From f04d44977fbc10424e6388f115d0745436469c35 Mon Sep 17 00:00:00 2001 From: Alex Nelson Date: Thu, 20 Mar 2025 11:42:58 -0400 Subject: [PATCH 1/7] Spear Phishing: Map unmapped concepts TemporalInterval and intervalIn A separate patch series will add review shapes. A follow-on patch will regenerate Make-managed files. References: * https://github.com/ucoProject/UCO-Profile-Time * https://github.com/ucoProject/UCO/issues/651 Signed-off-by: Alex Nelson --- .../illustrations/spear_phishing/drafting.ttl | 21 +++++++++- .../spear_phishing/spear_phishing.json | 38 +++++++++++++------ 2 files changed, 46 insertions(+), 13 deletions(-) diff --git a/examples/illustrations/spear_phishing/drafting.ttl b/examples/illustrations/spear_phishing/drafting.ttl index 482d13a8..cbf25660 100644 --- a/examples/illustrations/spear_phishing/drafting.ttl +++ b/examples/illustrations/spear_phishing/drafting.ttl @@ -1,8 +1,10 @@ +@prefix drafting: . @prefix ep: . @prefix owl: . @prefix rdf: . @prefix rdfs: . @prefix sh: . +@prefix time: . @prefix uco-core: . @prefix unmapped: . @prefix xsd: . @@ -12,6 +14,17 @@ uco-core:UcoThing-identifier-regex-shape sh:deactivated "true"^^xsd:boolean ; . +drafting:Perdurant + a owl:Class ; + rdfs:subClassOf uco-core:UcoObject ; + rdfs:isDefinedBy ; + . + +drafting:intervalIn + a owl:ObjectProperty ; + rdfs:isDefinedBy ; + . + ep:bearerOf-shape a sh:PropertyShape ; sh:message "This property is unmapped and intended to be replaced."@en ; @@ -107,8 +120,7 @@ ep:intervalIn-shape sh:message "This property is unmapped and intended to be replaced."@en ; sh:maxCount 0 ; sh:path unmapped:intervalIn ; - sh:severity sh:Info ; - sh:targetClass uco-core:UcoThing ; + sh:targetSubjectsOf unmapped:intervalIn ; . ep:isCarrierOf-shape @@ -194,3 +206,8 @@ ep:uses-shape sh:targetClass uco-core:UcoThing ; . +time:Interval + a owl:Class ; + rdfs:isDefinedBy time:2016 ; + . + diff --git a/examples/illustrations/spear_phishing/spear_phishing.json b/examples/illustrations/spear_phishing/spear_phishing.json index 8dc61197..3e86c4e3 100644 --- a/examples/illustrations/spear_phishing/spear_phishing.json +++ b/examples/illustrations/spear_phishing/spear_phishing.json @@ -1,9 +1,11 @@ { "@context": { + "drafting": "http://example.org/ontology/drafting/", "kb": "http://www.semanticweb.org/OpenCyberSecurityAlliance/Ontology/EndpointProtection/", "owl": "http://www.w3.org/2002/07/owl#", "rdf": "http://www.w3.org/1999/02/22-rdf-syntax-ns#", "rdfs": "http://www.w3.org/2000/01/rdf-schema#", + "time": "http://www.w3.org/2006/time#", "uco-action": "https://ontology.unifiedcyberontology.org/uco/action/", "uco-core": "https://ontology.unifiedcyberontology.org/uco/core/", "uco-identity": "https://ontology.unifiedcyberontology.org/uco/identity/", @@ -275,7 +277,7 @@ "@id": "kb:ActOfFileFlagging01" } ], - "unmapped:intervalIn": { + "drafting:intervalIn": { "@id": "kb:TemporalInterval03" } }, @@ -373,7 +375,7 @@ "@id": "kb:ActOfMalwareInstallation01" } ], - "unmapped:intervalIn": { + "drafting:intervalIn": { "@id": "kb:TemporalInterval02" }, "unmapped:precedes": { @@ -457,7 +459,7 @@ "@id": "kb:ActOfLinkOpening01" } ], - "unmapped:intervalIn": { + "drafting:intervalIn": { "@id": "kb:TemporalInterval01" }, "unmapped:precedes": { @@ -486,15 +488,15 @@ }, { "@id": "kb:TemporalInterval01", - "@type": "uco-core:UcoThing" + "@type": "kb:TemporalInterval" }, { "@id": "kb:TemporalInterval02", - "@type": "uco-core:UcoThing" + "@type": "kb:TemporalInterval" }, { "@id": "kb:TemporalInterval03", - "@type": "uco-core:UcoThing" + "@type": "kb:TemporalInterval" }, { "@id": "kb:ThreatActorRole01", @@ -912,6 +914,21 @@ ], "uco-core:description": "Browser process" }, + { + "@id": "kb:TemporalInterval", + "@type": "owl:Class", + "rdfs:seeAlso": { + "@id": "https://github.com/ucoProject/UCO/issues/651" + }, + "rdfs:subClassOf": [ + { + "@id": "drafting:Perdurant" + }, + { + "@id": "time:Interval" + } + ] + }, { "@id": "unmapped:bearerOf", "@type": "owl:ObjectProperty" @@ -955,11 +972,10 @@ }, { "@id": "unmapped:intervalIn", - "@type": "owl:ObjectProperty", - "rdfs:comment": "Property name not in drafted documentation; borrowed from W3C Time Ontology.", - "rdfs:seeAlso": { - "@id": "https://www.w3.org/TR/owl-time/#time:intervalIn" - } + "@type": [ + "owl:DeprecatedProperty", + "owl:ObjectProperty" + ] }, { "@id": "unmapped:isCarrierOf", From 5cdd38ca54009ec55bf72244f6a1d3617f9f910f Mon Sep 17 00:00:00 2001 From: Alex Nelson Date: Thu, 20 Mar 2025 11:45:34 -0400 Subject: [PATCH 2/7] Regenerate Make-managed files References: * https://github.com/ucoProject/UCO-Profile-Time * https://github.com/ucoProject/UCO/issues/651 Signed-off-by: Alex Nelson --- .../spear_phishing/spear_phishing.ttl | 30 ++++-- ...pear_phishing_validation-develop-2.0.0.ttl | 96 ------------------- .../spear_phishing_validation-develop.ttl | 96 ------------------- ...ear_phishing_validation-unstable-2.0.0.ttl | 96 ------------------- .../spear_phishing_validation-unstable.ttl | 96 ------------------- .../spear_phishing_validation.ttl | 96 ------------------- 6 files changed, 21 insertions(+), 489 deletions(-) diff --git a/examples/illustrations/spear_phishing/spear_phishing.ttl b/examples/illustrations/spear_phishing/spear_phishing.ttl