diff --git a/README.md b/README.md index 26618a0f..e4a340de 100644 --- a/README.md +++ b/README.md @@ -13,9 +13,8 @@ Through this approach not only are domain-focused representations defined consis The purpose of this repository is to provide a foundation for broader community involvement in defining what to represent and how. ### Current Release -The current release of UCO is v0.3.0 +The current release of UCO is 0.5.0 -The content of v0.3.0 is primarily of fixing lexical, syntactic and semantic reasoning errors present in v0.2.0 and simplifying in some areas. -Its content is driven primarily from the initial base requirements of expressing cyber investigation information and is the product of input from the [Cyberinvestigation Analysis Standard Expression (CASE)](https://caseontology.org/) community. +UCO 0.5.0 is primarily focused on the removal of the investigation namespace from UCO (that namespace now resides in the CASE ontology) and on the renaming of several classes (Observable subclasses, Facet subclasses) in the observable namespace and a single property (core:facet) to support improved alignment with the CASE ontology and the forthcoming addition of ObservableObject subclasses. Future versions of UCO will not only expand and refine the ontology itself but will also provide more complete and formalized documentation. diff --git a/Release Notes.md b/Release Notes.md new file mode 100644 index 00000000..5707c1a2 --- /dev/null +++ b/Release Notes.md @@ -0,0 +1,146 @@ +# UCO 0.5.0 Release Notes + +## Focus: + +UCO Version 0.5.0 is primarily focused on the removal of the investigation namespace from UCO (that namespace now resides in the CASE ontology) and on the renaming of several classes (Observable subclasses, Facet subclasses) in the observable namespace and a single property (core:facet) to support improved alignment with the CASE ontology and the forthcoming addition of ObservableObject subclasses. + +### Focus Exceptions:  + + +# Changes (these are changes to ontologies, classes or properties in the preexisting ontology) + +### Breaking Changes (these are changes to ontologies, classes or properties in the preexisting ontology that make the new release non-backward-compatible) + +* uco-observable: modified the class name of observable:CyberItem to be observable:ObservableObject - [Issue OC-7](https://unifiedcyberontology.atlassian.net/jira/software/projects/OC/issues/OC-7) +* uco-observable: modified the class name of observable:CyberAction to be observable:ObservableAction - [Issue OC-7](https://unifiedcyberontology.atlassian.net/jira/software/projects/OC/issues/OC-7) +* uco-observable: modified the class name of observable:CyberRelationship to be observable:ObservableRelationship - [Issue OC-7](https://unifiedcyberontology.atlassian.net/jira/software/projects/OC/issues/OC-7) +* uco-observable: modified the class name of observable:CyberObservablePattern to be observable:ObservablePattern - [Issue OC-7](https://unifiedcyberontology.atlassian.net/jira/software/projects/OC/issues/OC-7) +* uco-core: modified the property name of core:facets to be core:hasFacet - [Issue OC-58](https://unifiedcyberontology.atlassian.net/jira/software/projects/OC/issues/OC-58) +* uco-observable: renamed the Facet subclasses within the observable namespace by appending “Facet” to the end of each subclass name - [Issue OC-57](https://unifiedcyberontology.atlassian.net/jira/software/projects/OC/issues/OC-57) + + Deprecated Subclass Name | New Subclass Name + ------------------------ | ----------------- + observable:Account | observable:AccountFacet + observable:AccountAuthentication | observable:AccountAuthenticationFacet + observable:Application | observable:ApplicationFacet + observable:ApplicationAccount | observable:ApplicationAccountFacet + observable:ArchiveFile | observable:ArchiveFileFacet + observable:Attachment | observable:AttachmentFacet + observable:Audio | observable:AudioFacet + observable:AutonomousSystem | observable:AutonomousSystemFacet + observable:BluetoothAddress | observable:BluetoothAddressFacet + observable:BrowserBookmark | observable:BrowserBookmarkFacet + observable:BrowserCookie | observable:BrowserCookieFacet + observable:Calendar | observable:CalendarFacet + observable:CalendarEntry | observable:CalendarEntryFacet + observable:CompressedStream | observable:CompressedStreamFacet + observable:ComputerSpecification | observable:ComputerSpecificationFacet + observable:Contact | observable:ContactFacet + observable:ContentData | observable:ContentDataFacet + observable:DataRange | observable:DataRangeFacet + observable:Device | observable:DeviceFacet + observable:DigitalAccount | observable:DigitalAccountFacet + observable:DigitalSignatureInfo | observable:DigitalSignatureInfoFacet + observable:Disk | observable:DiskFacet + observable:DiskPartition | observable:DiskPartitionFacet + observable:DomainName | observable:DomainNameFacet + observable:EXIF | observable:EXIFFacet + observable:EmailAccount | observable:EmailAccountFacet + observable:EmailAddress |observable:EmailAddressFacet + observable:EmailMessage |observable:EmailMessageFacet + observable:EncodedStream |observable:EncodedStreamFacet + observable:EncryptedStream |observable:EncryptedStreamFacet + observable:Event |observable:EventFacet + observable:ExtInode |observable:ExtInodeFacet + observable:ExtractedStrings |observable:ExtractedStringsFacet + observable:File |observable:FileFacet + observable:FilePermissions |observable:FilePermissionsFacet + observable:FileSystem |observable:FileSystemFacet + observable:Fragment |observable:FragmentFacet + observable:GeoLocationEntry |observable:GeoLocationEntryFacet + observable:GeoLocationLog |observable:GeoLocationLogFacet + observable:GeoLocationTrack |observable:GeoLocationTrackFacet + observable:HTTPConnection |observable:HTTPConnectionFacet + observable:ICMPConnection |observable:ICMPConnectionFacet + observable:IPv4Address |observable:IPv4AddressFacet + observable:IPv6Address |observable:IPv6AddressFacet + observable:Image |observable:ImageFacet + observable:Library |observable:LibraryFacet + observable:MACAddress |observable:MACAddressFacet + observable:Memory |observable:MemoryFacet + observable:Message |observable:MessageFacet + observable:MessageThread |observable:MessageThreadFacet + observable:MftRecord |observable:MftRecordFacet + observable:MobileAccount |observable:MobileAccountFacet + observable:MobileDevice |observable:MobileDeviceFacet + observable:Mutex |observable:MutexFacet + observable:NTFSFilePermissions |observable:NTFSFilePermissionsFacet + observable:NTFSFileSystem |observable:NTFSFileSystemFacet + observable:NetworkConnection |observable:NetworkConnectionFacet + observable:NetworkFlow |observable:NetworkFlowFacet + observable:NetworkInterface |observable:NetworkInterfaceFacet + observable:Note |observable:NoteFacet + observable:OperatingSystem |observable:OperatingSystemFacet + observable:PDFFile |observable:PDFFileFacet + observable:PathRelation |observable:PathRelationFacet + observable:PhoneAccount |observable:PhoneAccountFacet + observable:PhoneCall |observable:PhoneCallFacet + observable:Process |observable:ProcessFacet + observable:PropertiesEnumeratedEffect |observable:PropertiesEnumeratedEffectFacet + observable:PropertyReadEffect |observable:PropertyReadEffectFacet + observable:RasterPicture |observable:RasterPictureFacet + observable:SIMCard |observable:SIMCardFacet + observable:SMSMessage |observable:SMSMessageFacet + observable:SQLiteBlob |observable:SQLiteBlobFacet + observable:SendControlCodeEffect |observable:SendControlCodeEffectFacet + observable:Software |observable:SoftwareFacet + observable:StateChangeEffect |observable:StateChangeEffectFacet + observable:SymbolicLink |observable:SymbolicLinkFacet + observable:TCPConnection |observable:TCPConnectionFacet + observable:UNIXAccount |observable:UNIXAccountFacet + observable:UNIXFilePermissions |observable:UNIXFilePermissionsFacet + observable:UNIXProcess |observable:UNIXProcessFacet + observable:UNIXVolume |observable:UNIXVolumeFacet + observable:URL |observable:URLFacet + observable:UserAccount |observable:UserAccountFacet + observable:UserSession |observable:UserSessionFacet + observable:ValuesEnumeratedEffect |observable:ValuesEnumeratedEffectFacet + observable:Volume |observable:VolumeFacet + observable:WhoIs |observable:WhoIsFacet + observable:WifiAddress |observable:WifiAddressFacet + observable:WindowsAccount |observable:WindowsAccountFacet + observable:WindowsActiveDirectoryAccount |observable:WindowsActiveDirectoryAccountFacet + observable:WindowsComputerSpecification |observable:WindowsComputerSpecificationFacet + observable:WindowsPEBinaryFile |observable:WindowsPEBinaryFileFacet + observable:WindowsPrefetch |observable:WindowsPrefetchFacet + observable:WindowsProcess |observable:WindowsProcessFacet + observable:WindowsRegistryHive |observable:WindowsRegistryHiveFacet + observable:WindowsRegistryKey |observable:WindowsRegistryKeyFacet + observable:WindowsService |observable:WindowsServiceFacet + observable:WindowsTask |observable:WindowsTaskFacet + observable:WindowsThread |observable:WindowsThreadFacet + observable:WindowsVolume |observable:WindowsVolumeFacet + observable:WirelessNetworkConnection |observable:WirelessNetworkConnectionFacet + observable:X509Certificate | observable:X509CertificateFacet + observable:X509V3Extensions | observable:X509V3ExtensionsFacet + + +### Range Changes (these are changes to the "range" of a property that are not breaking changes: typically these are broadening in the scope of the range) + +### Changes (these are general changes to the preexisting ontology that are not breaking or range changes) + +### Deprecations/Deletions (classes or properties that were deprecated from the ontology) + +* uco-investigation: removed the Investigation namespace (investigation.ttl and investigation-da.ttl) from the UCO ontology - Issue OC-6(https://unifiedcyberontology.atlassian.net/jira/software/projects/OC/issues/OC-6) +* uco-master: removed the Investigation namespace (investigation and investigation-da) imports - Issue OC-6(https://unifiedcyberontology.atlassian.net/jira/software/projects/OC/issues/OC-6) + +## Additions + +### Class Additions (classes that were added) + +### Property Additions (properties that were added) + +### Vocabulary Additions/Changes (vocabularies that were added or modified) + +## Annotation Changes + diff --git a/Release Notes.pdf b/Release Notes.pdf deleted file mode 100644 index b110def6..00000000 Binary files a/Release Notes.pdf and /dev/null differ diff --git a/uco-core/core-da.ttl b/uco-core/core-da.ttl index b61af438..f2b50c58 100644 --- a/uco-core/core-da.ttl +++ b/uco-core/core-da.ttl @@ -58,7 +58,7 @@ core:externalIdentifier rdfs:domain core:ExternalReference ; . -core:facets +core:hasFacet rdfs:domain core:UcoObject ; . @@ -133,3 +133,4 @@ core:type core:value rdfs:domain core:ControlledVocabulary ; . + diff --git a/uco-core/core.ttl b/uco-core/core.ttl index 88f01468..e2a1fb46 100644 --- a/uco-core/core.ttl +++ b/uco-core/core.ttl @@ -316,9 +316,9 @@ core:externalIdentifier rdfs:range xsd:string ; . -core:facets +core:hasFacet a owl:ObjectProperty ; - rdfs:label "facets"@en ; + rdfs:label "hasFacet"@en ; rdfs:comment "Further sets of properties characterizing a concept based on the particular context of the class and of the particular instance of the concept being characterized."@en ; rdfs:range core:Facet ; . @@ -452,3 +452,4 @@ core:value a owl:Class ; . + diff --git a/uco-investigation/investigation-da.ttl b/uco-investigation/investigation-da.ttl deleted file mode 100644 index 2992deaf..00000000 --- a/uco-investigation/investigation-da.ttl +++ /dev/null @@ -1,50 +0,0 @@ -# baseURI: https://unifiedcyberontology.org/ontology/uco/investigation-da - -@base . -@prefix investigation: . -@prefix owl: . -@prefix rdf: . -@prefix rdfs: . -@prefix xsd: . - - - a owl:Ontology ; - rdfs:label "investigation domain assertions"@en ; - . - -investigation:authorizationIdentifier - rdfs:domain investigation:Authorization ; - . - -investigation:authorizationType - rdfs:domain investigation:Authorization ; - . - -investigation:endTime - rdfs:domain investigation:Investigation ; - . - -investigation:exhibitNumber - rdfs:domain investigation:ProvenanceRecord ; - . - -investigation:focus - rdfs:domain investigation:Investigation ; - . - -investigation:investigationForm - rdfs:domain investigation:Investigation ; - . - -investigation:investigationStatus - rdfs:domain investigation:Investigation ; - . - -investigation:relevantAuthorization - rdfs:domain investigation:Investigation ; - . - -investigation:startTime - rdfs:domain investigation:Investigation ; - . - diff --git a/uco-investigation/investigation.ttl b/uco-investigation/investigation.ttl deleted file mode 100644 index 35054be9..00000000 --- a/uco-investigation/investigation.ttl +++ /dev/null @@ -1,227 +0,0 @@ -# baseURI: https://unifiedcyberontology.org/ontology/uco/investigation -# imports: https://unifiedcyberontology.org/ontology/uco/action -# imports: https://unifiedcyberontology.org/ontology/uco/core -# imports: https://unifiedcyberontology.org/ontology/uco/location -# imports: https://unifiedcyberontology.org/ontology/uco/role - -@base . -@prefix investigation: . -@prefix owl: . -@prefix rdf: . -@prefix rdfs: . -@prefix xsd: . - - - a owl:Ontology ; - rdfs:label "uco-investigation"@en ; - owl:imports - , - , - , - - ; - . - - - rdfs:domain investigation:Authorization ; - . - - - rdfs:domain investigation:Authorization ; - . - -investigation:Attorney - a owl:Class ; - rdfs:subClassOf ; - rdfs:label "Attorney"@en ; - rdfs:comment ""@en ; - . - -investigation:Authorization - a owl:Class ; - rdfs:subClassOf - , - [ - a owl:Restriction ; - owl:onProperty investigation:authorizationType ; - owl:cardinality "1"^^xsd:nonNegativeInteger ; - ] , - [ - a owl:Restriction ; - owl:onProperty ; - owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; - owl:onDataRange xsd:dateTime ; - ] , - [ - a owl:Restriction ; - owl:onProperty ; - owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; - owl:onDataRange xsd:dateTime ; - ] , - [ - a owl:Restriction ; - owl:onProperty investigation:authorizationIdentifier ; - owl:minQualifiedCardinality "1"^^xsd:nonNegativeInteger ; - owl:onDataRange xsd:string ; - ] - ; - rdfs:label "Authorization"@en ; - rdfs:comment "Identifies some form of authorization for investigatory action."@en ; - . - -investigation:Examiner - a owl:Class ; - rdfs:subClassOf ; - rdfs:label "Examiner"@en ; - rdfs:comment ""@en ; - . - -investigation:ExaminerActionLifecylce - a owl:Class ; - rdfs:subClassOf ; - rdfs:label "ExaminerActionLifecylce"@en ; - rdfs:comment ""@en ; - . - -investigation:Investigation - a owl:Class ; - rdfs:subClassOf - , - [ - a owl:Restriction ; - owl:onProperty investigation:investigationForm ; - owl:cardinality "1"^^xsd:nonNegativeInteger ; - ] , - [ - a owl:Restriction ; - owl:onProperty investigation:endTime ; - owl:maxCardinality "1"^^xsd:nonNegativeInteger ; - ] , - [ - a owl:Restriction ; - owl:onProperty investigation:investigationStatus ; - owl:maxCardinality "1"^^xsd:nonNegativeInteger ; - ] , - [ - a owl:Restriction ; - owl:onProperty investigation:startTime ; - owl:maxCardinality "1"^^xsd:nonNegativeInteger ; - ] - ; - rdfs:label "Investigation"@en ; - rdfs:comment "An exploration of the facts involved in a cyber-relevant set of suspicious activity."@en ; - . - -investigation:InvestigativeAction - a owl:Class ; - rdfs:subClassOf ; - rdfs:label "InvestigativeAction"@en ; - rdfs:comment "An examination action taken as part of a cyber investigation."@en ; - . - -investigation:Investigator - a owl:Class ; - rdfs:subClassOf ; - rdfs:label "Investigator"@en ; - rdfs:comment ""@en ; - . - -investigation:ProvenanceRecord - a owl:Class ; - rdfs:subClassOf - , - [ - a owl:Restriction ; - owl:onProperty investigation:exhibitNumber ; - owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; - owl:onDataRange xsd:string ; - ] - ; - rdfs:label "ProvenanceRecord"@en ; - rdfs:comment "A provenantial connection between a forensic action and a set of observations (items and/or actions) or interpretations that result from it."@en ; - . - -investigation:Subject - a owl:Class ; - rdfs:subClassOf ; - rdfs:label "Subject"@en ; - rdfs:comment ""@en ; - . - -investigation:SubjectActionLifecycle - a owl:Class ; - rdfs:subClassOf ; - rdfs:label "SubjectActionLifecycle"@en ; - rdfs:comment ""@en ; - . - -investigation:VictimActionLifecycle - a owl:Class ; - rdfs:subClassOf ; - rdfs:label "VictimActionLifecycle"@en ; - rdfs:comment ""@en ; - . - -investigation:authorizationIdentifier - a owl:DatatypeProperty ; - rdfs:label "authorizationIdentifier"@en ; - rdfs:comment "The identifier for a particular authorization (e.g. warrant number)"@en ; - rdfs:range xsd:string ; - . - -investigation:authorizationType - a owl:DatatypeProperty ; - rdfs:label "authorizationType"@en ; - rdfs:comment "A label categorizing a type of authorization (e.g. warrant)"@en ; - rdfs:range xsd:string ; - . - -investigation:endTime - a owl:DatatypeProperty ; - rdfs:label "endTime"@en ; - rdfs:comment ""@en ; - rdfs:range xsd:dateTime ; - . - -investigation:exhibitNumber - a owl:DatatypeProperty ; - rdfs:label "exhibitNumber"@en ; - rdfs:comment ""@en ; - rdfs:range xsd:string ; - . - -investigation:focus - a owl:DatatypeProperty ; - rdfs:label "focus"@en ; - rdfs:comment "Specifies the topical focus of an investigation."@en ; - rdfs:range xsd:string ; - . - -investigation:investigationForm - a owl:DatatypeProperty ; - rdfs:label "investigationForm"@en ; - rdfs:comment "A label categorizing a type of investigation (case, incident, suspicious-activity, etc.)"@en ; - rdfs:range ; - . - -investigation:investigationStatus - a owl:DatatypeProperty ; - rdfs:label "investigationStatus"@en ; - rdfs:comment "A label characterizing the status of an investigation (open, closed, etc.)."@en ; - rdfs:range xsd:string ; - . - -investigation:relevantAuthorization - a owl:ObjectProperty ; - rdfs:label "relevantAuthorization"@en ; - rdfs:comment "Specifies an authorization relevant to a particular investigation."