misp-taxonomies/veris/machinetag.json

{
  "description": "Vocabulary for Event Recording and Incident Sharing (VERIS)",
  "namespace": "veris",
  "version": 2,
  "values": [
    {
      "predicate": "iso_currency_code",
      "entry": [
        {
          "value": "DZD",
          "expanded": "DZD - Algerian Dinar"
        },
        {
          "value": "NAD",
          "expanded": "NAD - Namibia Dollar"
        },
        {
          "value": "GHS",
          "expanded": "GHS - Ghana Cedi"
        },
        {
          "value": "EGP",
          "expanded": "EGP - Egyptian Pound"
        },
        {
          "value": "BGN",
          "expanded": "BGN - Bulgarian Lev"
        },
        {
          "value": "PAB",
          "expanded": "PAB - Balboa"
        },
        {
          "value": "BOB",
          "expanded": "BOB - Boliviano"
        },
        {
          "value": "DKK",
          "expanded": "DKK - Danish Krone"
        },
        {
          "value": "BWP",
          "expanded": "BWP - Pula"
        },
        {
          "value": "LBP",
          "expanded": "LBP - Lebanese Pound"
        },
        {
          "value": "TZS",
          "expanded": "TZS - Tanzanian Shilling"
        },
        {
          "value": "VND",
          "expanded": "VND - Dong"
        },
        {
          "value": "AOA",
          "expanded": "AOA - Kwanza"
        },
        {
          "value": "KHR",
          "expanded": "KHR - Riel"
        },
        {
          "value": "MYR",
          "expanded": "MYR - Malaysian Ringgit"
        },
        {
          "value": "KYD",
          "expanded": "KYD - Cayman Islands Dollar"
        },
        {
          "value": "LYD",
          "expanded": "LYD - Libyan Dinar"
        },
        {
          "value": "UAH",
          "expanded": "UAH - Hryvnia"
        },
        {
          "value": "JOD",
          "expanded": "JOD - Jordanian Dinar"
        },
        {
          "value": "AWG",
          "expanded": "AWG - Aruban Florin"
        },
        {
          "value": "SAR",
          "expanded": "SAR - Saudi Riyal"
        },
        {
          "value": "EUR",
          "expanded": "EUR - Euro"
        },
        {
          "value": "HKD",
          "expanded": "HKD - Hong Kong Dollar"
        },
        {
          "value": "CHF",
          "expanded": "CHF - Swiss Franc"
        },
        {
          "value": "GIP",
          "expanded": "GIP - Gibraltar Pound"
        },
        {
          "value": "BYR",
          "expanded": "BYR - Belarussian Ruble"
        },
        {
          "value": "ALL",
          "expanded": "ALL - Lek"
        },
        {
          "value": "MRO",
          "expanded": "MRO - Ouguiya"
        },
        {
          "value": "HRK",
          "expanded": "HRK - Croatian Kuna"
        },
        {
          "value": "DJF",
          "expanded": "DJF - Djibouti Franc"
        },
        {
          "value": "SZL",
          "expanded": "SZL - Lilangeni"
        },
        {
          "value": "THB",
          "expanded": "THB - Baht"
        },
        {
          "value": "XAF",
          "expanded": "XAF - CFA Franc BEAC"
        },
        {
          "value": "BND",
          "expanded": "BND - Brunei Dollar"
        },
        {
          "value": "ISK",
          "expanded": "ISK - Iceland Krona"
        },
        {
          "value": "UYU",
          "expanded": "UYU - Peso Uruguayo"
        },
        {
          "value": "NIO",
          "expanded": "NIO - Cordoba Oro"
        },
        {
          "value": "LAK",
          "expanded": "LAK - Kip"
        },
        {
          "value": "SYP",
          "expanded": "SYP - Syrian Pound"
        },
        {
          "value": "MAD",
          "expanded": "MAD - Moroccan Dirham"
        },
        {
          "value": "MZN",
          "expanded": "MZN - Mozambique Metical"
        },
        {
          "value": "PHP",
          "expanded": "PHP - Philippine Peso"
        },
        {
          "value": "ZAR",
          "expanded": "ZAR - South African Rand"
        },
        {
          "value": "NPR",
          "expanded": "NPR - Nepalese Rupee"
        },
        {
          "value": "NGN",
          "expanded": "NGN - Naira"
        },
        {
          "value": "ZWD",
          "expanded": "ZWD - Zimbabwean Dollar A/06"
        },
        {
          "value": "CRC",
          "expanded": "CRC - Costa Rican Colon"
        },
        {
          "value": "AED",
          "expanded": "AED - UAE Dirham"
        },
        {
          "value": "GBP",
          "expanded": "GBP - Pound Sterling"
        },
        {
          "value": "MWK",
          "expanded": "MWK - Kwacha"
        },
        {
          "value": "LKR",
          "expanded": "LKR - Sri Lanka Rupee"
        },
        {
          "value": "PKR",
          "expanded": "PKR - Pakistan Rupee"
        },
        {
          "value": "HUF",
          "expanded": "HUF - Forint"
        },
        {
          "value": "BMD",
          "expanded": "BMD - Bermudian Dollar"
        },
        {
          "value": "LSL",
          "expanded": "LSL - Loti"
        },
        {
          "value": "MNT",
          "expanded": "MNT - Tugrik"
        },
        {
          "value": "AMD",
          "expanded": "AMD - Armenian Dram"
        },
        {
          "value": "UGX",
          "expanded": "UGX - Uganda Shilling"
        },
        {
          "value": "QAR",
          "expanded": "QAR - Qatari Rial"
        },
        {
          "value": "XDR",
          "expanded": "XDR - SDR (Special Drawing Right)"
        },
        {
          "value": "JMD",
          "expanded": "JMD - Jamaican Dollar"
        },
        {
          "value": "GEL",
          "expanded": "GEL - Lari"
        },
        {
          "value": "SHP",
          "expanded": "SHP - Saint Helena Pound"
        },
        {
          "value": "AFN",
          "expanded": "AFN - Afghani"
        },
        {
          "value": "SBD",
          "expanded": "SBD - Solomon Islands Dollar"
        },
        {
          "value": "KPW",
          "expanded": "KPW - North Korean Won"
        },
        {
          "value": "TRY",
          "expanded": "TRY - Turkish Lira"
        },
        {
          "value": "BDT",
          "expanded": "BDT - Taka"
        },
        {
          "value": "YER",
          "expanded": "YER - Yemeni Rial"
        },
        {
          "value": "HTG",
          "expanded": "HTG - Gourde"
        },
        {
          "value": "XOF",
          "expanded": "XOF - CFA Franc BCEAO"
        },
        {
          "value": "MGA",
          "expanded": "MGA - Malagasy Ariary"
        },
        {
          "value": "ANG",
          "expanded": "ANG - Netherlands Antillean Guilder"
        },
        {
          "value": "LRD",
          "expanded": "LRD - Liberian Dollar"
        },
        {
          "value": "RWF",
          "expanded": "RWF - Rwanda Franc"
        },
        {
          "value": "NOK",
          "expanded": "NOK - Norwegian Krone"
        },
        {
          "value": "MOP",
          "expanded": "MOP - Pataca"
        },
        {
          "value": "INR",
          "expanded": "INR - Indian Rupee"
        },
        {
          "value": "MXN",
          "expanded": "MXN - Mexican Peso"
        },
        {
          "value": "CZK",
          "expanded": "CZK - Czech Koruna"
        },
        {
          "value": "TJS",
          "expanded": "TJS - Somoni"
        },
        {
          "value": "TWD",
          "expanded": "TWD - New Taiwan Dollar"
        },
        {
          "value": "BTN",
          "expanded": "BTN - Ngultrum"
        },
        {
          "value": "COP",
          "expanded": "COP - Colombian Peso"
        },
        {
          "value": "TMT",
          "expanded": "TMT - Turkmenistan New Manat"
        },
        {
          "value": "MUR",
          "expanded": "MUR - Mauritius Rupee"
        },
        {
          "value": "IDR",
          "expanded": "IDR - Rupiah"
        },
        {
          "value": "HNL",
          "expanded": "HNL - Lempira"
        },
        {
          "value": "XPF",
          "expanded": "XPF - CFP Franc"
        },
        {
          "value": "FJD",
          "expanded": "FJD - Fiji Dollar"
        },
        {
          "value": "ETB",
          "expanded": "ETB - Ethiopian Birr"
        },
        {
          "value": "PEN",
          "expanded": "PEN - Nuevo Sol"
        },
        {
          "value": "BZD",
          "expanded": "BZD - Belize Dollar"
        },
        {
          "value": "ILS",
          "expanded": "ILS - New Israeli Sheqel"
        },
        {
          "value": "DOP",
          "expanded": "DOP - Dominican Peso"
        },
        {
          "value": "GGP",
          "expanded": "GGP - Guernsey pound"
        },
        {
          "value": "MDL",
          "expanded": "MDL - Moldovan Leu"
        },
        {
          "value": "BSD",
          "expanded": "BSD - Bahamian Dollar"
        },
        {
          "value": "SPL",
          "expanded": "SPL - Seborga Luigino"
        },
        {
          "value": "SEK",
          "expanded": "SEK - Swedish Krona"
        },
        {
          "value": "ZMK",
          "expanded": "ZMK - Zambian Kwacha"
        },
        {
          "value": "JEP",
          "expanded": "JEP - Jersey pound"
        },
        {
          "value": "AUD",
          "expanded": "AUD - Australian Dollar"
        },
        {
          "value": "SRD",
          "expanded": "SRD - Surinam Dollar"
        },
        {
          "value": "CUP",
          "expanded": "CUP - Cuban Peso"
        },
        {
          "value": "BBD",
          "expanded": "BBD - Barbados Dollar"
        },
        {
          "value": "KMF",
          "expanded": "KMF - Comoro Franc"
        },
        {
          "value": "KRW",
          "expanded": "KRW - South Korean Won"
        },
        {
          "value": "GMD",
          "expanded": "GMD - Dalasi"
        },
        {
          "value": "VEF",
          "expanded": "VEF - Bolivar "
        },
        {
          "value": "IMP",
          "expanded": "IMP - Isle of Man Pound"
        },
        {
          "value": "CUC",
          "expanded": "CUC - Peso Convertible"
        },
        {
          "value": "TVD",
          "expanded": "TVD - Tuvalu Dollar"
        },
        {
          "value": "CLP",
          "expanded": "CLP - Chilean Peso"
        },
        {
          "value": "LTL",
          "expanded": "LTL - Lithuanian Litas"
        },
        {
          "value": "CDF",
          "expanded": "CDF - Congolese Franc"
        },
        {
          "value": "XCD",
          "expanded": "XCD - East Caribbean Dollar"
        },
        {
          "value": "KZT",
          "expanded": "KZT - Tenge"
        },
        {
          "value": "RUB",
          "expanded": "RUB - Russian Ruble"
        },
        {
          "value": "TTD",
          "expanded": "TTD - Trinidad and Tobago Dollar"
        },
        {
          "value": "OMR",
          "expanded": "OMR - Rial Omani"
        },
        {
          "value": "BRL",
          "expanded": "BRL - Brazilian Real"
        },
        {
          "value": "MMK",
          "expanded": "MMK - Kyat"
        },
        {
          "value": "PLN",
          "expanded": "PLN - Zloty"
        },
        {
          "value": "PYG",
          "expanded": "PYG - Guarani"
        },
        {
          "value": "KES",
          "expanded": "KES - Kenyan Shilling"
        },
        {
          "value": "SVC",
          "expanded": "SVC - El Salvador Colon"
        },
        {
          "value": "MKD",
          "expanded": "MKD - Denar"
        },
        {
          "value": "AZN",
          "expanded": "AZN - Azerbaijanian Manat"
        },
        {
          "value": "TOP",
          "expanded": "TOP - Pa'anga"
        },
        {
          "value": "MVR",
          "expanded": "MVR - Rufiyaa"
        },
        {
          "value": "VUV",