index 89511553..80a51429 100644 --- a/examples/illustrations/spear_phishing/spear_phishing.ttl +++ b/examples/illustrations/spear_phishing/spear_phishing.ttl @@ -1,7 +1,9 @@ +@prefix drafting: . @prefix kb: . @prefix owl: . @prefix rdf: . @prefix rdfs: . +@prefix time: . @prefix uco-action: . @prefix uco-core: . @prefix uco-identity: . @@ -180,12 +182,12 @@ kb:CorporateLoggingTool01 kb:DetectionEvent01 a uco-core:Event ; + drafting:intervalIn kb:TemporalInterval03 ; unmapped:hasOccurrentPart kb:ActOfEndpointScan01 , kb:ActOfFileFlagging01 , kb:ActOfSending02 ; - unmapped:intervalIn kb:TemporalInterval03 ; . kb:EmailAccount01 @@ -229,11 +231,11 @@ kb:EndpointProtectionSoftware01 kb:InfectionEvent01 a uco-core:Event ; + drafting:intervalIn kb:TemporalInterval02 ; unmapped:hasOccurrentPart kb:ActOfMalwareDelivery01 , kb:ActOfMalwareInstallation01 ; - unmapped:intervalIn kb:TemporalInterval02 ; unmapped:precedes kb:DetectionEvent01 ; . @@ -283,11 +285,11 @@ kb:ScannerRole01 kb:SpearFishingEvent01 a uco-core:Event ; + drafting:intervalIn kb:TemporalInterval01 ; unmapped:hasOccurrentPart kb:ActOfEmailDelivery01 , kb:ActOfLinkOpening01 ; - unmapped:intervalIn kb:TemporalInterval01 ; unmapped:precedes kb:InfectionEvent01 ; . @@ -305,16 +307,25 @@ kb:TargetRole02 ; . +kb:TemporalInterval + a owl:Class ; + rdfs:subClassOf + drafting:Perdurant , + time:Interval + ; + rdfs:seeAlso ; + . + kb:TemporalInterval01 - a uco-core:UcoThing ; + a kb:TemporalInterval ; . kb:TemporalInterval02 - a uco-core:UcoThing ; + a kb:TemporalInterval ; . kb:TemporalInterval03 - a uco-core:UcoThing ; + a kb:TemporalInterval ; . kb:ThreatActorRole01 @@ -712,9 +723,10 @@ unmapped:hasRole . unmapped:intervalIn - a owl:ObjectProperty ; - rdfs:comment "Property name not in drafted documentation; borrowed from W3C Time Ontology." ; - rdfs:seeAlso ; + a + owl:ObjectProperty , + owl:DeprecatedProperty + ; . unmapped:isCarrierOf diff --git a/examples/illustrations/spear_phishing/spear_phishing_validation-develop-2.0.0.ttl b/examples/illustrations/spear_phishing/spear_phishing_validation-develop-2.0.0.ttl index 13031562..bfff51be 100644 --- a/examples/illustrations/spear_phishing/spear_phishing_validation-develop-2.0.0.ttl +++ b/examples/illustrations/spear_phishing/spear_phishing_validation-develop-2.0.0.ttl @@ -344,15 +344,6 @@ sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; sh:sourceShape ep:hasOccurrentPart-shape ; ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:DetectionEvent01 ; - sh:resultMessage "This property is unmapped and intended to be replaced."@en ; - sh:resultPath unmapped:intervalIn ; - sh:resultSeverity sh:Info ; - sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; - sh:sourceShape ep:intervalIn-shape ; - ] , [ a sh:ValidationResult ; sh:focusNode ep:EmailMessage01 ; @@ -407,15 +398,6 @@ sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; sh:sourceShape ep:hasOccurrentPart-shape ; ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:InfectionEvent01 ; - sh:resultMessage "This property is unmapped and intended to be replaced."@en ; - sh:resultPath unmapped:intervalIn ; - sh:resultSeverity sh:Info ; - sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; - sh:sourceShape ep:intervalIn-shape ; - ] , [ a sh:ValidationResult ; sh:focusNode ep:InfectionEvent01 ; @@ -502,15 +484,6 @@ sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; sh:sourceShape ep:hasOccurrentPart-shape ; ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:SpearFishingEvent01 ; - sh:resultMessage "This property is unmapped and intended to be replaced."@en ; - sh:resultPath unmapped:intervalIn ; - sh:resultSeverity sh:Info ; - sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; - sh:sourceShape ep:intervalIn-shape ; - ] , [ a sh:ValidationResult ; sh:focusNode ep:SpearFishingEvent01 ; @@ -538,75 +511,6 @@ sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; sh:sourceShape ep:realizedIn-shape ; ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:TemporalInterval01 ; - sh:resultMessage "Focus node is not designated a subclass of UcoThing." ; - sh:resultSeverity sh:Info ; - sh:sourceConstraint [ - a sh:SPARQLConstraint ; - sh:message "Focus node is not designated a subclass of UcoThing."@en ; - sh:select """ - PREFIX uco-core: - SELECT $this - WHERE { - FILTER NOT EXISTS { - $this a ?nClass . - ?nClass rdfs:subClassOf+ uco-core:UcoThing . - } - } - """ ; - ] ; - sh:sourceConstraintComponent sh:SPARQLConstraintComponent ; - sh:sourceShape ep:subclass-shape ; - sh:value ep:TemporalInterval01 ; - ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:TemporalInterval02 ; - sh:resultMessage "Focus node is not designated a subclass of UcoThing." ; - sh:resultSeverity sh:Info ; - sh:sourceConstraint [ - a sh:SPARQLConstraint ; - sh:message "Focus node is not designated a subclass of UcoThing."@en ; - sh:select """ - PREFIX uco-core: - SELECT $this - WHERE { - FILTER NOT EXISTS { - $this a ?nClass . - ?nClass rdfs:subClassOf+ uco-core:UcoThing . - } - } - """ ; - ] ; - sh:sourceConstraintComponent sh:SPARQLConstraintComponent ; - sh:sourceShape ep:subclass-shape ; - sh:value ep:TemporalInterval02 ; - ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:TemporalInterval03 ; - sh:resultMessage "Focus node is not designated a subclass of UcoThing." ; - sh:resultSeverity sh:Info ; - sh:sourceConstraint [ - a sh:SPARQLConstraint ; - sh:message "Focus node is not designated a subclass of UcoThing."