    related controls:
      type: array
      items:
        type: string

malware
type: EntityType
base type: SemanticMemory
description: A malicious software family or instance
negative example: Software features or system components that can be selectively restricted or disabled to prevent their abuse by adversaries, including legacy protocols, scripting engines, and unnecessary services.
negative example: A large-scale compromise of a third-party managed file-transfer platform used by thousands of organizations, resulting in unauthorized data access and exfiltration through exploitation of a critical software vulnerability.
negative example: Compromise of a widely-used open-source package through insertion of obfuscated malicious code in build scripts or test files, targeting a critical downstream dependency used by millions of systems.
negative example: A coordinated multi-phase attack operation targeting critical infrastructure, using wiper-style payloads and network spreading techniques to cause widespread disruptive impact across interconnected systems.
negative example: A legitimate domain registered to support a kill-switch mechanism, serving to disable or control the behavior of a self-replicating worm if the kill-switch domain can be contacted.
negative example: An extortion and encryption attack offered as a service, where criminals provide the ransomware toolkit and infrastructure in exchange for a percentage of recovery payments from victims.
negative example: Stuxnet is cataloged as malware, but researchers attribute its development to a joint US-Israel operation targeting Natanz's centrifuges, a threat-actor question, not a malware catalog entry.
defines trait: mif:trait/cited
defines trait: mif:trait/dated
defines trait: mif:trait/versioned
schema.org:
  required: name
  properties:
    name:
      type: string
    is family:
      type: boolean
    malware types:
      type: array
      items:
        type: string
    alternative label:
      type: array
      items:
        type: string
    kill chain phases:
      type: array
      items:
        type: string
    capabilities:
      type: array
      items:
        type: string
    operating system refs:
      type: array
      items:
        type: string
    implementation languages:
      type: array
      items:
        type: string
    first seen:
      type: string
      format: date-time
    last seen:
      type: string
      format: date-time

vulnerability
type: EntityType
base type: SemanticMemory
description: A CVE vulnerability instance in a product or component
negative example: An SBOM alone flags every CVE in its listed components; a VEX document, in OpenVEX or CSAF format, is what lets a vendor formally declare a finding unreachable and not affected.
defines trait: mif:trait/cited
defines trait: mif:trait/dated
schema.org:
  required: cve_id
  required: vulnerability_name
  properties:
    cve id:
      type: string
    vulnerability name:
      type: string
    weakness class:
      type: string
    cvss score:
      type: number
    affected product:
      type: string
    affected versions:
      type: array
      items:
        type: string
    published date:
      type: string
      format: date
    remediation:
      type: string

weakness
type: EntityType
base type: SemanticMemory
description: A CWE weakness class (a flaw type, distinct from a CVE instance)
defines trait: mif:trait/cited
defines trait: mif:trait/versioned
schema.org:
  required: cwe_id
  required: weakness_name
  properties:
    cwe id:
      type: string
    weakness name:
      type: string
    abstraction level:
      type: string
      enum: pillar
      enum: class
      enum: base
      enum: variant
      enum: compound
    description:
      type: string
    consequences:
      type: array
      items:
        type: string
    applicable platforms:
      type: array
      items:
        type: string
    likelihood of exploit:
      type: string
      enum: high
      enum: medium
      enum: low
      enum: unknown
    related weaknesses:
      type: array
      items:
        type: string

security-control
type: EntityType
base type: SemanticMemory
description: A security control or safeguard (the security specialization of the generic engineering-base `control`)
negative example: A prescriptive safeguard requires that code changes be reviewed and approved by a second person before merging, enforced through branch protection settings that reject pushes lacking required review status.
negative example: An allowlist-based input validation design pattern rejects any input that does not match a known-safe pattern rather than trying to blacklist dangerous patterns, reducing the risk of bypass attacks.
negative example: The failure to properly encode or sanitize user-supplied HTML and JavaScript in web application output, allowing an attacker to inject malicious scripts that execute in the browser of victim users.
defines trait: mif:trait/cited
defines trait: mif:trait/versioned
subtype of: control
schema.org:
  required: control_id
  required: control_name
  properties:
    control id:
      type: string
    control name:
      type: string
    control family:
      type: string
    objective:
      type: string
    implementation guidance:
      type: string
    baseline:
      type: string
      enum: low
      enum: moderate
      enum: high
      enum: privacy
    enhancements:
      type: array
      items:
        type: string