@en ; - rdfs:range investigation:Authorization ; - . - -investigation:startTime - a owl:DatatypeProperty ; - rdfs:label "startTime"@en ; - rdfs:comment ""@en ; - rdfs:range xsd:dateTime ; - . - diff --git a/uco-master/uco.ttl b/uco-master/uco.ttl index 6e0f79b4..25db6e17 100644 --- a/uco-master/uco.ttl +++ b/uco-master/uco.ttl @@ -1,45 +1,65 @@ +# baseURI: https://unifiedcyberontology.org/ontology/uco/uco +# imports: https://unifiedcyberontology.org/ontology/uco/action +# imports: https://unifiedcyberontology.org/ontology/uco/action-da +# imports: https://unifiedcyberontology.org/ontology/uco/core +# imports: https://unifiedcyberontology.org/ontology/uco/core-da +# imports: https://unifiedcyberontology.org/ontology/uco/identity +# imports: https://unifiedcyberontology.org/ontology/uco/identity-da +# imports: https://unifiedcyberontology.org/ontology/uco/location +# imports: https://unifiedcyberontology.org/ontology/uco/location-da +# imports: https://unifiedcyberontology.org/ontology/uco/marking +# imports: https://unifiedcyberontology.org/ontology/uco/marking-da +# imports: https://unifiedcyberontology.org/ontology/uco/observable +# imports: https://unifiedcyberontology.org/ontology/uco/observable-da +# imports: https://unifiedcyberontology.org/ontology/uco/pattern +# imports: https://unifiedcyberontology.org/ontology/uco/pattern-da +# imports: https://unifiedcyberontology.org/ontology/uco/role +# imports: https://unifiedcyberontology.org/ontology/uco/time +# imports: https://unifiedcyberontology.org/ontology/uco/tool +# imports: https://unifiedcyberontology.org/ontology/uco/tool-da +# imports: https://unifiedcyberontology.org/ontology/uco/types +# imports: https://unifiedcyberontology.org/ontology/uco/types-da +# imports: https://unifiedcyberontology.org/ontology/uco/victim + +@base . @prefix : . -@prefix xs: . @prefix owl: . @prefix rdf: . +@prefix rdfs: . @prefix uco: . @prefix xml: . +@prefix xs: . @prefix xsd: . -@prefix rdfs: . -@base . - - rdf:type owl:Ontology ; - owl:imports , - , - , - , - , - , - , - , - , - , - , - , - , - , - , - , - , - , - , - , - , - , - ; - rdfs:label "uco-master"@en . - -################################################################# -# Data properties -################################################################# -### https://unifiedcyberontology.org/ontology/uco/core#id - rdfs:range . + + a owl:Ontology ; + rdfs:label "uco-master"@en ; + owl:imports + , + , + , + , + , + , + , + , + , + , + , + , + , + , + , + , + , + , + , + , + + ; + . + + rdfs:range ; + . -### Generated by the OWL API (version 4.5.9.2019-02-01T07:24:44Z) https://github.com/owlcs/owlapi diff --git a/uco-observable/observable-da.ttl b/uco-observable/observable-da.ttl index c7390c3b..a61caca8 100644 --- a/uco-observable/observable-da.ttl +++ b/uco-observable/observable-da.ttl @@ -19,43 +19,43 @@ observable:abbreviation . observable:accessedDirectory - rdfs:domain observable:WindowsPrefetch ; + rdfs:domain observable:WindowsPrefetchFacet ; . observable:accessedFile - rdfs:domain observable:WindowsPrefetch ; + rdfs:domain observable:WindowsPrefetchFacet ; . observable:accessedTime - rdfs:domain observable:File ; + rdfs:domain observable:FileFacet ; . observable:account - rdfs:domain observable:WindowsTask ; + rdfs:domain observable:WindowsTaskFacet ; . observable:accountIdentifier - rdfs:domain observable:Account ; + rdfs:domain observable:AccountFacet ; . observable:accountIssuer - rdfs:domain observable:Account ; + rdfs:domain observable:AccountFacet ; . observable:accountLogin - rdfs:domain observable:DigitalAccount ; + rdfs:domain observable:DigitalAccountFacet ; . observable:accountLogonType - rdfs:domain observable:WindowsTask ; + rdfs:domain observable:WindowsTaskFacet ; . observable:accountRunLevel - rdfs:domain observable:WindowsTask ; + rdfs:domain observable:WindowsTaskFacet ; . observable:accountType - rdfs:domain observable:Account ; + rdfs:domain observable:AccountFacet ; . observable:actionID @@ -63,7 +63,7 @@ observable:actionID . observable:actionList - rdfs:domain observable:WindowsTask ; + rdfs:domain observable:WindowsTaskFacet ; . observable:actionType @@ -71,11 +71,11 @@ observable:actionType . observable:activeDirectoryGroups - rdfs:domain observable:WindowsActiveDirectoryAccount ; + rdfs:domain observable:WindowsActiveDirectoryAccountFacet ; . observable:adapterName - rdfs:domain observable:NetworkInterface ; + rdfs:domain observable:NetworkInterfaceFacet ; . observable:address @@ -88,61 +88,61 @@ observable:addressOfEntryPoint observable:addressValue rdfs:domain - observable:BluetoothAddress , - observable:WifiAddress + observable:BluetoothAddressFacet , + observable:WifiAddressFacet ; . observable:allocationStatus - rdfs:domain observable:File ; + rdfs:domain observable:FileFacet ; . observable:alternateDataStreams - rdfs:domain observable:NTFSFileSystem ; + rdfs:domain observable:NTFSFileSystemFacet ; . observable:application - rdfs:domain observable:PhoneCall ; + rdfs:domain observable:PhoneCallFacet ; . observable:applicationFileName - rdfs:domain observable:WindowsPrefetch ; + rdfs:domain observable:WindowsPrefetchFacet ; . observable:applicationIdentifier - rdfs:domain observable:Application ; + rdfs:domain observable:ApplicationFacet ; . observable:archiveType - rdfs:domain observable:ArchiveFile ; + rdfs:domain observable:ArchiveFileFacet ; . observable:arguments - rdfs:domain observable:Process ; + rdfs:domain observable:ProcessFacet ; . observable:asHandle - rdfs:domain observable:AutonomousSystem ; + rdfs:domain observable:AutonomousSystemFacet ; . observable:aslrEnabled - rdfs:domain observable:WindowsProcess ; + rdfs:domain observable:WindowsProcessFacet ; . observable:attendant - rdfs:domain observable:CalendarEntry ; + rdfs:domain observable:CalendarEntryFacet ; . observable:audioType - rdfs:domain observable:Audio ; + rdfs:domain observable:AudioFacet ; . observable:authorityKeyIdentifier - rdfs:domain observable:X509V3Extensions ; + rdfs:domain observable:X509V3ExtensionsFacet ; . observable:availableRam - rdfs:domain observable:ComputerSpecification ; + rdfs:domain observable:ComputerSpecificationFacetFacet ; . observable:baseOfCode @@ -150,79 +150,79 @@ observable:baseOfCode . observable:baseStation - rdfs:domain observable:WirelessNetworkConnection ; + rdfs:domain observable:WirelessNetworkConnectionFacet ; . observable:basicConstraints - rdfs:domain observable:X509V3Extensions ; + rdfs:domain observable:X509V3ExtensionsFacet ; . observable:bcc - rdfs:domain observable:EmailMessage ; + rdfs:domain observable:EmailMessageFacet ; . observable:binary - rdfs:domain observable:Process ; + rdfs:domain observable:ProcessFacet ; . observable:biosDate - rdfs:domain observable:ComputerSpecification ; + rdfs:domain observable:ComputerSpecificationFacet ; . observable:biosManufacturer - rdfs:domain observable:ComputerSpecification ; + rdfs:domain observable:ComputerSpecificationFacet ; . observable:biosReleaseDate - rdfs:domain observable:ComputerSpecification ; + rdfs:domain observable:ComputerSpecificationFacet ; . observable:biosSerialNumber - rdfs:domain observable:ComputerSpecification ; + rdfs:domain observable:ComputerSpecificationFacet ; . observable:biosVersion - rdfs:domain observable:ComputerSpecification ; + rdfs:domain observable:ComputerSpecificationFacet ; . observable:bitRate - rdfs:domain observable:Audio ; + rdfs:domain observable:AudioFacet ; . observable:bitness - rdfs:domain observable:OperatingSystem ; + rdfs:domain observable:OperatingSystemFacet ; . observable:bitsPerPixel - rdfs:domain observable:RasterPicture ; + rdfs:domain observable:RasterPictureFacet ; . observable:blockType - rdfs:domain observable:Memory ; + rdfs:domain observable:MemoryFacet ; . observable:bluetoothDeviceName - rdfs:domain observable:MobileDevice ; + rdfs:domain observable:MobileDeviceFacet ; . observable:body - rdfs:domain observable:EmailMessage ; + rdfs:domain observable:EmailMessageFacet ; . observable:bodyMultipart - rdfs:domain observable:EmailMessage ; + rdfs:domain observable:EmailMessageFacet ; . observable:bodyRaw - rdfs:domain observable:EmailMessage ; + rdfs:domain observable:EmailMessageFacet ; . observable:bookmarkPath - rdfs:domain observable:BrowserBookmark ; + rdfs:domain observable:BrowserBookmarkFacet ; . observable:byteOrder - rdfs:domain observable:ContentData ; + rdfs:domain observable:ContentDataFacet ; . observable:byteStringValue @@ -230,43 +230,43 @@ observable:byteStringValue . observable:callType - rdfs:domain observable:PhoneCall ; + rdfs:domain observable:PhoneCallFacet ; . observable:camera - rdfs:domain observable:RasterPicture ; + rdfs:domain observable:RasterPictureFacet ; . observable:canEscalatePrivs - rdfs:domain observable:UserAccount ; + rdfs:domain observable:UserAccountFacet ; . observable:carrier - rdfs:domain observable:SIMCard ; + rdfs:domain observable:SIMCardFacet ; . observable:categories - rdfs:domain observable:EmailMessage ; + rdfs:domain observable:EmailMessageFacet ; . observable:cc - rdfs:domain observable:EmailMessage ; + rdfs:domain observable:EmailMessageFacet ; . observable:certificateIssuer - rdfs:domain observable:DigitalSignatureInfo ; + rdfs:domain observable:DigitalSignatureInfoFacet ; . observable:certificatePolicies - rdfs:domain observable:X509V3Extensions ; + rdfs:domain observable:X509V3ExtensionsFacet ; . observable:certificateSubject - rdfs:domain observable:DigitalSignatureInfo ; + rdfs:domain observable:DigitalSignatureInfoFacet ; . observable:characteristics - rdfs:domain observable:WindowsPEBinaryFile ; + rdfs:domain observable:WindowsPEBinaryFileFacet ; . observable:checksum @@ -274,15 +274,15 @@ observable:checksum . observable:clockSetting - rdfs:domain observable:MobileDevice ; + rdfs:domain observable:MobileDeviceFacet ; . observable:clusterSize - rdfs:domain observable:FileSystem ; + rdfs:domain observable:FileSystemFacet ; . observable:columnName - rdfs:domain observable:SQLiteBlob ; + rdfs:domain observable:SQLiteBlobFacet ; . observable:comClassID @@ -294,19 +294,19 @@ observable:comData . observable:comment - rdfs:domain observable:ArchiveFile ; + rdfs:domain observable:ArchiveFileFacet ; . observable:compressionMethod - rdfs:domain observable:CompressedStream ; + rdfs:domain observable:CompressedStreamFacet ; . observable:compressionRatio - rdfs:domain observable:CompressedStream ; + rdfs:domain observable:CompressedStreamFacet ; . observable:computerName - rdfs:domain observable:Event ; + rdfs:domain observable:EventFacet ; . observable:contactID @@ -314,7 +314,7 @@ observable:contactID . observable:contactInfo - rdfs:domain observable:WhoIs ; + rdfs:domain observable:WhoIsFacet ; . observable:contactName @@ -330,83 +330,83 @@ observable:contactType . observable:contentDisposition - rdfs:domain observable:EmailMessage ; + rdfs:domain observable:EmailMessageFacet ; . observable:contentType - rdfs:domain observable:EmailMessage ; + rdfs:domain observable:EmailMessageFacet ; . observable:context - rdfs:domain observable:WindowsThread ; + rdfs:domain observable:WindowsThreadFacet ; . observable:controlCode - rdfs:domain observable:SendControlCodeEffect ; + rdfs:domain observable:SendControlCodeEffectFacet ; . observable:cookieDomain - rdfs:domain observable:BrowserCookie ; + rdfs:domain observable:BrowserCookieFacet ; . observable:cookieName - rdfs:domain observable:BrowserCookie ; + rdfs:domain observable:BrowserCookieFacet ; . observable:cookiePath - rdfs:domain observable:BrowserCookie ; + rdfs:domain observable:BrowserCookieFacet ; . observable:cpeid - rdfs:domain observable:Software ; + rdfs:domain observable:SoftwareFacet ; . observable:cpu - rdfs:domain observable:ComputerSpecification ; + rdfs:domain observable:ComputerSpecificationFacet ; . observable:cpuFamily - rdfs:domain observable:ComputerSpecification ; + rdfs:domain observable:ComputerSpecificationFacet ; . observable:createdTime - rdfs:domain observable:File ; + rdfs:domain observable:FileFacet ; . observable:creationDate - rdfs:domain observable:WhoIs ; + rdfs:domain observable:WhoIsFacet ; . observable:creationFlags - rdfs:domain observable:WindowsThread ; + rdfs:domain observable:WindowsThreadFacet ; . observable:creationTime - rdfs:domain observable:WindowsThread ; + rdfs:domain observable:WindowsThreadFacet ; . observable:creator - rdfs:domain observable:WindowsRegistryKey ; + rdfs:domain observable:WindowsRegistryKeyFacet ; . observable:creatorUser - rdfs:domain observable:Process ; + rdfs:domain observable:ProcessFacet ; . observable:crlDistributionPoints - rdfs:domain observable:X509V3Extensions ; + rdfs:domain observable:X509V3ExtensionsFacet ; . observable:currentSystemDate - rdfs:domain observable:ComputerSpecification ; + rdfs:domain observable:ComputerSpecificationFacet ; . observable:currentWorkingDirectory - rdfs:domain observable:Process ; + rdfs:domain observable:ProcessFacet ; . observable:cyberAction - rdfs:domain observable:Event ; + rdfs:domain observable:EventFacet ; . observable:data @@ -414,11 +414,11 @@ observable:data . observable:dataPayload - rdfs:domain observable:ContentData ; + rdfs:domain observable:ContentDataFacet ; . observable:dataPayloadReferenceURL - rdfs:domain observable:ContentData ; + rdfs:domain observable:ContentDataFacet ; . observable:dataType @@ -426,11 +426,11 @@ observable:dataType . observable:depEnabled - rdfs:domain observable:WindowsProcess ; + rdfs:domain observable:WindowsProcessFacet ; . observable:descriptions - rdfs:domain observable:WindowsService ; + rdfs:domain observable:WindowsServiceFacet ; . observable:destination @@ -438,43 +438,43 @@ observable:destination . observable:destinationFlags - rdfs:domain observable:TCPConnection ; + rdfs:domain observable:TCPConnectionFacet ; . observable:destinationPort - rdfs:domain observable:NetworkConnection ; + rdfs:domain observable:NetworkConnectionFacet ; . observable:deviceType - rdfs:domain observable:Device ; + rdfs:domain observable:DeviceFacet ; . observable:dhcpLeaseExpires - rdfs:domain observable:NetworkInterface ; + rdfs:domain observable:NetworkInterfaceFacet ; . observable:dhcpLeaseObtained - rdfs:domain observable:NetworkInterface ; + rdfs:domain observable:NetworkInterfaceFacet ; . observable:dhcpServer - rdfs:domain observable:NetworkInterface ; + rdfs:domain observable:NetworkInterfaceFacet ; . observable:diskPartitionType - rdfs:domain observable:DiskPartition ; + rdfs:domain observable:DiskPartitionFacet ; . observable:diskSize - rdfs:domain observable:Disk ; + rdfs:domain observable:DiskFacet ; . observable:diskType - rdfs:domain observable:Disk ; + rdfs:domain observable:DiskFacet ; . observable:displayName - rdfs:domain observable:WindowsService ; + rdfs:domain observable:WindowsServiceFacet ; . observable:dllCharacteristics @@ -482,7 +482,7 @@ observable:dllCharacteristics . observable:dnssec - rdfs:domain observable:WhoIs ; + rdfs:domain observable:WhoIsFacet ; . observable:documentInformationDictionary @@ -490,55 +490,55 @@ observable:documentInformationDictionary . observable:domain - rdfs:domain observable:WindowsComputerSpecification ; + rdfs:domain observable:WindowsComputerSpecificationFacet ; . observable:domainID - rdfs:domain observable:WhoIs ; + rdfs:domain observable:WhoIsFacet ; . observable:domainName - rdfs:domain observable:WhoIs ; + rdfs:domain observable:WhoIsFacet ; . observable:driveLetter - rdfs:domain observable:WindowsVolume ; + rdfs:domain observable:WindowsVolumeFacet ; . observable:driveType - rdfs:domain observable:WindowsVolume ; + rdfs:domain observable:WindowsVolumeFacet ; . observable:dst - rdfs:domain observable:NetworkConnection ; + rdfs:domain observable:NetworkConnectionFacet ; . observable:dstBytes - rdfs:domain observable:NetworkFlow ; + rdfs:domain observable:NetworkFlowFacet ; . observable:dstPackets - rdfs:domain observable:NetworkFlow ; + rdfs:domain observable:NetworkFlowFacet ; . observable:dstPayload - rdfs:domain observable:NetworkFlow ; + rdfs:domain observable:NetworkFlowFacet ; . observable:duration - rdfs:domain observable:PhoneCall ; + rdfs:domain observable:PhoneCallFacet ; . observable:effectiveGroup - rdfs:domain observable:UserSession ; + rdfs:domain observable:UserSessionFacet ; . observable:effectiveGroupID - rdfs:domain observable:UserSession ; + rdfs:domain observable:UserSessionFacet ; . observable:effectiveUser - rdfs:domain observable:UserSession ; + rdfs:domain observable:UserSessionFacet ; . observable:emailAddress @@ -550,27 +550,27 @@ observable:encoding . observable:encodingMethod - rdfs:domain observable:EncodedStream ; + rdfs:domain observable:EncodedStreamFacet ; . observable:encryptionIV - rdfs:domain observable:EncryptedStream ; + rdfs:domain observable:EncryptedStreamFacet ; . observable:encryptionKey - rdfs:domain observable:EncryptedStream ; + rdfs:domain observable:EncryptedStreamFacet ; . observable:encryptionMethod - rdfs:domain observable:EncryptedStream ; + rdfs:domain observable:EncryptedStreamFacet ; . observable:encryptionMode - rdfs:domain observable:EncryptedStream ; + rdfs:domain observable:EncryptedStreamFacet ; . observable:endTime - rdfs:domain observable:PhoneCall ; + rdfs:domain observable:PhoneCallFacet ; . observable:englishTranslation @@ -578,31 +578,31 @@ observable:englishTranslation . observable:entropy - rdfs:domain observable:ContentData ; + rdfs:domain observable:ContentDataFacet ; . observable:entryID - rdfs:domain observable:NTFSFileSystem ; + rdfs:domain observable:NTFSFileSystemFacet ; . observable:environmentVariables - rdfs:domain observable:Process ; + rdfs:domain observable:ProcessFacet ; . observable:eventID - rdfs:domain observable:Event ; + rdfs:domain observable:EventFacet ; . observable:eventStatus - rdfs:domain observable:CalendarEntry ; + rdfs:domain observable:CalendarEntryFacet ; . observable:eventText - rdfs:domain observable:Event ; + rdfs:domain observable:EventFacet ; . observable:eventType - rdfs:domain observable:Event ; + rdfs:domain observable:EventFacet ; . observable:execArguments @@ -622,71 +622,71 @@ observable:execWorkingDirectory . observable:exifData - rdfs:domain observable:EXIF ; + rdfs:domain observable:EXIFFacet ; . observable:exitCode - rdfs:domain observable:WindowsTask ; + rdfs:domain observable:WindowsTaskFacet ; . observable:exitStatus - rdfs:domain observable:Process ; + rdfs:domain observable:ProcessFacet ; . observable:exitTime - rdfs:domain observable:Process ; + rdfs:domain observable:ProcessFacet ; . observable:expirationDate - rdfs:domain observable:WhoIs ; + rdfs:domain observable:WhoIsFacet ; . observable:expirationTime - rdfs:domain observable:BrowserCookie ; + rdfs:domain observable:BrowserCookieFacet ; . observable:extDeletionTime - rdfs:domain observable:ExtInode ; + rdfs:domain observable:ExtInodeFacet ; . observable:extFileType - rdfs:domain observable:ExtInode ; + rdfs:domain observable:ExtInodeFacet ; . observable:extFlags - rdfs:domain observable:ExtInode ; + rdfs:domain observable:ExtInodeFacet ; . observable:extHardLinkCount - rdfs:domain observable:ExtInode ; + rdfs:domain observable:ExtInodeFacet ; . observable:extInodeChangeTime - rdfs:domain observable:ExtInode ; + rdfs:domain observable:ExtInodeFacet ; . observable:extInodeID - rdfs:domain observable:ExtInode ; + rdfs:domain observable:ExtInodeFacet ; . observable:extPermissions - rdfs:domain observable:ExtInode ; + rdfs:domain observable:ExtInodeFacet ; . observable:extSGID - rdfs:domain observable:ExtInode ; + rdfs:domain observable:ExtInodeFacet ; . observable:extSUID - rdfs:domain observable:ExtInode ; + rdfs:domain observable:ExtInodeFacet ; . observable:extendedKeyUsage - rdfs:domain observable:X509V3Extensions ; + rdfs:domain observable:X509V3ExtensionsFacet ; . observable:extension - rdfs:domain observable:File ; + rdfs:domain observable:FileFacet ; . observable:faxNumber @@ -698,95 +698,95 @@ observable:fileAlignment . observable:fileHeaderHashes - rdfs:domain observable:WindowsPEBinaryFile ; + rdfs:domain observable:WindowsPEBinaryFileFacet ; . observable:fileName - rdfs:domain observable:File ; + rdfs:domain observable:FileFacet ; . observable:filePath - rdfs:domain observable:File ; + rdfs:domain observable:FileFacet ; . observable:fileSystemType - rdfs:domain observable:FileSystem ; + rdfs:domain observable:FileSystemFacet ; . observable:firstLoginTime - rdfs:domain observable:DigitalAccount ; + rdfs:domain observable:DigitalAccountFacet ; . observable:firstName - rdfs:domain observable:Contact ; + rdfs:domain observable:ContactFacet ; . observable:firstRun - rdfs:domain observable:WindowsPrefetch ; + rdfs:domain observable:WindowsPrefetchFacet ; . observable:flags - rdfs:domain observable:WindowsTask ; + rdfs:domain observable:WindowsTaskFacet ; . observable:format - rdfs:domain observable:Audio ; + rdfs:domain observable:AudioFacet ; . observable:fragment - rdfs:domain observable:URL ; + rdfs:domain observable:URLFacet ; . observable:fragmentIndex - rdfs:domain observable:Fragment ; + rdfs:domain observable:FragmentFacet ; . observable:freeSpace - rdfs:domain observable:Disk ; + rdfs:domain observable:DiskFacet ; . observable:from - rdfs:domain observable:PhoneCall ; + rdfs:domain observable:PhoneCallFacet ; . observable:fullValue - rdfs:domain observable:URL ; + rdfs:domain observable:URLFacet ; . observable:geoLocationEntry - rdfs:domain observable:GeoLocationTrack ; + rdfs:domain observable:GeoLocationTrackFacet ; . observable:gid - rdfs:domain observable:UNIXAccount ; + rdfs:domain observable:UNIXAccountFacet ; . observable:globalFlagList - rdfs:domain observable:WindowsComputerSpecification ; + rdfs:domain observable:WindowsComputerSpecificationFacet ; . observable:gpu - rdfs:domain observable:ComputerSpecification ; + rdfs:domain observable:ComputerSpecificationFacet ; . observable:gpuFamily - rdfs:domain observable:ComputerSpecification ; + rdfs:domain observable:ComputerSpecificationFacet ; . observable:groupName - rdfs:domain observable:WindowsService ; + rdfs:domain observable:WindowsServiceFacet ; . observable:groups - rdfs:domain observable:WindowsAccount ; + rdfs:domain observable:WindowsAccountFacet ; . observable:hasChanged - rdfs:domain observable:CyberItem ; + rdfs:domain observable:ObservableObject ; . observable:hash - rdfs:domain observable:ContentData ; + rdfs:domain observable:ContentDataFacet ; . observable:hashes @@ -794,7 +794,7 @@ observable:hashes . observable:headerRaw - rdfs:domain observable:EmailMessage ; + rdfs:domain observable:EmailMessageFacet ; . observable:hexadecimalValue @@ -802,31 +802,31 @@ observable:hexadecimalValue . observable:hiveType - rdfs:domain observable:WindowsRegistryHive ; + rdfs:domain observable:WindowsRegistryHiveFacet ; . observable:homeDirectory - rdfs:domain observable:UserAccount ; + rdfs:domain observable:UserAccountFacet ; . observable:host - rdfs:domain observable:URL ; + rdfs:domain observable:URLFacet ; . observable:hostname - rdfs:domain observable:ComputerSpecification ; + rdfs:domain observable:ComputerSpecificationFacet ; . observable:httpMesageBodyLength - rdfs:domain observable:HTTPConnection ; + rdfs:domain observable:HTTPConnectionFacet ; . observable:httpMessageBodyData - rdfs:domain observable:HTTPConnection ; + rdfs:domain observable:HTTPConnectionFacet ; . observable:httpRequestHeader - rdfs:domain observable:HTTPConnection ; + rdfs:domain observable:HTTPConnectionFacet ; . observable:iComHandlerAction @@ -846,11 +846,11 @@ observable:iShowMessageAction . observable:icmpCode - rdfs:domain observable:ICMPConnection ; + rdfs:domain observable:ICMPConnectionFacet ; . observable:icmpType - rdfs:domain observable:ICMPConnection ; + rdfs:domain observable:ICMPConnectionFacet ; . observable:imageBase @@ -858,59 +858,59 @@ observable:imageBase . observable:imageCompressionMethod - rdfs:domain observable:RasterPicture ; + rdfs:domain observable:RasterPictureFacet ; . observable:imageName - rdfs:domain observable:WindowsTask ; + rdfs:domain observable:WindowsTaskFacet ; . observable:imageType - rdfs:domain observable:Image ; + rdfs:domain observable:ImageFacet ; . observable:impHash - rdfs:domain observable:WindowsPEBinaryFile ; + rdfs:domain observable:WindowsPEBinaryFileFacet ; . observable:inReplyTo - rdfs:domain observable:EmailMessage ; + rdfs:domain observable:EmailMessageFacet ; . observable:inhibitAnyPolicy - rdfs:domain observable:X509V3Extensions ; + rdfs:domain observable:X509V3ExtensionsFacet ; . observable:installDate - rdfs:domain observable:OperatingSystem ; + rdfs:domain observable:OperatingSystemFacet ; . observable:ip - rdfs:domain observable:NetworkInterface ; + rdfs:domain observable:NetworkInterfaceFacet ; . observable:ipAddress - rdfs:domain observable:WhoIs ; + rdfs:domain observable:WhoIsFacet ; . observable:ipGateway - rdfs:domain observable:NetworkInterface ; + rdfs:domain observable:NetworkInterfaceFacet ; . observable:ipfix - rdfs:domain observable:NetworkFlow ; + rdfs:domain observable:NetworkFlowFacet ; . observable:isActive - rdfs:domain observable:NetworkConnection ; + rdfs:domain observable:NetworkConnectionFacet ; . observable:isDirectory - rdfs:domain observable:File ; + rdfs:domain observable:FileFacet ; . observable:isDisabled - rdfs:domain observable:DigitalAccount ; + rdfs:domain observable:DigitalAccountFacet ; . observable:isEnabled @@ -918,31 +918,31 @@ observable:isEnabled . observable:isEncrypted - rdfs:domain observable:ContentData ; + rdfs:domain observable:ContentDataFacet ; . observable:isHidden - rdfs:domain observable:Process ; + rdfs:domain observable:ProcessFacet ; . observable:isInjected - rdfs:domain observable:Memory ; + rdfs:domain observable:MemoryFacet ; . observable:isMapped - rdfs:domain observable:Memory ; + rdfs:domain observable:MemoryFacet ; . observable:isMimeEncoded - rdfs:domain observable:EmailMessage ; + rdfs:domain observable:EmailMessageFacet ; . observable:isMultipart - rdfs:domain observable:EmailMessage ; + rdfs:domain observable:EmailMessageFacet ; . observable:isNamed - rdfs:domain observable:Mutex ; + rdfs:domain observable:MutexFacet ; . observable:isOptimized @@ -950,67 +950,67 @@ observable:isOptimized . observable:isPrivate - rdfs:domain observable:CalendarEntry ; + rdfs:domain observable:CalendarEntryFacet ; . observable:isPrivileged - rdfs:domain observable:UserAccount ; + rdfs:domain observable:UserAccountFacet ; . observable:isProtected - rdfs:domain observable:Memory ; + rdfs:domain observable:MemoryFacet ; . observable:isRead - rdfs:domain observable:EmailMessage ; + rdfs:domain observable:EmailMessageFacet ; . observable:isSecure - rdfs:domain observable:BrowserCookie ; + rdfs:domain observable:BrowserCookieFacet ; . observable:isSelfSigned - rdfs:domain observable:X509Certificate ; + rdfs:domain observable:X509CertificateFacet ; . observable:isServiceAccount - rdfs:domain observable:UserAccount ; + rdfs:domain observable:UserAccountFacet ; . observable:isTLD - rdfs:domain observable:DomainName ; + rdfs:domain observable:DomainNameFacet ; . observable:isVolatile - rdfs:domain observable:Memory ; + rdfs:domain observable:MemoryFacet ; . observable:issuer - rdfs:domain observable:X509Certificate ; + rdfs:domain observable:X509CertificateFacet ; . observable:issuerAlternativeName - rdfs:domain observable:X509V3Extensions ; + rdfs:domain observable:X509V3ExtensionsFacet ; . observable:issuerHash - rdfs:domain observable:X509Certificate ; + rdfs:domain observable:X509CertificateFacet ; . observable:key - rdfs:domain observable:WindowsRegistryKey ; + rdfs:domain observable:WindowsRegistryKeyFacet ; . observable:keyUsage - rdfs:domain observable:X509V3Extensions ; + rdfs:domain observable:X509V3ExtensionsFacet ; . observable:keypadUnlockCode - rdfs:domain observable:MobileDevice ; + rdfs:domain observable:MobileDeviceFacet ; . observable:labels - rdfs:domain observable:EmailMessage ; + rdfs:domain observable:EmailMessageFacet ; . observable:language @@ -1018,15 +1018,15 @@ observable:language . observable:lastLoginTime - rdfs:domain observable:DigitalAccount ; + rdfs:domain observable:DigitalAccountFacet ; . observable:lastName - rdfs:domain observable:Contact ; + rdfs:domain observable:ContactFacet ; . observable:lastRun - rdfs:domain observable:WindowsPrefetch ; + rdfs:domain observable:WindowsPrefetchFacet ; . observable:length @@ -1034,7 +1034,7 @@ observable:length . observable:libraryType - rdfs:domain observable:Library ; + rdfs:domain observable:LibraryFacet ; . observable:loaderFlags @@ -1042,31 +1042,31 @@ observable:loaderFlags . observable:localTime - rdfs:domain observable:ComputerSpecification ; + rdfs:domain observable:ComputerSpecificationFacet ; . observable:location - rdfs:domain observable:GeoLocationEntry ; + rdfs:domain observable:GeoLocationEntryFacet ; . observable:loginTime - rdfs:domain observable:UserSession ; + rdfs:domain observable:UserSessionFacet ; . observable:logoutTime - rdfs:domain observable:UserSession ; + rdfs:domain observable:UserSessionFacet ; . observable:lookupDate - rdfs:domain observable:WhoIs ; + rdfs:domain observable:WhoIsFacet ; . observable:macAddress - rdfs:domain observable:NetworkInterface ; + rdfs:domain observable:NetworkInterfaceFacet ; . observable:machine - rdfs:domain observable:WindowsPEBinaryFile ; + rdfs:domain observable:WindowsPEBinaryFileFacet ; . observable:magic @@ -1074,7 +1074,7 @@ observable:magic . observable:magicNumber - rdfs:domain observable:ContentData ; + rdfs:domain observable:ContentDataFacet ; . observable:majorImageVersion @@ -1094,82 +1094,82 @@ observable:majorSubsystemVersion . observable:manufacturer - rdfs:domain observable:Device ; + rdfs:domain observable:DeviceFacet ; . observable:maxRunTime - rdfs:domain observable:WindowsTask ; + rdfs:domain observable:WindowsTaskFacet ; . observable:message - rdfs:domain observable:MessageThread ; + rdfs:domain observable:MessageThreadFacet ; . observable:messageID rdfs:domain - observable:EmailMessage , - observable:Message + observable:EmailMessageFacet , + observable:MessageFacet ; . observable:messageText - rdfs:domain observable:Message ; + rdfs:domain observable:MessageFacet ; . observable:messageType - rdfs:domain observable:Message ; + rdfs:domain observable:MessageFacet ; . observable:metadataChangeTime - rdfs:domain observable:File ; + rdfs:domain observable:FileFacet ; . observable:mftFileID - rdfs:domain observable:MftRecord ; + rdfs:domain observable:MftRecordFacet ; . observable:mftFileNameAccessedTime - rdfs:domain observable:MftRecord ; + rdfs:domain observable:MftRecordFacet ; . observable:mftFileNameCreatedTime - rdfs:domain observable:MftRecord ; + rdfs:domain observable:MftRecordFacet ; . observable:mftFileNameLength - rdfs:domain observable:MftRecord ; + rdfs:domain observable:MftRecordFacet ; . observable:mftFileNameModifiedTime - rdfs:domain observable:MftRecord ; + rdfs:domain observable:MftRecordFacet ; . observable:mftFileNameRecordChangeTime - rdfs:domain observable:MftRecord ; + rdfs:domain observable:MftRecordFacet ; . observable:mftFlags - rdfs:domain observable:MftRecord ; + rdfs:domain observable:MftRecordFacet ; . observable:mftParentID - rdfs:domain observable:MftRecord ; + rdfs:domain observable:MftRecordFacet ; . observable:mftRecordChangeTime - rdfs:domain observable:MftRecord ; + rdfs:domain observable:MftRecordFacet ; . observable:middleName - rdfs:domain observable:Contact ; + rdfs:domain observable:ContactFacet ; . observable:mimeClass - rdfs:domain observable:ContentData ; + rdfs:domain observable:ContentDataFacet ; . observable:mimeType - rdfs:domain observable:ContentData ; + rdfs:domain observable:ContentDataFacet ; . observable:minorImageVersion @@ -1189,79 +1189,79 @@ observable:minorSubsystemVersion . observable:mockLocationsAllowed - rdfs:domain observable:MobileDevice ; + rdfs:domain observable:MobileDeviceFacet ; . observable:model - rdfs:domain observable:Device ; + rdfs:domain observable:DeviceFacet ; . observable:modifiedTime - rdfs:domain observable:File ; + rdfs:domain observable:FileFacet ; . observable:mostRecentRunTime - rdfs:domain observable:WindowsTask ; + rdfs:domain observable:WindowsTaskFacet ; . observable:mountPoint - rdfs:domain observable:DiskPartition ; + rdfs:domain observable:DiskPartitionFacet ; . observable:msProductID - rdfs:domain observable:WindowsComputerSpecification ; + rdfs:domain observable:WindowsComputerSpecificationFacet ; . observable:msProductName - rdfs:domain observable:WindowsComputerSpecification ; + rdfs:domain observable:WindowsComputerSpecificationFacet ; . observable:nameConstraints - rdfs:domain observable:X509V3Extensions ; + rdfs:domain observable:X509V3ExtensionsFacet ; . observable:nameserver - rdfs:domain observable:WhoIs ; + rdfs:domain observable:WhoIsFacet ; . observable:netBIOSName - rdfs:domain observable:WindowsComputerSpecification ; + rdfs:domain observable:WindowsComputerSpecificationFacet ; . observable:network - rdfs:domain observable:MobileDevice ; + rdfs:domain observable:MobileDeviceFacet ; . observable:networkInterface - rdfs:domain observable:ComputerSpecification ; + rdfs:domain observable:ComputerSpecificationFacet ; . observable:newObject - rdfs:domain observable:StateChangeEffect ; + rdfs:domain observable:StateChangeEffectFacet ; . observable:nextRunTime - rdfs:domain observable:WindowsTask ; + rdfs:domain observable:WindowsTaskFacet ; . observable:ntfsHardLinkCount - rdfs:domain observable:MftRecord ; + rdfs:domain observable:MftRecordFacet ; . observable:ntfsOwnerID - rdfs:domain observable:MftRecord ; + rdfs:domain observable:MftRecordFacet ; . observable:ntfsOwnerSID - rdfs:domain observable:MftRecord ; + rdfs:domain observable:MftRecordFacet ; . observable:number - rdfs:domain observable:AutonomousSystem ; + rdfs:domain observable:AutonomousSystemFacet ; . observable:numberOfLaunches - rdfs:domain observable:Application ; + rdfs:domain observable:ApplicationFacet ; . observable:numberOfRVAAndSizes @@ -1269,121 +1269,117 @@ observable:numberOfRVAAndSizes . observable:numberOfSections - rdfs:domain observable:WindowsPEBinaryFile ; + rdfs:domain observable:WindowsPEBinaryFileFacet ; . observable:numberOfSubkeys - rdfs:domain observable:WindowsRegistryKey ; + rdfs:domain observable:WindowsRegistryKeyFacet ; . observable:numberOfSymbols - rdfs:domain observable:WindowsPEBinaryFile ; + rdfs:domain observable:WindowsPEBinaryFileFacet ; . observable:objectGUID - rdfs:domain observable:WindowsActiveDirectoryAccount ; + rdfs:domain observable:WindowsActiveDirectoryAccountFacet ; . observable:oldObject - rdfs:domain observable:StateChangeEffect ; - . - -observable:taskComment - rdfs:domain observable:WindowsTask ; + rdfs:domain observable:StateChangeEffectFacet ; . observable:openFileDescriptor - rdfs:domain observable:UNIXProcess ; + rdfs:domain observable:UNIXProcessFacet ; . observable:operatingSystem - rdfs:domain observable:Application ; + rdfs:domain observable:ApplicationFacet ; . observable:optionalHeader - rdfs:domain observable:WindowsPEBinaryFile ; + rdfs:domain observable:WindowsPEBinaryFileFacet ; . observable:options - rdfs:domain observable:UNIXVolume ; + rdfs:domain observable:UNIXVolumeFacet ; . observable:otherHeaders - rdfs:domain observable:EmailMessage ; + rdfs:domain observable:EmailMessageFacet ; . observable:owner rdfs:domain - observable:Account , - observable:FilePermissions + observable:AccountFacet , + observable:FilePermissionsFacet ; . observable:ownerSID - rdfs:domain observable:WindowsProcess ; + rdfs:domain observable:WindowsProcessFacet ; . observable:parameterAddress - rdfs:domain observable:WindowsThread ; + rdfs:domain observable:WindowsThreadFacet ; . observable:parameters - rdfs:domain observable:WindowsTask ; + rdfs:domain observable:WindowsTaskFacet ; . observable:parent - rdfs:domain observable:Process ; + rdfs:domain observable:ProcessFacet ; . observable:participant - rdfs:domain observable:MessageThread ; + rdfs:domain observable:MessageThreadFacet ; . observable:partition - rdfs:domain observable:Disk ; + rdfs:domain observable:DiskFacet ; . observable:partitionID - rdfs:domain observable:DiskPartition ; + rdfs:domain observable:DiskPartitionFacet ; . observable:partitionLength - rdfs:domain observable:DiskPartition ; + rdfs:domain observable:DiskPartitionFacet ; . observable:partitionOffset - rdfs:domain observable:DiskPartition ; + rdfs:domain observable:DiskPartitionFacet ; . observable:password rdfs:domain - observable:AccountAuthentication , - observable:URL + observable:AccountAuthenticationFacet , + observable:URLFacet ; . observable:passwordLastChanged - rdfs:domain observable:AccountAuthentication ; + rdfs:domain observable:AccountAuthenticationFacet ; . observable:passwordType - rdfs:domain observable:AccountAuthentication ; + rdfs:domain observable:AccountAuthenticationFacet ; . observable:path - rdfs:domain observable:PathRelation ; + rdfs:domain observable:PathRelationFacet ; . observable:pdfId0 - rdfs:domain observable:PDFFile ; + rdfs:domain observable:PDFFileFacet ; . observable:pdfId1 - rdfs:domain observable:PDFFile ; + rdfs:domain observable:PDFFileFacet ; . observable:peType - rdfs:domain observable:WindowsPEBinaryFile ; + rdfs:domain observable:WindowsPEBinaryFileFacet ; . observable:phone @@ -1391,111 +1387,111 @@ observable:phone . observable:phoneActivationTime - rdfs:domain observable:MobileDevice ; + rdfs:domain observable:MobileDeviceFacet ; . observable:phoneNumber - rdfs:domain observable:PhoneAccount ; + rdfs:domain observable:PhoneAccountFacet ; . observable:phoneNumbers - rdfs:domain observable:Contact ; + rdfs:domain observable:ContactFacet ; . observable:pictureHeight - rdfs:domain observable:RasterPicture ; + rdfs:domain observable:RasterPictureFacet ; . observable:pictureWidth - rdfs:domain observable:RasterPicture ; + rdfs:domain observable:RasterPictureFacet ; . observable:picturetype - rdfs:domain observable:RasterPicture ; + rdfs:domain observable:RasterPictureFacet ; . observable:pid - rdfs:domain observable:Process ; + rdfs:domain observable:ProcessFacet ; . observable:pointerToSymbolTable - rdfs:domain observable:WindowsPEBinaryFile ; + rdfs:domain observable:WindowsPEBinaryFileFacet ; . observable:policyConstraints - rdfs:domain observable:X509V3Extensions ; + rdfs:domain observable:X509V3ExtensionsFacet ; . observable:policyMappings - rdfs:domain observable:X509V3Extensions ; + rdfs:domain observable:X509V3ExtensionsFacet ; . observable:port - rdfs:domain observable:URL ; + rdfs:domain observable:URLFacet ; . observable:prefetchHash - rdfs:domain observable:WindowsPrefetch ; + rdfs:domain observable:WindowsPrefetchFacet ; . observable:priority - rdfs:domain observable:EmailMessage ; + rdfs:domain observable:EmailMessageFacet ; . observable:privateKeyUsagePeriodNotAfter - rdfs:domain observable:X509V3Extensions ; + rdfs:domain observable:X509V3ExtensionsFacet ; . observable:privateKeyUsagePeriodNotBefore - rdfs:domain observable:X509V3Extensions ; + rdfs:domain observable:X509V3ExtensionsFacet ; . observable:processorArchitecture - rdfs:domain observable:ComputerSpecification ; + rdfs:domain observable:ComputerSpecificationFacet ; . observable:properties - rdfs:domain observable:PropertiesEnumeratedEffect ; + rdfs:domain observable:PropertiesEnumeratedEffectFacet ; . observable:propertyName - rdfs:domain observable:PropertyReadEffect ; + rdfs:domain observable:PropertyReadEffectFacet ; . observable:protocols - rdfs:domain observable:NetworkConnection ; + rdfs:domain observable:NetworkConnectionFacet ; . observable:query - rdfs:domain observable:URL ; + rdfs:domain observable:URLFacet ; . observable:rangeOffset - rdfs:domain observable:DataRange ; + rdfs:domain observable:DataRangeFacet ; . observable:rangeOffsetType - rdfs:domain observable:DataRange ; + rdfs:domain observable:DataRangeFacet ; . observable:rangeSize - rdfs:domain observable:DataRange ; + rdfs:domain observable:DataRangeFacet ; . observable:receivedLines - rdfs:domain observable:EmailMessage ; + rdfs:domain observable:EmailMessageFacet ; . observable:receivedTime - rdfs:domain observable:EmailMessage ; + rdfs:domain observable:EmailMessageFacet ; . observable:recurrence - rdfs:domain observable:CalendarEntry ; + rdfs:domain observable:CalendarEntryFacet ; . observable:references - rdfs:domain observable:EmailMessage ; + rdfs:domain observable:EmailMessageFacet ; . observable:referralURL @@ -1503,31 +1499,31 @@ observable:referralURL . observable:regionSize - rdfs:domain observable:Memory ; + rdfs:domain observable:MemoryFacet ; . observable:regionStartAddress - rdfs:domain observable:Memory ; + rdfs:domain observable:MemoryFacet ; . observable:region_end_address - rdfs:domain observable:Memory ; + rdfs:domain observable:MemoryFacet ; . observable:regionalInternetRegistry - rdfs:domain observable:WhoIs ; + rdfs:domain observable:WhoIsFacet ; . observable:registeredOrganization - rdfs:domain observable:WindowsComputerSpecification ; + rdfs:domain observable:WindowsComputerSpecificationFacet ; . observable:registeredOwner - rdfs:domain observable:WindowsComputerSpecification ; + rdfs:domain observable:WindowsComputerSpecificationFacet ; . observable:registrantIDs - rdfs:domain observable:WhoIs ; + rdfs:domain observable:WhoIsFacet ; . observable:registrarGUID @@ -1539,7 +1535,7 @@ observable:registrarID . observable:registrarInfo - rdfs:domain observable:WhoIs ; + rdfs:domain observable:WhoIsFacet ; . observable:registrarName @@ -1547,51 +1543,51 @@ observable:registrarName . observable:registryValues - rdfs:domain observable:WindowsRegistryKey ; + rdfs:domain observable:WindowsRegistryKeyFacet ; . observable:remarks - rdfs:domain observable:WhoIs ; + rdfs:domain observable:WhoIsFacet ; . observable:remindTime - rdfs:domain observable:CalendarEntry ; + rdfs:domain observable:CalendarEntryFacet ; . observable:requestMethod - rdfs:domain observable:HTTPConnection ; + rdfs:domain observable:HTTPConnectionFacet ; . observable:requestValue - rdfs:domain observable:HTTPConnection ; + rdfs:domain observable:HTTPConnectionFacet ; . observable:requestVersion - rdfs:domain observable:HTTPConnection ; + rdfs:domain observable:HTTPConnectionFacet ; . observable:rowCondition - rdfs:domain observable:SQLiteBlob ; + rdfs:domain observable:SQLiteBlobFacet ; . observable:rowIndex - rdfs:domain observable:SQLiteBlob ; + rdfs:domain observable:SQLiteBlobFacet ; . observable:ruid - rdfs:domain observable:UNIXProcess ; + rdfs:domain observable:UNIXProcessFacet ; . observable:runningStatus - rdfs:domain observable:WindowsThread ; + rdfs:domain observable:WindowsThreadFacet ; . observable:scheme - rdfs:domain observable:URL ; + rdfs:domain observable:URLFacet ; . observable:screenName - rdfs:domain observable:Contact ; + rdfs:domain observable:ContactFacet ; . observable:sectionAlignment @@ -1599,51 +1595,51 @@ observable:sectionAlignment . observable:sections - rdfs:domain observable:WindowsPEBinaryFile ; + rdfs:domain observable:WindowsPEBinaryFileFacet ; . observable:sectorSize - rdfs:domain observable:Volume ; + rdfs:domain observable:VolumeFacet ; . observable:securityAttributes - rdfs:domain observable:WindowsThread ; + rdfs:domain observable:WindowsThreadFacet ; . observable:sender - rdfs:domain observable:EmailMessage ; + rdfs:domain observable:EmailMessageFacet ; . observable:sentTime - rdfs:domain observable:EmailMessage ; + rdfs:domain observable:EmailMessageFacet ; . observable:serialNumber - rdfs:domain observable:Device ; + rdfs:domain observable:DeviceFacet ; . observable:serverName - rdfs:domain observable:WhoIs ; + rdfs:domain observable:WhoIsFacet ; . observable:serviceName - rdfs:domain observable:WindowsService ; + rdfs:domain observable:WindowsServiceFacet ; . observable:serviceStatus - rdfs:domain observable:WindowsService ; + rdfs:domain observable:WindowsServiceFacet ; . observable:serviceType - rdfs:domain observable:WindowsService ; + rdfs:domain observable:WindowsServiceFacet ; . observable:sessionID - rdfs:domain observable:Message ; + rdfs:domain observable:MessageFacet ; . observable:shell - rdfs:domain observable:UNIXAccount ; + rdfs:domain observable:UNIXAccountFacet ; . observable:showMessageBody @@ -1655,27 +1651,27 @@ observable:showMessageTitle . observable:sid - rdfs:domain observable:NTFSFileSystem ; + rdfs:domain observable:NTFSFileSystemFacet ; . observable:signature - rdfs:domain observable:X509Certificate ; + rdfs:domain observable:X509CertificateFacet ; . observable:signatureAlgorithm - rdfs:domain observable:X509Certificate ; + rdfs:domain observable:X509CertificateFacet ; . observable:signatureDescription - rdfs:domain observable:DigitalSignatureInfo ; + rdfs:domain observable:DigitalSignatureInfoFacet ; . observable:signatureExists - rdfs:domain observable:DigitalSignatureInfo ; + rdfs:domain observable:DigitalSignatureInfoFacet ; . observable:signatureVerified - rdfs:domain observable:DigitalSignatureInfo ; + rdfs:domain observable:DigitalSignatureInfoFacet ; . observable:size @@ -1683,7 +1679,7 @@ observable:size . observable:sizeInBytes - rdfs:domain observable:ContentData ; + rdfs:domain observable:ContentDataFacet ; . observable:sizeOfCode @@ -1711,7 +1707,7 @@ observable:sizeOfInitializedData . observable:sizeOfOptionalHeader - rdfs:domain observable:WindowsPEBinaryFile ; + rdfs:domain observable:WindowsPEBinaryFileFacet ; . observable:sizeOfStackCommit @@ -1727,81 +1723,81 @@ observable:sizeOfUninitializedData . observable:sourceFlags - rdfs:domain observable:TCPConnection ; + rdfs:domain observable:TCPConnectionFacet ; . observable:sourcePort - rdfs:domain observable:NetworkConnection ; + rdfs:domain observable:NetworkConnectionFacet ; . observable:spaceLeft - rdfs:domain observable:DiskPartition ; + rdfs:domain observable:DiskPartitionFacet ; . observable:spaceUsed - rdfs:domain observable:DiskPartition ; + rdfs:domain observable:DiskPartitionFacet ; . observable:sponsoringRegistrar - rdfs:domain observable:WhoIs ; + rdfs:domain observable:WhoIsFacet ; . observable:src - rdfs:domain observable:NetworkConnection ; + rdfs:domain observable:NetworkConnectionFacet ; . observable:srcBytes - rdfs:domain observable:NetworkFlow ; + rdfs:domain observable:NetworkFlowFacet ; . observable:srcPackets - rdfs:domain observable:NetworkFlow ; + rdfs:domain observable:NetworkFlowFacet ; . observable:srcPayload - rdfs:domain observable:NetworkFlow ; + rdfs:domain observable:NetworkFlowFacet ; . observable:ssid - rdfs:domain observable:WirelessNetworkConnection ; + rdfs:domain observable:WirelessNetworkConnectionFacet ; . observable:stackSize - rdfs:domain observable:WindowsThread ; + rdfs:domain observable:WindowsThreadFacet ; . observable:startAddress - rdfs:domain observable:WindowsThread ; + rdfs:domain observable:WindowsThreadFacet ; . observable:startCommandLine - rdfs:domain observable:WindowsService ; + rdfs:domain observable:WindowsServiceFacet ; . observable:startTime - rdfs:domain observable:PhoneCall ; + rdfs:domain observable:PhoneCallFacet ; . observable:startType - rdfs:domain observable:WindowsService ; + rdfs:domain observable:WindowsServiceFacet ; . observable:startupInfo - rdfs:domain observable:WindowsProcess ; + rdfs:domain observable:WindowsProcessFacet ; . observable:state - rdfs:domain observable:CyberItem ; + rdfs:domain observable:ObservableObject ; . observable:status - rdfs:domain observable:WhoIs ; + rdfs:domain observable:WhoIsFacet ; . observable:storageCapacityInBytes rdfs:domain - observable:MobileDevice , - observable:SIMCard + observable:MobileDeviceFacet , + observable:SIMCardFacet ; . @@ -1810,39 +1806,39 @@ observable:stringValue . observable:strings - rdfs:domain observable:ExtractedStrings ; + rdfs:domain observable:ExtractedStringsFacet ; . observable:subject - rdfs:domain observable:EmailMessage ; + rdfs:domain observable:EmailMessageFacet ; . observable:subjectAlternativeName - rdfs:domain observable:X509V3Extensions ; + rdfs:domain observable:X509V3ExtensionsFacet ; . observable:subjectDirectoryAttributes - rdfs:domain observable:X509V3Extensions ; + rdfs:domain observable:X509V3ExtensionsFacet ; . observable:subjectHash - rdfs:domain observable:X509Certificate ; + rdfs:domain observable:X509CertificateFacet ; . observable:subjectKeyIdentifier - rdfs:domain observable:X509V3Extensions ; + rdfs:domain observable:X509V3ExtensionsFacet ; . observable:subjectPublicKeyAlgorithm - rdfs:domain observable:X509Certificate ; + rdfs:domain observable:X509CertificateFacet ; . observable:subjectPublicKeyExponent - rdfs:domain observable:X509Certificate ; + rdfs:domain observable:X509CertificateFacet ; . observable:subjectPublicKeyModulus - rdfs:domain observable:X509Certificate ; + rdfs:domain observable:X509CertificateFacet ; . observable:subsystem @@ -1850,7 +1846,7 @@ observable:subsystem . observable:swid - rdfs:domain observable:Software ; + rdfs:domain observable:SoftwareFacet ; . observable:symbolicName @@ -1858,27 +1854,31 @@ observable:symbolicName . observable:systemTime - rdfs:domain observable:ComputerSpecification ; + rdfs:domain observable:ComputerSpecificationFacet ; . observable:tableName - rdfs:domain observable:SQLiteBlob ; + rdfs:domain observable:SQLiteBlobFacet ; . observable:targetFile - rdfs:domain observable:SymbolicLink ; + rdfs:domain observable:SymbolicLinkFacet ; + . + +observable:taskComment + rdfs:domain observable:WindowsTaskFacet ; . observable:taskCreator - rdfs:domain observable:WindowsTask ; + rdfs:domain observable:WindowsTaskFacet ; . observable:text - rdfs:domain observable:Note ; + rdfs:domain observable:NoteFacet ; . observable:threadID - rdfs:domain observable:WindowsThread ; + rdfs:domain observable:WindowsThreadFacet ; . observable:thumbprintHash @@ -1886,35 +1886,35 @@ observable:thumbprintHash . observable:timeDateStamp - rdfs:domain observable:WindowsPEBinaryFile ; + rdfs:domain observable:WindowsPEBinaryFileFacet ; . observable:timesExecuted - rdfs:domain observable:WindowsPrefetch ; + rdfs:domain observable:WindowsPrefetchFacet ; . observable:timezoneDST - rdfs:domain observable:ComputerSpecification ; + rdfs:domain observable:ComputerSpecificationFacet ; . observable:timezoneStandard - rdfs:domain observable:ComputerSpecification ; + rdfs:domain observable:ComputerSpecificationFacet ; . observable:to - rdfs:domain observable:PhoneCall ; + rdfs:domain observable:PhoneCallFacet ; . observable:totalFragments - rdfs:domain observable:Fragment ; + rdfs:domain observable:FragmentFacet ; . observable:totalRam - rdfs:domain observable:ComputerSpecification ; + rdfs:domain observable:ComputerSpecificationFacet ; . observable:totalSpace - rdfs:domain observable:DiskPartition ; + rdfs:domain observable:DiskPartitionFacet ; . observable:triggerBeginTime @@ -1934,7 +1934,7 @@ observable:triggerFrequency . observable:triggerList - rdfs:domain observable:WindowsTask ; + rdfs:domain observable:WindowsTaskFacet ; . observable:triggerMaxRunTime @@ -1950,62 +1950,62 @@ observable:triggerType . observable:updatedDate - rdfs:domain observable:WhoIs ; + rdfs:domain observable:WhoIsFacet ; . observable:uptime - rdfs:domain observable:ComputerSpecification ; + rdfs:domain observable:ComputerSpecificationFacet ; . observable:url - rdfs:domain observable:Attachment ; + rdfs:domain observable:AttachmentFacet ; . observable:urlTargeted - rdfs:domain observable:BrowserBookmark ; + rdfs:domain observable:BrowserBookmarkFacet ; . observable:userName - rdfs:domain observable:URL ; + rdfs:domain observable:URLFacet ; . observable:validityNotAfter - rdfs:domain observable:X509Certificate ; + rdfs:domain observable:X509CertificateFacet ; . observable:validityNotBefore - rdfs:domain observable:X509Certificate ; + rdfs:domain observable:X509CertificateFacet ; . observable:value - rdfs:domain observable:IPv4Address ; + rdfs:domain observable:IPv4AddressFacet ; . observable:values - rdfs:domain observable:ValuesEnumeratedEffect ; + rdfs:domain observable:ValuesEnumeratedEffectFacet ; . observable:version rdfs:domain - observable:Application , - observable:PDFFile + observable:ApplicationFacet , + observable:PDFFileFacet ; . observable:visibility - rdfs:domain observable:MessageThread ; + rdfs:domain observable:MessageThreadFacet ; . observable:visitCount - rdfs:domain observable:BrowserBookmark ; + rdfs:domain observable:BrowserBookmarkFacet ; . observable:volume - rdfs:domain observable:WindowsPrefetch ; + rdfs:domain observable:WindowsPrefetchFacet ; . observable:volumeID - rdfs:domain observable:Volume ; + rdfs:domain observable:VolumeFacet ; . observable:whoisServer @@ -2017,41 +2017,42 @@ observable:win32VersionValue . observable:windowTitle - rdfs:domain observable:WindowsProcess ; + rdfs:domain observable:WindowsProcessFacet ; . observable:windowsDirectory - rdfs:domain observable:WindowsComputerSpecification ; + rdfs:domain observable:WindowsComputerSpecificationFacet ; . observable:windowsSystemDirectory - rdfs:domain observable:WindowsComputerSpecification ; + rdfs:domain observable:WindowsComputerSpecificationFacet ; . observable:windowsTempDirectory - rdfs:domain observable:WindowsComputerSpecification ; + rdfs:domain observable:WindowsComputerSpecificationFacet ; . observable:windowsVolumeAttributes - rdfs:domain observable:WindowsVolume ; + rdfs:domain observable:WindowsVolumeFacet ; . observable:workItemData - rdfs:domain observable:WindowsTask ; + rdfs:domain observable:WindowsTaskFacet ; . observable:workingDirectory - rdfs:domain observable:WindowsTask ; + rdfs:domain observable:WindowsTaskFacet ; . observable:x509v3extensions - rdfs:domain observable:X509Certificate ; + rdfs:domain observable:X509CertificateFacet ; . observable:xMailer - rdfs:domain observable:EmailMessage ; + rdfs:domain observable:EmailMessageFacet ; . observable:xOriginatingIP - rdfs:domain observable:EmailMessage ; + rdfs:domain observable:EmailMessageFacet ; . + diff --git a/uco-observable/observable.ttl b/uco-observable/observable.ttl index eee355d6..288a89a6 100644 --- a/uco-observable/observable.ttl +++ b/uco-observable/observable.ttl @@ -28,7 +28,32 @@ ; . -observable:Account +observable:AccountAuthenticationFacet + a owl:Class ; + rdfs:subClassOf + , + [ + a owl:Restriction ; + owl:onProperty observable:passwordLastChanged ; + owl:maxCardinality "1"^^xsd:nonNegativeInteger ; + ] , + [ + a owl:Restriction ; + owl:onProperty observable:password ; + owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; + owl:onDataRange xsd:string ; + ] , + [ + a owl:Restriction ; + owl:onProperty observable:passwordType ; + owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; + owl:onDataRange xsd:string ; + ] + ; + rdfs:label "AccountAuthenticationFacet"@en ; + . + +observable:AccountFacet a owl:Class ; rdfs:subClassOf , @@ -75,67 +100,57 @@ observable:Account owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "Account"@en ; + rdfs:label "AccountFacet"@en ; rdfs:comment "The fundamental properties of an account."