@en ; - sh:select """ - PREFIX uco-core: - SELECT $this - WHERE { - FILTER NOT EXISTS { - $this a ?nClass . - ?nClass rdfs:subClassOf+ uco-core:UcoThing . - } - } - """ ; - ] ; - sh:sourceConstraintComponent sh:SPARQLConstraintComponent ; - sh:sourceShape ep:subclass-shape ; - sh:value ep:TemporalInterval03 ; - ] , [ a sh:ValidationResult ; sh:focusNode ep:ThreatActorRole01 ; diff --git a/examples/illustrations/spear_phishing/spear_phishing_validation-develop.ttl b/examples/illustrations/spear_phishing/spear_phishing_validation-develop.ttl index 649d0313..f14fe9a9 100644 --- a/examples/illustrations/spear_phishing/spear_phishing_validation-develop.ttl +++ b/examples/illustrations/spear_phishing/spear_phishing_validation-develop.ttl @@ -346,15 +346,6 @@ sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; sh:sourceShape ep:hasOccurrentPart-shape ; ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:DetectionEvent01 ; - sh:resultMessage "This property is unmapped and intended to be replaced."@en ; - sh:resultPath unmapped:intervalIn ; - sh:resultSeverity sh:Info ; - sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; - sh:sourceShape ep:intervalIn-shape ; - ] , [ a sh:ValidationResult ; sh:focusNode ep:EmailMessage01 ; @@ -409,15 +400,6 @@ sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; sh:sourceShape ep:hasOccurrentPart-shape ; ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:InfectionEvent01 ; - sh:resultMessage "This property is unmapped and intended to be replaced."@en ; - sh:resultPath unmapped:intervalIn ; - sh:resultSeverity sh:Info ; - sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; - sh:sourceShape ep:intervalIn-shape ; - ] , [ a sh:ValidationResult ; sh:focusNode ep:InfectionEvent01 ; @@ -504,15 +486,6 @@ sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; sh:sourceShape ep:hasOccurrentPart-shape ; ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:SpearFishingEvent01 ; - sh:resultMessage "This property is unmapped and intended to be replaced."@en ; - sh:resultPath unmapped:intervalIn ; - sh:resultSeverity sh:Info ; - sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; - sh:sourceShape ep:intervalIn-shape ; - ] , [ a sh:ValidationResult ; sh:focusNode ep:SpearFishingEvent01 ; @@ -540,75 +513,6 @@ sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; sh:sourceShape ep:realizedIn-shape ; ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:TemporalInterval01 ; - sh:resultMessage "Focus node is not designated a subclass of UcoThing." ; - sh:resultSeverity sh:Info ; - sh:sourceConstraint [ - a sh:SPARQLConstraint ; - sh:message "Focus node is not designated a subclass of UcoThing."@en ; - sh:select """ - PREFIX uco-core: - SELECT $this - WHERE { - FILTER NOT EXISTS { - $this a ?nClass . - ?nClass rdfs:subClassOf+ uco-core:UcoThing . - } - } - """ ; - ] ; - sh:sourceConstraintComponent sh:SPARQLConstraintComponent ; - sh:sourceShape ep:subclass-shape ; - sh:value ep:TemporalInterval01 ; - ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:TemporalInterval02 ; - sh:resultMessage "Focus node is not designated a subclass of UcoThing." ; - sh:resultSeverity sh:Info ; - sh:sourceConstraint [ - a sh:SPARQLConstraint ; - sh:message "Focus node is not designated a subclass of UcoThing."@en ; - sh:select """ - PREFIX uco-core: - SELECT $this - WHERE { - FILTER NOT EXISTS { - $this a ?nClass . - ?nClass rdfs:subClassOf+ uco-core:UcoThing . - } - } - """ ; - ] ; - sh:sourceConstraintComponent sh:SPARQLConstraintComponent ; - sh:sourceShape ep:subclass-shape ; - sh:value ep:TemporalInterval02 ; - ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:TemporalInterval03 ; - sh:resultMessage "Focus node is not designated a subclass of UcoThing." ; - sh:resultSeverity sh:Info ; - sh:sourceConstraint [ - a sh:SPARQLConstraint ; - sh:message "Focus node is not designated a subclass of UcoThing."@en ; - sh:select """ - PREFIX uco-core: - SELECT $this - WHERE { - FILTER NOT EXISTS { - $this a ?nClass . - ?nClass rdfs:subClassOf+ uco-core:UcoThing . - } - } - """ ; - ] ; - sh:sourceConstraintComponent sh:SPARQLConstraintComponent ; - sh:sourceShape ep:subclass-shape ; - sh:value ep:TemporalInterval03 ; - ] , [ a sh:ValidationResult ; sh:focusNode ep:ThreatActorRole01 ; diff --git a/examples/illustrations/spear_phishing/spear_phishing_validation-unstable-2.0.0.ttl b/examples/illustrations/spear_phishing/spear_phishing_validation-unstable-2.0.0.ttl index b8a13645..1f41e27b 100644 --- a/examples/illustrations/spear_phishing/spear_phishing_validation-unstable-2.0.0.ttl +++ b/examples/illustrations/spear_phishing/spear_phishing_validation-unstable-2.0.0.ttl @@ -346,15 +346,6 @@ sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; sh:sourceShape ep:hasOccurrentPart-shape ; ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:DetectionEvent01 ; - sh:resultMessage "This property is unmapped and intended to be replaced."