{
    "$id": "../sdos/report.json",
    "$schema": "http://json-schema.org/draft-06/schema#",
    "title": "report",
    "description": "Reports are collections of threat intelligence focused on one or more topics, such as a description of a threat actor, malware, or attack technique, including context and related details.",
    "type": "object",
    "allOf": [
        {
            "$ref": "../common/core.json"
        },
        {
            "properties": {
                "type": {
                    "type": "string",
                    "description": "The type of this object, which MUST be the literal `report`.",
                    "const": "report"
                },
                "id": {
                    "title": "id",
                    "pattern": "^report--"
                },
                "labels": {
                    "type": "array",
                    "description": "This field is an Open Vocabulary that specifies the primary subject of this report. The suggested values for this field are in report-label-ov.",
                    "items": {
                        "type": "string"
                    },
                    "minItems": 1
                },
                "name": {
                    "type": "string",
                    "description": "The name used to identify the Report."
                },
                "description": {
                    "type": "string",
                    "description": "A description that provides more details and context about Report."
                },
                "published": {
                    "$ref": "../common/timestamp.json",
                    "description": "The date that this report object was officially published by the creator of this report."
                },
                "object_refs": {
                    "type": "array",
                    "description": "Specifies the STIX Objects that are referred to by this Report.",
                    "items": {
                        "$ref": "../common/identifier.json"
                    },
                    "minItems": 1
                }
            }
        }
    ],
    "required": [
        "name",
        "labels",
        "object_refs",
        "published"
    ],
    "definitions": {
        "report-label-ov": {
            "type": "string",
            "enum": [
                "threat-report",
                "attack-pattern",
                "campaign",
                "identity",
                "indicator",
                "malware",
                "observed-data",
                "threat-actor",
                "tool",
                "vulnerability"
            ]
        }
    }
}