@en ; . -observable:AccountAuthentication +observable:AlternateDataStream a owl:Class ; rdfs:subClassOf - , [ a owl:Restriction ; - owl:onProperty observable:passwordLastChanged ; + owl:onProperty observable:hashes ; owl:maxCardinality "1"^^xsd:nonNegativeInteger ; ] , [ a owl:Restriction ; - owl:onProperty observable:password ; + owl:onProperty observable:size ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; - owl:onDataRange xsd:string ; + owl:onDataRange xsd:integer ; ] , [ a owl:Restriction ; - owl:onProperty observable:passwordType ; - owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; + owl:onProperty ; owl:onDataRange xsd:string ; + owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "AccountAuthentication"@en ; + rdfs:label "AlternateDataStream"@en ; . -observable:AlternateDataStream +observable:ApplicationAccountFacet a owl:Class ; rdfs:subClassOf + , [ a owl:Restriction ; - owl:onProperty observable:hashes ; - owl:maxCardinality "1"^^xsd:nonNegativeInteger ; - ] , - [ - a owl:Restriction ; - owl:onProperty observable:size ; - owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; - owl:onDataRange xsd:integer ; - ] , - [ - a owl:Restriction ; - owl:onProperty ; - owl:onDataRange xsd:string ; + owl:onProperty observable:application ; + owl:onClass observable:ObservableObject ; owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "AlternateDataStream"@en ; + rdfs:label "ApplicationAccountFacet"@en ; + rdfs:comment "Characteristics of an account within a particular application."@en ; . -observable:Application +observable:ApplicationFacet a owl:Class ; rdfs:subClassOf , [ a owl:Restriction ; owl:onProperty observable:operatingSystem ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ @@ -157,26 +172,11 @@ observable:Application owl:onDataRange xsd:string ; ] ; - rdfs:label "Application"@en ; + rdfs:label "ApplicationFacet"@en ; rdfs:comment "Characteristics of a software application."@en ; . -observable:ApplicationAccount - a owl:Class ; - rdfs:subClassOf - , - [ - a owl:Restriction ; - owl:onProperty observable:application ; - owl:onClass observable:CyberItem ; - owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; - ] - ; - rdfs:label "ApplicationAccount"@en ; - rdfs:comment "Characteristics of an account within a particular application."@en ; - . - -observable:ArchiveFile +observable:ArchiveFileFacet a owl:Class ; rdfs:subClassOf , @@ -199,16 +199,16 @@ observable:ArchiveFile owl:onDataRange xsd:string ; ] ; - rdfs:label "ArchiveFile"@en ; + rdfs:label "ArchiveFileFacet"@en ; . -observable:Attachment +observable:AttachmentFacet a owl:Class ; rdfs:subClassOf ; - rdfs:label "Attachment"@en ; + rdfs:label "AttachmentFacet"@en ; . -observable:Audio +observable:AudioFacet a owl:Class ; rdfs:subClassOf , @@ -237,11 +237,11 @@ observable:Audio owl:onDataRange xsd:string ; ] ; - rdfs:label "Audio"@en ; + rdfs:label "AudioFacet"@en ; rdfs:comment "Characteristics of piece of digital audio."@en ; . -observable:AutonomousSystem +observable:AutonomousSystemFacet a owl:Class ; rdfs:subClassOf , @@ -263,11 +263,11 @@ observable:AutonomousSystem owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "AutonomousSystem"@en ; + rdfs:label "AutonomousSystemFacet"@en ; rdfs:comment "Basic characteristics of an Internet autonomous system."@en ; . -observable:BluetoothAddress +observable:BluetoothAddressFacet a owl:Class ; rdfs:subClassOf , @@ -278,11 +278,11 @@ observable:BluetoothAddress owl:onDataRange xsd:string ; ] ; - rdfs:label "BluetoothAddress"@en ; + rdfs:label "BluetoothAddressFacet"@en ; rdfs:comment "Properties of a Bluetooth address."@en ; . -observable:BrowserBookmark +observable:BrowserBookmarkFacet a owl:Class ; rdfs:subClassOf , @@ -304,7 +304,7 @@ observable:BrowserBookmark [ a owl:Restriction ; owl:onProperty observable:application ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ @@ -320,11 +320,11 @@ observable:BrowserBookmark owl:onDataRange xsd:string ; ] ; - rdfs:label "BrowserBookmark"@en ; + rdfs:label "BrowserBookmarkFacet"@en ; rdfs:comment "A bookmark to a web pages or files using a web browser."@en ; . -observable:BrowserCookie +observable:BrowserCookieFacet a owl:Class ; rdfs:subClassOf , @@ -346,13 +346,13 @@ observable:BrowserCookie [ a owl:Restriction ; owl:onProperty observable:application ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ a owl:Restriction ; owl:onProperty observable:cookieDomain ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ @@ -374,32 +374,11 @@ observable:BrowserCookie owl:onDataRange xsd:string ; ] ; - rdfs:label "BrowserCookie"@en ; + rdfs:label "BrowserCookieFacet"@en ; rdfs:comment "A piece of data used by a (remote) web page, stored on the local machine."@en ; . -observable:Calendar - a owl:Class ; - rdfs:subClassOf - , - [ - a owl:Restriction ; - owl:onProperty observable:application ; - owl:onClass observable:CyberItem ; - owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; - ] , - [ - a owl:Restriction ; - owl:onProperty observable:owner ; - owl:onClass observable:CyberItem ; - owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; - ] - ; - rdfs:label "Calendar"@en ; - rdfs:comment "A collection of appointments and meetings."@en ; - . - -observable:CalendarEntry +observable:CalendarEntryFacet a owl:Class ; rdfs:subClassOf , @@ -441,7 +420,7 @@ observable:CalendarEntry [ a owl:Restriction ; owl:onProperty observable:application ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ @@ -481,11 +460,32 @@ observable:CalendarEntry owl:onDataRange xsd:string ; ] ; - rdfs:label "CalendarEntry"@en ; + rdfs:label "CalendarEntryFacet"@en ; rdfs:comment "Characteristics of an entry (appointment, meeting, event) within a calendar."@en ; . -observable:CompressedStream +observable:CalendarFacet + a owl:Class ; + rdfs:subClassOf + , + [ + a owl:Restriction ; + owl:onProperty observable:application ; + owl:onClass observable:ObservableObject ; + owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; + ] , + [ + a owl:Restriction ; + owl:onProperty observable:owner ; + owl:onClass observable:ObservableObject ; + owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; + ] + ; + rdfs:label "CalendarFacet"@en ; + rdfs:comment "A collection of appointments and meetings."@en ; + . + +observable:CompressedStreamFacet a owl:Class ; rdfs:subClassOf , @@ -502,11 +502,11 @@ observable:CompressedStream owl:onDataRange xsd:string ; ] ; - rdfs:label "CompressedStream"@en ; + rdfs:label "CompressedStreamFacet"@en ; rdfs:comment "Characteristics of compression applied to a body of data content."@en ; . -observable:ComputerSpecification +observable:ComputerSpecificationFacet a owl:Class ; rdfs:subClassOf , @@ -621,18 +621,18 @@ observable:ComputerSpecification owl:onDataRange xsd:string ; ] ; - rdfs:label "ComputerSpecification"@en ; + rdfs:label "ComputerSpecificationFacet"@en ; rdfs:comment "Characterizes a computer system (as a combination of both software and hardware)."@en ; . -observable:Contact +observable:ContactFacet a owl:Class ; rdfs:subClassOf , [ a owl:Restriction ; owl:onProperty observable:application ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ @@ -678,11 +678,11 @@ observable:Contact owl:onDataRange xsd:string ; ] ; - rdfs:label "Contact"@en ; + rdfs:label "ContactFacet"@en ; rdfs:comment "Contact found in an application, for example an entry in an address book."@en ; . -observable:ContentData +observable:ContentDataFacet a owl:Class ; rdfs:subClassOf , @@ -694,7 +694,7 @@ observable:ContentData [ a owl:Restriction ; owl:onProperty observable:dataPayloadReferenceURL ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ @@ -740,59 +740,11 @@ observable:ContentData owl:onDataRange xsd:string ; ] ; - rdfs:label "ContentData"@en ; + rdfs:label "ContentDataFacet"@en ; rdfs:comment "Characteristics of a block of digital data."@en ; . -observable:CyberAction - a owl:Class ; - rdfs:subClassOf - , - observable:Observable - ; - rdfs:label "CyberAction"@en ; - rdfs:comment "Something that may be done or performed within the digital domain."@en ; - . - -observable:CyberItem - a owl:Class ; - rdfs:subClassOf - , - observable:Observable , - [ - a owl:Restriction ; - owl:onProperty observable:state ; - owl:maxCardinality "1"^^xsd:nonNegativeInteger ; - ] , - [ - a owl:Restriction ; - owl:onProperty observable:hasChanged ; - owl:onDataRange xsd:boolean ; - owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; - ] - ; - rdfs:label "CyberItem"@en ; - rdfs:comment "A distinct article or unit within the digital domain."@en ; - . - -observable:CyberObservablePattern - a owl:Class ; - rdfs:subClassOf observable:Observable ; - rdfs:label "CyberObservablePattern"@en ; - rdfs:comment "A logical pattern composed of cyberitem and cyberaction properties."@en ; - . - -observable:CyberRelationship - a owl:Class ; - rdfs:subClassOf - , - observable:Observable - ; - rdfs:label "CyberRelationship"@en ; - rdfs:comment "An association or link between two cyber observable objects."@en ; - . - -observable:DataRange +observable:DataRangeFacet a owl:Class ; rdfs:subClassOf , @@ -815,7 +767,7 @@ observable:DataRange owl:onDataRange xsd:string ; ] ; - rdfs:label "DataRange"@en ; + rdfs:label "DataRangeFacet"@en ; rdfs:comment "Bounding characteristics of a range within a block of digital data."@en ; . @@ -823,10 +775,10 @@ observable:DefinedEffectFacet a owl:Class ; rdfs:subClassOf ; rdfs:label "DefinedEffectFacet"@en ; - rdfs:comment "A set of properties characterizing some defined effect of a cyberaction in relation to one or more cyberitems."@en ; + rdfs:comment "A set of properties characterizing some defined effect of a observable action in relation to one or more observable objects."@en ; . -observable:Device +observable:DeviceFacet a owl:Class ; rdfs:subClassOf , @@ -854,11 +806,11 @@ observable:Device owl:onDataRange xsd:string ; ] ; - rdfs:label "Device"@en ; + rdfs:label "DeviceFacet"@en ; rdfs:comment "Characteristics of a piece of electronic equipment."@en ; . -observable:DigitalAccount +observable:DigitalAccountFacet a owl:Class ; rdfs:subClassOf , @@ -885,11 +837,11 @@ observable:DigitalAccount owl:onDataRange xsd:string ; ] ; - rdfs:label "DigitalAccount"@en ; + rdfs:label "DigitalAccountFacet"@en ; rdfs:comment "Characteristics of an account within the digital domain."@en ; . -observable:DigitalSignatureInfo +observable:DigitalSignatureInfoFacet a owl:Class ; rdfs:subClassOf , @@ -922,11 +874,11 @@ observable:DigitalSignatureInfo owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "DigitalSignatureInfo"@en ; + rdfs:label "DigitalSignatureInfoFacet"@en ; rdfs:comment "Characteristics of a value calculated via a mathematical scheme for demonstrating the authenticity of a digital message or documents."@en ; . -observable:Disk +observable:DiskFacet a owl:Class ; rdfs:subClassOf , @@ -948,10 +900,10 @@ observable:Disk owl:onDataRange xsd:long ; ] ; - rdfs:label "Disk"@en ; + rdfs:label "DiskFacet"@en ; . -observable:DiskPartition +observable:DiskPartitionFacet a owl:Class ; rdfs:subClassOf , @@ -1008,11 +960,11 @@ observable:DiskPartition owl:onDataRange xsd:string ; ] ; - rdfs:label "DiskPartition"@en ; + rdfs:label "DiskPartitionFacet"@en ; rdfs:comment "Characteristics of a region on a hard disk or other secondary storage."@en ; . -observable:DomainName +observable:DomainNameFacet a owl:Class ; rdfs:subClassOf , @@ -1029,7 +981,7 @@ observable:DomainName owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "DomainName"@en ; + rdfs:label "DomainNameFacet"@en ; rdfs:comment "Characteristics of an identification string that defines a realm of administrative autonomy, authority or control within the Internet."@en ; . @@ -1037,11 +989,11 @@ observable:ESN a owl:DatatypeProperty ; rdfs:label "ESN"@en ; rdfs:comment "Electronic Serial Number ."@en ; - rdfs:domain observable:MobileDevice ; + rdfs:domain observable:MobileDeviceFacet ; rdfs:range xsd:string ; . -observable:EXIF +observable:EXIFFacet a owl:Class ; rdfs:subClassOf , @@ -1051,26 +1003,26 @@ observable:EXIF owl:minCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "EXIF"@en ; + rdfs:label "EXIFFacet"@en ; rdfs:comment "Specifies exchangeable image file format (Exif) metadata tags for image and sound files recorded by digital cameras."@en ; . -observable:EmailAccount +observable:EmailAccountFacet a owl:Class ; rdfs:subClassOf , [ a owl:Restriction ; owl:onProperty observable:emailAddress ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "EmailAccount"@en ; + rdfs:label "EmailAccountFacet"@en ; rdfs:comment "Characteristics of an account within an email domain."@en ; . -observable:EmailAddress +observable:EmailAddressFacet a owl:Class ; rdfs:subClassOf , @@ -1087,11 +1039,11 @@ observable:EmailAddress owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "EmailAddress"@en ; + rdfs:label "EmailAddressFacet"@en ; rdfs:comment "Characteristics of an identifier for an email box to which email messages are delivered."@en ; . -observable:EmailMessage +observable:EmailMessageFacet a owl:Class ; rdfs:subClassOf , @@ -1118,43 +1070,43 @@ observable:EmailMessage [ a owl:Restriction ; owl:onProperty observable:application ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ a owl:Restriction ; owl:onProperty observable:bodyRaw ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ a owl:Restriction ; owl:onProperty observable:from ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ a owl:Restriction ; owl:onProperty observable:headerRaw ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ a owl:Restriction ; owl:onProperty observable:inReplyTo ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ a owl:Restriction ; owl:onProperty observable:sender ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ a owl:Restriction ; owl:onProperty observable:xOriginatingIP ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ @@ -1218,11 +1170,11 @@ observable:EmailMessage owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "EmailMessage"@en ; + rdfs:label "EmailMessageFacet"@en ; rdfs:comment "An instance of an email message, corresponding to the internet message format described in RFC 5322 and related RFCs."@en ; . -observable:EncodedStream +observable:EncodedStreamFacet a owl:Class ; rdfs:subClassOf , @@ -1233,11 +1185,11 @@ observable:EncodedStream owl:onDataRange xsd:string ; ] ; - rdfs:label "EncodedStream"@en ; + rdfs:label "EncodedStreamFacet"@en ; rdfs:comment "Represents the encoding-related properties of some encoded thing."@en ; . -observable:EncryptedStream +observable:EncryptedStreamFacet a owl:Class ; rdfs:subClassOf , @@ -1252,7 +1204,7 @@ observable:EncryptedStream owl:maxCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "EncryptedStream"@en ; + rdfs:label "EncryptedStreamFacet"@en ; rdfs:comment "Represents the encryption-related properties of some encrypted thing."@en ; . @@ -1276,7 +1228,7 @@ observable:EnvironmentVariable rdfs:comment "Represents the properties of an environment variable."@en ; . -observable:Event +observable:EventFacet a owl:Class ; rdfs:subClassOf , @@ -1288,7 +1240,7 @@ observable:Event [ a owl:Restriction ; owl:onProperty observable:cyberAction ; - owl:onClass observable:CyberAction ; + owl:onClass observable:ObservableAction ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ @@ -1318,15 +1270,15 @@ observable:Event [ a owl:Restriction ; owl:onProperty observable:application ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "Event"@en ; + rdfs:label "EventFacet"@en ; rdfs:comment "An event, mainly used for operating system events."@en ; . -observable:ExtInode +observable:ExtInodeFacet a owl:Class ; rdfs:subClassOf , @@ -1383,7 +1335,7 @@ observable:ExtInode owl:onDataRange xsd:integer ; ] ; - rdfs:label "ExtInode"@en ; + rdfs:label "ExtInodeFacet"@en ; rdfs:comment "Characterizes the details of a single EXT file."@en ; . @@ -1433,14 +1385,14 @@ observable:ExtractedString rdfs:comment "A string extracted from a cyber item."@en ; . -observable:ExtractedStrings +observable:ExtractedStringsFacet a owl:Class ; rdfs:subClassOf ; - rdfs:label "ExtractedStrings"@en ; + rdfs:label "ExtractedStringsFacet"@en ; rdfs:comment "One or more strings extracted from a cyber item."@en ; . -observable:File +observable:FileFacet a owl:Class ; rdfs:subClassOf , @@ -1488,26 +1440,26 @@ observable:File owl:onDataRange xsd:string ; ] ; - rdfs:label "File"@en ; + rdfs:label "FileFacet"@en ; rdfs:comment "The basic properties associated with the storage of a file on a file system."@en ; . -observable:FilePermissions +observable:FilePermissionsFacet a owl:Class ; rdfs:subClassOf , [ a owl:Restriction ; owl:onProperty observable:owner ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "FilePermissions"@en ; + rdfs:label "FilePermissionsFacet"@en ; rdfs:comment "Characteristics of permissions or access rights for a file."@en ; . -observable:FileSystem +observable:FileSystemFacet a owl:Class ; rdfs:subClassOf , @@ -1523,18 +1475,18 @@ observable:FileSystem owl:onDataRange xsd:integer ; ] ; - rdfs:label "FileSystem"@en ; + rdfs:label "FileSystemFacet"@en ; rdfs:comment "Represents the properties of a file system."@en ; . -observable:Fragment +observable:FragmentFacet a owl:Class ; rdfs:subClassOf ; - rdfs:label "Fragment"@en ; + rdfs:label "FragmentFacet"@en ; rdfs:comment "Characteristics of an individual fragment of a file."