threat-actor
type: EntityType
base type: SemanticMemory
description: A threat actor or intrusion set
negative example: Zero-trust adoption was driven by the Colonial Pipeline breach, where one compromised VPN credential without MFA gave broad network access, a perimeter-model failure, not a threat-actor catalog entry.
negative example: Falco detects runtime threats via kernel syscall events, such as a write to /etc/shadow, filling the gap static scanners and OPA/Gatekeeper miss, it's a security tool, not a threat actor.
negative example: An organized series of coordinated attacks targeting multiple major corporations, employing sophisticated phishing and zero-day exploitation techniques to achieve intellectual property theft and surveillance access.
negative example: A tiered command-and-control infrastructure consisting of multiple staged relay servers and domain registrations designed to obscure the true location and origin of attack communications.
negative example: An attack vector leveraging weak credential validation at login endpoints, allowing unauthorized access through reuse of previously compromised username-password pairs across multiple services.
negative example: A sophisticated, state-sponsored cyberweapon designed to target industrial control systems, featuring self-propagation across USB devices and zero-day exploitation of multiple operating system components.
negative example: A continuous process of collecting, analyzing, and responding to security events and anomalies across an organization's infrastructure to detect unauthorized access, data exfiltration, and malicious activity.
negative example: A large-scale retail data breach targeting millions of customer payment card records through exploitation of inadequately segmented network architecture and unpatched point-of-sale systems.
defines trait: mif:trait/cited
defines trait: mif:trait/attributed
schema.org:
  required: name
  properties:
    name:
      type: string
    alternative label:
      type: array
      items:
        type: string
    threat actor types:
      type: array
      items:
        type: string
    roles:
      type: array
      items:
        type: string
    goals:
      type: array
      items:
        type: string
    sophistication:
      type: string
    resource level:
      type: string
    primary motivation:
      type: string
    first seen:
      type: string
      format: date-time
    last seen:
      type: string
      format: date-time

attack-campaign
type: EntityType
base type: EpisodicMemory
description: A grouping of adversarial behaviour over a period of time
defines trait: mif:trait/timeline
defines trait: mif:trait/cited
schema.org:
  required: campaign_name
  properties:
    campaign name:
      type: string
    first seen:
      type: string
      format: date-time
    last seen:
      type: string
      format: date-time
    attributed to:
      type: string
    objectives:
      type: array
      items:
        type: string
    alternative label:
      type: array
      items:
        type: string

indicator-of-compromise
type: EntityType
base type: SemanticMemory
description: An observable pattern that indicates malicious activity
defines trait: mif:trait/cited
defines trait: mif:trait/dated
schema.org:
  required: name
  required: pattern
  properties:
    name:
      type: string
    pattern:
      type: string
    pattern type:
      type: string
    pattern version:
      type: string
    valid from:
      type: string
      format: date-time
    valid until:
      type: string
      format: date-time
    indicator types:
      type: array
      items:
        type: string
    kill chain phases:
      type: array
      items:
        type: string

security-infrastructure
type: EntityType
base type: SemanticMemory
description: Adversary or defensive infrastructure (servers, domains, hosting)
alternative label: signing infrastructure
alternative label: verification infrastructure
alternative label: trust infrastructure
alternative label: package security infrastructure
example: A package manager automatically verifies a cryptographic checksum against a public transparency log before trusting a downloaded module
example: An extension marketplace now requires developer-registered private-key signing on every future upload, rejecting anything unsigned
example: An official plugin directory applies automated security review to listings but explicitly cannot verify every server a plugin might call
negative example: Enforcing mTLS at the service-mesh layer guarantees workload-identity-authenticated encryption on every internal connection, rejecting perimeter-only segmentation as insufficient against post-foothold lateral movement.
defines trait: mif:trait/cited
schema.org:
  required: name
  properties:
    name:
      type: string
    infrastructure types:
      type: array
      items:
        type: string
    alternative label:
      type: array
      items:
        type: string
    kill chain phases:
      type: array
      items:
        type: string
    first seen:
      type: string
      format: date-time
    last seen:
      type: string
      format: date-time
    description:
      type: string