@en ; - sh:resultPath unmapped:intervalIn ; - sh:resultSeverity sh:Info ; - sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; - sh:sourceShape ep:intervalIn-shape ; - ] , [ a sh:ValidationResult ; sh:focusNode ep:EmailMessage01 ; @@ -409,15 +400,6 @@ sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; sh:sourceShape ep:hasOccurrentPart-shape ; ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:InfectionEvent01 ; - sh:resultMessage "This property is unmapped and intended to be replaced."@en ; - sh:resultPath unmapped:intervalIn ; - sh:resultSeverity sh:Info ; - sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; - sh:sourceShape ep:intervalIn-shape ; - ] , [ a sh:ValidationResult ; sh:focusNode ep:InfectionEvent01 ; @@ -504,15 +486,6 @@ sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; sh:sourceShape ep:hasOccurrentPart-shape ; ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:SpearFishingEvent01 ; - sh:resultMessage "This property is unmapped and intended to be replaced."@en ; - sh:resultPath unmapped:intervalIn ; - sh:resultSeverity sh:Info ; - sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; - sh:sourceShape ep:intervalIn-shape ; - ] , [ a sh:ValidationResult ; sh:focusNode ep:SpearFishingEvent01 ; @@ -540,75 +513,6 @@ sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; sh:sourceShape ep:realizedIn-shape ; ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:TemporalInterval01 ; - sh:resultMessage "Focus node is not designated a subclass of UcoThing." ; - sh:resultSeverity sh:Info ; - sh:sourceConstraint [ - a sh:SPARQLConstraint ; - sh:message "Focus node is not designated a subclass of UcoThing."@en ; - sh:select """ - PREFIX uco-core: - SELECT $this - WHERE { - FILTER NOT EXISTS { - $this a ?nClass . - ?nClass rdfs:subClassOf+ uco-core:UcoThing . - } - } - """ ; - ] ; - sh:sourceConstraintComponent sh:SPARQLConstraintComponent ; - sh:sourceShape ep:subclass-shape ; - sh:value ep:TemporalInterval01 ; - ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:TemporalInterval02 ; - sh:resultMessage "Focus node is not designated a subclass of UcoThing." ; - sh:resultSeverity sh:Info ; - sh:sourceConstraint [ - a sh:SPARQLConstraint ; - sh:message "Focus node is not designated a subclass of UcoThing."@en ; - sh:select """ - PREFIX uco-core: - SELECT $this - WHERE { - FILTER NOT EXISTS { - $this a ?nClass . - ?nClass rdfs:subClassOf+ uco-core:UcoThing . - } - } - """ ; - ] ; - sh:sourceConstraintComponent sh:SPARQLConstraintComponent ; - sh:sourceShape ep:subclass-shape ; - sh:value ep:TemporalInterval02 ; - ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:TemporalInterval03 ; - sh:resultMessage "Focus node is not designated a subclass of UcoThing." ; - sh:resultSeverity sh:Info ; - sh:sourceConstraint [ - a sh:SPARQLConstraint ; - sh:message "Focus node is not designated a subclass of UcoThing."@en ; - sh:select """ - PREFIX uco-core: - SELECT $this - WHERE { - FILTER NOT EXISTS { - $this a ?nClass . - ?nClass rdfs:subClassOf+ uco-core:UcoThing . - } - } - """ ; - ] ; - sh:sourceConstraintComponent sh:SPARQLConstraintComponent ; - sh:sourceShape ep:subclass-shape ; - sh:value ep:TemporalInterval03 ; - ] , [ a sh:ValidationResult ; sh:focusNode ep:ThreatActorRole01 ; diff --git a/examples/illustrations/spear_phishing/spear_phishing_validation-unstable.ttl b/examples/illustrations/spear_phishing/spear_phishing_validation-unstable.ttl index 649d0313..f14fe9a9 100644 --- a/examples/illustrations/spear_phishing/spear_phishing_validation-unstable.ttl +++ b/examples/illustrations/spear_phishing/spear_phishing_validation-unstable.ttl @@ -346,15 +346,6 @@ sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; sh:sourceShape ep:hasOccurrentPart-shape ; ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:DetectionEvent01 ; - sh:resultMessage "This property is unmapped and intended to be replaced."@en ; - sh:resultPath unmapped:intervalIn ; - sh:resultSeverity sh:Info ; - sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; - sh:sourceShape ep:intervalIn-shape ; - ] , [ a sh:ValidationResult ; sh:focusNode ep:EmailMessage01 ; @@ -409,15 +400,6 @@ sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; sh:sourceShape ep:hasOccurrentPart-shape ; ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:InfectionEvent01 ; - sh:resultMessage "This property is unmapped and intended to be replaced."@en ; - sh:resultPath unmapped:intervalIn ; - sh:resultSeverity sh:Info ; - sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; - sh:sourceShape ep:intervalIn-shape ; - ] , [ a sh:ValidationResult ; sh:focusNode ep:InfectionEvent01 ; @@ -504,15 +486,6 @@ sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; sh:sourceShape ep:hasOccurrentPart-shape ; ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:SpearFishingEvent01 ; - sh:resultMessage "This property is unmapped and intended to be replaced."@en ; - sh:resultPath unmapped:intervalIn ; - sh:resultSeverity sh:Info ; - sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; - sh:sourceShape ep:intervalIn-shape ; - ] , [ a sh:ValidationResult ; sh:focusNode ep:SpearFishingEvent01 ; @@ -540,75 +513,6 @@ sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; sh:sourceShape ep:realizedIn-shape ; ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:TemporalInterval01 ; - sh:resultMessage "Focus node is not designated a subclass of UcoThing." ; - sh:resultSeverity sh:Info ; - sh:sourceConstraint [ - a sh:SPARQLConstraint ; - sh:message "Focus node is not designated a subclass of UcoThing."