Detailed Observation Example w/ Actions

example.json

{
    "type": "package",
    "spec_version": "stix-2.0",
    "observations": [{
        "type": "observation",
        "id": "observation--1",
        "spec_version": "stix-2.0",
        "created_at": "2016-03-21T01:01:01Z",
        "observed_at": "2016-03-20T12:33:22Z",
        "cybox": {
            "actions": [{
                "id": "action--1",
                "type": "cybox-action",
                "name": "create network connection",
                "associated_objects": [
                    {
                        "type": "associated-object",
                        "object_ref": "network-connection--1",
                        "association": "output of"
                    },
                    {
                        "type": "associated-object",
                        "object_ref": "process-object--1",
                        "association": "initiator of"
                    }
                ]
            }],
            "objects": [
                {
                    "type": "network-connection",
                    "id": "network-connection--1",
                    "spec_version": "cybox-3.0",
                    "protocols":{"layer7":"http"}
                },
                {
                    "type": "ipv4-addr-object",
                    "id": "ip-address--1",
                    "spec_version": "cybox-3.0",
                    "value": "1.2.3.4"
                },
                {
                    "type": "domain-name-object",
                    "id": "domain-name--1",
                    "spec_version": "cybox-3.0",
                    "value": "http://foo.bar.com"
                },
                {
                    "type": "email-message-object",
                    "id": "email-message--1",
                    "spec_version": "cybox-3.0",
                    "from": "[email protected]",
                    "subject": "Check this out!"
                },
                {
                    "type": "file-object",
                    "id": "file-object--1",
                    "hashes": {"md5": "B4D33B0C7306351B9ED96578465C5579"}
                },
                {
                    "type": "file-object",
                    "id": "file-object--2",
                    "hashes": {"md5": "FFCCAADC7306351B9ED96578465C5579"}
                },
                {
                    "type": "process-object",
                    "id": "process-object--1",
                    "pid":1234
                }
            ],
            "relationships": [
                {
                    "type": "object-relationship",
                    "id": "object-relationship--1",
                    "spec_version": "cybox-3.0",
                    "source_ref": "email-message--1",
                    "target_ref": "file-object--1",
                    "kind_of_relationship": "has-attachment"
                },
                {
                    "type": "object-relationship",
                    "id": "object-relationship--2",
                    "spec_version": "cybox-3.0",
                    "source_ref": "file-object--1",
                    "target_ref": "file-object--2",
                    "kind_of_relationship": "contains"
                },
                {
                    "type": "object-relationship",
                    "id": "object-relationship--3",
                    "spec_version": "cybox-3.0",
                    "source_ref": "file-object--2",
                    "target_ref": "proces-object--1",
                    "kind_of_relationship": "image-of"
                },
                {
                    "type": "object-relationship",
                    "id": "object-relationship--4",
                    "spec_version": "cybox-3.0",
                    "source_ref": "domain-name--1",
                    "target_ref": "network-connection--1",
                    "kind_of_relationship": "destination-of"
                },
                {
                    "type": "object-relationship",
                    "id": "object-relationship--5",
                    "spec_version": "cybox-3.0",
                    "source_ref": "domain-name--1",
                    "target_ref": "ip-address--1",
                    "kind_of_relationship": "resolves-to"
                }
            ]
        }
    }]
}