security-tool
type: EntityType
base type: SemanticMemory
description: A legitimate tool that can be used by adversaries or defenders
alternative label: verification tool
alternative label: signing tool
alternative label: attestation CLI tool
alternative label: package security tool
example: A package manager's chain-of-trust verifies a signed release manifest against trusted keys before installing anything, blocking by default on failure
example: A command-line tool verifies a file's signature keylessly by pinning a certificate identity and issuer rather than a static key
example: A package manager's opt-in attestation verification wraps another CLI tool to hard-fail an install when provenance verification fails
negative example: A TLS/SSL fingerprint artifact associated with a particular remote-access framework, allowing defenders to identify command-and-control communications even when encrypted.
negative example: Cobalt Strike team servers serve both authorized red teams and criminal C2 infrastructure; defenders fingerprint them via JA3/JARM TLS and malleable-C2 beacon-interval analysis rather than default signatures.
defines trait: mif:trait/cited
defines trait: mif:trait/versioned
schema.org:
  required: name
  properties:
    name:
      type: string
    tool types:
      type: array
      items:
        type: string
    alternative label:
      type: array
      items:
        type: string
    kill chain phases:
      type: array
      items:
        type: string
    tool version:
      type: string
    description:
      type: string

threat-intelligence-report
type: EntityType
base type: EpisodicMemory
description: A curated threat-intelligence report grouping related CTI objects
negative example: Mean time to detect (MTTD) and dwell time together measure the elapsed time from when a breach occurs (or evidence of compromise is logged) to when security operations detect and confirm it, serving as a key indicator of detection capability maturity.
negative example: A sophisticated, long-duration attack operation targeting industrial control systems and critical infrastructure, employing living-off-the-land techniques and prioritizing stealth and persistence over disruptive impact.
negative example: Equifax attackers lingered roughly 76 days, exfiltrating data on nearly half the US population, leading to a $700 million FTC settlement, a report on patch-delay consequences, not a threat actor.
defines trait: mif:trait/cited
defines trait: mif:trait/dated
defines trait: mif:trait/documented
schema.org:
  required: name
  properties:
    name:
      type: string
    report types:
      type: array
      items:
        type: string
    published:
      type: string
      format: date-time
    object refs:
      type: array
      items:
        type: string
    description:
      type: string

supply-chain-risk
type: EntityType
base type: SemanticMemory
description: A cyber supply-chain (C-SCRM) supplier or component risk
alternative label: supply chain vulnerability
alternative label: dependency risk
alternative label: package supply chain threat
alternative label: software supply-chain attack
example: A package registry verifies integrity only by checksum, with no cryptographic signing yet, leaving a gap versus other language ecosystems
example: A verification command silently returned success even when no attestation existed at all, until a later patched version fixed it
example: An attacker compromised a maintainer's credentials and repointed every version tag of a widely used action to a malicious commit
defines trait: mif:trait/cited
defines trait: mif:trait/versioned
schema.org:
  required: risk_id
  required: risk_statement
  properties:
    risk id:
      type: string
    risk statement:
      type: string
    supplier name:
      type: string
    component type:
      type: string
    likelihood:
      type: string
      enum: very-low
      enum: low
      enum: moderate
      enum: high
      enum: very-high
    impact level:
      type: string
      enum: very-low
      enum: low
      enum: moderate
      enum: high
      enum: very-high
    risk response:
      type: string
      enum: accept
      enum: avoid
      enum: mitigate
      enum: share
      enum: transfer
    mitigation controls:
      type: array
      items:
        type: string

security-policy
type: EntityType
base type: ProceduralMemory
description: A security policy grounded in an OSCAL system security plan / profile
negative example: An API gateway deployed as a policy enforcement point is a design pattern where all service-to-service requests flow through a gateway that applies authentication, authorization, and rate-limiting rules before forwarding.
negative example: The implementation of multi-factor authentication across all user authentication endpoints as a required technical control for reducing unauthorized access risk through credential compromise.
negative example: Technical implementation of cryptographic algorithms and key-management procedures for protecting data at rest and in transit, including cipher-strength requirements and key-derivation practices.
defines trait: mif:trait/versioned
defines trait: mif:trait/documented
defines trait: mif:trait/cited
schema.org:
  required: policy_name
  properties:
    policy name:
      type: string
    policy version:
      type: string
    policy status:
      type: string
    system name:
      type: string
    system id:
      type: string
    authorization boundary:
      type: string
    control implementations:
      type: array
      items:
        type: string
    responsible parties:
      type: array
      items:
        type: string