@en ; - sh:select """ - PREFIX uco-core: - SELECT $this - WHERE { - FILTER NOT EXISTS { - $this a ?nClass . - ?nClass rdfs:subClassOf+ uco-core:UcoThing . - } - } - """ ; - ] ; - sh:sourceConstraintComponent sh:SPARQLConstraintComponent ; - sh:sourceShape ep:subclass-shape ; - sh:value ep:TemporalInterval01 ; - ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:TemporalInterval02 ; - sh:resultMessage "Focus node is not designated a subclass of UcoThing." ; - sh:resultSeverity sh:Info ; - sh:sourceConstraint [ - a sh:SPARQLConstraint ; - sh:message "Focus node is not designated a subclass of UcoThing."@en ; - sh:select """ - PREFIX uco-core: - SELECT $this - WHERE { - FILTER NOT EXISTS { - $this a ?nClass . - ?nClass rdfs:subClassOf+ uco-core:UcoThing . - } - } - """ ; - ] ; - sh:sourceConstraintComponent sh:SPARQLConstraintComponent ; - sh:sourceShape ep:subclass-shape ; - sh:value ep:TemporalInterval02 ; - ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:TemporalInterval03 ; - sh:resultMessage "Focus node is not designated a subclass of UcoThing." ; - sh:resultSeverity sh:Info ; - sh:sourceConstraint [ - a sh:SPARQLConstraint ; - sh:message "Focus node is not designated a subclass of UcoThing."@en ; - sh:select """ - PREFIX uco-core: - SELECT $this - WHERE { - FILTER NOT EXISTS { - $this a ?nClass . - ?nClass rdfs:subClassOf+ uco-core:UcoThing . - } - } - """ ; - ] ; - sh:sourceConstraintComponent sh:SPARQLConstraintComponent ; - sh:sourceShape ep:subclass-shape ; - sh:value ep:TemporalInterval03 ; - ] , [ a sh:ValidationResult ; sh:focusNode ep:ThreatActorRole01 ; diff --git a/examples/illustrations/spear_phishing/spear_phishing_validation.ttl b/examples/illustrations/spear_phishing/spear_phishing_validation.ttl index 13031562..bfff51be 100644 --- a/examples/illustrations/spear_phishing/spear_phishing_validation.ttl +++ b/examples/illustrations/spear_phishing/spear_phishing_validation.ttl @@ -344,15 +344,6 @@ sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; sh:sourceShape ep:hasOccurrentPart-shape ; ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:DetectionEvent01 ; - sh:resultMessage "This property is unmapped and intended to be replaced."@en ; - sh:resultPath unmapped:intervalIn ; - sh:resultSeverity sh:Info ; - sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; - sh:sourceShape ep:intervalIn-shape ; - ] , [ a sh:ValidationResult ; sh:focusNode ep:EmailMessage01 ; @@ -407,15 +398,6 @@ sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; sh:sourceShape ep:hasOccurrentPart-shape ; ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:InfectionEvent01 ; - sh:resultMessage "This property is unmapped and intended to be replaced."@en ; - sh:resultPath unmapped:intervalIn ; - sh:resultSeverity sh:Info ; - sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; - sh:sourceShape ep:intervalIn-shape ; - ] , [ a sh:ValidationResult ; sh:focusNode ep:InfectionEvent01 ; @@ -502,15 +484,6 @@ sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; sh:sourceShape ep:hasOccurrentPart-shape ; ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:SpearFishingEvent01 ; - sh:resultMessage "This property is unmapped and intended to be replaced."@en ; - sh:resultPath unmapped:intervalIn ; - sh:resultSeverity sh:Info ; - sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; - sh:sourceShape ep:intervalIn-shape ; - ] , [ a sh:ValidationResult ; sh:focusNode ep:SpearFishingEvent01 ; @@ -538,75 +511,6 @@ sh:sourceConstraintComponent sh:MaxCountConstraintComponent ; sh:sourceShape ep:realizedIn-shape ; ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:TemporalInterval01 ; - sh:resultMessage "Focus node is not designated a subclass of UcoThing." ; - sh:resultSeverity sh:Info ; - sh:sourceConstraint [ - a sh:SPARQLConstraint ; - sh:message "Focus node is not designated a subclass of UcoThing."@en ; - sh:select """ - PREFIX uco-core: - SELECT $this - WHERE { - FILTER NOT EXISTS { - $this a ?nClass . - ?nClass rdfs:subClassOf+ uco-core:UcoThing . - } - } - """ ; - ] ; - sh:sourceConstraintComponent sh:SPARQLConstraintComponent ; - sh:sourceShape ep:subclass-shape ; - sh:value ep:TemporalInterval01 ; - ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:TemporalInterval02 ; - sh:resultMessage "Focus node is not designated a subclass of UcoThing." ; - sh:resultSeverity sh:Info ; - sh:sourceConstraint [ - a sh:SPARQLConstraint ; - sh:message "Focus node is not designated a subclass of UcoThing."@en ; - sh:select """ - PREFIX uco-core: - SELECT $this - WHERE { - FILTER NOT EXISTS { - $this a ?nClass . - ?nClass rdfs:subClassOf+ uco-core:UcoThing . - } - } - """ ; - ] ; - sh:sourceConstraintComponent sh:SPARQLConstraintComponent ; - sh:sourceShape ep:subclass-shape ; - sh:value ep:TemporalInterval02 ; - ] , - [ - a sh:ValidationResult ; - sh:focusNode ep:TemporalInterval03 ; - sh:resultMessage "Focus node is not designated a subclass of UcoThing." ; - sh:resultSeverity sh:Info ; - sh:sourceConstraint [ - a sh:SPARQLConstraint ; - sh:message "Focus node is not designated a subclass of UcoThing."