          "expanded": "VUV - Vatu"
        },
        {
          "value": "GNF",
          "expanded": "GNF - Guinea Franc"
        },
        {
          "value": "WST",
          "expanded": "WST - Tala"
        },
        {
          "value": "IQD",
          "expanded": "IQD - Iraqi Dinar"
        },
        {
          "value": "ERN",
          "expanded": "ERN - Nakfa"
        },
        {
          "value": "BAM",
          "expanded": "BAM - Convertible Mark"
        },
        {
          "value": "SCR",
          "expanded": "SCR - Seychelles Rupee"
        },
        {
          "value": "CAD",
          "expanded": "CAD - Canadian Dollar"
        },
        {
          "value": "CVE",
          "expanded": "CVE - Cape Verde Escudo"
        },
        {
          "value": "KWD",
          "expanded": "KWD - Kuwaiti Dinar"
        },
        {
          "value": "BIF",
          "expanded": "BIF - Burundi Franc"
        },
        {
          "value": "PGK",
          "expanded": "PGK - Kina"
        },
        {
          "value": "SOS",
          "expanded": "SOS - Somali Shilling"
        },
        {
          "value": "SGD",
          "expanded": "SGD - Singapore Dollar"
        },
        {
          "value": "UZS",
          "expanded": "UZS - Uzbekistan Sum"
        },
        {
          "value": "STD",
          "expanded": "STD - Dobra"
        },
        {
          "value": "IRR",
          "expanded": "IRR - Iranian Rial"
        },
        {
          "value": "CNY",
          "expanded": "CNY - Yuan Renminbi"
        },
        {
          "value": "SLL",
          "expanded": "SLL - Leone"
        },
        {
          "value": "TND",
          "expanded": "TND - Tunisian Dinar"
        },
        {
          "value": "GYD",
          "expanded": "GYD - Guyana Dollar"
        },
        {
          "value": "NZD",
          "expanded": "NZD - New Zealand Dollar"
        },
        {
          "value": "FKP",
          "expanded": "FKP - Falkland Islands Pound"
        },
        {
          "value": "LVL",
          "expanded": "LVL - Latvian Lats"
        },
        {
          "value": "USD",
          "expanded": "USD - US Dollar"
        },
        {
          "value": "KGS",
          "expanded": "KGS - Som"
        },
        {
          "value": "ARS",
          "expanded": "ARS - Argentine Peso"
        },
        {
          "value": "RON",
          "expanded": "RON - New Romanian Leu"
        },
        {
          "value": "GTQ",
          "expanded": "GTQ - Quetzal"
        },
        {
          "value": "RSD",
          "expanded": "RSD - Serbian Dinar"
        },
        {
          "value": "BHD",
          "expanded": "BHD - Bahraini Dinar"
        },
        {
          "value": "JPY",
          "expanded": "JPY - Yen"
        },
        {
          "value": "SDG",
          "expanded": "SDG - Sudanese Pound"
        }
      ]
    },
    {
      "predicate": "confidence",
      "entry": [
        {
          "value": "High",
          "expanded": "High confidence"
        },
        {
          "value": "None",
          "expanded": "No confidence"
        },
        {
          "value": "Medium",
          "expanded": "Medium confidence"
        },
        {
          "value": "Low",
          "expanded": "Low confidence"
        }
      ]
    },
    {
      "predicate": "targeted",
      "entry": [
        {
          "value": "Targeted",
          "expanded": "Targeted: victim chosen as target then actor determined what weaknesses could be exploited"
        },
        {
          "value": "NA",
          "expanded": "Not applicable"
        },
        {
          "value": "Opportunistic",
          "expanded": "Opportunistic: victim attacked because they exhibited a weakness the actor knew how to exploit"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        }
      ]
    },
    {
      "predicate": "discovery_method",
      "entry": [
        {
          "value": "Int - financial audit",
          "expanded": "Internal - financial audit and reconciliation process"
        },
        {
          "value": "Ext - found documents",
          "expanded": "External - Found documents"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Ext - audit",
          "expanded": "External - security audit or scan"
        },
        {
          "value": "Ext - incident response",
          "expanded": "External - Notified while investigating another incident"
        },
        {
          "value": "Ext - unknown",
          "expanded": "External - unknown"
        },
        {
          "value": "Other",
          "expanded": "Other"
        },
        {
          "value": "Int - NIDS",
          "expanded": "Internal - network IDS or IPS alert"
        },
        {
          "value": "Ext - emergency response team",
          "expanded": "External - Emergency response team"
        },
        {
          "value": "Ext - fraud detection",
          "expanded": "External - fraud detection (e.g., CPP)"
        },
        {
          "value": "Int - incident response",
          "expanded": "Internal - discovered while responding to another (separate) incident"
        },
        {
          "value": "Ext - customer",
          "expanded": "External - reported by customer or partner affected by the incident"
        },
        {
          "value": "Prt - audit",
          "expanded": "Partner - Audit performed by a partner organization"
        },
        {
          "value": "Int - IT review",
          "expanded": "Internal - Informal IT review"
        },
        {
          "value": "Int - log review",
          "expanded": "Internal - log review process or SIEM"
        },
        {
          "value": "Int - unknown",
          "expanded": "Internal - unknown"
        },
        {
          "value": "Ext - suspicious traffic",
          "expanded": "External - Report of suspicious traffic"
        },
        {
          "value": "Int - HIDS",
          "expanded": "Internal - host IDS or file integrity monitoring"
        },
        {
          "value": "Prt - Other",
          "expanded": "Partner - Other"
        },
        {
          "value": "Ext - monitoring service",
          "expanded": "External - managed security event monitoring service"
        },
        {
          "value": "Prt - antivirus",
          "expanded": "Partner - Notified by antivirus company but not through AV product"
        },
        {
          "value": "Prt - Unknown",
          "expanded": "Partner - Unknown"
        },
        {
          "value": "Int - security alarm",
          "expanded": "Internal - physical security system alarm"
        },
        {
          "value": "Ext - law enforcement",
          "expanded": "Internal - notified by law enforcement or government agency"
        },
        {
          "value": "Int - antivirus",
          "expanded": "Internal - antivirus alert"
        },
        {
          "value": "Int - infrastructure monitoring",
          "expanded": "Internal - Infrastructure monitoring"
        },
        {
          "value": "Prt - incident response",
          "expanded": "Partner - notified while investigating another incident"
        },
        {
          "value": "Int - data loss prevention",
          "expanded": "Internal - Data loss prevention software"
        },
        {
          "value": "Int - fraud detection",
          "expanded": "Internal - fraud detection mechanism"
        },
        {
          "value": "Prt - monitoring service",
          "expanded": "Partner - Reported by a monitoring service"
        },
        {
          "value": "Int - reported by employee",
          "expanded": "Internal - reported by employee who saw something odd"
        },
        {
          "value": "Ext - actor disclosure",
          "expanded": "External - disclosed by threat agent (e.g., public brag, private blackmail)"
        }
      ]
    },
    {
      "predicate": "cost_corrective_action",
      "entry": [
        {
          "value": "Simple and cheap",
          "expanded": "Simple and cheap"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Something in-between",
          "expanded": "Something in-between"
        },
        {
          "value": "Difficult and expensive",
          "expanded": "Difficult and expensive"
        }
      ]
    },
    {
      "predicate": "security_incident",
      "entry": [
        {
          "value": "Suspected",
          "expanded": "Suspected"
        },
        {
          "value": "Confirmed",
          "expanded": "Yes - Confirmed"
        },
        {
          "value": "Near miss",
          "expanded": "Near miss (actions did not compromise asset)"
        },
        {
          "value": "False positive",
          "expanded": "False positive (response triggered, but no incident)"
        }
      ]
    },
    {
      "predicate": "country",
      "entry": [
        {
          "value": "BD",
          "expanded": "Bangladesh"
        },
        {
          "value": "BE",
          "expanded": "Belgium"
        },
        {
          "value": "BF",
          "expanded": "Burkina Faso"
        },
        {
          "value": "BG",
          "expanded": "Bulgaria"
        },
        {
          "value": "BA",
          "expanded": "Bosnia and Herzegovina"
        },
        {
          "value": "BB",
          "expanded": "Barbados"
        },
        {
          "value": "WF",
          "expanded": "Wallis and Futuna Islands"
        },
        {
          "value": "BL",
          "expanded": "Saint-Barthelemy"
        },
        {
          "value": "BM",
          "expanded": "Bermuda"
        },
        {
          "value": "BN",
          "expanded": "Brunei Darussalam"
        },
        {
          "value": "BO",
          "expanded": "Bolivia"
        },
        {
          "value": "BH",
          "expanded": "Bahrain"
        },
        {
          "value": "BI",
          "expanded": "Burundi"
        },
        {
          "value": "BJ",
          "expanded": "Benin"
        },
        {
          "value": "BT",
          "expanded": "Bhutan"
        },
        {
          "value": "JM",
          "expanded": "Jamaica"
        },
        {
          "value": "BV",
          "expanded": "Bouvet Island"
        },
        {
          "value": "BW",
          "expanded": "Botswana"
        },
        {
          "value": "WS",
          "expanded": "Samoa"
        },
        {
          "value": "BQ",
          "expanded": "Bonaire,  Saint Eustatius and Saba"
        },
        {
          "value": "BR",
          "expanded": "Brazil"
        },
        {
          "value": "BS",
          "expanded": "Bahamas"
        },
        {
          "value": "JE",
          "expanded": "Jersey"
        },
        {
          "value": "BY",
          "expanded": "Belarus"
        },
        {
          "value": "BZ",
          "expanded": "Belize"
        },
        {
          "value": "RU",
          "expanded": "Russian Federation"
        },
        {
          "value": "RW",
          "expanded": "Rwanda"
        },
        {
          "value": "RS",
          "expanded": "Serbia"
        },
        {
          "value": "TL",
          "expanded": "Timor-Leste"
        },
        {
          "value": "RE",
          "expanded": "Reunion"
        },
        {
          "value": "TM",
          "expanded": "Turkmenistan"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "TJ",
          "expanded": "Tajikistan"
        },
        {
          "value": "RO",
          "expanded": "Romania"
        },
        {
          "value": "TK",
          "expanded": "Tokelau"
        },
        {
          "value": "GW",
          "expanded": "Guinea-Bissau"
        },
        {
          "value": "GU",
          "expanded": "Guam"
        },
        {
          "value": "GT",
          "expanded": "Guatemala"
        },
        {
          "value": "GS",
          "expanded": "South Georgia and the South Sandwich Islands"
        },