security-assessment
type: EntityType
base type: EpisodicMemory
description: A security assessment, audit, or test of a system
negative example: Unlike a fixed-duration penetration test, a bug bounty program run through a platform like HackerOne or Bugcrowd operates continuously with a defined scope, an ongoing practice, not a discrete assessment.
negative example: A control runs at push time to detect credentials matching known patterns before they reach shared branches, paired with a documented incident-response runbook for when real credentials are detected as already pushed.
negative example: The metric tracking the number of open critical security findings in the backlog measures the aggregate count of unresolved vulnerabilities above a severity threshold, updated daily to reflect the current remediation queue depth.
negative example: The fail-secure design pattern ensures that when a system encounters an error or component failure, it defaults to denying access or rejecting operations rather than inadvertently granting permissions.
negative example: A security design review gate discipline requires that all architectural changes above a size threshold undergo formal security design review by the security team before implementation, documenting the threat model and mitigations.
negative example: A dual-purpose network utility that performs port scanning and service enumeration through TCP/IP-level probes, equally useful for both legitimate infrastructure inventory and attacker reconnaissance.
negative example: A behavioral pattern in Windows Event Logs showing access to the LSASS process memory in a manner consistent with credential extraction, used to identify systems with unauthorized access activity.
negative example: A documented remediation plan that schedules correction of identified compliance deficiencies against a baseline security framework, including specific actions, responsible parties, and target completion dates.
negative example: A compliance requirement from a payment-card security standard for maintaining separate network segments containing systems that store, process, or transmit cardholder data.
defines trait: mif:trait/timeline
defines trait: mif:trait/cited
defines trait: mif:trait/documented
schema.org:
  required: assessment_id
  properties:
    assessment id:
      type: string
    assessment subject:
      type: string
    assessment scope:
      type: string
    assessment activities:
      type: array
      items:
        type: string
    start date:
      type: string
      format: date
    end date:
      type: string
      format: date
    findings:
      type: array
      items:
        type: string
    risks identified:
      type: array
      items:
        type: string

poam
type: EntityType
base type: ProceduralMemory
description: A plan of action and milestones tracking risks to remediation
negative example: A coordinated vulnerability disclosure process discipline defines the steps for responsible reporting of security flaws (notification timelines, embargo periods, credit assignment) to avoid alarming users before patches are available.
defines trait: mif:trait/cited
defines trait: mif:trait/dated
defines trait: mif:trait/documented
schema.org:
  required: poam_id
  required: system_id
  properties:
    poam id:
      type: string
    system id:
      type: string
    risks:
      type: array
      items:
        type: string
    observations:
      type: array
      items:
        type: string
    poam items:
      type: array
      items:
        type: string
    milestones:
      type: array
      items:
        type: string
    remediation tracking:
      type: string
    status:
      type: string

security-threat
type: EntityType
base type: SemanticMemory
description: A security threat, attack class, or vulnerability affecting the software lifecycle (SDLC-facing supertype refined by attack-tactic/weakness/vulnerability)
alternative label: attack vector
alternative label: vulnerability
alternative label: exploit
alternative label: threat class
alternative label: injection attack
alternative label: supply chain compromise
example: Malicious instructions embedded in tool descriptions parsed as trusted context
example: Silently altering approved tool definitions to inject behavior without re-authorization
example: A command injection chain of published vulnerabilities sharing one unsanitized root cause
example: Poisoned release tags exfiltrating credentials from continuous integration
negative example: Generating an SBOM automatically at build time, rather than manually, was chosen because the Log4j incident showed exposure often traces through unexpected transitive dependencies, not itself a security threat.
negative example: Mean time to remediation (MTTR) for critical vulnerabilities measures the elapsed time from a critical vulnerability being identified to a fix being deployed to production, tracked as a team performance metric to monitor patch velocity.
negative example: Threat modeling using STRIDE is an engineering practice where teams systematically enumerate potential security threats to a system across spoofing, tampering, repudiation, information disclosure, denial of service, and elevation categories.
negative example: The improper handling of special characters in user-supplied input when constructing database queries allows attackers to manipulate query logic and gain unauthorized access to sensitive data.
negative example: A vulnerability in a transitive dependency inherited through a software package's supply chain, exposing downstream applications to exploitation even though the application itself has no direct vulnerable code.
negative example: Physical or logical isolation of security-critical network segments from general-purpose networks to limit the blast radius of a compromise and prevent lateral movement across organizational boundaries.
negative example: An exploitation framework providing payload generation, multi-stage delivery, and post-exploitation automation for penetration testers, equally valuable for defenders simulating attacks and adversaries conducting real intrusions.
defines trait: mif:trait/cited
defines trait: mif:trait/versioned
schema.org:
  required: threat_name
  required: attack_vector
  properties:
    threat name:
      type: string
    attack vector:
      type: string
      description: How the threat is exploited
    impact:
      type: string
      description: What an attacker gains or breaks
    mitigation summary:
      type: string
      description: Primary defenses against this threat
    references:
      type: array
      items:
        type: string
    attack id:
      type: string
      description: ATT&CK technique/sub-technique (e.g. T1566) or CAPEC ID
    tactic:
      type: string
      description: ATT&CK tactic / kill-chain phase
    adversary:
      type: string
      description: Intrusion set / ATT&CK Group