@en ; . -observable:GeoLocationEntry +observable:GeoLocationEntryFacet a owl:Class ; rdfs:subClassOf , @@ -1551,15 +1503,15 @@ observable:GeoLocationEntry [ a owl:Restriction ; owl:onProperty observable:application ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "GeoLocationEntry"@en ; + rdfs:label "GeoLocationEntryFacet"@en ; rdfs:comment "Characteristics of a single application-specific geolocation entry."@en ; . -observable:GeoLocationLog +observable:GeoLocationLogFacet a owl:Class ; rdfs:subClassOf , @@ -1571,15 +1523,15 @@ observable:GeoLocationLog [ a owl:Restriction ; owl:onProperty observable:application ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "GeoLocationLog"@en ; + rdfs:label "GeoLocationLogFacet"@en ; rdfs:comment "A log containing geolocation tracks and/or geolocation entries."@en ; . -observable:GeoLocationTrack +observable:GeoLocationTrackFacet a owl:Class ; rdfs:subClassOf , @@ -1596,11 +1548,11 @@ observable:GeoLocationTrack [ a owl:Restriction ; owl:onProperty observable:application ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "GeoLocationTrack"@en ; + rdfs:label "GeoLocationTrackFacet"@en ; rdfs:comment "Characteristics of a set of contiguous geolocation entries representing a path/track taken."@en ; . @@ -1630,7 +1582,7 @@ observable:GlobalFlagType rdfs:comment "Characterizes Windows global flags."@en ; . -observable:HTTPConnection +observable:HTTPConnectionFacet a owl:Class ; rdfs:subClassOf , @@ -1642,7 +1594,7 @@ observable:HTTPConnection [ a owl:Restriction ; owl:onProperty observable:httpMessageBodyData ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ @@ -1670,7 +1622,7 @@ observable:HTTPConnection owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "HTTPConnection"@en ; + rdfs:label "HTTPConnectionFacet"@en ; rdfs:comment "Specifies HTTP-specific network connection properties."@en ; . @@ -1678,14 +1630,14 @@ observable:ICCID a owl:DatatypeProperty ; rdfs:label "ICCID"@en ; rdfs:comment "Integrated circuit card identifier (http://www.itu.int/)."@en ; - rdfs:domain observable:SIMCard ; + rdfs:domain observable:SIMCardFacet ; rdfs:range xsd:string ; . -observable:ICMPConnection +observable:ICMPConnectionFacet a owl:Class ; rdfs:subClassOf ; - rdfs:label "ICMPConnection"@en ; + rdfs:label "ICMPConnectionFacet"@en ; rdfs:comment "Specifies ICMP-specific network connection properties."@en ; . @@ -1739,7 +1691,7 @@ observable:IMEI a owl:DatatypeProperty ; rdfs:label "IMEI"@en ; rdfs:comment "International Mobile Equipment Identity (IMEI)."@en ; - rdfs:domain observable:MobileDevice ; + rdfs:domain observable:MobileDeviceFacet ; rdfs:range xsd:string ; . @@ -1748,13 +1700,13 @@ observable:IMSI rdfs:label "IMSI"@en ; rdfs:comment "An International Mobile Subscriber Identity (IMSI) is a unique identification associated with all GSM and UMTS network mobile phone users. It is stored as a 64-bit field in the SIM inside the phone and is sent by the phone to the network."@en ; rdfs:domain - observable:MobileAccount , - observable:SIMCard + observable:MobileAccountFacet , + observable:SIMCardFacet ; rdfs:range xsd:string ; . -observable:IPv4Address +observable:IPv4AddressFacet a owl:Class ; rdfs:subClassOf , @@ -1765,11 +1717,11 @@ observable:IPv4Address owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "IPv4Address"@en ; + rdfs:label "IPv4AddressFacet"@en ; rdfs:comment "Characteristics of an IPv4 internet protocol address."@en ; . -observable:IPv6Address +observable:IPv6AddressFacet a owl:Class ; rdfs:subClassOf , @@ -1780,7 +1732,7 @@ observable:IPv6Address owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "IPv6Address"@en ; + rdfs:label "IPv6AddressFacet"@en ; rdfs:comment "Characteristics of an IPv6 internet protocol address."@en ; . @@ -1804,7 +1756,7 @@ observable:IShowMessageActionType rdfs:comment "Characterizes IShowMessage actions."@en ; . -observable:Image +observable:ImageFacet a owl:Class ; rdfs:subClassOf , @@ -1815,11 +1767,11 @@ observable:Image owl:onDataRange xsd:string ; ] ; - rdfs:label "Image"@en ; + rdfs:label "ImageFacet"@en ; rdfs:comment "Characteristics of a complete copy of a hard disk, memory or other digital media."@en ; . -observable:Library +observable:LibraryFacet a owl:Class ; rdfs:subClassOf , @@ -1829,14 +1781,14 @@ observable:Library owl:maxCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "Library"@en ; + rdfs:label "LibraryFacet"@en ; rdfs:comment """A characterization of a software library. What about Android Package and iOS Package and Windows MSI?"""@en ; . -observable:MACAddress +observable:MACAddressFacet a owl:Class ; rdfs:subClassOf , @@ -1847,7 +1799,7 @@ observable:MACAddress owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "MACAddress"@en ; + rdfs:label "MACAddressFacet"@en ; rdfs:comment "Characteristics of a media access control (MAC) address identifier assigned to network interfaces for communications at the data link layer of a network segment."@en ; . @@ -1856,8 +1808,8 @@ observable:MSISDN rdfs:label "MSISDN"@en ; rdfs:comment "Mobile Station International Subscriber Directory Number (MSISDN) is a number used to identify a mobile phone number internationally. MSISDN is defined by the E.164 numbering plan. This number includes a country code and a National Destination Code which identifies the subscriber's operator."@en ; rdfs:domain - observable:MobileAccount , - observable:MobileDevice + observable:MobileAccountFacet , + observable:MobileDeviceFacet ; rdfs:range xsd:string ; . @@ -1866,11 +1818,11 @@ observable:MSISDNType a owl:DatatypeProperty ; rdfs:label "MSISDNType"@en ; rdfs:comment "???."@en ; - rdfs:domain observable:MobileAccount ; + rdfs:domain observable:MobileAccountFacet ; rdfs:range xsd:string ; . -observable:Memory +observable:MemoryFacet a owl:Class ; rdfs:subClassOf , @@ -1910,11 +1862,11 @@ observable:Memory owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "Memory"@en ; + rdfs:label "MemoryFacet"@en ; rdfs:comment "Characteristics of a region of computer memory."@en ; . -observable:Message +observable:MessageFacet a owl:Class ; rdfs:subClassOf , @@ -1926,13 +1878,13 @@ observable:Message [ a owl:Restriction ; owl:onProperty observable:application ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ a owl:Restriction ; owl:onProperty observable:from ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ @@ -1960,11 +1912,11 @@ observable:Message owl:onDataRange xsd:string ; ] ; - rdfs:label "Message"@en ; + rdfs:label "MessageFacet"@en ; rdfs:comment "Characteristics of an electronic message."@en ; . -observable:MessageThread +observable:MessageThreadFacet a owl:Class ; rdfs:subClassOf , @@ -1977,15 +1929,15 @@ observable:MessageThread [ a owl:Restriction ; owl:onProperty observable:message ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:minQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "MessageThread"@en ; + rdfs:label "MessageThreadFacet"@en ; rdfs:comment "Characteristics of a running commentary of electronic messages pertaining to one topic or question."@en ; . -observable:MftRecord +observable:MftRecordFacet a owl:Class ; rdfs:subClassOf , @@ -2057,7 +2009,7 @@ observable:MftRecord owl:onDataRange xsd:string ; ] ; - rdfs:label "MftRecord"@en ; + rdfs:label "MftRecordFacet"@en ; rdfs:comment "Characterizes the details of a single NTFS file."@en ; . @@ -2067,7 +2019,7 @@ observable:MimePartType [ a owl:Restriction ; owl:onProperty observable:bodyRaw ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ @@ -2094,7 +2046,7 @@ observable:MimePartType """@en ; . -observable:MobileAccount +observable:MobileAccountFacet a owl:Class ; rdfs:subClassOf , @@ -2117,11 +2069,11 @@ observable:MobileAccount owl:onDataRange xsd:string ; ] ; - rdfs:label "MobileAccount"@en ; + rdfs:label "MobileAccountFacet"@en ; rdfs:comment "Properties of a Mobile Account."@en ; . -observable:MobileDevice +observable:MobileDeviceFacet a owl:Class ; rdfs:subClassOf , @@ -2180,11 +2132,11 @@ observable:MobileDevice owl:onDataRange xsd:string ; ] ; - rdfs:label "MobileDevice"@en ; + rdfs:label "MobileDeviceFacet"@en ; rdfs:comment "Properties of a Mobile Device."@en ; . -observable:Mutex +observable:MutexFacet a owl:Class ; rdfs:subClassOf , @@ -2195,17 +2147,17 @@ observable:Mutex owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "Mutex"@en ; + rdfs:label "MutexFacet"@en ; . -observable:NTFSFilePermissions +observable:NTFSFilePermissionsFacet a owl:Class ; rdfs:subClassOf ; - rdfs:label "NTFSFilePermissions"@en ; + rdfs:label "NTFSFilePermissionsFacet"@en ; rdfs:comment "Characteristics of permissions or access rights for an NTFS file."@en ; . -observable:NTFSFileSystem +observable:NTFSFileSystemFacet a owl:Class ; rdfs:subClassOf , @@ -2222,10 +2174,10 @@ observable:NTFSFileSystem owl:onDataRange xsd:string ; ] ; - rdfs:label "NTFSFileSystem"@en ; + rdfs:label "NTFSFileSystemFacet"@en ; . -observable:NetworkConnection +observable:NetworkConnectionFacet a owl:Class ; rdfs:subClassOf , @@ -2263,11 +2215,11 @@ observable:NetworkConnection owl:onDataRange xsd:integer ; ] ; - rdfs:label "NetworkConnection"@en ; + rdfs:label "NetworkConnectionFacet"@en ; rdfs:comment "Characteristics of connection (completed or attempted) across a digital network."@en ; . -observable:NetworkFlow +observable:NetworkFlowFacet a owl:Class ; rdfs:subClassOf , @@ -2279,13 +2231,13 @@ observable:NetworkFlow [ a owl:Restriction ; owl:onProperty observable:dstPayload ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ a owl:Restriction ; owl:onProperty observable:srcPayload ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ @@ -2313,11 +2265,11 @@ observable:NetworkFlow owl:onDataRange xsd:integer ; ] ; - rdfs:label "NetworkFlow"@en ; + rdfs:label "NetworkFlowFacet"@en ; rdfs:comment "Characteristics of a sequence of data transiting a one or more digital network connections."@en ; . -observable:NetworkInterface +observable:NetworkInterfaceFacet a owl:Class ; rdfs:subClassOf , @@ -2334,7 +2286,7 @@ observable:NetworkInterface [ a owl:Restriction ; owl:onProperty observable:macAddress ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ @@ -2344,7 +2296,7 @@ observable:NetworkInterface owl:onDataRange xsd:string ; ] ; - rdfs:label "NetworkInterface"@en ; + rdfs:label "NetworkInterfaceFacet"@en ; . observable:NetworkSocketAddressFamily @@ -2523,7 +2475,7 @@ observable:NetworkSocketType ] ; . -observable:Note +observable:NoteFacet a owl:Class ; rdfs:subClassOf , @@ -2546,11 +2498,11 @@ observable:Note [ a owl:Restriction ; owl:onProperty observable:application ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "Note"@en ; + rdfs:label "NoteFacet"@en ; rdfs:comment "Characteristics of digital textual note."@en ; . @@ -2562,6 +2514,54 @@ observable:Observable """@en ; . +observable:ObservableAction + a owl:Class ; + rdfs:subClassOf + , + observable:Observable + ; + rdfs:label "ObservableAction"@en ; + rdfs:comment "Something that may be done or performed within the digital domain."@en ; + . + +observable:ObservableObject + a owl:Class ; + rdfs:subClassOf + , + observable:Observable , + [ + a owl:Restriction ; + owl:onProperty observable:state ; + owl:maxCardinality "1"^^xsd:nonNegativeInteger ; + ] , + [ + a owl:Restriction ; + owl:onProperty observable:hasChanged ; + owl:onDataRange xsd:boolean ; + owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; + ] + ; + rdfs:label "ObservableObject"@en ; + rdfs:comment "A distinct article or unit within the digital domain."@en ; + . + +observable:ObservablePattern + a owl:Class ; + rdfs:subClassOf observable:Observable ; + rdfs:label "ObservablePattern"@en ; + rdfs:comment "A logical pattern composed of observable object and observable action properties."@en ; + . + +observable:ObservableRelationship + a owl:Class ; + rdfs:subClassOf + , + observable:Observable + ; + rdfs:label "ObservableRelationship"@en ; + rdfs:comment "An association or link between two cyber observable objects."@en ; + . + observable:Observation a owl:Class ; rdfs:subClassOf @@ -2581,7 +2581,7 @@ observable:Observation rdfs:comment "An observation of something."@en ; . -observable:OperatingSystem +observable:OperatingSystemFacet a owl:Class ; rdfs:subClassOf , @@ -2613,11 +2613,11 @@ observable:OperatingSystem owl:onDataRange xsd:string ; ] ; - rdfs:label "OperatingSystem"@en ; + rdfs:label "OperatingSystemFacet"@en ; rdfs:comment "Specifies information about an operating system."@en ; . -observable:PDFFile +observable:PDFFileFacet a owl:Class ; rdfs:subClassOf , @@ -2645,14 +2645,14 @@ observable:PDFFile owl:onDataRange xsd:string ; ] ; - rdfs:label "PDFFile"@en ; + rdfs:label "PDFFileFacet"@en ; . observable:PIN a owl:DatatypeProperty ; rdfs:label "PIN"@en ; rdfs:comment "Personal Identification Number (PIN)."@en ; - rdfs:domain observable:SIMCard ; + rdfs:domain observable:SIMCardFacet ; rdfs:range xsd:string ; . @@ -2660,18 +2660,18 @@ observable:PUK a owl:DatatypeProperty ; rdfs:label "PUK"@en ; rdfs:comment "Personal Unlocking Key (PUK) to unlock the SIM card."@en ; - rdfs:domain observable:SIMCard ; + rdfs:domain observable:SIMCardFacet ; rdfs:range xsd:string ; . -observable:PathRelation +observable:PathRelationFacet a owl:Class ; rdfs:subClassOf ; - rdfs:label "PathRelation"@en ; + rdfs:label "PathRelationFacet"@en ; rdfs:comment "Specifies the location of one object within another containing object."@en ; . -observable:PhoneAccount +observable:PhoneAccountFacet a owl:Class ; rdfs:subClassOf , @@ -2682,11 +2682,11 @@ observable:PhoneAccount owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "PhoneAccount"@en ; + rdfs:label "PhoneAccountFacet"@en ; rdfs:comment "Characteristics of a telephone service account."@en ; . -observable:PhoneCall +observable:PhoneCallFacet a owl:Class ; rdfs:subClassOf , @@ -2703,13 +2703,13 @@ observable:PhoneCall [ a owl:Restriction ; owl:onProperty observable:from ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ a owl:Restriction ; owl:onProperty observable:to ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ @@ -2727,15 +2727,15 @@ observable:PhoneCall [ a owl:Restriction ; owl:onProperty observable:application ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "PhoneCall"@en ; + rdfs:label "PhoneCallFacet"@en ; rdfs:comment "Characteristics of a specific phone call."@en ; . -observable:Process +observable:ProcessFacet a owl:Class ; rdfs:subClassOf , @@ -2757,19 +2757,19 @@ observable:Process [ a owl:Restriction ; owl:onProperty observable:binary ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ a owl:Restriction ; owl:onProperty observable:creatorUser ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ a owl:Restriction ; owl:onProperty observable:parent ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ @@ -2803,11 +2803,11 @@ observable:Process owl:onDataRange xsd:string ; ] ; - rdfs:label "Process"@en ; + rdfs:label "ProcessFacet"@en ; rdfs:comment "Characteristics of an instance of a computer program as executed on an operating system."@en ; . -observable:PropertiesEnumeratedEffect +observable:PropertiesEnumeratedEffectFacet a owl:Class ; rdfs:subClassOf , @@ -2819,11 +2819,11 @@ observable:PropertiesEnumeratedEffect owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "PropertiesEnumeratedEffect"@en ; + rdfs:label "PropertiesEnumeratedEffectFacet"@en ; rdfs:comment "Characterizes the effects of actions upon cyberitems where some properties of the cyberitem are enumerated, such as the startup parameters for a process."@en ; . -observable:PropertyReadEffect +observable:PropertyReadEffectFacet a owl:Class ; rdfs:subClassOf , @@ -2841,18 +2841,18 @@ observable:PropertyReadEffect owl:onDataRange xsd:string ; ] ; - rdfs:label "PropertyReadEffect"@en ; + rdfs:label "PropertyReadEffectFacet"@en ; rdfs:comment "Characterize the effects of actions upon cyberitems where some specific property is read from an cyberitem, such as the current running state of a process."@en ; . -observable:RasterPicture +observable:RasterPictureFacet a owl:Class ; rdfs:subClassOf , [ a owl:Restriction ; owl:onProperty observable:camera ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ @@ -2886,7 +2886,7 @@ observable:RasterPicture owl:onDataRange xsd:string ; ] ; - rdfs:label "RasterPicture"@en ; + rdfs:label "RasterPictureFacet"@en ; . observable:RegistryDatatype @@ -2949,7 +2949,7 @@ observable:RegistryDatatype ] ; . -observable:SIMCard +observable:SIMCardFacet a owl:Class ; rdfs:subClassOf , @@ -3002,7 +3002,7 @@ observable:SIMCard owl:onDataRange xsd:string ; ] ; - rdfs:label "SIMCard"@en ; + rdfs:label "SIMCardFacet"@en ; rdfs:comment "Properties of a Mobile SIM card."@en ; . @@ -3010,7 +3010,7 @@ observable:SIMForm a owl:DatatypeProperty ; rdfs:label "SIMForm"@en ; rdfs:comment "The form of SIM card such as SIM, Micro SIM, Nano SIM."@en ; - rdfs:domain observable:SIMCard ; + rdfs:domain observable:SIMCardFacet ; rdfs:range xsd:string ; . @@ -3018,11 +3018,11 @@ observable:SIMType a owl:DatatypeProperty ; rdfs:label "SIMType"@en ; rdfs:comment "The type of SIM card such as SIM, USIM, UICC."@en ; - rdfs:domain observable:SIMCard ; + rdfs:domain observable:SIMCardFacet ; rdfs:range xsd:string ; . -observable:SMSMessage +observable:SMSMessageFacet a owl:Class ; rdfs:subClassOf , @@ -3033,11 +3033,11 @@ observable:SMSMessage owl:onDataRange xsd:boolean ; ] ; - rdfs:label "SMSMessage"@en ; + rdfs:label "SMSMessageFacet"@en ; rdfs:comment "Characteristics of a Short Message Service (SMS) 'text' message."@en ; . -observable:SQLiteBlob +observable:SQLiteBlobFacet a owl:Class ; rdfs:subClassOf , @@ -3060,11 +3060,11 @@ observable:SQLiteBlob owl:onDataRange xsd:string ; ] ; - rdfs:label "SQLiteBlob"@en ; + rdfs:label "SQLiteBlobFacet"@en ; rdfs:comment "Characteristics of blob of data within a SQLite database."@en ; . -observable:SendControlCodeEffect +observable:SendControlCodeEffectFacet a owl:Class ; rdfs:subClassOf , @@ -3076,11 +3076,11 @@ observable:SendControlCodeEffect owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "SendControlCodeEffect"@en ; + rdfs:label "SendControlCodeEffectFacet"@en ; rdfs:comment "Characterizes the effects of actions upon cyberitems where some control code, or other control-oriented communication signal, is sent to the cyberitem. For example, an action may send a control code to change the running state of a process."