        {
          "value": "GR",
          "expanded": "Greece"
        },
        {
          "value": "GQ",
          "expanded": "Equatorial Guinea"
        },
        {
          "value": "GP",
          "expanded": "Guadeloupe"
        },
        {
          "value": "JP",
          "expanded": "Japan"
        },
        {
          "value": "GY",
          "expanded": "Guyana"
        },
        {
          "value": "GG",
          "expanded": "Guernsey"
        },
        {
          "value": "GF",
          "expanded": "French Guiana"
        },
        {
          "value": "GE",
          "expanded": "Georgia"
        },
        {
          "value": "GD",
          "expanded": "Grenada"
        },
        {
          "value": "GB",
          "expanded": "United Kingdom"
        },
        {
          "value": "GA",
          "expanded": "Gabon"
        },
        {
          "value": "SV",
          "expanded": "El Salvador"
        },
        {
          "value": "GN",
          "expanded": "Guinea"
        },
        {
          "value": "GM",
          "expanded": "Gambia"
        },
        {
          "value": "GL",
          "expanded": "Greenland"
        },
        {
          "value": "GI",
          "expanded": "Gibraltar"
        },
        {
          "value": "GH",
          "expanded": "Ghana"
        },
        {
          "value": "OM",
          "expanded": "Oman"
        },
        {
          "value": "TN",
          "expanded": "Tunisia"
        },
        {
          "value": "JO",
          "expanded": "Jordan"
        },
        {
          "value": "HR",
          "expanded": "Croatia"
        },
        {
          "value": "HT",
          "expanded": "Haiti"
        },
        {
          "value": "HU",
          "expanded": "Hungary"
        },
        {
          "value": "HK",
          "expanded": "Hong Kong"
        },
        {
          "value": "HN",
          "expanded": "Honduras"
        },
        {
          "value": "HM",
          "expanded": "Heard Island and McDonal Islands"
        },
        {
          "value": "VE",
          "expanded": "Venezuela (Bolivarian Republic of)"
        },
        {
          "value": "PR",
          "expanded": "Puerto Rico"
        },
        {
          "value": "PS",
          "expanded": "Palestinian Territory, Occupied"
        },
        {
          "value": "PW",
          "expanded": "Palau"
        },
        {
          "value": "PT",
          "expanded": "Portugal"
        },
        {
          "value": "SJ",
          "expanded": "Svalbard and Jan Mayen Islands"
        },
        {
          "value": "PY",
          "expanded": "Paraguay"
        },
        {
          "value": "IQ",
          "expanded": "Iraq"
        },
        {
          "value": "PA",
          "expanded": "Panama"
        },
        {
          "value": "PF",
          "expanded": "French Polynesia"
        },
        {
          "value": "PG",
          "expanded": "Papua New Guinea"
        },
        {
          "value": "PE",
          "expanded": "Peru"
        },
        {
          "value": "PK",
          "expanded": "Pakistan"
        },
        {
          "value": "PH",
          "expanded": "Philippines"
        },
        {
          "value": "PN",
          "expanded": "Pitcairn"
        },
        {
          "value": "PL",
          "expanded": "Poland"
        },
        {
          "value": "PM",
          "expanded": "Saint Pierre and Miquelon"
        },
        {
          "value": "ZM",
          "expanded": "Zambia"
        },
        {
          "value": "EH",
          "expanded": "Western Sahara"
        },
        {
          "value": "EE",
          "expanded": "Estonia"
        },
        {
          "value": "EG",
          "expanded": "Egypt"
        },
        {
          "value": "ZA",
          "expanded": "South Africa"
        },
        {
          "value": "EC",
          "expanded": "Ecuador"
        },
        {
          "value": "IT",
          "expanded": "Italy"
        },
        {
          "value": "VN",
          "expanded": "Viet Nam"
        },
        {
          "value": "SB",
          "expanded": "Solomon Islands"
        },
        {
          "value": "ET",
          "expanded": "Ethiopia"
        },
        {
          "value": "SO",
          "expanded": "Somalia"
        },
        {
          "value": "ZW",
          "expanded": "Zimbabwe"
        },
        {
          "value": "SA",
          "expanded": "Saudi Arabia"
        },
        {
          "value": "ES",
          "expanded": "Spain"
        },
        {
          "value": "ER",
          "expanded": "Eritrea"
        },
        {
          "value": "ME",
          "expanded": "Montenegro"
        },
        {
          "value": "MD",
          "expanded": "Moldova, Republic of"
        },
        {
          "value": "MG",
          "expanded": "Madagascar"
        },
        {
          "value": "MF",
          "expanded": "Saint Martin (French part)"
        },
        {
          "value": "MA",
          "expanded": "Morocco"
        },
        {
          "value": "MC",
          "expanded": "Monaco"
        },
        {
          "value": "UZ",
          "expanded": "Uzbekistan"
        },
        {
          "value": "MM",
          "expanded": "Myanmar"
        },
        {
          "value": "ML",
          "expanded": "Mali"
        },
        {
          "value": "MO",
          "expanded": "Macao"
        },
        {
          "value": "MN",
          "expanded": "Mongolia"
        },
        {
          "value": "MH",
          "expanded": "Marshall Islands"
        },
        {
          "value": "MK",
          "expanded": "Macedonia, The former Yugoslav Republic of"
        },
        {
          "value": "MU",
          "expanded": "Mauritius"
        },
        {
          "value": "MT",
          "expanded": "Malta"
        },
        {
          "value": "MW",
          "expanded": "Malawi"
        },
        {
          "value": "MV",
          "expanded": "Maldives"
        },
        {
          "value": "MQ",
          "expanded": "Martinique"
        },
        {
          "value": "MP",
          "expanded": "Northern Mariana Islands"
        },
        {
          "value": "MS",
          "expanded": "Montserrat"
        },
        {
          "value": "MR",
          "expanded": "Mauritania"
        },
        {
          "value": "IM",
          "expanded": "Isle of Man"
        },
        {
          "value": "UG",
          "expanded": "Uganda"
        },
        {
          "value": "TZ",
          "expanded": "Tanzania, United Republic of"
        },
        {
          "value": "MY",
          "expanded": "Malaysia"
        },
        {
          "value": "MX",
          "expanded": "Mexico"
        },
        {
          "value": "IL",
          "expanded": "Israel"
        },
        {
          "value": "FR",
          "expanded": "France"
        },
        {
          "value": "IO",
          "expanded": "British Virgin Islands"
        },
        {
          "value": "SH",
          "expanded": "Saint Helena"
        },
        {
          "value": "FI",
          "expanded": "Finland"
        },
        {
          "value": "FJ",
          "expanded": "Fiji"
        },
        {
          "value": "FK",
          "expanded": "Faeroe Islands"
        },
        {
          "value": "FM",
          "expanded": "Micronesia (Federated States of)"
        },
        {
          "value": "FO",
          "expanded": "Falkland Islands (Malvinas)"
        },
        {
          "value": "NI",
          "expanded": "Nicaragua"
        },
        {
          "value": "NL",
          "expanded": "Netherlands"
        },
        {
          "value": "NO",
          "expanded": "Norway"
        },
        {
          "value": "NA",
          "expanded": "Namibia"
        },
        {
          "value": "VU",
          "expanded": "Vanuatu"
        },
        {
          "value": "NC",
          "expanded": "New Caledonia"
        },
        {
          "value": "NE",
          "expanded": "Niger"
        },
        {
          "value": "NF",
          "expanded": "Norfolk Island"
        },
        {
          "value": "NG",
          "expanded": "Nigeria"
        },
        {
          "value": "NZ",
          "expanded": "New Zealand"
        },
        {
          "value": "NP",
          "expanded": "Nepal"
        },
        {
          "value": "NR",
          "expanded": "Nauru"
        },
        {
          "value": "NU",
          "expanded": "Niue"
        },
        {
          "value": "CK",
          "expanded": "Cook Islands"
        },
        {
          "value": "CI",
          "expanded": "Cote d'Ivoire"
        },
        {
          "value": "CH",
          "expanded": "Switzerland"
        },
        {
          "value": "CO",
          "expanded": "Colombia"
        },
        {
          "value": "CN",
          "expanded": "China"
        },
        {
          "value": "CM",
          "expanded": "Cameroon"
        },
        {
          "value": "CL",
          "expanded": "Chile"
        },
        {
          "value": "CC",
          "expanded": "Cocos (Keeling) Islands"
        },
        {
          "value": "CA",
          "expanded": "Canada"
        },
        {
          "value": "CG",
          "expanded": "Congo"
        },
        {
          "value": "CF",
          "expanded": "Central African Republic"
        },
        {
          "value": "CD",
          "expanded": "Congo, Democratic Republic of the"
        },
        {
          "value": "CZ",
          "expanded": "Czech Republic"
        },
        {
          "value": "CY",
          "expanded": "Cyprus"
        },
        {
          "value": "CX",
          "expanded": "Christmas Island"
        },
        {
          "value": "CR",
          "expanded": "Costa Rica"
        },
        {
          "value": "CW",
          "expanded": "Curacao"
        },
        {
          "value": "CV",
          "expanded": "Cape Verde"
        },
        {
          "value": "CU",
          "expanded": "Cuba"
        },
        {
          "value": "SZ",
          "expanded": "Swaziland"
        },
        {
          "value": "SY",
          "expanded": "Syrian Arab Republic"
        },
        {
          "value": "SX",
          "expanded": "Sint Maarten (Dutch part)"
        },
        {
          "value": "KG",
          "expanded": "Kyrgyzstan"
        },
        {
          "value": "KE",
          "expanded": "Kenya"
        },
        {
          "value": "SS",
          "expanded": "South Sudan"
        },
        {
          "value": "SR",
          "expanded": "Suriname"
        },
        {
          "value": "KI",
          "expanded": "Kiribati"
        },
        {
          "value": "KH",
          "expanded": "Cambodia"
        },
        {
          "value": "KN",
          "expanded": "Saint Kitts and Nevis"
        },
        {
          "value": "KM",
          "expanded": "Comoros"
        },
        {
          "value": "ST",
          "expanded": "Sao Tome and Principe"
        },
        {
          "value": "SK",
          "expanded": "Slovakia"
        },
        {
          "value": "KR",
          "expanded": "Korea, Republic of"
        },
        {
          "value": "SI",
          "expanded": "Slovenia"
        },
        {
          "value": "KP",
          "expanded": "Korea, Democratic People's Republic of"
        },
        {
          "value": "KW",
          "expanded": "Kuwait"
        },
        {
          "value": "SN",
          "expanded": "Senegal"
        },
        {
          "value": "SM",
          "expanded": "San Marino"
        },
        {
          "value": "SL",
          "expanded": "Sierra Leone"
        },
        {
          "value": "SC",
          "expanded": "Seychelles"
        },
        {
          "value": "KZ",
          "expanded": "Kazakhstan"
        },
        {
