Skip to content

Commit 688c84b

Browse files
ajnelson-nistajnelson-nist
authored
Merge pull request #62 from fabrizio-turchi/issue-#20
Fix #20 issue, adding EventRecordFacet and ObservableAction classes
2 parents eba58c7 + fa790e1 commit 688c84b

File tree

4 files changed

+244
-36
lines changed

4 files changed

+244
-36
lines changed

‎case.jsonld

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1705,6 +1705,110 @@
17051705
}
17061706
}
17071707
]
1708+
},
1709+
{
1710+
"@id": "kb:63455f6a-3e0a-58d2-b425-68030c41a62a",
1711+
"@type": "uco-observable:ObservableObject",
1712+
"uco-core:hasFacet": [
1713+
{
1714+
"@id": "kb:67ecf21e-de3c-5430-84ac-891a81265d51",
1715+
"@type": "uco-observable:AccountFacet",
1716+
"uco-observable:isActive": {
1717+
"@type": "xsd:boolean",
1718+
"@value": true
1719+
},
1720+
"uco-observable:accountIdentifier": "u_moss"
1721+
},
1722+
{
1723+
"@id": "kb:ab3cd06a-45f4-5067-ada0-646de5548101",
1724+
"@type": "uco-observable:ApplicationAccountFacet",
1725+
"uco-observable:application": {
1726+
"@id": "kb:63455f6a-3e0a-58d2-b425-68030c41a62a"
1727+
}
1728+
}
1729+
]
1730+
},
1731+
{
1732+
"@id": "kb:b6326bd9-8691-59c5-b126-9ca2be995d78",
1733+
"@type": "uco-observable:ObservableObject",
1734+
"uco-core:hasFacet": [
1735+
{
1736+
"@id": "kb:82bd053b-bb47-5931-a59e-bcb6b451d048",
1737+
"@type": "uco-observable:ApplicationFacet",
1738+
"uco-observable:applicationIdentifier": "iPhoneNetworkDataUsage"
1739+
}
1740+
]
1741+
},
1742+
{
1743+
"@id": "kb:1b700918-7f2d-55ad-acd8-fba19ce9e7aa",
1744+
"@type": "uco-observable:ObservableAction",
1745+
"uco-core:name": "Network log entry",
1746+
"uco-core:description": "Network log entry extraction of all lines",
1747+
"uco-action:actionStatus": {
1748+
"@type": "uco-vocabulary:ActionStatusTypeVocab",
1749+
"@value": "Complete/Finish"
1750+
},
1751+
"uco-action:startTime": {
1752+
"@type": "xsd:dateTime",
1753+
"@value": "2024-02-29T12:28:49+00:00"
1754+
},
1755+
"uco-action:endTime": {
1756+
"@type": "xsd:dateTime",
1757+
"@value": "2024-02-29T12:43:44+00:00"
1758+
},
1759+
"uco-action:performer": {
1760+
"@id": "kb:0db6f576-b92c-520d-9e1a-445eb103254b"
1761+
},
1762+
"uco-action:instrument": {
1763+
"@id": "kb:dae7ab48-4877-5aeb-83be-51c67fa53493"
1764+
},
1765+
"uco-action:location": {
1766+
"@id": "kb:f0e14e08-35aa-5381-b2f2-5822f93163b7"
1767+
},
1768+
"uco-action:object": {
1769+
"@id": "kb:1506e4eb-8c84-5ffc-9329-3cf998ca145b"
1770+
},
1771+
"uco-action:participant": {
1772+
"@id": "kb:0db6f576-b92c-520d-9e1a-445eb103254b"
1773+
}
1774+
},
1775+
{
1776+
"@id": "kb:28779a1c-3868-5089-9408-e989937cf375",
1777+
"@type": "uco-observable:ObservableObject",
1778+
"uco-core:hasFacet": [
1779+
{
1780+
"@id": "kb:075ee909-b08c-5f4a-9c43-08a00829d72d",
1781+
"@type": "uco-observable:EventRecordFacet",
1782+
"uco-observable:eventRecordID": "geod/AlexisBarreyat.BeReal",
1783+
"uco-observable:eventRecordRaw": "Wifi In:0, Wifi Out:0, Wan In:37847, 10689999, Wan Out:18956",
1784+
"uco-observable:eventRecordServiceName": "BeReal",
1785+
"uco-observable:eventType": "information",
1786+
"uco-observable:account": {
1787+
"@id": "kb:63455f6a-3e0a-58d2-b425-68030c41a62a"
1788+
},
1789+
"uco-observable:application": {
1790+
"@id": "kb:b6326bd9-8691-59c5-b126-9ca2be995d78"
1791+
},
1792+
"uco-observable:cyberAction": {
1793+
"@id": "kb:1b700918-7f2d-55ad-acd8-fba19ce9e7aa"
1794+
},
1795+
"uco-observable:eventRecordDevice": {
1796+
"@id": "kb:cad54a2d-fb07-50a8-9f71-7d7ea46d0b68"
1797+
},
1798+
"uco-observable:observableCreatedTime": {
1799+
"@type": "xsd:dateTime",
1800+
"@value": "2024-04-21T21:38:19+00:00"
1801+
},
1802+
"uco-observable:startTime": {
1803+
"@type": "xsd:dateTime",
1804+
"@value": "2024-04-21T21:38:19+00:00"
1805+
},
1806+
"uco-observable:endTime": {
1807+
"@type": "xsd:dateTime",
1808+
"@value": "2024-04-21T23:58:19+00:00"
1809+
}
1810+
}
1811+
]
17081812
}
17091813
]
17101814
}

