Attributes
SecurityIncident	_securityIncident
String	attackVector	Attack method chosen from the following enumerated list: Exploited New Vulnerability Exploited Known Vulnerability Self Propagating Malicious Logic Insider Purposeful Insider Accidental Distributed Network Activity Non Distributed Network Activity Network Scan System Scan Compromise Through Another System Reconnaissance Unknown/NA Other (See Comment)
String	description	Free text field descriping the attack method
String	rootCause	Description of the root cause of the attack

 _securityIncident

Public SecurityIncident _securityIncident

Constraints:

Properties:

Aggregation	None
Alias
Association	SecurityIncidentAttackedUsing
Association End
Class	SecurityIncidentAttackMethod
Datatype
Default
Default Value
Is Composite	false
Is Derived	false
Is Derived Union	false
Is Leaf	false
Is Ordered	false
Is Read Only	false
Is Static	false
Is Unique	true
Keywords
Lower	1
Lower Value	(1)
Multiplicity	1
Name	_securityIncident
Name Expression
Namespace	SecurityIncidentAttackMethod
Opposite	_securityIncidentAttackMethod
Owner	SecurityIncidentAttackMethod
Owning Association
Owning Template Parameter
Qualified Name	SID Models::Enterprise Domain::Enterprise Risk ABE::Enterprise Security ABE::Security Incident ABE::SecurityIncidentAttackMethod::_securityIncident
Stereotype
Template Parameter
Type	SecurityIncident
Upper	1
Upper Value	(1)
Visibility	Public

 attackVector

Public String attackVector

Attack method chosen from the following enumerated list:

Exploited New Vulnerability
Exploited Known Vulnerability
Self Propagating Malicious Logic
Insider Purposeful
Insider Accidental
Distributed Network Activity
Non Distributed Network Activity
Network Scan
System Scan
Compromise Through Another System
Reconnaissance
Unknown/NA
Other (See Comment)

Constraints:

Properties:

Aggregation	None
Alias
Association
Association End
Class	SecurityIncidentAttackMethod
Datatype
Default
Default Value
Is Composite	false
Is Derived	false
Is Derived Union	false
Is Leaf	false
Is Ordered	false
Is Read Only	false
Is Static	false
Is Unique	true
Keywords
Lower	0
Lower Value	(0)
Multiplicity	0..1
Name	attackVector
Name Expression
Namespace	SecurityIncidentAttackMethod
Opposite
Owner	SecurityIncidentAttackMethod
Owning Association
Owning Template Parameter
Qualified Name	SID Models::Enterprise Domain::Enterprise Risk ABE::Enterprise Security ABE::Security Incident ABE::SecurityIncidentAttackMethod::attackVector
Stereotype	required
Template Parameter
Type	String
Upper	1
Upper Value	(1)
Visibility	Public

 description

Public String description

Free text field descriping the attack method

Constraints:

Properties:

Aggregation	None
Alias
Association
Association End
Class	SecurityIncidentAttackMethod
Datatype
Default
Default Value
Is Composite	false
Is Derived	false
Is Derived Union	false
Is Leaf	false
Is Ordered	false
Is Read Only	false
Is Static	false
Is Unique	true
Keywords
Lower	0
Lower Value	(0)
Multiplicity	0..1
Name	description
Name Expression
Namespace	SecurityIncidentAttackMethod
Opposite
Owner	SecurityIncidentAttackMethod
Owning Association
Owning Template Parameter
Qualified Name	SID Models::Enterprise Domain::Enterprise Risk ABE::Enterprise Security ABE::Security Incident ABE::SecurityIncidentAttackMethod::description
Stereotype	required
Template Parameter
Type	String
Upper	1
Upper Value	(1)
Visibility	Public

 rootCause

Public String rootCause

Description of the root cause of the attack

Constraints:

Properties:

Aggregation	None
Alias
Association
Association End
Class	SecurityIncidentAttackMethod
Datatype
Default
Default Value
Is Composite	false
Is Derived	false
Is Derived Union	false
Is Leaf	false
Is Ordered	false
Is Read Only	false
Is Static	false
Is Unique	true
Keywords
Lower	0
Lower Value	(0)
Multiplicity	0..1
Name	rootCause
Name Expression
Namespace	SecurityIncidentAttackMethod
Opposite
Owner	SecurityIncidentAttackMethod
Owning Association
Owning Template Parameter
Qualified Name	SID Models::Enterprise Domain::Enterprise Risk ABE::Enterprise Security ABE::Security Incident ABE::SecurityIncidentAttackMethod::rootCause
Stereotype	required
Template Parameter
Type	String
Upper	1
Upper Value	(1)
Visibility	Public

• Describes the attack used that caused the incident. The attack method is the method used by the Threat Actor to impact the IT service.