Detection objective (DOM) A detection objective defines what to detect: prioritized signals, composition strategy, and links to threat vectors. Schema identifier: `objective::1.0`.
The document MUST declare metadata.schema: objective::1.0.
name and top-level composition MUST be present.objective body MUST include at least one signals entry.Each signal MUST have name, uuid, description, severity, methodology, entities, and data.
objective.composition MUST mirror the top-level composition strategy and description.objective.threats entries MUST reference valid threat UUIDs when cross-validation is enabled.references MAY be omitted.
Field Type Required Default Description namestring yes — Objective display name metadataObjectMetadata yes — See metadata.md compositionObjectiveComposition yes — Top-level composition block objectiveObjectiveBody yes — Detection objective body referencesObjectReferences no null External and internal references
Field Type Required Description strategystring yes Detection composition strategy vocabulary descriptionstring yes How signals compose
Field Type Required Default Description prioritystring yes — Priority level typestring yes — Detection type vocabulary descriptionstring yes — Objective narrative signalslist[DetectionSignal] yes — Detection signals (min 1) compositionObjectiveComposition yes — Nested composition (same semantics as top-level) investmentstring no null Investment level threatslist[string] no null Threat vector UUIDs attacklist[string] no null ATT&CK technique IDs
Field Type Required Default Description namestring yes — Signal name uuidstring yes — Signal UUID descriptionstring yes — Signal description severitystring yes — Severity vocabulary dataSignalData yes — Data availability and requirements methodologystring yes — Detection methodology vocabulary entitieslist[string] yes — Signal entity vocabulary values effortinteger no null Recovery effort (NIST 800-61) detectorslist[ExternalDetector] no null External detector references exampleslist[DetectionExample] no null Example queries parentstring no null Parent signal UUID
Field Type Required Description availabilitystring yes Data availability level requirementsstring yes Data source requirements logsourceslist[string] no MITRE data source references
Field Type Required Description namestring yes Detector name technologystring yes Technology identifier descriptionstring yes Detector description linkstring no Reference URL
Field Type Required Description descriptionstring yes Example description linkstring yes Example URL languagestring no Query language querystring no Example query text
metadata.md — shared metadatathreat-1.0.md — referenced by objective.threatsrule-1.0.md — rules reference objectives via detection_model (objective UUID)Vocabularies: detection.composition, detection.types, detection.methodology, signal.entities, severity, datasources, efforts
No object-level configuration overrides. See configuration.md .
name : Credential Access Objective metadata : uuid : 00000000-0000-4000-8002-000000000001 schema : objective::1.0 version : 1 tlp : clear composition : # top-level: mirrors objective.composition strategy : synergetic description : Compose signals for credential access detection objective : priority : High type : Threat description : Detect credential access techniques composition : # same strategy + description as above strategy : synergetic description : Compose signals for credential access detection threats : - 00000000-0000-4000-8001-000000000001 # → threat UUID signals : - name : Suspicious logon signal uuid : 00000000-0000-4000-8099-000000000001 description : Suspicious authentication activity severity : Medium methodology : analytics entities : [ host ] data : availability : Complete requirements : Security event logs Version Date Notes 1.0 2026-06-25 Initial spec from opentide models/objective.py