security-framework
type: EntityType
base type: SemanticMemory
description: A security or assurance framework, taxonomy, or standard (e.g. OWASP Top 10, MITRE ATLAS, SLSA, NIST SSDF/CSF)
alternative label: security standard
alternative label: controls framework
alternative label: vulnerability taxonomy
alternative label: assurance framework
alternative label: compliance framework
example: A peer-reviewed top-ten risk taxonomy for an emerging application class
example: A provenance standard defining leveled requirements from machine-readable to isolated builds
example: A management-system standard with a reference set of controls in an annex
example: Federal guidance organizing risk actions across govern, map, measure, and manage functions
negative example: A secure SDLC gating discipline requires that each stage of the software development lifecycle (design, development, testing, deployment) must pass defined security criteria and automated scans before proceeding to the next stage.
negative example: Under DoD RMF, a POA&M, tracked operationally in eMASS, is the remediation record an Authorizing Official reviews; RMF is the framework itself, not the POA&M.
negative example: A classification scheme for sensitive data based on compliance frameworks, including categories like public, internal-use-only, confidential, and restricted, with associated handling and protection requirements.
defines trait: mif:trait/cited
defines trait: mif:trait/versioned
defines trait: mif:trait/documented
schema.org:
  required: framework_name
  required: scope
  properties:
    framework name:
      type: string
    scope:
      type: string
      description: What the framework governs (e.g. application risk, supply-chain integrity, adversary TTPs)
    maintainer:
      type: string
      description: Organization that maintains the framework
    relationship:
      type: string
      description: How it relates to or composes with other frameworks
    version:
      type: string
      description: Framework version/edition (e.g. CSF 2.0, OWASP Top 10:2025)
    structure:
      type: string
      description: Framework structure (e.g. CSF: 6 functions / 22 categories / 106 subcategories)

security-incident
type: EntityType
base type: EpisodicMemory
description: A security breach/incident carrying the VERIS four A's (Actor + Action + Asset + Attribute)
defines trait: mif:trait/timeline
defines trait: mif:trait/stakeholders
defines trait: mif:trait/cited
schema.org:
  required: severity
  required: impact
  required: resolution
  properties:
    severity:
      type: string
      enum: critical
      enum: high
      enum: medium
      enum: low
    impact:
      type: string
    resolution:
      type: string
    actor:
      type: string
      description: VERIS Actor — external / internal / partner
    action:
      type: string
      description: VERIS Action — malware / hacking / social / error / misuse
    asset:
      type: string
      description: VERIS Asset — the device/data affected
    attribute:
      type: string
      description: VERIS Attribute — how affected (CIA)

attributed_to
type: Relationship
description: A campaign is attributed to a threat actor (stix:attributed-to)
domain: mif:entityType/attack-campaign
range: mif:entityType/threat-actor
symmetric property: false

categorizes
type: Relationship
description: A weakness class categorizes a vulnerability instance (CWE CanPrecede / rdfs:subClassOf)
domain: mif:entityType/weakness
range: mif:entityType/vulnerability
symmetric property: false

defines
type: Relationship
description: A framework defines a control (OSCAL profile import->include-controls)
domain: mif:entityType/security-framework
range: mif:entityType/security-control
symmetric property: false