          "value": "KY",
          "expanded": "Cayman Islands"
        },
        {
          "value": "SG",
          "expanded": "Singapore"
        },
        {
          "value": "SE",
          "expanded": "Sweden"
        },
        {
          "value": "SD",
          "expanded": "Sudan"
        },
        {
          "value": "DO",
          "expanded": "Dominican Republic"
        },
        {
          "value": "DM",
          "expanded": "Dominica"
        },
        {
          "value": "DJ",
          "expanded": "Djibouti"
        },
        {
          "value": "DK",
          "expanded": "Denmark"
        },
        {
          "value": "VG",
          "expanded": "British Virgin Islands"
        },
        {
          "value": "DE",
          "expanded": "Germany"
        },
        {
          "value": "YE",
          "expanded": "Yemen"
        },
        {
          "value": "Other",
          "expanded": "Other"
        },
        {
          "value": "DZ",
          "expanded": "Algeria"
        },
        {
          "value": "US",
          "expanded": "United States of America"
        },
        {
          "value": "UY",
          "expanded": "Uruguay"
        },
        {
          "value": "YT",
          "expanded": "Mayotte"
        },
        {
          "value": "UM",
          "expanded": "United States Minor Outlying Islands"
        },
        {
          "value": "LB",
          "expanded": "Lebanon"
        },
        {
          "value": "LC",
          "expanded": "Saint Lucia"
        },
        {
          "value": "LA",
          "expanded": "Lao People's Democratic Republic"
        },
        {
          "value": "TV",
          "expanded": "Tuvalu"
        },
        {
          "value": "TW",
          "expanded": "Taiwan, Province of China"
        },
        {
          "value": "TT",
          "expanded": "Trinidad and Tobago"
        },
        {
          "value": "TR",
          "expanded": "Turkey"
        },
        {
          "value": "LK",
          "expanded": "Sri Lanka"
        },
        {
          "value": "LI",
          "expanded": "Liechtenstein"
        },
        {
          "value": "LV",
          "expanded": "Latvia"
        },
        {
          "value": "TO",
          "expanded": "Tonga"
        },
        {
          "value": "LT",
          "expanded": "Lithuania"
        },
        {
          "value": "LU",
          "expanded": "Luxembourg"
        },
        {
          "value": "LR",
          "expanded": "Liberia"
        },
        {
          "value": "LS",
          "expanded": "Lesotho"
        },
        {
          "value": "TH",
          "expanded": "Thailand"
        },
        {
          "value": "TF",
          "expanded": "French Southern Territories"
        },
        {
          "value": "TG",
          "expanded": "Togo"
        },
        {
          "value": "TD",
          "expanded": "Chad"
        },
        {
          "value": "TC",
          "expanded": "Turks and Caicos Islands"
        },
        {
          "value": "LY",
          "expanded": "Libya"
        },
        {
          "value": "VA",
          "expanded": "Holy See"
        },
        {
          "value": "VC",
          "expanded": "Saint Vincent and the Grenadines"
        },
        {
          "value": "AE",
          "expanded": "United Arab Emirates"
        },
        {
          "value": "AD",
          "expanded": "Andorra"
        },
        {
          "value": "AG",
          "expanded": "Antigua and Barbuda"
        },
        {
          "value": "AF",
          "expanded": "Afghanistan"
        },
        {
          "value": "AI",
          "expanded": "Anguilla"
        },
        {
          "value": "VI",
          "expanded": "United States Virgin Islands"
        },
        {
          "value": "IS",
          "expanded": "Iceland"
        },
        {
          "value": "IR",
          "expanded": "Iran (Islamic Republic of)"
        },
        {
          "value": "AM",
          "expanded": "Armenia"
        },
        {
          "value": "AL",
          "expanded": "Albania"
        },
        {
          "value": "AO",
          "expanded": "Angola"
        },
        {
          "value": "AQ",
          "expanded": "Antarctica"
        },
        {
          "value": "AS",
          "expanded": "American Samoa"
        },
        {
          "value": "AR",
          "expanded": "Argentina"
        },
        {
          "value": "AU",
          "expanded": "Australia"
        },
        {
          "value": "AT",
          "expanded": "Austria"
        },
        {
          "value": "AW",
          "expanded": "Aruba"
        },
        {
          "value": "IN",
          "expanded": "India"
        },
        {
          "value": "AX",
          "expanded": "Aland Islands"
        },
        {
          "value": "AZ",
          "expanded": "Azerbaijan"
        },
        {
          "value": "IE",
          "expanded": "Ireland"
        },
        {
          "value": "ID",
          "expanded": "Indonesia"
        },
        {
          "value": "UA",
          "expanded": "Ukraine"
        },
        {
          "value": "QA",
          "expanded": "Qatar"
        },
        {
          "value": "MZ",
          "expanded": "Mozambique"
        }
      ]
    },
    {
      "predicate": "impact:overall_rating",
      "entry": [
        {
          "value": "Insignificant",
          "expanded": "Insignificant: Impact absorbed by normal activities"
        },
        {
          "value": "Catastrophic",
          "expanded": "Catastrophic: A business-ending event (don't choose this if the victim will continue operations)"
        },
        {
          "value": "Distracting",
          "expanded": "Distracting: Limited \"hard costs\", but impact felt through having to deal with the incident rather than conducting normal duties"
        },
        {
          "value": "Damaging",
          "expanded": "Damaging: Real and serious effect on the \"bottom line\" and/or long-term ability to generate revenue"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Painful",
          "expanded": "Painful: Limited \"hard costs\", but impact felt through having to deal with the incident rather than conducting normal duties"
        }
      ]
    },
    {
      "predicate": "actor:motive",
      "entry": [
        {
          "value": "Grudge",
          "expanded": "Grudge or personal offense"
        },
        {
          "value": "Financial",
          "expanded": "Financial or personal gain"
        },
        {
          "value": "NA",
          "expanded": "Not Applicable (unintentional action)"
        },
        {
          "value": "Ideology",
          "expanded": "Ideology or protest"
        },
        {
          "value": "Convenience",
          "expanded": "Convenience of expediency"
        },
        {
          "value": "Other",
          "expanded": "Other"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Fun",
          "expanded": "Fun, curiosity, or pride"
        },
        {
          "value": "Fear",
          "expanded": "Fear or duress"
        },
        {
          "value": "Espionage",
          "expanded": "Espionage or competitive advantage"
        },
        {
          "value": "Secondary",
          "expanded": "Aid in a different attack"
        }
      ]
    },
    {
      "predicate": "asset:management",
      "entry": [
        {
          "value": "NA",
          "expanded": "Not applicable"
        },
        {
          "value": "Internal",
          "expanded": "Internally managed"
        },
        {
          "value": "External",
          "expanded": "Externally managed"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        }
      ]
    },
    {
      "predicate": "asset:variety",
      "entry": [
        {
          "value": "M - Flash drive",
          "expanded": "Media - Flash drive or card"
        },
        {
          "value": "S - Print",
          "expanded": "Server - Print"
        },
        {
          "value": "P - Guard",
          "expanded": "People - Guard"
        },
        {
          "value": "S - Database",
          "expanded": "Server - Database"
        },
        {
          "value": "N - PBX",
          "expanded": "Network - Private branch exchange (PBX)"
        },
        {
          "value": "M - Other",
          "expanded": "Media - Other/Unknown"
        },
        {
          "value": "S - Other",
          "expanded": "Server - Other/Unknown"
        },
        {
          "value": "P - System admin",
          "expanded": "People - Administrator"
        },
        {
          "value": "S - POS controller",
          "expanded": "Server - POS controller"
        },
        {
          "value": "T - Other",
          "expanded": "Public Terminal - Other/Unknown"
        },
        {
          "value": "N - Camera",
          "expanded": "Network - Camera or surveillance system"
        },
        {
          "value": "S - Unknown",
          "expanded": "Server - Unknown"
        },
        {
          "value": "S - DHCP",
          "expanded": "Server - DHCP"
        },
        {
          "value": "U - POS terminal",
          "expanded": "User Device - POS terminal"
        },
        {
          "value": "N - LAN",
          "expanded": "Network - Wired LAN"
        },
        {
          "value": "P - Manager",
          "expanded": "People - Manager"
        },
        {
          "value": "M - Payment card",
          "expanded": "Media - Payment card (e.g., magstripe, EMV)"
        },
        {
          "value": "N - Public WAN",
          "expanded": "Network - Public WAN"
        },
        {
          "value": "P - Former employee",
          "expanded": "People - Former employee"
        },
        {
          "value": "S - Authentication",
          "expanded": "Server - Authentication"
        },
        {
          "value": "U - Mobile phone",
          "expanded": "User Device - Mobile phone or smartphone"
        },
        {
          "value": "N - Router or switch",
          "expanded": "Network - Router or switch"
        },
        {
          "value": "T - Kiosk",
          "expanded": "Public Terminal - Self-service kiosk"
        },
        {
          "value": "N - HSM",
          "expanded": "Network - Hardware security module (HSM)"
        },
        {
          "value": "U - Peripheral",
          "expanded": "User Device - Peripheral (e.g., printer, copier, fax)"
        },
        {
          "value": "S - Code repository",
          "expanded": "Server - Code repository"
        },
        {
          "value": "S - SCADA",
          "expanded": "Server - SCADA system"
        },
        {
          "value": "P - End-user",
          "expanded": "People - End-user"
        },
        {
          "value": "N - SAN",
          "expanded": "Network - Storage area network (SAN)"
        },
        {
          "value": "T - ATM",
          "expanded": "Public Terminal - Automated Teller Machine (ATM)"
        },
        {
          "value": "N - RTU",
          "expanded": "Network - Remote terminal unit (RTU)"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "M - Smart card",
          "expanded": "Media - Identity smart card"
        },
        {
          "value": "N - IDS",
          "expanded": "Network - IDS or IPs"
        },
        {
          "value": "N - PLC",
          "expanded": "Network - Programmable logic controller (PLC)"
        },
        {
          "value": "N - Other",
          "expanded": "Network - Other/Unknown"
        },
        {
          "value": "P - Cashier",
          "expanded": "People - Cashier"
        },
        {
          "value": "P - Executive",
          "expanded": "People - Executive"
        },
        {
          "value": "U - Desktop",
          "expanded": "User Device - Desktop or workstation"
        },
        {
          "value": "U - Tablet",
          "expanded": "User Device - Tablet"
        },
