{
    "$id": "../sros/sighting.json",
    "$schema": "http://json-schema.org/draft-06/schema#",
    "title": "sighting",
    "description": "A Sighting denotes the belief that something in CTI (e.g., an indicator, malware, tool, threat actor, etc.) was seen.",
    "type": "object",
    "allOf": [
        {
            "$ref": "../common/core.json"
        },
        {
            "properties": {
                "type": {
                    "type": "string",
                    "description": "The type of this object, which MUST be the literal `sighting`.",
                    "const": "sighting"
                },
                "id": {
                    "title": "id",
                    "pattern": "^sighting--"
                },
                "first_seen": {
                    "$ref": "../common/timestamp.json",
                    "description": "The beginning of the time window during which the SDO referenced by the sighting_of_ref property was sighted."
                },
                "last_seen": {
                    "$ref": "../common/timestamp.json",
                    "description": "The end of the time window during which the SDO referenced by the sighting_of_ref property was sighted."
                },
                "count": {
                    "type": "integer",
                    "description": "This is an integer between 0 and 999,999,999 inclusive and represents the number of times the object was sighted.",
                    "minimum": 0,
                    "maximum": 999999999
                },
                "sighting_of_ref": {
                    "allOf": [
                        {
                            "$ref": "../common/identifier.json"
                        },
                        {
                            "not": {
                                "pattern": "^sighting--"
                            }
                        },
                        {
                            "not": {
                                "pattern": "^relationship--"
                            }
                        },
                        {
                            "not": {
                                "pattern": "^bundle--"
                            }
                        },
                        {
                            "not": {
                                "pattern": "^marking-definition--"
                            }
                        }
                    ],
                    "description": "An ID reference to the object that has been sighted."
                },
                "observed_data_refs": {
                    "type": "array",
                    "description": "A list of ID references to the Observed Data objects that contain the raw cyber data for this Sighting.",
                    "items": {
                        "allOf": [
                            {
                                "$ref": "../common/identifier.json"
                            },
                            {
                                "pattern": "^observed-data--"
                            }
                        ]
                    },
                    "minItems": 1
                },
                "where_sighted_refs": {
                    "type": "array",
                    "description": "The ID of the Victim Target objects of the entities that saw the sighting.",
                    "items": {
                        "allOf": [
                            {
                                "$ref": "../common/identifier.json"
                            },
                            {
                                "pattern": "^identity--"
                            }
                        ]
                    },
                    "minItems": 1
                },
                "summary": {
                    "type": "boolean",
                    "description": "The summary property indicates whether the Sighting should be considered summary data. "
                }
            }
        }
    ],
    "required": [
        "sighting_of_ref"
    ]
}