documents
type: Relationship
description: A threat-intelligence report documents a campaign (STIX Report object_refs)
domain: mif:entityType/threat-intelligence-report
range: mif:entityType/attack-campaign
symmetric property: false

exploits
type: Relationship
description: Malware exploits a vulnerability (stix:exploits, Malware -> Vulnerability)
domain: mif:entityType/malware
range: mif:entityType/vulnerability
symmetric property: false

hosts
type: Relationship
description: Infrastructure hosts malware (stix:hosts, Infrastructure -> Malware)
domain: mif:entityType/security-infrastructure
range: mif:entityType/malware
symmetric property: false

indicates
type: Relationship
description: An indicator of compromise indicates malware (stix:indicates, Indicator -> Malware)
domain: mif:entityType/indicator-of-compromise
range: mif:entityType/malware
symmetric property: false

mitigates_threat
type: Relationship
description: A mitigation mitigates a threat technique (stix:mitigates, course-of-action -> attack-pattern)
domain: mif:entityType/attack-mitigation
range: mif:entityType/security-threat
symmetric property: false

mitigates
type: Relationship
description: A control mitigates a vulnerability (RO:0000056 participates-in; OSCAL control satisfies risk)
domain: mif:entityType/security-control
range: mif:entityType/vulnerability
symmetric property: false

realizes
type: Relationship
description: An incident realizes a threat (RO:0000056 participates-in)
domain: mif:entityType/security-incident
range: mif:entityType/security-threat
symmetric property: false

tracks
type: Relationship
description: A POA&M tracks a vulnerability to remediation (OSCAL poam:risks / poam-item)
domain: mif:entityType/poam
range: mif:entityType/vulnerability
symmetric property: false

uses
type: Relationship
description: A threat actor uses a security tool (stix:uses, threat-actor -> tool)
domain: mif:entityType/threat-actor
range: mif:entityType/security-tool
symmetric property: false

https://mif-spec.dev/ns/pattern/0
type: DiscoveryPattern
content pattern: \b(CVE-\d{4}-\d{4,})\b
suggests entity type: vulnerability
suggests namespace: _semantic/vulnerabilities

https://mif-spec.dev/ns/pattern/1
type: DiscoveryPattern
content pattern: \bCWE-\d+\b
suggests entity type: weakness
suggests namespace: _semantic/weaknesses

https://mif-spec.dev/ns/pattern/2
type: DiscoveryPattern
content pattern: \b(AC|AU|SC|SI|IA)-\d+\b
suggests entity type: security-control
suggests namespace: _semantic/controls

https://mif-spec.dev/ns/pattern/3
type: DiscoveryPattern
content pattern: \b(APT\d+|Lazarus Group|FIN\d+|Sandworm|Volt Typhoon)\b
suggests entity type: threat-actor
suggests namespace: _semantic/actors

https://mif-spec.dev/ns/pattern/4
type: DiscoveryPattern
content pattern: \b(Operation|Campaign)\s+[A-Z][a-zA-Z]+\b
suggests entity type: attack-campaign
suggests namespace: _episodic/campaigns

https://mif-spec.dev/ns/pattern/5
type: DiscoveryPattern
content pattern: \b(IOC|YARA|Sigma rule|STIX pattern|TLP:)\b
suggests entity type: indicator-of-compromise
suggests namespace: _semantic/indicators

https://mif-spec.dev/ns/pattern/6
type: DiscoveryPattern
content pattern: \b(supply chain|SBOM|C-SCRM)\b
suggests entity type: supply-chain-risk
suggests namespace: _semantic/supply-chain

https://mif-spec.dev/ns/pattern/7
type: DiscoveryPattern
content pattern: \b(pen test|red team|audit finding|compliance review)\b
suggests entity type: security-assessment
suggests namespace: _episodic/assessments

https://mif-spec.dev/ns/pattern/8
type: DiscoveryPattern
content pattern: \b(acceptable use policy|data classification policy)\b
suggests entity type: security-policy
suggests namespace: _procedural/policies

https://mif-spec.dev/ns/pattern/9
type: DiscoveryPattern
content pattern: \b(Mimikatz|WannaCry|Cobalt Strike|S\d{4})\b
suggests entity type: malware
suggests namespace: _semantic/threats