@en ; . -observable:Software +observable:SoftwareFacet a owl:Class ; rdfs:subClassOf , @@ -3115,7 +3115,7 @@ observable:Software owl:onDataRange xsd:string ; ] ; - rdfs:label "Software"@en ; + rdfs:label "SoftwareFacet"@en ; rdfs:comment """High-level properties associated with software, including software products. How does this relate to Application? @@ -3123,7 +3123,7 @@ How does this relate to Application? """@en ; . -observable:StateChangeEffect +observable:StateChangeEffectFacet a owl:Class ; rdfs:subClassOf , @@ -3131,51 +3131,45 @@ observable:StateChangeEffect [ a owl:Restriction ; owl:onProperty observable:oldObject ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ a owl:Restriction ; owl:onProperty observable:newObject ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "StateChangeEffect"@en ; + rdfs:label "StateChangeEffectFacet"@en ; rdfs:comment "Characterizes the effects of actions upon cyberitems where the some state of the cyberitem is changed."@en ; . -observable:SymbolicLink +observable:SymbolicLinkFacet a owl:Class ; rdfs:subClassOf , [ a owl:Restriction ; owl:onProperty observable:targetFile ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "SymbolicLink"@en ; + rdfs:label "SymbolicLinkFacet"@en ; rdfs:comment "Characteristics of a file that contains a reference to another file or directory in the form of an absolute or relative path and that affects pathname resolution."@en ; . -observable:TCPConnection +observable:TCPConnectionFacet a owl:Class ; rdfs:subClassOf ; - rdfs:label "TCPConnection"@en ; + rdfs:label "TCPConnectionFacet"@en ; rdfs:comment "Specifies TCP-specific network connection properties."@en ; . observable:TaskActionType a owl:Class ; rdfs:subClassOf - [ - a owl:Restriction ; - owl:onProperty observable:iEmailAction ; - owl:onClass observable:CyberItem ; - owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; - ] , [ a owl:Restriction ; owl:onProperty observable:iComHandlerAction ; @@ -3194,6 +3188,12 @@ observable:TaskActionType owl:onClass observable:IShowMessageActionType ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , + [ + a owl:Restriction ; + owl:onProperty observable:iEmailAction ; + owl:onClass observable:ObservableObject ; + owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; + ] , [ a owl:Restriction ; owl:onProperty observable:actionID ; @@ -3265,7 +3265,7 @@ observable:TriggerType rdfs:comment "Characterizes task triggers. See also: http://msdn.microsoft.com/en-us/library/windows/desktop/aa383868(v=vs.85).aspx."@en ; . -observable:UNIXAccount +observable:UNIXAccountFacet a owl:Class ; rdfs:subClassOf , @@ -3282,24 +3282,24 @@ observable:UNIXAccount owl:onDataRange xsd:string ; ] ; - rdfs:label "UNIXAccount"@en ; + rdfs:label "UNIXAccountFacet"@en ; . -observable:UNIXFilePermissions +observable:UNIXFilePermissionsFacet a owl:Class ; rdfs:subClassOf ; - rdfs:label "UNIXFilePermissions"@en ; + rdfs:label "UNIXFilePermissionsFacet"@en ; rdfs:comment "Characteristics of permissions or access rights for a UNIX file."@en ; . -observable:UNIXProcess +observable:UNIXProcessFacet a owl:Class ; rdfs:subClassOf ; - rdfs:label "UNIXProcess"@en ; + rdfs:label "UNIXProcessFacet"@en ; rdfs:comment "Characterization of a UNIX process."@en ; . -observable:UNIXVolume +observable:UNIXVolumeFacet a owl:Class ; rdfs:subClassOf , @@ -3316,24 +3316,24 @@ observable:UNIXVolume owl:onDataRange xsd:string ; ] ; - rdfs:label "UNIXVolume"@en ; + rdfs:label "UNIXVolumeFacet"@en ; rdfs:comment "Characterizes a Unix disk volume."@en ; . -observable:URL +observable:URLFacet a owl:Class ; rdfs:subClassOf , [ a owl:Restriction ; owl:onProperty observable:host ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ a owl:Restriction ; owl:onProperty observable:userName ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ @@ -3379,11 +3379,11 @@ observable:URL owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "URL"@en ; + rdfs:label "URLFacet"@en ; rdfs:comment "Characteristics of a uniform resource locator (URL)."@en ; . -observable:UserAccount +observable:UserAccountFacet a owl:Class ; rdfs:subClassOf , @@ -3412,10 +3412,10 @@ observable:UserAccount owl:onDataRange xsd:string ; ] ; - rdfs:label "UserAccount"@en ; + rdfs:label "UserAccountFacet"@en ; . -observable:UserSession +observable:UserSessionFacet a owl:Class ; rdfs:subClassOf , @@ -3432,7 +3432,7 @@ observable:UserSession [ a owl:Restriction ; owl:onProperty observable:effectiveUser ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ @@ -3448,11 +3448,11 @@ observable:UserSession owl:onDataRange xsd:string ; ] ; - rdfs:label "UserSession"@en ; + rdfs:label "UserSessionFacet"@en ; rdfs:comment "Characterizes a user session."@en ; . -observable:ValuesEnumeratedEffect +observable:ValuesEnumeratedEffectFacet a owl:Class ; rdfs:subClassOf , @@ -3464,11 +3464,11 @@ observable:ValuesEnumeratedEffect owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "ValuesEnumeratedEffect"@en ; + rdfs:label "ValuesEnumeratedEffectFacet"@en ; rdfs:comment "Characterizes the effects of actions upon cyberitems where some values of the cyberitem are enumerated, such as the values of a registry key."@en ; . -observable:Volume +observable:VolumeFacet a owl:Class ; rdfs:subClassOf , @@ -3485,11 +3485,11 @@ observable:Volume owl:onDataRange xsd:string ; ] ; - rdfs:label "Volume"@en ; + rdfs:label "VolumeFacet"@en ; rdfs:comment "Characteristics of a single accessible storage area (Volume) with a single file system."@en ; . -observable:WhoIs +observable:WhoIsFacet a owl:Class ; rdfs:subClassOf , @@ -3516,19 +3516,19 @@ observable:WhoIs [ a owl:Restriction ; owl:onProperty observable:domainName ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ a owl:Restriction ; owl:onProperty observable:ipAddress ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ a owl:Restriction ; owl:onProperty observable:serverName ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ @@ -3574,7 +3574,7 @@ observable:WhoIs owl:onDataRange vocab:WhoisStatusTypeVocab ; ] ; - rdfs:label "WhoIs"@en ; + rdfs:label "WhoIsFacet"@en ; rdfs:comment "Characterizes Whois information for a domain."@en ; . @@ -3594,19 +3594,19 @@ observable:WhoisContactType [ a owl:Restriction ; owl:onProperty observable:emailAddress ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ a owl:Restriction ; owl:onProperty observable:faxNumber ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ a owl:Restriction ; owl:onProperty observable:phone ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ @@ -3643,25 +3643,25 @@ observable:WhoisRegistrarInfoType [ a owl:Restriction ; owl:onProperty observable:emailAddress ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ a owl:Restriction ; owl:onProperty observable:phone ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ a owl:Restriction ; owl:onProperty observable:referralURL ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ a owl:Restriction ; owl:onProperty observable:whoisServer ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ @@ -3687,7 +3687,7 @@ observable:WhoisRegistrarInfoType rdfs:comment "Registrar-related properties from a Whois record."@en ; . -observable:WifiAddress +observable:WifiAddressFacet a owl:Class ; rdfs:subClassOf , @@ -3698,17 +3698,17 @@ observable:WifiAddress owl:onDataRange xsd:string ; ] ; - rdfs:label "WifiAddress"@en ; + rdfs:label "WifiAddressFacet"@en ; rdfs:comment "Properties of a WiFI address."@en ; . -observable:WindowsAccount +observable:WindowsAccountFacet a owl:Class ; rdfs:subClassOf ; - rdfs:label "WindowsAccount"@en ; + rdfs:label "WindowsAccountFacet"@en ; . -observable:WindowsActiveDirectoryAccount +observable:WindowsActiveDirectoryAccountFacet a owl:Class ; rdfs:subClassOf , @@ -3719,10 +3719,10 @@ observable:WindowsActiveDirectoryAccount owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "WindowsActiveDirectoryAccount"@en ; + rdfs:label "WindowsActiveDirectoryAccountFacet"@en ; . -observable:WindowsComputerSpecification +observable:WindowsComputerSpecificationFacet a owl:Class ; rdfs:subClassOf , @@ -3739,19 +3739,19 @@ observable:WindowsComputerSpecification [ a owl:Restriction ; owl:onProperty observable:windowsDirectory ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ a owl:Restriction ; owl:onProperty observable:windowsSystemDirectory ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ a owl:Restriction ; owl:onProperty observable:windowsTempDirectory ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ @@ -3773,11 +3773,11 @@ observable:WindowsComputerSpecification owl:onDataRange xsd:string ; ] ; - rdfs:label "WindowsComputerSpecification"@en ; + rdfs:label "WindowsComputerSpecificationFacet"@en ; rdfs:comment "Specifies Windows-specific system properties."@en ; . -observable:WindowsPEBinaryFile +observable:WindowsPEBinaryFileFacet a owl:Class ; rdfs:subClassOf , @@ -3822,7 +3822,7 @@ observable:WindowsPEBinaryFile owl:onDataRange xsd:string ; ] ; - rdfs:label "WindowsPEBinaryFile"@en ; + rdfs:label "WindowsPEBinaryFileFacet"@en ; rdfs:comment "Properties specific to Windows portable executable (PE) files."@en ; . @@ -3886,7 +3886,7 @@ observable:WindowsPESection rdfs:label "WindowsPESection"@en ; . -observable:WindowsPrefetch +observable:WindowsPrefetchFacet a owl:Class ; rdfs:subClassOf , @@ -3903,7 +3903,7 @@ observable:WindowsPrefetch [ a owl:Restriction ; owl:onProperty observable:volume ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ @@ -3925,11 +3925,11 @@ observable:WindowsPrefetch owl:onDataRange xsd:string ; ] ; - rdfs:label "WindowsPrefetch"@en ; + rdfs:label "WindowsPrefetchFacet"@en ; rdfs:comment "Characterizes entries in the Windows prefetch files. Starting with Windows XP, prefetching was introduced to speed up application startup."@en ; . -observable:WindowsProcess +observable:WindowsProcessFacet a owl:Class ; rdfs:subClassOf , @@ -3969,10 +3969,10 @@ observable:WindowsProcess owl:onDataRange xsd:string ; ] ; - rdfs:label "WindowsProcess"@en ; + rdfs:label "WindowsProcessFacet"@en ; . -observable:WindowsRegistryHive +observable:WindowsRegistryHiveFacet a owl:Class ; rdfs:subClassOf , @@ -3983,11 +3983,11 @@ observable:WindowsRegistryHive owl:onDataRange xsd:string ; ] ; - rdfs:label "WindowsRegistryHive"@en ; + rdfs:label "WindowsRegistryHiveFacet"@en ; rdfs:comment "Characteristics of a particular logical group of keys, subkeys, and values in a Windows registry."@en ; . -observable:WindowsRegistryKey +observable:WindowsRegistryKeyFacet a owl:Class ; rdfs:subClassOf , @@ -3999,7 +3999,7 @@ observable:WindowsRegistryKey [ a owl:Restriction ; owl:onProperty observable:creator ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ @@ -4015,7 +4015,7 @@ observable:WindowsRegistryKey owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "WindowsRegistryKey"@en ; + rdfs:label "WindowsRegistryKeyFacet"@en ; rdfs:comment "Characteristics of a particular key within a Windows registry."@en ; . @@ -4044,7 +4044,7 @@ observable:WindowsRegistryValue rdfs:comment "Properties of a particular value within a Windows registry."@en ; . -observable:WindowsService +observable:WindowsServiceFacet a owl:Class ; rdfs:subClassOf , @@ -4088,7 +4088,7 @@ observable:WindowsService owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] ; - rdfs:label "WindowsService"@en ; + rdfs:label "WindowsServiceFacet"@en ; rdfs:comment "Properties specific to Windows services."@en ; . @@ -4180,7 +4180,7 @@ observable:WindowsServiceType ] ; . -observable:WindowsTask +observable:WindowsTaskFacet a owl:Class ; rdfs:subClassOf , @@ -4202,25 +4202,25 @@ observable:WindowsTask [ a owl:Restriction ; owl:onProperty observable:account ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ a owl:Restriction ; owl:onProperty observable:application ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ a owl:Restriction ; owl:onProperty observable:workItemData ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ a owl:Restriction ; owl:onProperty observable:workingDirectory ; - owl:onClass observable:CyberItem ; + owl:onClass observable:ObservableObject ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ @@ -4284,11 +4284,11 @@ observable:WindowsTask owl:onDataRange vocab:TaskStatusVocab ; ] ; - rdfs:label "WindowsTask"@en ; + rdfs:label "WindowsTaskFacet"@en ; rdfs:comment "Characterize Windows task scheduler tasks. See Also: http://msdn.microsoft.com/en-us/library/windows/desktop/aa381311(v=vs.85).aspx."@en ; . -observable:WindowsThread +observable:WindowsThreadFacet a owl:Class ; rdfs:subClassOf , @@ -4321,11 +4321,11 @@ observable:WindowsThread owl:onDataRange xsd:string ; ] ; - rdfs:label "WindowsThread"@en ; + rdfs:label "WindowsThreadFacet"@en ; rdfs:comment "Characteristics of a single thread of execution within a Windows process."@en ; . -observable:WindowsVolume +observable:WindowsVolumeFacet a owl:Class ; rdfs:subClassOf , @@ -4348,11 +4348,11 @@ observable:WindowsVolume owl:onDataRange vocab:WindowsVolumeAttributeVocab ; ] ; - rdfs:label "WindowsVolume"@en ; + rdfs:label "WindowsVolumeFacet"@en ; rdfs:comment "Characterizes a Windows disk volume."@en ; . -observable:WirelessNetworkConnection +observable:WirelessNetworkConnectionFacet a owl:Class ; rdfs:subClassOf , @@ -4369,11 +4369,11 @@ observable:WirelessNetworkConnection owl:onDataRange xsd:string ; ] ; - rdfs:label "WirelessNetworkConnection"@en ; + rdfs:label "WirelessNetworkConnectionFacet"@en ; rdfs:comment "Connection to a wireless network."@en ; . -observable:X509Certificate +observable:X509CertificateFacet a owl:Class ; rdfs:subClassOf , @@ -4405,7 +4405,7 @@ observable:X509Certificate [ a owl:Restriction ; owl:onProperty observable:x509v3extensions ; - owl:onClass observable:X509V3Extensions ; + owl:onClass observable:X509V3ExtensionsFacet ; owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ; ] , [ @@ -4469,10 +4469,10 @@ observable:X509Certificate owl:onDataRange xsd:string ; ] ; - rdfs:label "X509Certificate"@en ; + rdfs:label "X509CertificateFacet"@en ; . -observable:X509V3Extensions +observable:X509V3ExtensionsFacet a owl:Class ; rdfs:subClassOf , @@ -4571,7 +4571,7 @@ observable:X509V3Extensions owl:onDataRange xsd:string ; ] ; - rdfs:label "X509V3Extensions"@en ; + rdfs:label "X509V3ExtensionsFacet"@en ; rdfs:comment "Extended properties of X.509 v3 digital certificates."@en ; . @@ -4586,14 +4586,14 @@ observable:accessedDirectory a owl:ObjectProperty ; rdfs:label "accessedDirectory"@en ; rdfs:comment "Directories accessed by the prefetch application during startup."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:accessedFile a owl:ObjectProperty ; rdfs:label "accessedFile"@en ; rdfs:comment "Files (e.g., DLLs and other support files) used by the application during startup."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:accessedTime @@ -4607,7 +4607,7 @@ observable:account a owl:ObjectProperty ; rdfs:label "account"@en ; rdfs:comment "Specifies the account used to run the scheduled task. See also: http://msdn.microsoft.com/en-us/library/windows/desktop/aa381228(v=vs.85).aspx."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:accountIdentifier @@ -4724,7 +4724,7 @@ observable:application a owl:ObjectProperty ; rdfs:label "application"@en ; rdfs:comment "The application associated with this object."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:applicationFileName @@ -4816,13 +4816,13 @@ observable:basicConstraints observable:bcc a owl:ObjectProperty ; rdfs:label "bcc"@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:binary a owl:ObjectProperty ; rdfs:label "binary"@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:biosDate @@ -4910,7 +4910,7 @@ observable:bodyMultipart observable:bodyRaw a owl:ObjectProperty ; rdfs:label "bodyRaw"@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:bookmarkPath @@ -4943,7 +4943,7 @@ observable:camera a owl:ObjectProperty ; rdfs:label "camera"@en ; rdfs:comment "The name/make of the camera that was used for taking the picture."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:canEscalatePrivs @@ -4969,7 +4969,7 @@ observable:categories observable:cc a owl:ObjectProperty ; rdfs:label "cc"@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:certificateIssuer @@ -5121,7 +5121,7 @@ observable:context observable:controlCode a owl:DatatypeProperty ; rdfs:label "controlCode"@en ; - rdfs:comment "Specifies the actual control code that was sent to the cyberitem."@en ; + rdfs:comment "Specifies the actual control code that was sent to the observable object."@en ; rdfs:range xsd:string ; . @@ -5129,7 +5129,7 @@ observable:cookieDomain a owl:ObjectProperty ; rdfs:label "cookieDomain"@en ; rdfs:comment "The domain for which the cookie is stored, for example nfi.minjus.nl."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:cookieName @@ -5197,14 +5197,14 @@ observable:creator a owl:ObjectProperty ; rdfs:label "creator"@en ; rdfs:comment "Specifies the name of the creator of the registry key."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:creatorUser a owl:ObjectProperty ; rdfs:label "creatorUser"@en ; rdfs:comment "The user that created/owns the process."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:crlDistributionPoints @@ -5230,7 +5230,7 @@ observable:cyberAction a owl:ObjectProperty ; rdfs:label "cyberAction"@en ; rdfs:comment "The action taken in response to the event."@en ; - rdfs:range observable:CyberAction ; + rdfs:range observable:ObservableAction ; . observable:data @@ -5248,7 +5248,7 @@ observable:dataPayload observable:dataPayloadReferenceURL a owl:ObjectProperty ; rdfs:label "dataPayloadReferenceURL"@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:dataType @@ -5314,7 +5314,7 @@ observable:dhcpServer a owl:ObjectProperty ; rdfs:label "dhcpServer"@en ; rdfs:comment "Specifies the list of DHCP server IP Addresses used by the network interface."