‎case_mapping/uco/action.py

Lines changed: 25 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
from datetime import datetime
2-
from typing import Any, List, Optional, Union
2+
from typing import Any, List, Optional, Sequence, Union
33

44
from pytz import timezone
55

@@ -11,19 +11,21 @@ class Action(ObjectEntity):
1111
def __init__(
1212
self,
1313
*args: Any,
14-
description: Optional[str] = None,
15-
facets: Optional[List[FacetEntity]] = None,
14+
action_count: Optional[int] = None,
15+
action_status: Optional[str] = None,
1616
end_time: Optional[datetime] = None,
1717
environment: Optional[ObjectEntity] = None,
18-
instrument: Union[None, ObjectEntity, List[ObjectEntity]] = None,
19-
location: Union[None, Location, List[Location]] = None,
20-
name: Optional[str] = None,
21-
objects: Union[None, ObjectEntity, List[ObjectEntity]] = None,
18+
error: Optional[ObjectEntity] = None,
19+
instrument: Union[None, ObjectEntity, Sequence[ObjectEntity]] = None,
20+
location: Union[None, Location, Sequence[Location]] = None,
21+
objects: Union[None, ObjectEntity, Sequence[ObjectEntity]] = None,
22+
participant: Union[None, Sequence[ObjectEntity]] = None,
2223
performer: Optional[ObjectEntity] = None,
23-
results: Union[None, ObjectEntity, List[ObjectEntity]] = None,
24+
results: Union[None, ObjectEntity, Sequence[ObjectEntity]] = None,
2425
start_time: Optional[datetime] = None,
26+
subaction: Optional[ObjectEntity] = None,
2527
**kwargs: Any,
26-
):
28+
) -> None:
2729
"""
2830
An action is something that may be done or performed.
2931
Actions group the properties characterizing core action-elements (who, how, with what, where, etc.).
@@ -38,21 +40,32 @@ def __init__(
3840
:param object: The things that the action is performed on/against.
3941
:param result: The things resulting from performing an action.
4042
"""
41-
super().__init__(
42-
*args, description=description, facets=facets, name=name, **kwargs
43-
)
43+
super().__init__(*args, **kwargs)
4444
self["@type"] = "uco-action:Action"
45+
self._nonegative_int_vars(
46+
**{
47+
"uco-action:actionCount": action_count,
48+
}
49+
)
50+
if action_status:
51+
self["uco-action:actionStatus"] = {
52+
"@type": "uco-vocabulary:ActionStatusTypeVocab",
53+
"@value": action_status,
54+
}
4555
self._datetime_vars(
4656
**{"uco-action:startTime": start_time, "uco-action:endTime": end_time}
4757
)
4858
self._node_reference_vars(
4959
**{
5060
"uco-action:environment": environment,
61+
"uco-action:error": error,
5162
"uco-action:performer": performer,
5263
"uco-action:instrument": instrument,
5364
"uco-action:location": location,
5465
"uco-action:result": results,
5566
"uco-action:object": objects,
67+
"uco-action:participant": participant,
68+
"uco-action:subaction": subaction,
5669
}
5770
)
5871

‎case_mapping/uco/observable.py

Lines changed: 49 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,10 @@
44
from cdo_local_uuid import local_uuid
55

66
from ..base import FacetEntity, ObjectEntity, UcoInherentCharacterizationThing
7+
from .action import Action
78
from .core import Relationship
89
from .identity import Identity
10+
from .location import Location
911
from .types import Dictionary
1012

1113

@@ -426,6 +428,15 @@ def __init__(self, *args: Any, has_changed=None, state=None, **kwargs: Any) -> N
426428
self._bool_vars(**{"uco-observable:hasChanged": has_changed})
427429