@en ; - sh:select """ - PREFIX uco-core: - SELECT $this - WHERE { - FILTER NOT EXISTS { - $this a ?nClass . - ?nClass rdfs:subClassOf+ uco-core:UcoThing . - } - } - """ ; - ] ; - sh:sourceConstraintComponent sh:SPARQLConstraintComponent ; - sh:sourceShape ep:subclass-shape ; - sh:value ep:TemporalInterval03 ; - ] , [ a sh:ValidationResult ; sh:focusNode ep:ThreatActorRole01 ; From d18a0c08b4da85364dc6616abfc11b168e4a1ba9 Mon Sep 17 00:00:00 2001 From: Alex Nelson Date: Thu, 20 Mar 2025 12:55:13 -0400 Subject: [PATCH 3/7] Run postvisit.mk if present This patch was distilled from PR 147. References: * https://github.com/casework/CASE-Examples/pull/147 Signed-off-by: Alex Nelson --- examples/illustrations/src/illustration-nosrc.mk | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/examples/illustrations/src/illustration-nosrc.mk b/examples/illustrations/src/illustration-nosrc.mk index bc4d63ff..52f52ed5 100644 --- a/examples/illustrations/src/illustration-nosrc.mk +++ b/examples/illustrations/src/illustration-nosrc.mk @@ -85,6 +85,9 @@ all: \ test ! -r figures/Makefile \ || $(MAKE) \ --directory figures + test ! -r postvisit.mk \ + || $(MAKE) \ + --file postvisit.mk .PHONY: \ check-pytest @@ -335,6 +338,10 @@ check: \ $(example_name)_validation-develop-2.0.0.ttl \ $(example_name)_validation-unstable.ttl \ $(example_name)_validation-unstable-2.0.0.ttl + test ! -r postvisit.mk \ + || $(MAKE) \ + --file postvisit.mk \ + check # Run pytest tests only if any are written. # (Pytest exits in an error state if called with no tests found.) @@ -348,6 +355,10 @@ check-pytest: \ ) clean: + @test ! -r postvisit.mk \ + || $(MAKE) \ + --file postvisit.mk \ + clean @rm -f \ .drafting.ttl.*.log \ figures/*.dot \ From 62271b56641755299084eb8180a7bfdb368c6f64 Mon Sep 17 00:00:00 2001 From: Alex Nelson Date: Thu, 20 Mar 2025 13:01:42 -0400 Subject: [PATCH 4/7] Track UCO-Profile-Time for draft concept review in Spear Phishing example No effects were observed on Make-managed files. References: * https://github.com/ucoProject/UCO/issues/651 Signed-off-by: Alex Nelson --- .gitmodules | 4 ++ Makefile | 6 +++ dependencies/UCO-Profile-Time | 1 + .../illustrations/spear_phishing/postvisit.mk | 51 +++++++++++++++++++ 4 files changed, 62 insertions(+) create mode 160000 dependencies/UCO-Profile-Time create mode 100644 examples/illustrations/spear_phishing/postvisit.mk diff --git a/.gitmodules b/.gitmodules index 6922aea9..3615a653 100644 --- a/.gitmodules +++ b/.gitmodules @@ -14,3 +14,7 @@ path = dependencies/CASE-unstable-2.0.0 url = https://github.com/casework/CASE-Archive.git branch = unstable-2.0.0 +[submodule "dependencies/UCO-Profile-Time"] + path = dependencies/UCO-Profile-Time + url = https://github.com/ucoProject/UCO-Profile-Time.git + branch = main diff --git a/Makefile b/Makefile index 23738d53..aeb22f83 100644 --- a/Makefile +++ b/Makefile @@ -61,6 +61,12 @@ all: \ $(MAKE) \ --directory dependencies/CASE-unstable-2.0.0 \ .git_submodule_init.done.log + # UCO-Profile-Time + test -r dependencies/UCO-Profile-Time/README.md \ + || git submodule update --init dependencies/UCO-Profile-Time + $(MAKE) \ + --directory dependencies/UCO-Profile-Time \ + .git_submodule_init.done.log # Retrieve rdf-toolkit.jar. $(MAKE) \ --directory dependencies/CASE-develop \ diff --git a/dependencies/UCO-Profile-Time b/dependencies/UCO-Profile-Time new file mode 160000 index 00000000..2e1eb638 --- /dev/null +++ b/dependencies/UCO-Profile-Time @@ -0,0 +1 @@ +Subproject commit 2e1eb638e9fe6d2ee30d050afe59ca2acc7cb330 diff --git a/examples/illustrations/spear_phishing/postvisit.mk b/examples/illustrations/spear_phishing/postvisit.mk new file mode 100644 index 00000000..56396645 --- /dev/null +++ b/examples/illustrations/spear_phishing/postvisit.mk @@ -0,0 +1,51 @@ +#!/usr/bin/make -f + +# Portions of this file contributed by NIST are governed by the +# following statement: +# +# This software was developed at the National Institute of Standards +# and Technology by employees of the Federal Government in the course +# of their official duties. Pursuant to Title 17 Section 105 of the +# United States Code, this software is not subject to copyright +# protection within the United States. NIST assumes no responsibility +# whatsoever for its use by other parties, and makes no guarantees, +# expressed or implied, about its quality, reliability, or any other +# characteristic. +# +# We would appreciate acknowledgement if the software is used. + +SHELL := /bin/bash + +top_srcdir := $(shell cd ../../.. ; pwd) + +time_ttl := $(top_srcdir)/dependencies/UCO-Profile-Time/dependencies/CDO-Shapes-Time/dependencies/time.ttl +sh_time_ttl := $(top_srcdir)/dependencies/UCO-Profile-Time/dependencies/CDO-Shapes-Time/shapes/sh-time.ttl +profile_uco_time_ttl := $(top_srcdir)/dependencies/UCO-Profile-Time/ontology/uco-time.ttl +sh_uco_time_ttl := $(top_srcdir)/dependencies/UCO-Profile-Time/ontology/uco-time.ttl + +all: + +.uco-profiles.done.log: \ + $(profile_uco_time_ttl) \ + $(sh_time_ttl) \ + $(sh_uco_time_ttl) \ + $(time_ttl) \ + $(top_srcdir)/.venv.done.log \ + spear_phishing.json + source $(top_srcdir)/venv/bin/activate \ + && case_validate \ + --allow-infos \ + --ontology-graph $(profile_uco_time_ttl) \ + --ontology-graph $(sh_time_ttl) \ + --ontology-graph $(sh_uco_time_ttl) \ + --ontology-graph $(time_ttl) \ + --ontology-graph drafting.ttl \ + spear_phishing.json + touch $@ + +check: \ + .uco-profiles.done.log + +clean: + @rm -f \ + .uco-profiles.done.log From ecbba3a044d95b463f32eb5cd7375d1280ae5f94 Mon Sep 17 00:00:00 2001 From: Alex Nelson Date: Thu, 20 Mar 2025 17:39:55 -0400 Subject: [PATCH 5/7] Bump UCO-Profile-Time pointer No effects were observed on Make-managed files. Signed-off-by: Alex Nelson --- dependencies/UCO-Profile-Time | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dependencies/UCO-Profile-Time b/dependencies/UCO-Profile-Time index 2e1eb638..e6b497d4 160000 --- a/dependencies/UCO-Profile-Time +++ b/dependencies/UCO-Profile-Time @@ -1 +1 @@ -Subproject commit 2e1eb638e9fe6d2ee30d050afe59ca2acc7cb330 +Subproject commit e6b497d415430223c05a79638690f79a03727583 From c92ec614b203aafe922b1e043589b59692c38393 Mon Sep 17 00:00:00 2001 From: Alex Nelson Date: Fri, 21 Mar 2025 08:53:59 -0400 Subject: [PATCH 6/7] Add example-specific classes to align Perdurant and time mapping A follow-on patch will regenerate Make-managed files. References: * https://github.com/ucoProject/UCO/issues/544 * https://github.com/ucoProject/UCO/issues/651 Signed-off-by: Alex Nelson --- .../spear_phishing/spear_phishing.json | 93 ++++++++++++++++--- 1 file changed, 78 insertions(+), 15 deletions(-) diff --git a/examples/illustrations/spear_phishing/spear_phishing.json b/examples/illustrations/spear_phishing/spear_phishing.json index 3e86c4e3..33379a41 100644 --- a/examples/illustrations/spear_phishing/spear_phishing.json +++ b/examples/illustrations/spear_phishing/spear_phishing.json @@ -25,18 +25,18 @@ }, { "@id": "kb:ActOfMalwareDelivery01", - "@type": "uco-observable:ObservableAction", + "@type": "kb:ObservableAction", "unmapped:precedes": { "@id": "kb:ActOfMalwareInstallation01" } }, { "@id": "kb:ActOfMalwareInstallation01", - "@type": "uco-observable:ObservableAction" + "@type": "kb:ObservableAction" }, { "@id": "kb:ActOfNetworkLogin01", - "@type": "uco-observable:ObservableAction", + "@type": "kb:ObservableAction", "uco-action:endTime": { "@type": "xsd:dateTime", "@value": "2021-09-02T07:32:16.411Z" @@ -44,7 +44,7 @@ }, { "@id": "kb:ActOfNetworkLogout01", - "@type": "uco-observable:ObservableAction", + "@type": "kb:ObservableAction", "uco-action:endTime": { "@type": "xsd:dateTime", "@value": "2021-09-02T11:07:30.658Z" @@ -57,18 +57,18 @@ }, { "@id": "kb:ActOfEmailDelivery01", - "@type": "uco-observable:ObservableAction", + "@type": "kb:ObservableAction", "unmapped:precedes": { "@id": "kb:ActOfLinkOpening01" } }, { "@id": "kb:ActOfLinkOpening01", - "@type": "uco-observable:ObservableAction" + "@type": "kb:ObservableAction" }, { "@id": "kb:ActOfSending02", - "@type": "uco-observable:ObservableAction" + "@type": "kb:ObservableAction" }, { "@id": "kb:Agent01", @@ -265,7 +265,7 @@ }, { "@id": "kb:DetectionEvent01", - "@type": "uco-core:Event", + "@type": "kb:Event", "unmapped:hasOccurrentPart": [ { "@id": "kb:ActOfSending02" @@ -352,21 +352,21 @@ }, { "@id": "kb:ActOfEndpointScan01", - "@type": "uco-observable:ObservableAction", + "@type": "kb:ObservableAction", "unmapped:precedes": { "@id": "kb:ActOfFileFlagging01" } }, { "@id": "kb:ActOfFileFlagging01", - "@type": "uco-observable:ObservableAction", + "@type": "kb:ObservableAction", "unmapped:hasOutput": { "@id": "kb:Alert01" } }, { "@id": "kb:InfectionEvent01", - "@type": "uco-core:Event", + "@type": "kb:Event", "unmapped:hasOccurrentPart": [ { "@id": "kb:ActOfMalwareDelivery01" @@ -450,7 +450,7 @@ }, { "@id": "kb:SpearFishingEvent01", - "@type": "uco-core:Event", + "@type": "kb:Event", "unmapped:hasOccurrentPart": [ { "@id": "kb:ActOfEmailDelivery01" @@ -708,7 +708,7 @@ }, { "@id": "kb:observable-action-295ce323-3284-402c-a320-e8fc4c04f835", - "@type": "uco-observable:ObservableAction", + "@type": "kb:ObservableAction", "uco-action:object": { "@id": "kb:email-message-4a81644f-04ad-4d79-8159-a963ddd2fb58" }, @@ -724,7 +724,7 @@ }, { "@id": "kb:observable-action-7522ac48-586f-4fba-84b4-b409d042658c", - "@type": "uco-observable:ObservableAction", + "@type": "kb:ObservableAction", "uco-action:environment": { "@id": "kb:windows-process-b2afcc1c-2f41-4b4d-8c8f-b74d4b7ec22c" }, @@ -737,7 +737,7 @@ }, { "@id": "kb:observable-action-abfeee80-d2b7-451a-91b5-e753798ca4c6", - "@type": "uco-observable:ObservableAction", + "@type": "kb:ObservableAction", "uco-action:environment": { "@id": "kb:windows-process-b2afcc1c-2f41-4b4d-8c8f-b74d4b7ec22c" }, @@ -929,6 +929,69 @@ } ] }, + { + "@id": "kb:Action", + "@type": "owl:Class", + "rdfs:comment": "This class is a temporary class to align concepts for UCO Issues 544 and 651.", + "rdfs:seeAlso": [ + { + "@id": "https://github.com/ucoProject/UCO/issues/544" + }, + { + "@id": "https://github.com/ucoProject/UCO/issues/651" + } + ], + "rdfs:subClassOf": [ + { + "@id": "drafting:Perdurant" + }, + { + "@id": "uco-action:Action" + } + ] + }, + { + "@id": "kb:Event", + "@type": "owl:Class", + "rdfs:comment": "This