        {
          "value": "N - Firewall",
          "expanded": "Network - Firewall"
        },
        {
          "value": "P - Customer",
          "expanded": "People - Customer"
        },
        {
          "value": "S - Mainframe",
          "expanded": "Server - Mainframe"
        },
        {
          "value": "S - Directory",
          "expanded": "Server - Directory (LDAP, AD)"
        },
        {
          "value": "U - Auth token",
          "expanded": "User Device - Authentication token or device"
        },
        {
          "value": "U - Media",
          "expanded": "User Device - Media player or recorder"
        },
        {
          "value": "T - Gas terminal",
          "expanded": "Public Terminal - Gas \"pay-at-the-pump\" terminal"
        },
        {
          "value": "T - PED pad",
          "expanded": "Public Terminal - Detached PIN pad or card reader"
        },
        {
          "value": "M - Disk drive",
          "expanded": "Media - Hard disk drive"
        },
        {
          "value": "S - VM host",
          "expanded": "Server - Virtual Host"
        },
        {
          "value": "P - Auditor",
          "expanded": "People - Auditor"
        },
        {
          "value": "U - VoIP phone",
          "expanded": "User Device - VoIP phone"
        },
        {
          "value": "N - Broadband",
          "expanded": "Network - Mobile broadband network"
        },
        {
          "value": "U - Other",
          "expanded": "User Device - Other/Unknown"
        },
        {
          "value": "U - Telephone",
          "expanded": "User Device - Telephone"
        },
        {
          "value": "P - Call center",
          "expanded": "People - Call center"
        },
        {
          "value": "N - Private WAN",
          "expanded": "Network - Private WAN"
        },
        {
          "value": "S - DNS",
          "expanded": "Server - DNS"
        },
        {
          "value": "P - Helpdesk",
          "expanded": "People - Helpdesk"
        },
        {
          "value": "N - Telephone",
          "expanded": "Network - Telephone"
        },
        {
          "value": "U - Laptop",
          "expanded": "User Device - Laptop"
        },
        {
          "value": "S - Log",
          "expanded": "Server - Log or event management"
        },
        {
          "value": "P - Finance",
          "expanded": "People - Finance"
        },
        {
          "value": "P - Human resources",
          "expanded": "People - Human resources"
        },
        {
          "value": "N - VoIP adapter",
          "expanded": "Network - VoIP adapter"
        },
        {
          "value": "S - Backup",
          "expanded": "Server - Backup"
        },
        {
          "value": "P - Partner",
          "expanded": "People - Partner"
        },
        {
          "value": "P - Maintenance",
          "expanded": "People - Maintenance"
        },
        {
          "value": "S - Payment switch",
          "expanded": "Server - Payment switch or gateway"
        },
        {
          "value": "S - DCS",
          "expanded": "Server - Distributed control system (DCS)"
        },
        {
          "value": "P - Other",
          "expanded": "People - Other/Unknown"
        },
        {
          "value": "S - Proxy",
          "expanded": "Server - Proxy"
        },
        {
          "value": "S - Mail",
          "expanded": "Server - Mail"
        },
        {
          "value": "M - Tapes",
          "expanded": "Media - Backup tapes"
        },
        {
          "value": "S - Remote access",
          "expanded": "Server - Remote access"
        },
        {
          "value": "N - Access reader",
          "expanded": "Network - Access control reader (e.g., badge, biometric)"
        },
        {
          "value": "S - File",
          "expanded": "Server - File"
        },
        {
          "value": "S - Web application",
          "expanded": "Server - Web application"
        },
        {
          "value": "M - Documents",
          "expanded": "Media - Documents"
        },
        {
          "value": "N - WLAN",
          "expanded": "Network - Wireless LAN"
        },
        {
          "value": "P - Developer",
          "expanded": "People - Developer"
        },
        {
          "value": "M - Disk media",
          "expanded": "Media - Disk media (e.g., CDs, DVDs)"
        }
      ]
    },
    {
      "predicate": "asset:accessibility",
      "entry": [
        {
          "value": "NA",
          "expanded": "Not applicable"
        },
        {
          "value": "Internal",
          "expanded": "Internally accessible"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "External",
          "expanded": "Publicly accessible"
        },
        {
          "value": "Isolated",
          "expanded": "Internally isolated or restricted environment"
        }
      ]
    },
    {
      "predicate": "asset:governance",
      "entry": [
        {
          "value": "3rd party hosted",
          "expanded": "Hosted by 3rd party"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "3rd party managed",
          "expanded": "Managed by 3rd party"
        },
        {
          "value": "3rd party owned",
          "expanded": "Owned by 3rd party"
        },
        {
          "value": "Personally owned",
          "expanded": "Personally owned asset"
        },
        {
          "value": "Internally isolated",
          "expanded": "Isolated internal asset"
        }
      ]
    },
    {
      "predicate": "asset:hosting",
      "entry": [
        {
          "value": "External shared",
          "expanded": "Externally hosted in a shared envirnoment"
        },
        {
          "value": "External dedicated",
          "expanded": "Externally hosted in a dedicated envirnoment"
        },
        {
          "value": "NA",
          "expanded": "Not applicable"
        },
        {
          "value": "Internal",
          "expanded": "Internally hosted"
        },
        {
          "value": "External",
          "expanded": "Externally hosted (unsure if dedicated or shared)"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        }
      ]
    },
    {
      "predicate": "asset:ownership",
      "entry": [
        {
          "value": "Customer",
          "expanded": "Customer owned"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Victim",
          "expanded": "Victim owned"
        },
        {
          "value": "NA",
          "expanded": "Not applicable"
        },
        {
          "value": "Employee",
          "expanded": "Employee owned"
        },
        {
          "value": "Partner",
          "expanded": "Partner owned"
        }
      ]
    },
    {
      "predicate": "asset:cloud",
      "entry": [
        {
          "value": "Hosting error",
          "expanded": "Misconfiguration or error by hosting provider"
        },
        {
          "value": "User breakout",
          "expanded": "Elevation of privilege by another customer in shared environment"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Other",
          "expanded": "Other"
        },
        {
          "value": "Hosting governance",
          "expanded": "Lack of security process or procedure by hosting provider"
        },
        {
          "value": "Customer attack",
          "expanded": "Penetration of another web site on shared device"
        },
        {
          "value": "Hypervisor",
          "expanded": "Hypervisor break-out attack"
        },
        {
          "value": "Partner application",
          "expanded": "Application vulnerability in partner-developed application"
        }
      ]
    },
    {
      "predicate": "victim:employee_count",
      "entry": [
        {
          "value": "1001 to 10000",
          "expanded": "1,001 to 10,000 employees"
        },
        {
          "value": "Over 100000",
          "expanded": "Over 100,0001 employees"
        },
        {
          "value": "Large",
          "expanded": "Large organizations (over 1,000 employees)"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown number of employees"
        },
        {
          "value": "50001 to 100000",
          "expanded": "50,001 to 100,000 employees"
        },
        {
          "value": "101 to 1000",
          "expanded": "101 to 1,000 employees"
        },
        {
          "value": "25001 to 50000",
          "expanded": "25,001 to 50,000 employees"
        },
        {
          "value": "10001 to 25000",
          "expanded": "10,001 to 25,000 employees"
        },
        {
          "value": "Small",
          "expanded": "Small organizations (1,000 employees or less)"
        },
        {
          "value": "1 to 10",
          "expanded": "1 to 10 employees"
        },
        {
          "value": "11 to 100",
          "expanded": "11 to 100 employees"
        }
      ]
    },
    {
      "predicate": "timeline:unit",
      "entry": [
        {
          "value": "Months",
          "expanded": "Months"
        },
        {
          "value": "Seconds",
          "expanded": "Seconds"
        },
        {
          "value": "NA",
          "expanded": "NA"
        },
        {
          "value": "Never",
          "expanded": "Never"
        },
        {
          "value": "Days",
          "expanded": "Days"
        },
        {
          "value": "Years",
          "expanded": "Years"
        },
        {
          "value": "Hours",
          "expanded": "Hours"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Weeks",
          "expanded": "Weeks"
        },
        {
          "value": "Minutes",
          "expanded": "Minutes"
        }
      ]
    },
    {
      "predicate": "impact:loss:rating",
      "entry": [
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Major",
          "expanded": "Major"
        },
        {
          "value": "Moderate",
          "expanded": "Moderate"
        },
        {
          "value": "None",
          "expanded": "None"
        },
        {
          "value": "Minor",
          "expanded": "Minor"
        }
      ]
    },
    {
      "predicate": "impact:loss:variety",
      "entry": [
        {
          "value": "Legal and regulatory",
          "expanded": "Legal and regulatory costs"
        },
        {
          "value": "Asset and fraud",
          "expanded": "Asset and fraud-related losses"
        },
        {
          "value": "Business disruption",
          "expanded": "Business disruption"
        },
        {
          "value": "Response and recovery",
          "expanded": "Response and recovery costs"
        },
        {
          "value": "Competitive advantage",
          "expanded": "Loss of competitive advantage"
        },
        {
          "value": "Operating costs",
          "expanded": "Increased operating costs"
        },
        {
          "value": "Brand damage",
          "expanded": "Brand and market damage"
        }
      ]
    },
    {
      "predicate": "attribute:integrity:variety",
      "entry": [
        {
          "value": "Misrepresentation",
          "expanded": "Misrepresentation"
        },
        {
          "value": "Modify data",
          "expanded": "Modified stored data or content"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Created account",
          "expanded": "Created new user account"
        },
        {
          "value": "Defacement",
          "expanded": "Deface content"
        },
        {
          "value": "Log tampering",
          "expanded": "Log tampering or modification"
        },
        {
          "value": "Modify privileges",
          "expanded": "Modified privileges or permissions"
        },
        {
          "value": "Software installation",
          "expanded": "Software installation or code modification"
        },
        {
          "value": "Other",
          "expanded": "Other"
        },
        {
          "value": "Fraudulent transaction",
          "expanded": "Initiate fraudulent transaction"
