{
    "$id": "../sdos/intrusion-set.json",
    "$schema": "http://json-schema.org/draft-06/schema#",
    "title": "intrusion-set",
    "description": "An Intrusion Set is a grouped set of adversary behavior and resources with common properties that is believed to be orchestrated by a single organization.",
    "type": "object",
    "allOf": [
        {
            "$ref": "../common/core.json"
        },
        {
            "properties": {
                "type": {
                    "type": "string",
                    "description": "The type of this object, which MUST be the literal `intrusion-set`.",
                    "const": "intrusion-set"
                },
                "id": {
                    "title": "id",
                    "pattern": "^intrusion-set--"
                },
                "name": {
                    "type": "string",
                    "description": "The name used to identify the Intrusion Set."
                },
                "description": {
                    "type": "string",
                    "description": "Provides more context and details about the Intrusion Set object."
                },
                "aliases": {
                    "type": "array",
                    "description": "Alternative names used to identify this Intrusion Set.",
                    "items": {
                        "type": "string"
                    },
                    "minItems": 1
                },
                "first_seen": {
                    "$ref": "../common/timestamp.json",
                    "description": "The time that this Intrusion Set was first seen."
                },
                "last_seen": {
                    "$ref": "../common/timestamp.json",
                    "description": "The time that this Intrusion Set was last seen."
                },
                "goals": {
                    "type": "array",
                    "description": "The high level goals of this Intrusion Set, namely, what are they trying to do.",
                    "items": {
                        "type": "string"
                    },
                    "minItems": 1
                },
                "resource_level": {
                    "type": "string",
                    "description": "This defines the organizational level at which this Intrusion Set typically works. Open Vocab - attack-resource-level-ov"
                },
                "primary_motivation": {
                    "type": "string",
                    "description": "The primary reason, motivation, or purpose behind this Intrusion Set. Open Vocab - attack-motivation-ov"
                },
                "secondary_motivations": {
                    "type": "array",
                    "description": "The secondary reasons, motivations, or purposes behind this Intrusion Set. Open Vocab - attack-motivation-ov",
                    "items": {
                        "type": "string"
                    },
                    "minItems": 1
                }
            }
        }
    ],
    "required": [
        "name"
    ],
    "definitions": {
        "attack-resource-level-ov": {
            "type": "string",
            "enum": [
                "individual",
                "club",
                "contest",
                "team",
                "organization",
                "government"
            ]
        },
        "attack-motivation-ov": {
            "type": "string",
            "enum": [
                "accidental",
                "coercion",
                "dominance",
                "ideology",
                "notoriety",
                "organizational-gain",
                "personal-gain",
                "personal-satisfaction",
                "revenge",
                "unpredictable"
            ]
        }
    }
}