class is a temporary class to align concepts for UCO Issues 544 and 651.", + "rdfs:seeAlso": [ + { + "@id": "https://github.com/ucoProject/UCO/issues/544" + }, + { + "@id": "https://github.com/ucoProject/UCO/issues/651" + } + ], + "rdfs:subClassOf": [ + { + "@id": "drafting:Perdurant" + }, + { + "@id": "uco-core:Event" + } + ] + }, + { + "@id": "kb:ObservableAction", + "@type": "owl:Class", + "rdfs:comment": "This class is a temporary class to align concepts for UCO Issues 544 and 651.", + "rdfs:seeAlso": [ + { + "@id": "https://github.com/ucoProject/UCO/issues/544" + }, + { + "@id": "https://github.com/ucoProject/UCO/issues/651" + } + ], + "rdfs:subClassOf": [ + { + "@id": "kb:Action" + }, + { + "@id": "uco-observable:ObservableAction" + } + ] + }, { "@id": "unmapped:bearerOf", "@type": "owl:ObjectProperty" From 96aaa0d60f7831e705f5a1ea3d8a12bdf2d90338 Mon Sep 17 00:00:00 2001 From: Alex Nelson Date: Fri, 21 Mar 2025 08:54:42 -0400 Subject: [PATCH 7/7] Regenerate Make-managed files References: * https://github.com/ucoProject/UCO/issues/544 * https://github.com/ucoProject/UCO/issues/651 Signed-off-by: Alex Nelson --- .../spear_phishing/spear_phishing.ttl | 69 +++++++++++++++---- 1 file changed, 54 insertions(+), 15 deletions(-) diff --git a/examples/illustrations/spear_phishing/spear_phishing.ttl b/examples/illustrations/spear_phishing/spear_phishing.ttl index 80a51429..f6882a1c 100644 --- a/examples/illustrations/spear_phishing/spear_phishing.ttl +++ b/examples/illustrations/spear_phishing/spear_phishing.ttl @@ -30,40 +30,40 @@ . kb:ActOfEmailDelivery01 - a uco-observable:ObservableAction ; + a kb:ObservableAction ; unmapped:precedes kb:ActOfLinkOpening01 ; . kb:ActOfEndpointScan01 - a uco-observable:ObservableAction ; + a kb:ObservableAction ; unmapped:precedes kb:ActOfFileFlagging01 ; . kb:ActOfFileFlagging01 - a uco-observable:ObservableAction ; + a kb:ObservableAction ; unmapped:hasOutput kb:Alert01 ; . kb:ActOfLinkOpening01 - a uco-observable:ObservableAction ; + a kb:ObservableAction ; . kb:ActOfMalwareDelivery01 - a uco-observable:ObservableAction ; + a kb:ObservableAction ; unmapped:precedes kb:ActOfMalwareInstallation01 ; . kb:ActOfMalwareInstallation01 - a uco-observable:ObservableAction ; + a kb:ObservableAction ; . kb:ActOfNetworkLogin01 - a uco-observable:ObservableAction ; + a kb:ObservableAction ; uco-action:endTime "2021-09-02T07:32:16.411000+00:00"^^xsd:dateTime ; . kb:ActOfNetworkLogout01 - a uco-observable:ObservableAction ; + a kb:ObservableAction ; uco-action:endTime "2021-09-02T11:07:30.658000+00:00"^^xsd:dateTime ; . @@ -73,7 +73,20 @@ kb:ActOfNetworkingSession01 . kb:ActOfSending02 - a uco-observable:ObservableAction ; + a kb:ObservableAction ; + . + +kb:Action + a owl:Class ; + rdfs:subClassOf + drafting:Perdurant , + uco-action:Action + ; + rdfs:comment "This class is a temporary class to align concepts for UCO Issues 544 and 651." ; + rdfs:seeAlso + , + + ; . kb:Agent01 @@ -181,7 +194,7 @@ kb:CorporateLoggingTool01 . kb:DetectionEvent01 - a uco-core:Event ; + a kb:Event ; drafting:intervalIn kb:TemporalInterval03 ; unmapped:hasOccurrentPart kb:ActOfEndpointScan01 , @@ -229,8 +242,21 @@ kb:EndpointProtectionSoftware01 ; . +kb:Event + a owl:Class ; + rdfs:subClassOf + drafting:Perdurant , + uco-core:Event + ; + rdfs:comment "This class is a temporary class to align concepts for UCO Issues 544 and 651." ; + rdfs:seeAlso + , + + ; + . + kb:InfectionEvent01 - a uco-core:Event ; + a kb:Event ; drafting:intervalIn kb:TemporalInterval02 ; unmapped:hasOccurrentPart kb:ActOfMalwareDelivery01 , @@ -263,6 +289,19 @@ kb:NetworkAccount01 uco-core:hasFacet kb:digital-account-facet-cb1b2980-3859-439f-81a4-b3bf0cd2b65c ; . +kb:ObservableAction + a owl:Class ; + rdfs:subClassOf + kb:Action , + uco-observable:ObservableAction + ; + rdfs:comment "This class is a temporary class to align concepts for UCO Issues 544 and 651." ; + rdfs:seeAlso + , + + ; + . + kb:Port01 a uco-core:UcoThing ; unmapped:isCarrierOf kb:MaliciousSoftware01 ; @@ -284,7 +323,7 @@ kb:ScannerRole01 . kb:SpearFishingEvent01 - a uco-core:Event ; + a kb:Event ; drafting:intervalIn kb:TemporalInterval01 ; unmapped:hasOccurrentPart kb:ActOfEmailDelivery01 , @@ -525,7 +564,7 @@ kb:ipv4-address-facet-e167349a-c017-4a89-880a-648751c8fffd . kb:observable-action-295ce323-3284-402c-a320-e8fc4c04f835 - a uco-observable:ObservableAction ; + a kb:ObservableAction ; uco-action:object kb:email-message-4a81644f-04ad-4d79-8159-a963ddd2fb58 ; uco-action:participant kb:ComputingDevice02 ; uco-action:performer kb:EmailSoftwareProgram01 ; @@ -533,14 +572,14 @@ kb:observable-action-295ce323-3284-402c-a320-e8fc4c04f835 . kb:observable-action-7522ac48-586f-4fba-84b4-b409d042658c - a uco-observable:ObservableAction ; + a kb:ObservableAction ; uco-action:environment kb:windows-process-b2afcc1c-2f41-4b4d-8c8f-b74d4b7ec22c ; uco-action:performer kb:ComputingDevice03 ; uco-action:result kb:MaliciousSoftware01 ; . kb:observable-action-abfeee80-d2b7-451a-91b5-e753798ca4c6 - a uco-observable:ObservableAction ; + a kb:ObservableAction ; uco-action:environment kb:windows-process-b2afcc1c-2f41-4b4d-8c8f-b74d4b7ec22c ; uco-action:object kb:URL01 ; .