        },
        {
          "value": "Alter behavior",
          "expanded": "Influence or alter human behavior"
        },
        {
          "value": "Hardware tampering",
          "expanded": "Hardware tampering or physical alteration"
        },
        {
          "value": "Modify configuration",
          "expanded": "Modified configuration or services"
        },
        {
          "value": "Repurpose",
          "expanded": "Repurposed asset for unauthorized function"
        }
      ]
    },
    {
      "predicate": "attribute:availability:variety",
      "entry": [
        {
          "value": "Acceleration",
          "expanded": "Acceleration"
        },
        {
          "value": "Interruption",
          "expanded": "Interruption"
        },
        {
          "value": "Loss",
          "expanded": "Loss"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Degradation",
          "expanded": "Performance degradation"
        },
        {
          "value": "Other",
          "expanded": "Other"
        },
        {
          "value": "Obscuration",
          "expanded": "Conversion or obscuration"
        },
        {
          "value": "Destruction",
          "expanded": "Destruction"
        }
      ]
    },
    {
      "predicate": "attribute:confidentiality:data_victim",
      "entry": [
        {
          "value": "Customer",
          "expanded": "Customer"
        },
        {
          "value": "Patient",
          "expanded": "Patient"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Other",
          "expanded": "Other"
        },
        {
          "value": "Student",
          "expanded": "Student"
        },
        {
          "value": "Employee",
          "expanded": "Employee"
        },
        {
          "value": "Partner",
          "expanded": "Partner"
        }
      ]
    },
    {
      "predicate": "attribute:confidentiality:state",
      "entry": [
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Transmitted encrypted",
          "expanded": "Transmitted encrypted"
        },
        {
          "value": "Transmitted unencrypted",
          "expanded": "Transmitted unencrypted"
        },
        {
          "value": "Stored",
          "expanded": "Stored"
        },
        {
          "value": "Transmitted",
          "expanded": "Transmitted"
        },
        {
          "value": "Processed",
          "expanded": "Processed"
        },
        {
          "value": "Stored encrypted",
          "expanded": "Stored encrypted"
        },
        {
          "value": "Stored unencrypted",
          "expanded": "Stored unencrypted"
        }
      ]
    },
    {
      "predicate": "attribute:confidentiality:data_disclosure",
      "entry": [
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Yes",
          "expanded": "Yes (confirmed)"
        },
        {
          "value": "Potentially",
          "expanded": "Potentially (at risk)"
        },
        {
          "value": "No",
          "expanded": "No"
        }
      ]
    },
    {
      "predicate": "actor:internal:job_change",
      "entry": [
        {
          "value": "Lateral move",
          "expanded": "Lateral move"
        },
        {
          "value": "Job eval",
          "expanded": "Recent poor job evaluation"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Personal issues",
          "expanded": "Personal issues"
        },
        {
          "value": "Let go",
          "expanded": "Fired, laid off, or let go"
        },
        {
          "value": "Reprimanded",
          "expanded": "Recently reprimanded"
        },
        {
          "value": "Hired",
          "expanded": "Recently hired"
        },
        {
          "value": "Passed over",
          "expanded": "Recently passed over for promotion"
        },
        {
          "value": "Demoted",
          "expanded": "Recently demoted or hours reduced"
        },
        {
          "value": "Promoted",
          "expanded": "Recently promoted"
        },
        {
          "value": "Resigned",
          "expanded": "Recently resigned"
        },
        {
          "value": "Other",
          "expanded": "Other"
        }
      ]
    },
    {
      "predicate": "actor:internal:variety",
      "entry": [
        {
          "value": "End-user",
          "expanded": "End-user or regular employee"
        },
        {
          "value": "Human resources",
          "expanded": "Human resources staff"
        },
        {
          "value": "Finance",
          "expanded": "Finance or accounting staff"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Helpdesk",
          "expanded": "Helpdesk staff"
        },
        {
          "value": "Executive",
          "expanded": "Executive or upper management"
        },
        {
          "value": "Cashier",
          "expanded": "Cashier, teller, or waiter"
        },
        {
          "value": "Manager",
          "expanded": "Manager or supervisor"
        },
        {
          "value": "Guard",
          "expanded": "Security guard"
        },
        {
          "value": "Other",
          "expanded": "Other"
        },
        {
          "value": "Auditor",
          "expanded": "Auditor"
        },
        {
          "value": "Maintenance",
          "expanded": "Maintenance or janitorial staff"
        },
        {
          "value": "Call center",
          "expanded": "Call center staff"
        },
        {
          "value": "System admin",
          "expanded": "System or network administrator"
        },
        {
          "value": "Developer",
          "expanded": "Software developer"
        }
      ]
    },
    {
      "predicate": "actor:external:variety",
      "entry": [
        {
          "value": "Customer",
          "expanded": "Customer (B2C)"
        },
        {
          "value": "Organized crime",
          "expanded": "Organized or professional criminal group"
        },
        {
          "value": "Acquaintance",
          "expanded": "Relative or acquaintance of employee"
        },
        {
          "value": "Competitor",
          "expanded": "Competitor"
        },
        {
          "value": "Unaffiliated",
          "expanded": "Unaffiliated person(s)"
        },
        {
          "value": "Force majeure",
          "expanded": "Force majeure (nature and chance)"
        },
        {
          "value": "Former employee",
          "expanded": "Former employee (no longer had access)"
        },
        {
          "value": "Nation-state",
          "expanded": "Nation-state"
        },
        {
          "value": "Activist",
          "expanded": "Activist group"
        },
        {
          "value": "Terrorist",
          "expanded": "Terrorist group"
        },
        {
          "value": "Auditor",
          "expanded": "Auditor"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "State-affiliated",
          "expanded": "State-sponsored or affiliated group"
        },
        {
          "value": "Other",
          "expanded": "Other"
        }
      ]
    },
    {
      "predicate": "action:malware:vector",
      "entry": [
        {
          "value": "Remote injection",
          "expanded": "Remotely injected by agent (i.e. via SQLi)"
        },
        {
          "value": "Software update",
          "expanded": "Included in automated software update"
        },
        {
          "value": "Instant messaging",
          "expanded": "Instant Messaging"
        },
        {
          "value": "Email attachment",
          "expanded": "Email via user-executed attachment"
        },
        {
          "value": "Direct install",
          "expanded": "Directly installed or inserted by threat agent (after system access)"
        },
        {
          "value": "Download by malware",
          "expanded": "Downloaded and installed by local malware"
        },
        {
          "value": "Removable media",
          "expanded": "Removable storage media or devices"
        },
        {
          "value": "Web drive-by",
          "expanded": "Web via auto-executed or \"drive-by\" infection"
        },
        {
          "value": "Email link",
          "expanded": "Email via embedded link"
        },
        {
          "value": "Network propagation",
          "expanded": "Network propagation"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Email autoexecute",
          "expanded": "Email via automatic execution"
        },
        {
          "value": "Web download",
          "expanded": "Web via user-executed or downloaded content"
        },
        {
          "value": "Other",
          "expanded": "Other"
        }
      ]
    },
    {
      "predicate": "action:malware:variety",
      "entry": [
        {
          "value": "Spam",
          "expanded": "Send spam"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Packet sniffer",
          "expanded": "Packet sniffer (capture data from network)"
        },
        {
          "value": "Backdoor",
          "expanded": "Backdoor (enable remote access)"
        },
        {
          "value": "Exploit vuln",
          "expanded": "Exploit vulnerability in code (vs misconfig or weakness)"
        },
        {
          "value": "Other",
          "expanded": "Other"
        },
        {
          "value": "Password dumper",
          "expanded": "Password dumper (extract credential hashes)"
        },
        {
          "value": "Scan network",
          "expanded": "Scan or footprint network"
        },
        {
          "value": "Downloader",
          "expanded": "Downloader (pull updates or other malware) "
        },
        {
          "value": "Adminware",
          "expanded": "System or network utilities (e.g., PsTools, Netcat)"
        },
        {
          "value": "Click fraud",
          "expanded": "Click fraud or Bitcoin mining"
        },
        {
          "value": "Adware",
          "expanded": "Adware"
        },
        {
          "value": "C2",
          "expanded": "Command and control (C2)"
        },
        {
          "value": "Worm",
          "expanded": "Worm (propagate to other systems or devices)"
        },
        {
          "value": "Spyware/Keylogger",
          "expanded": "Spyware, keylogger or form-grabber (capture user input or activity)"
        },
        {
          "value": "Brute force",
          "expanded": "Brute force attack"
        },
        {
          "value": "Capture app data",
          "expanded": "Capture data from application or system process"
        },
        {
          "value": "Ram scraper",
          "expanded": "Ram scraper or memory parser (capture data from volatile memory)"
        },
        {
          "value": "Disable controls",
          "expanded": "Disable or interfere with security controls"
        },
        {
          "value": "Capture stored data",
          "expanded": "Capture data stored on system disk"
        },
        {
          "value": "Ransomware",
          "expanded": "Ransomware (encrypt or seize stored data)"
        },
        {
          "value": "Export data",
          "expanded": "Export data to another site or system"
        },
        {
          "value": "Client-side attack",
          "expanded": "Client-side or browser attack (e.g., redirection, XSS, MitB)"
        },
        {
          "value": "SQL injection",
          "expanded": "SQL injection attack"
        },
        {
          "value": "Rootkit",
          "expanded": "Rootkit (maintain local privileges and stealth)"
        },
        {
          "value": "Destroy data",
          "expanded": "Destroy or corrupt stored data"
        },
        {
          "value": "DoS",
          "expanded": "DoS attack"
        }
      ]
    },
    {
      "predicate": "action:social:vector",
      "entry": [
        {
          "value": "In-person",
          "expanded": "In-person"
        },
        {
          "value": "Social media",
          "expanded": "Social media or networking"
        },
        {
