malware-development-environment.json

{
    "$schema": "http://json-schema.org/draft-04/schema#",
    "definitions": {
        "malware-development-environment": {
            "title": "MalwareDevelopmentEnvironment",
            "type": "object",
            "description": "Captures details of the development environment used in developing the malware instance, such as information on any tools that were used.",
            "properties": {
                "tool_refs": {
                    "type": "array",
                    "items": {"type": "string"},
                    "description": "References the tools used in the development of the malware instance. The Objects referenced MUST be of STIX type software and MUST be specified in the observable_objects property of the Package."
                },
                "debugging_file_refs": {
                    "type": "array",
                    "items": {"type": "string"},
                    "description": "References debugging files associated with the malware instance, such as PDB files. The Objects referenced MUST be of STIX type file and MUST be specified in the observable_objects property of the Package."
                }
            },
            "anyOf": [
                {"required": ["tool_refs"]},
                {"required": ["debugging_file_refs"]}
            ]
        }
    }
}