428430

431+
class ObservableAction(Action):
432+
def __init__(self, *args: Any, **kwargs: Any) -> None:
433+
"""
434+
An observable action is a grouping of characteristics unique to something that may be done or performed within the digital domain.
435+
"""
436+
super().__init__(*args, **kwargs)
437+
self["@type"] = "uco-observable:ObservableAction"
438+
439+
429440
class FacetApplication(FacetEntity):
430441
def __init__(
431442
self,
@@ -1342,42 +1353,61 @@ def __init__(self, path: str) -> None:
13421353
self._str_vars(**{"uco-observable:path": path})
13431354

13441355

1345-
class FacetEvent(FacetEntity):
1356+
class EventRecordFacet(FacetEntity):
13461357
def __init__(
13471358
self,
1348-
event_type=None,
1349-
event_text=None,
1350-
event_id=None,
1351-
cyber_action=None,
1352-
computer_name=None,
1353-
created_time=None,
1354-
start_time=None,
1355-
end_time=None,
1359+
account: Union[None, ObjectEntity] = None,
1360+
application: Union[None, ObjectEntity] = None,
1361+
cyber_action: Union[None, ObjectEntity] = None,
1362+
end_time: Optional[datetime] = None,
1363+
event_record_device: Union[None, ObjectEntity] = None,
1364+
event_record_id: Optional[str] = None,
1365+
event_record_raw: Optional[str] = None,
1366+
event_record_service_name: Optional[str] = None,
1367+
event_record_text: Optional[str] = None,
1368+
event_type: Optional[str] = None,
1369+
observable_created_time: Optional[datetime] = None,
1370+
start_time: Optional[datetime] = None,
13561371
):
13571372
"""
13581373
An event facet is a grouping of characteristics unique to something that happens in a digital context
13591374
(e.g., operating system events).
1360-
:param event_type: The type of the event, for example 'information', 'warning' or 'error'.
1361-
:param event_text: The textual representation of the event.
1362-
:param event_id: The identifier of the event.
1375+
:param account: Specifies the account referenced in an event log entry or
1376+
used to run the scheduled task.
1377+
:param application: The application associated with this object.
13631378
:param cyber_action: The action taken in response to the event.
1364-
:param created_time: The date and time at which the observable object being characterized was created.
1365-
:param start_time: The date and time at which the observable object being characterized started.
13661379
:param end_time: The date and time at which the observable object being characterized ended.
1380+
:param event_record_device: The device where the event has been registered.
1381+
:param event_record_id: The identifier of the event.
1382+
:param event_record_raw: The complete raw content of the event record.
1383+
:param event_record_service_name: The service that generated the event record.
1384+
:param event_record_text: The textual representation of the event.
1385+
:param event_type: The type of the event, for example 'information', 'warning' or 'error'.
1386+
:param observable_created_time: The date and time at which the observable object being characterized was created.
1387+
:param start_time: The date and time at which the observable object being characterized started.
13671388
"""
13681389
super().__init__()
13691390
self["@type"] = "uco-observable:EventRecordFacet"
13701391
self._str_vars(
13711392
**{
1393+
"uco-observable:eventRecordID": event_record_id,
1394+
"uco-observable:eventRecordRaw": event_record_raw,
1395+
"uco-observable:eventRecordServiceName": event_record_service_name,
1396+
"uco-observable:eventRecordText": event_record_text,
13721397
"uco-observable:eventType": event_type,
1373-
"uco-observable:eventText": event_text,
1374-
"uco-observable:eventID": event_id,
1375-
"uco-observable:computerName": computer_name,
13761398
}
13771399
)
1378-
self._node_reference_vars(**{"uco-observable:cyberAction": cyber_action})
1400+
self._node_reference_vars(
1401+
**{
1402+
"uco-observable:account": account,
1403+
"uco-observable:application": application,
1404+
"uco-observable:cyberAction": cyber_action,
1405+
"uco-observable:eventRecordDevice": event_record_device,
1406+
}
1407+
)
13791408
self._datetime_vars(
13801409
**{
1410+
"uco-observable:observableCreatedTime": observable_created_time,
13811411
"uco-observable:startTime": start_time,
13821412
"uco-observable:endTime": end_time,
13831413
}
@@ -1719,7 +1749,7 @@ def __init__(self, disk_type=None, size=None, partition=None):
17191749
"uco-observable:SIMCardFacet": FacetSimCard,
17201750
"uco-observable:OperatingSystemFacet": FacetOperatingSystem,
17211751
"uco-observable:PathRelationFacet": FacetPathRelation,
1722-
"uco-observable:EventFacet": FacetEvent,
1752+
"uco-observable:EventRecordFacet": EventRecordFacet,
17231753
"uco-observable:ObservableRelationship": ObservableRelationship,
17241754
"uco-observable:ApplicationAccountFacet": FacetApplicationAccount,
17251755
"uco-observable:DigitalAccountFacet": FacetDigitalAccount,

0 commit comments

Comments
 (0)