          "value": "Documents",
          "expanded": "Documents"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "SMS",
          "expanded": "SMS or texting"
        },
        {
          "value": "Phone",
          "expanded": "Phone"
        },
        {
          "value": "Website",
          "expanded": "Website"
        },
        {
          "value": "Other",
          "expanded": "Other"
        },
        {
          "value": "IM",
          "expanded": "Instant messaging"
        },
        {
          "value": "Removable media",
          "expanded": "Removable storage media"
        },
        {
          "value": "Email",
          "expanded": "Email"
        },
        {
          "value": "Software",
          "expanded": "Software"
        }
      ]
    },
    {
      "predicate": "action:social:target",
      "entry": [
        {
          "value": "Customer",
          "expanded": "Customer (B2C)"
        },
        {
          "value": "End-user",
          "expanded": "End-user or regular employee"
        },
        {
          "value": "Human resources",
          "expanded": "Human resources staff"
        },
        {
          "value": "Finance",
          "expanded": "Finance or accounting staff"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Helpdesk",
          "expanded": "Helpdesk staff"
        },
        {
          "value": "Executive",
          "expanded": "Executive or upper management"
        },
        {
          "value": "Cashier",
          "expanded": "Cashier, teller or waiter"
        },
        {
          "value": "Manager",
          "expanded": "Manager or supervisor"
        },
        {
          "value": "Former employee",
          "expanded": "Former employee"
        },
        {
          "value": "Guard",
          "expanded": "Security guard"
        },
        {
          "value": "Other",
          "expanded": "Other"
        },
        {
          "value": "Auditor",
          "expanded": "Auditor"
        },
        {
          "value": "Maintenance",
          "expanded": "Maintenance or janitorial staff"
        },
        {
          "value": "Call center",
          "expanded": "Call center staff"
        },
        {
          "value": "Partner",
          "expanded": "Partner (B2B)"
        },
        {
          "value": "System admin",
          "expanded": "System or network administrator"
        },
        {
          "value": "Developer",
          "expanded": "Software developer"
        }
      ]
    },
    {
      "predicate": "action:social:variety",
      "entry": [
        {
          "value": "Scam",
          "expanded": "Online scam or hoax (e.g., scareware, 419 scam, auction fraud)"
        },
        {
          "value": "Phishing",
          "expanded": "Phishing (or any type of *ishing)"
        },
        {
          "value": "Elicitation",
          "expanded": "Elicitation (subtle extraction of info through conversation)"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Spam",
          "expanded": "Spam (unsolicited or undesired email and advertisements)"
        },
        {
          "value": "Influence",
          "expanded": "Influence tactics (Leveraging authority or obligation, framing, etc)"
        },
        {
          "value": "Propaganda",
          "expanded": "Propaganda or disinformation"
        },
        {
          "value": "Forgery",
          "expanded": "Forgery or counterfeiting (fake hardware, software, documents, etc)"
        },
        {
          "value": "Bribery",
          "expanded": "Bribery or solicitation"
        },
        {
          "value": "Other",
          "expanded": "Other"
        },
        {
          "value": "Pretexting",
          "expanded": "Pretexting (dialogue leveraging invented scenario)"
        },
        {
          "value": "Extortion",
          "expanded": "Extortion or blackmail"
        },
        {
          "value": "Baiting",
          "expanded": "Baiting (planting infected media)"
        }
      ]
    },
    {
      "predicate": "action:environmental:variety",
      "entry": [
        {
          "value": "Hazmat",
          "expanded": "Hazardous material"
        },
        {
          "value": "Temperature",
          "expanded": "Extreme temperature"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Hurricane",
          "expanded": "Hurricane"
        },
        {
          "value": "Ice",
          "expanded": "Ice and snow"
        },
        {
          "value": "Meteorite",
          "expanded": "Meteorite"
        },
        {
          "value": "Other",
          "expanded": "Other"
        },
        {
          "value": "Pathogen",
          "expanded": "Pathogen"
        },
        {
          "value": "Landslide",
          "expanded": "Landslide"
        },
        {
          "value": "Tornado",
          "expanded": "Tornado"
        },
        {
          "value": "Leak",
          "expanded": "Water leak"
        },
        {
          "value": "Earthquake",
          "expanded": "Earthquake"
        },
        {
          "value": "Particulates",
          "expanded": "Particulate matter (e.g., dust, smoke)"
        },
        {
          "value": "Power failure",
          "expanded": "Power failure or fluctuation"
        },
        {
          "value": "EMI",
          "expanded": "Electromagnetic interference (EMI)"
        },
        {
          "value": "Humidity",
          "expanded": "Humidity"
        },
        {
          "value": "Tsunami",
          "expanded": "Tsunami"
        },
        {
          "value": "ESD",
          "expanded": "Electrostatic discharge (ESD)"
        },
        {
          "value": "Deterioration",
          "expanded": "Deterioration and degradation"
        },
        {
          "value": "Volcano",
          "expanded": "Volcanic eruption"
        },
        {
          "value": "Lightning",
          "expanded": "Lightning"
        },
        {
          "value": "Wind",
          "expanded": "Wind"
        },
        {
          "value": "Flood",
          "expanded": "Flood"
        },
        {
          "value": "Vermin",
          "expanded": "Vermin"
        },
        {
          "value": "Fire",
          "expanded": "Fire"
        }
      ]
    },
    {
      "predicate": "action:error:vector",
      "entry": [
        {
          "value": "Random error",
          "expanded": "Random error (no reason, no fault)"
        },
        {
          "value": "Carelessness",
          "expanded": "Carelessness"
        },
        {
          "value": "Other",
          "expanded": "Other"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Inadequate processes",
          "expanded": "Inadequate or insufficient processes"
        },
        {
          "value": "Inadequate technology",
          "expanded": "Inadequate or insufficient technology resources"
        },
        {
          "value": "Inadequate personnel",
          "expanded": "Inadequate or insufficient personnel"
        }
      ]
    },
    {
      "predicate": "action:error:variety",
      "entry": [
        {
          "value": "Disposal error",
          "expanded": "Disposal error"
        },
        {
          "value": "Omission",
          "expanded": "Omission (something intended, but not done)"
        },
        {
          "value": "Loss",
          "expanded": "Loss or misplacement"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Maintenance error",
          "expanded": "Maintenance error"
        },
        {
          "value": "Misinformation",
          "expanded": "Misinformation (unintentionally giving false info)"
        },
        {
          "value": "Physical accidents",
          "expanded": "Physical accidents (e.g., drops, bumps, spills)"
        },
        {
          "value": "Publishing error",
          "expanded": "Publishing error (private info to public doc or site)"
        },
        {
          "value": "Malfunction",
          "expanded": "Technical malfunction or glitch"
        },
        {
          "value": "Capacity shortage",
          "expanded": "Poor capacity planning"
        },
        {
          "value": "Other",
          "expanded": "Other"
        },
        {
          "value": "Programming error",
          "expanded": "Programming error (flaws or bugs in custom code)"
        },
        {
          "value": "Data entry error",
          "expanded": "Data entry error"
        },
        {
          "value": "Gaffe",
          "expanded": "Gaffe (social or verbal slip)"
        },
        {
          "value": "Misconfiguration",
          "expanded": "Misconfiguration"
        },
        {
          "value": "Misdelivery",
          "expanded": "Misdelivery (send wrong info or to wrong recipient)"
        },
        {
          "value": "Classification error",
          "expanded": "Classification or labeling error"
        }
      ]
    },
    {
      "predicate": "action:misuse:vector",
      "entry": [
        {
          "value": "Physical access",
          "expanded": "Physical access within corporate facility"
        },
        {
          "value": "Remote access",
          "expanded": "Remote access connection to corporate network (i.e. VPN)"
        },
        {
          "value": "LAN access",
          "expanded": "Local network access within corporate facility"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Non-corporate",
          "expanded": "Non-corporate facilities or networks"
        },
        {
          "value": "Other",
          "expanded": "Other"
        }
      ]
    },
    {
      "predicate": "action:misuse:variety",
      "entry": [
        {
          "value": "Unapproved software",
          "expanded": "Use of unapproved software or services"
        },
        {
          "value": "Illicit content",
          "expanded": "Storage or distribution of illicit content"
        },
        {
          "value": "Unapproved workaround",
          "expanded": "Unapproved workaround or shortcut"
        },
        {
          "value": "Unapproved hardware",
          "expanded": "Use of unapproved hardware or devices"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Email misuse",
          "expanded": "Inappropriate use of email or IM"
        },
        {
          "value": "Possession abuse",
          "expanded": "Abuse of physical access to asset"
        },
        {
          "value": "Other",
          "expanded": " Other"
        },
        {
          "value": "Net misuse",
          "expanded": "Inappropriate use of network or Web access"
        },
        {
          "value": "Data mishandling",
          "expanded": "Handling of data in an unapproved manner"
        },
        {
          "value": "Privilege abuse",
          "expanded": "Abuse of system access privileges"
        },
        {
          "value": "Knowledge abuse",
          "expanded": "Abuse of private or entrusted knowledge"
        }
      ]
    },
    {
      "predicate": "action:hacking:vector",
      "entry": [
        {
          "value": "Physical access",
          "expanded": "Physical access or connection (i.e., at keyboard or via cable) "
        },
        {
          "value": "Command shell",
          "expanded": "Remote shell"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Backdoor or C2",
          "expanded": "Backdoor or command and control channel"
        },
        {
          "value": "Web application",
          "expanded": "Web application"
        },
        {
          "value": "Desktop sharing",
          "expanded": "Graphical desktop sharing (RDP, VNC, PCAnywhere, Citrix)"
        },
        {
          "value": "3rd party desktop",
          "expanded": "3rd party online desktop sharing (LogMeIn, Go2Assist)"
        },
        {
          "value": "Partner",
          "expanded": "Partner connection or credential"
        },
        {
          "value": "VPN",
          "expanded": "VPN"
        },
        {
          "value": "Other",
          "expanded": "Other"
        }
      ]
    },
    {
      "predicate": "action:hacking:variety",
      "entry": [
        {
          "value": "XSS",
          "expanded": "Cross-site scripting"
        },
        {
          "value": "HTTP Response Splitting",
          "expanded": "HTTP Response Splitting"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Buffer overflow",
          "expanded": "Buffer overflow"
        },
        {
          "value": "Format string attack",
          "expanded": "Format string attack"
        },
        {
          "value": "LDAP injection",
          "expanded": "LDAP injection"
        },
        {
          "value": "SSI injection",
          "expanded": "SSI injection"
        },
        {
          "value": "MitM",
          "expanded": "Man-in-the-middle attack"
        },
        {
          "value": "Path traversal",
          "expanded": "Path traversal"
        },
        {
          "value": "URL redirector abuse",
          "expanded": "URL redirector abuse"
        },
        {
          "value": "Use of backdoor or C2",
          "expanded": "Use of Backdoor or C2 channel"
        },
        {
          "value": "Mail command injection",
          "expanded": "Mail command injection"
        },
        {
          "value": "Virtual machine escape",
          "expanded": "Virtual machine escape"
        },
        {
          "value": "OS commanding",
          "expanded": "OS commanding"
        },
        {
          "value": "Soap array abuse",
          "expanded": "Soap array abuse"
        },
        {
          "value": "Footprinting",
          "expanded": "Footprinting and fingerprinting"
        },
        {
          "value": "Cryptanalysis",
          "expanded": "Cryptanalysis"
        },
        {
          "value": "SQLi",
          "expanded": "SQL injection"
        },
        {
          "value": "XML external entities",
          "expanded": "XML external entities"
        },
        {
          "value": "Abuse of functionality",
          "expanded": "Abuse of functionality"
        },
        {
          "value": "XML injection",
          "expanded": "XML injection"
        },
        {
          "value": "Routing detour",
          "expanded": "Routing detour"
        },
        {
          "value": "HTTP response smuggling",
          "expanded": "HTTP response smuggling"
        },
        {
          "value": "Forced browsing",
          "expanded": "Forced browsing or predictable resource location"
        },
        {
          "value": "Cache poisoning",
          "expanded": "Cache poisoning"
        },
        {
          "value": "Null byte injection",
          "expanded": "Null byte injection"
        },
        {
          "value": "Reverse engineering",
          "expanded": "Reverse engineering"
        },
        {
          "value": "Brute force",
          "expanded": "Brute force or password guessing attacks"
        },
        {
          "value": "Fuzz testing",
          "expanded": "Fuzz testing"
        },
        {
          "value": "Offline cracking",
          "expanded": "Offline password or key cracking (e.g., rainbow tables, Hashcat, JtR)"
        },
        {
          "value": "CSRF",
          "expanded": "Cross-site request forgery"
        },
        {
          "value": "XML entity expansion",
          "expanded": "XML entity expansion"
        },
        {
          "value": "RFI",
          "expanded": "Remote file inclusion"
        },
        {
          "value": "Session fixation",
          "expanded": "Session fixation"
        },
        {
          "value": "Integer overflows",
          "expanded": "Integer overflows"
        },
        {
          "value": "XQuery injection",
          "expanded": "XQuery injection"
        },
        {
          "value": "Pass-the-hash",
          "expanded": "Pass-the-hash"
        },
        {
          "value": "XML attribute blowup",
          "expanded": "XML attribute blowup"
        },
        {
          "value": "Session prediction",
          "expanded": "Credential or session prediction"
        },
        {
          "value": "Use of stolen creds",
          "expanded": "Use of stolen authentication credentials"
        },
        {
          "value": "HTTP request smuggling",
          "expanded": "HTTP request smuggling"
        },
        {
          "value": "XPath injection",
          "expanded": "XPath injection"
        },
        {
          "value": "Other",
          "expanded": "Other"
        },
        {
          "value": "DoS",
          "expanded": "Denial of service"
        },
        {
          "value": "Special element injection",
          "expanded": "Special element injection"
        },
        {
          "value": "HTTP request splitting",
          "expanded": "HTTP request splitting"
        },
        {
          "value": "Session replay",
          "expanded": "Session replay"
        }
      ]
    },
    {
      "predicate": "action:physical:vector",
      "entry": [
        {
          "value": "Personal vehicle",
          "expanded": "Personal vehicle"
        },
        {
          "value": "Visitor privileges",
          "expanded": "Given temporary visitor access"
        },
        {
          "value": "Public facility",
          "expanded": "Public facility or area"
        },
        {
          "value": "Victim grounds",
          "expanded": "Victim outdoor grounds"
        },
        {
          "value": "Uncontrolled location",
          "expanded": "The location was uncontrolled (public)"
        },
        {
          "value": "Partner vehicle",
          "expanded": "Partner vehicle (e.g., delivery truck)"
        },
        {
          "value": "Victim work area",
          "expanded": "Victim private or work area (e.g., office space)"
        },
        {
          "value": "Victim secure area",
          "expanded": "Victim high security area (e.g., server room, R&D labs)"
        },
        {
          "value": "Partner facility",
          "expanded": "Partner facility or area"
        },
        {
          "value": "Personal residence",
          "expanded": "Personal residence"
        },
        {
          "value": "Other",
          "expanded": "Other"
        },
        {
          "value": "Public vehicle",
          "expanded": "Public vehicle (e.g., plane, taxi)"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Victim public area",
          "expanded": "Victim public or customer area (e.g., lobby, storefront)"
        },
        {
          "value": "Privileged access",
          "expanded": "Held privileged access to location"
        }
      ]
    },
    {
      "predicate": "action:physical:variety",
      "entry": [
        {
          "value": "Skimmer",
          "expanded": "Installing card skimming device"
        },
        {
          "value": "Snooping",
          "expanded": "Snooping (sneak about to gain info or access)"
        },
        {
          "value": "Tampering",
          "expanded": "Tampering (alter physical form or function)"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Theft",
          "expanded": "Theft (taking assets without permission)"
        },
        {
          "value": "Connection",
          "expanded": "Connection"
        },
        {
          "value": "Surveillance",
          "expanded": "Surveillance (monitoring and observation)"
        },
        {
          "value": "Assault",
          "expanded": "Assault (threats or acts of physical violence)"
        },
        {
          "value": "Other",
          "expanded": "Other"
        },
        {
          "value": "Wiretapping",
          "expanded": "Wiretapping (Physical tap to comms line)"
        },
        {
          "value": "Bypassed controls",
          "expanded": "Bypassed physical barriers or controls"
        },
        {
          "value": "Disabled controls",
          "expanded": "Disabled physical barriers or controls"
        },
        {
          "value": "Destruction",
          "expanded": "Destruction (deliberate damaging or disabling)"
        }
      ]
    },
    {
      "predicate": "attribute:confidentiality:data:variety",
      "entry": [
        {
          "value": "Source code",
          "expanded": "Source code"
        },
        {
          "value": "Personal",
          "expanded": "Personal or identifying information (e.g., addr, ID#, credit score)"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown"
        },
        {
          "value": "Medical",
          "expanded": "Medical records"
        },
        {
          "value": "Classified",
          "expanded": "Classified information"
        },
        {
          "value": "System",
          "expanded": "System information (e.g., config info, open services)"
        },
        {
          "value": "Digital certificate",
          "expanded": "Digital certificate"
        },
        {
          "value": "Secrets",
          "expanded": "Trade secrets"
        },
        {
          "value": "Internal",
          "expanded": "Sensitive internal data (e.g., plans, reports, emails)"
        },
        {
          "value": "Virtual currency",
          "expanded": "Virtual currency"
        },
        {
          "value": "Copyrighted",
          "expanded": "Copyrighted material"
        },
        {
          "value": "Credentials",
          "expanded": "Authentication credentials (e.g., pwds, OTPs, biometrics)"
        },
        {
          "value": "Other",
          "expanded": "Other"
        },
        {
          "value": "Payment",
          "expanded": "Payment card data (e.g., PAN, PIN, CVV2, Expiration)"
        },
        {
          "value": "Bank",
          "expanded": "Bank account data"
        }
      ]
    }
  ],
  "predicates": [
    {
      "value": "iso_currency_code"
    },
    {
      "value": "confidence"
    },
    {
      "value": "targeted"
    },
    {
      "value": "discovery_method"
    },
    {
      "value": "cost_corrective_action"
    },
    {
      "value": "security_incident"
    },
    {
      "value": "country"
    },
    {
      "value": "impact:overall_rating"
    },
    {
      "value": "actor:motive"
    },
    {
      "value": "asset:management"
    },
    {
      "value": "asset:variety"
    },
    {
      "value": "asset:accessibility"
    },
    {
      "value": "asset:governance"
    },
    {
      "value": "asset:hosting"
    },
    {
      "value": "asset:ownership"
    },
    {
      "value": "asset:cloud"
    },
    {
      "value": "victim:employee_count"
    },
    {
      "value": "timeline:unit"
    },
    {
      "value": "impact:loss:rating"
    },
    {
      "value": "impact:loss:variety"
    },
    {
      "value": "attribute:integrity:variety"
    },
    {
      "value": "attribute:availability:variety"
    },
    {
      "value": "attribute:confidentiality:data_victim"
    },
    {
      "value": "attribute:confidentiality:state"
    },
    {
      "value": "attribute:confidentiality:data_disclosure"
    },
    {
      "value": "actor:internal:job_change"
    },
    {
      "value": "actor:internal:variety"
    },
    {
      "value": "actor:external:variety"
    },
    {
      "value": "action:malware:vector"
    },
    {
      "value": "action:malware:variety"
    },
    {
      "value": "action:social:vector"
    },
    {
      "value": "action:social:target"
    },
    {
      "value": "action:social:variety"
    },
    {
      "value": "action:environmental:variety"
    },
    {
      "value": "action:error:vector"
    },
    {
      "value": "action:error:variety"
    },
    {
      "value": "action:misuse:vector"
    },
    {
      "value": "action:misuse:variety"
    },
    {
      "value": "action:hacking:vector"
    },
    {
      "value": "action:hacking:variety"
    },
    {
      "value": "action:physical:vector"
    },
    {
      "value": "action:physical:variety"
    },
    {
      "value": "attribute:confidentiality:data:variety"
    }
  ]
}