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:diskPartitionType @@ -5375,7 +5375,7 @@ observable:domainID a owl:DatatypeProperty ; rdfs:label "domainID"@en ; rdfs:comment "Specifies the domain id for the domain associated with a Whois entry."@en ; - rdfs:domain observable:WhoIs ; + rdfs:domain observable:WhoIsFacet ; rdfs:range xsd:string ; . @@ -5383,7 +5383,7 @@ observable:domainName a owl:ObjectProperty ; rdfs:label "domainName"@en ; rdfs:comment "Specifies the corresponding domain name for a whois entry."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:driveLetter @@ -5404,7 +5404,7 @@ observable:dst a owl:ObjectProperty ; rdfs:label "dst"@en ; rdfs:comment "Specifies the destination(s) of the network connection."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:dstBytes @@ -5422,7 +5422,7 @@ observable:dstPackets observable:dstPayload a owl:ObjectProperty ; rdfs:label "dstPayload"@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:duration @@ -5450,14 +5450,14 @@ observable:effectiveUser a owl:ObjectProperty ; rdfs:label "effectiveUser"@en ; rdfs:comment "Specifies the effective user details used in the user session."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:emailAddress a owl:ObjectProperty ; rdfs:label "emailAddress"@en ; rdfs:comment "An email address."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:encoding @@ -5708,7 +5708,7 @@ observable:faxNumber a owl:ObjectProperty ; rdfs:label "faxNumber"@en ; rdfs:comment "A phone number(account) of a fax."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:fileAlignment @@ -5805,7 +5805,7 @@ observable:from a owl:ObjectProperty ; rdfs:label "from"@en ; rdfs:comment "The phone number of the initiating party."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:fullValue @@ -5818,7 +5818,7 @@ observable:fullValue observable:geoLocationEntry a owl:ObjectProperty ; rdfs:label "geoLocationEntry"@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:gid @@ -5883,7 +5883,7 @@ observable:hashes observable:headerRaw a owl:ObjectProperty ; rdfs:label "headerRaw"@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:hexadecimalValue @@ -5910,7 +5910,7 @@ observable:host a owl:ObjectProperty ; rdfs:label "host"@en ; rdfs:comment "Domain name or IP address where the resource is located."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:hostname @@ -5931,7 +5931,7 @@ observable:httpMessageBodyData a owl:ObjectProperty ; rdfs:label "httpMessageBodyData"@en ; rdfs:comment "Specifies the data contained in an HTTP message body."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:httpRequestHeader @@ -5952,7 +5952,7 @@ observable:iEmailAction a owl:ObjectProperty ; rdfs:label "iEmailAction"@en ; rdfs:comment "Specifies an action that sends an e-mail, which in this context refers to actual email message sent. See also: http://msdn.microsoft.com/en-us/library/windows/desktop/aa380693(v=vs.85).aspx."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:iExecAction @@ -6021,7 +6021,7 @@ observable:inReplyTo a owl:ObjectProperty ; rdfs:label "inReplyTo"@en ; rdfs:comment "One of more unique identifiers for identifying the email(s) this email is a reply to."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:inhibitAnyPolicy @@ -6041,21 +6041,21 @@ observable:ip a owl:ObjectProperty ; rdfs:label "ip"@en ; rdfs:comment "Specifies the list of IP addresses used by the network interface."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:ipAddress a owl:ObjectProperty ; rdfs:label "ipAddress"@en ; rdfs:comment "Specifies the corresponding ip address for a whois entry. Usually corresponds to a nameserver lookup."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:ipGateway a owl:ObjectProperty ; rdfs:label "ipGateway"@en ; rdfs:comment "Specifies the list of IP Gateway IP Addresses used by the network interface."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:ipfix @@ -6337,7 +6337,7 @@ observable:macAddress a owl:ObjectProperty ; rdfs:label "macAddress"@en ; rdfs:comment "Specifies the MAC or hardware address of the physical network card. "@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:machine @@ -6404,7 +6404,7 @@ observable:maxRunTime observable:message a owl:ObjectProperty ; rdfs:label "message"@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:messageID @@ -6605,7 +6605,7 @@ observable:nameserver a owl:ObjectProperty ; rdfs:label "nameserver"@en ; rdfs:comment "Specifies a list of nameserver entries for a Whois entry."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:netBIOSName @@ -6626,14 +6626,14 @@ observable:networkInterface a owl:ObjectProperty ; rdfs:label "networkInterface"@en ; rdfs:comment "Specifies the list of network interfaces present on the system."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:newObject a owl:ObjectProperty ; rdfs:label "newObject"@en ; - rdfs:comment "Specifies the cyberitem and its properties as they are after the state change effect occurred."@en ; - rdfs:range observable:CyberItem ; + rdfs:comment "Specifies the observable object and its properties as they are after the state change effect occurred."@en ; + rdfs:range observable:ObservableObject ; . observable:nextRunTime @@ -6713,8 +6713,8 @@ observable:objectGUID observable:oldObject a owl:ObjectProperty ; rdfs:label "oldObject"@en ; - rdfs:comment "Specifies the cyberitem and its properties as they were before the state change effect occurred."@en ; - rdfs:range observable:CyberItem ; + rdfs:comment "Specifies the observable object and its properties as they were before the state change effect occurred."@en ; + rdfs:range observable:ObservableObject ; . observable:openFileDescriptor @@ -6727,7 +6727,7 @@ observable:openFileDescriptor observable:operatingSystem a owl:ObjectProperty ; rdfs:label "operatingSystem"@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:optionalHeader @@ -6759,7 +6759,7 @@ observable:owner ; rdfs:range , - observable:CyberItem + observable:ObservableObject ; . @@ -6786,20 +6786,20 @@ observable:parent a owl:ObjectProperty ; rdfs:label "parent"@en ; rdfs:comment "The process that created this process."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:participant a owl:ObjectProperty ; rdfs:label "participant"@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:partition a owl:ObjectProperty ; rdfs:label "partition"@en ; rdfs:comment "The partitions that reside on the disk."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:partitionID @@ -6877,7 +6877,7 @@ observable:phone a owl:ObjectProperty ; rdfs:label "phone"@en ; rdfs:comment "A phone number(account)."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:phoneActivationTime @@ -6984,14 +6984,14 @@ observable:processorArchitecture a owl:DatatypeProperty ; rdfs:label "processorArchitecture"@en ; rdfs:comment "Specifies the specific architecture (e.g. x86) used by the CPU of the system."@en ; - rdfs:domain observable:ComputerSpecification ; + rdfs:domain observable:ComputerSpecificationFacet ; rdfs:range xsd:string ; . observable:properties a owl:DatatypeProperty ; rdfs:label "properties"@en ; - rdfs:comment "Specifies the properties that were enumerated as a result of the action on the cyberitem."@en ; + rdfs:comment "Specifies the properties that were enumerated as a result of the action on the observable object."@en ; rdfs:range xsd:string ; . @@ -7061,14 +7061,14 @@ observable:references a owl:ObjectProperty ; rdfs:label "references"@en ; rdfs:comment "A list of email message identifiers this email relates to."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:referralURL a owl:ObjectProperty ; rdfs:label "referralURL"@en ; rdfs:comment "Specifies the corresponding referral URL for a registrar."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:regionSize @@ -7260,7 +7260,7 @@ observable:securityAttributes observable:sender a owl:ObjectProperty ; rdfs:label "sender"@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:sentTime @@ -7280,7 +7280,7 @@ observable:serverName a owl:ObjectProperty ; rdfs:label "serverName"@en ; rdfs:comment "Specifies the corresponding server name for a whois entry. This usually corresponds to a nameserver lookup."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:serviceName @@ -7507,7 +7507,7 @@ observable:srcPackets observable:srcPayload a owl:ObjectProperty ; rdfs:label "srcPayload"@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:ssid @@ -7673,7 +7673,7 @@ observable:targetFile a owl:ObjectProperty ; rdfs:label "targetFile"@en ; rdfs:comment "Specifies the file targeted by a symbolic link."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:taskComment @@ -7741,7 +7741,7 @@ observable:to a owl:ObjectProperty ; rdfs:label "to"@en ; rdfs:comment "The receiver's phone number."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:totalFragments @@ -7851,7 +7851,7 @@ observable:userName a owl:ObjectProperty ; rdfs:label "userName"@en ; rdfs:comment "Username used to authenticate to this resource."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:validityNotAfter @@ -7902,7 +7902,7 @@ observable:volume a owl:ObjectProperty ; rdfs:label "volume"@en ; rdfs:comment "The volume from which the prefetch application was run. If the applicatin was run from multiple volumes, there will be a separate prefetch file for each."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:volumeID @@ -7916,7 +7916,7 @@ observable:whoisServer a owl:ObjectProperty ; rdfs:label "whoisServer"@en ; rdfs:comment "Specifies the corresponding whois server for a registrar."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:win32VersionValue @@ -7936,21 +7936,21 @@ observable:windowsDirectory a owl:ObjectProperty ; rdfs:label "windowsDirectory"@en ; rdfs:comment "The Windows_Directory field specifies the fully-qualified path to the Windows install directory."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:windowsSystemDirectory a owl:ObjectProperty ; rdfs:label "windowsSystemDirectory"@en ; rdfs:comment "The Windows_System_Directory field specifies the fully-qualified path to the Windows system directory."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:windowsTempDirectory a owl:ObjectProperty ; rdfs:label "windowsTempDirectory"@en ; rdfs:comment "The Windows_Temp_Directory field specifies the fully-qualified path to the Windows temporary files directory."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:windowsVolumeAttributes @@ -7964,20 +7964,20 @@ observable:workItemData a owl:ObjectProperty ; rdfs:label "workItemData"@en ; rdfs:comment "Specifies application defined data associated with the scheduled task. See also: http://msdn.microsoft.com/en-us/library/windows/desktop/aa381271(v=vs.85).aspx."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:workingDirectory a owl:ObjectProperty ; rdfs:label "workingDirectory"@en ; rdfs:comment "Specifies the working directory for the scheduled task. See also: http://msdn.microsoft.com/en-us/library/windows/desktop/aa381878(v=vs.85).aspx."@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . observable:x509v3extensions a owl:ObjectProperty ; rdfs:label "x509V3Extensions"@en ; - rdfs:range observable:X509V3Extensions ; + rdfs:range observable:X509V3ExtensionsFacet ; . observable:xMailer @@ -7989,6 +7989,6 @@ observable:xMailer observable:xOriginatingIP a owl:ObjectProperty ; rdfs:label "xOriginatingIP"@en ; - rdfs:range observable:CyberItem ; + rdfs:range observable:ObservableObject ; . diff --git a/uco-types/types.ttl b/uco-types/types.ttl index 1966cf00..3137fa3d 100644 --- a/uco-types/types.ttl +++ b/uco-types/types.ttl @@ -151,3 +151,4 @@ types:value rdfs:comment "A specific property value."@en ; rdfs:range xsd:string ; . + diff --git a/uco-vocabulary/vocabulary.ttl b/uco-vocabulary/vocabulary.ttl index 066422bd..be4c8cac 100644 --- a/uco-vocabulary/vocabulary.ttl +++ b/uco-vocabulary/vocabulary.ttl @@ -463,170 +463,6 @@ vocab:CharacterEncodingVocab ) ; . -vocab:CyberItemRelationshipVocab - a rdfs:Datatype ; - rdfs:subClassOf rdfs:Resource ; - rdfs:label "Cyber Item Relationship Vocabulary"@en-US ; - rdfs:comment "Defines an open-vocabulary of inter-cyberitem relationships."@en ; - owl:oneOf ( - "Allocated"^^vocab:CyberItemRelationshipVocab - "Allocated_By"^^vocab:CyberItemRelationshipVocab - "Bound"^^vocab:CyberItemRelationshipVocab - "Bound_By"^^vocab:CyberItemRelationshipVocab - "Characterized_By"^^vocab:CyberItemRelationshipVocab - "Characterizes"^^vocab:CyberItemRelationshipVocab - "Child_Of"^^vocab:CyberItemRelationshipVocab - "Closed"^^vocab:CyberItemRelationshipVocab - "Closed_By"^^vocab:CyberItemRelationshipVocab - "Compressed"^^vocab:CyberItemRelationshipVocab - "Compressed_By"^^vocab:CyberItemRelationshipVocab - "Compressed_From"^^vocab:CyberItemRelationshipVocab - "Compressed_Into"^^vocab:CyberItemRelationshipVocab - "Connected_From"^^vocab:CyberItemRelationshipVocab - "Connected_To"^^vocab:CyberItemRelationshipVocab - "Contained_Within"^^vocab:CyberItemRelationshipVocab - "Contains"^^vocab:CyberItemRelationshipVocab - "Copied"^^vocab:CyberItemRelationshipVocab - "Copied_By"^^vocab:CyberItemRelationshipVocab - "Copied_From"^^vocab:CyberItemRelationshipVocab - "Copied_To"^^vocab:CyberItemRelationshipVocab - "Created"^^vocab:CyberItemRelationshipVocab - "Created_By"^^vocab:CyberItemRelationshipVocab - "Decoded"^^vocab:CyberItemRelationshipVocab - "Decoded_By"^^vocab:CyberItemRelationshipVocab - "Decompressed"^^vocab:CyberItemRelationshipVocab - "Decompressed_By"^^vocab:CyberItemRelationshipVocab - "Decrypted"^^vocab:CyberItemRelationshipVocab - "Decrypted_By"^^vocab:CyberItemRelationshipVocab - "Deleted"^^vocab:CyberItemRelationshipVocab - "Deleted_By"^^vocab:CyberItemRelationshipVocab - "Deleted_From"^^vocab:CyberItemRelationshipVocab - "Downloaded"^^vocab:CyberItemRelationshipVocab - "Downloaded_By"^^vocab:CyberItemRelationshipVocab - "Downloaded_From"^^vocab:CyberItemRelationshipVocab - "Downloaded_To"^^vocab:CyberItemRelationshipVocab - "Dropped"^^vocab:CyberItemRelationshipVocab - "Dropped_By"^^vocab:CyberItemRelationshipVocab - "Encoded"^^vocab:CyberItemRelationshipVocab - "Encoded_By"^^vocab:CyberItemRelationshipVocab - "Encrypted"^^vocab:CyberItemRelationshipVocab - "Encrypted_By"^^vocab:CyberItemRelationshipVocab - "Encrypted_From"^^vocab:CyberItemRelationshipVocab - "Encrypted_To"^^vocab:CyberItemRelationshipVocab - "Extracted_From"^^vocab:CyberItemRelationshipVocab - "FQDN_Of"^^vocab:CyberItemRelationshipVocab - "Freed"^^vocab:CyberItemRelationshipVocab - "Freed_By"^^vocab:CyberItemRelationshipVocab - "Hooked"^^vocab:CyberItemRelationshipVocab - "Hooked_By"^^vocab:CyberItemRelationshipVocab - "Initialized_By"^^vocab:CyberItemRelationshipVocab - "Initialized_To"^^vocab:CyberItemRelationshipVocab - "Injected"^^vocab:CyberItemRelationshipVocab - "Injected_As"^^vocab:CyberItemRelationshipVocab - "Injected_By"^^vocab:CyberItemRelationshipVocab - "Injected_Into"^^vocab:CyberItemRelationshipVocab - "Installed"^^vocab:CyberItemRelationshipVocab - "Installed_By"^^vocab:CyberItemRelationshipVocab - "Joined"^^vocab:CyberItemRelationshipVocab - "Joined_By"^^vocab:CyberItemRelationshipVocab - "Killed"^^vocab:CyberItemRelationshipVocab - "Killed_By"^^vocab:CyberItemRelationshipVocab - "Listened_On"^^vocab:CyberItemRelationshipVocab - "Listened_On_By"^^vocab:CyberItemRelationshipVocab - "Loaded_From"^^vocab:CyberItemRelationshipVocab - "Loaded_Into"^^vocab:CyberItemRelationshipVocab - "Locked"^^vocab:CyberItemRelationshipVocab - "Locked_By"^^vocab:CyberItemRelationshipVocab - "Mapped_By"^^vocab:CyberItemRelationshipVocab - "Mapped_Into"^^vocab:CyberItemRelationshipVocab - "Merged"^^vocab:CyberItemRelationshipVocab - "Merged_By"^^vocab:CyberItemRelationshipVocab - "Modified_Properties_Of"^^vocab:CyberItemRelationshipVocab - "Monitored"^^vocab:CyberItemRelationshipVocab - "Monitored_By"^^vocab:CyberItemRelationshipVocab - "Moved"^^vocab:CyberItemRelationshipVocab - "Moved_By"^^vocab:CyberItemRelationshipVocab - "Moved_From"^^vocab:CyberItemRelationshipVocab - "Moved_To"^^vocab:CyberItemRelationshipVocab - "Opened"^^vocab:CyberItemRelationshipVocab - "Opened_By"^^vocab:CyberItemRelationshipVocab - "Packed"^^vocab:CyberItemRelationshipVocab - "Packed_By"^^vocab:CyberItemRelationshipVocab - "Packed_From"^^vocab:CyberItemRelationshipVocab - "Packed_Into"^^vocab:CyberItemRelationshipVocab - "Parent_Of"^^vocab:CyberItemRelationshipVocab - "Paused"^^vocab:CyberItemRelationshipVocab - "Paused_By"^^vocab:CyberItemRelationshipVocab - "Previously_Contained"^^vocab:CyberItemRelationshipVocab - "Properties_Modified_By"^^vocab:CyberItemRelationshipVocab - "Properties_Queried"^^vocab:CyberItemRelationshipVocab - "Properties_Queried_By"^^vocab:CyberItemRelationshipVocab - "Read_From"^^vocab:CyberItemRelationshipVocab - "Read_From_By"^^vocab:CyberItemRelationshipVocab - "Received"^^vocab:CyberItemRelationshipVocab - "Received_By"^^vocab:CyberItemRelationshipVocab - "Received_From"^^vocab:CyberItemRelationshipVocab - "Received_Via_Upload"^^vocab:CyberItemRelationshipVocab - "Redirects_To"^^vocab:CyberItemRelationshipVocab - "Related_To"^^vocab:CyberItemRelationshipVocab - "Renamed"^^vocab:CyberItemRelationshipVocab - "Renamed_By"^^vocab:CyberItemRelationshipVocab - "Renamed_From"^^vocab:CyberItemRelationshipVocab - "Renamed_To"^^vocab:CyberItemRelationshipVocab - "Resolved_To"^^vocab:CyberItemRelationshipVocab - "Resumed"^^vocab:CyberItemRelationshipVocab - "Resumed_By"^^vocab:CyberItemRelationshipVocab - "Root_Domain_Of"^^vocab:CyberItemRelationshipVocab - "Searched_For"^^vocab:CyberItemRelationshipVocab - "Searched_For_By"^^vocab:CyberItemRelationshipVocab - "Sent"^^vocab:CyberItemRelationshipVocab - "Sent_By"^^vocab:CyberItemRelationshipVocab - "Sent_To"^^vocab:CyberItemRelationshipVocab - "Sent_Via_Upload"^^vocab:CyberItemRelationshipVocab - "Set_From"^^vocab:CyberItemRelationshipVocab - "Set_To"^^vocab:CyberItemRelationshipVocab - "Sub-domain_Of"^^vocab:CyberItemRelationshipVocab - "Supra-domain_Of"^^vocab:CyberItemRelationshipVocab - "Suspended"^^vocab:CyberItemRelationshipVocab - "Suspended_By"^^vocab:CyberItemRelationshipVocab - "Unhooked"^^vocab:CyberItemRelationshipVocab - "Unhooked_By"^^vocab:CyberItemRelationshipVocab - "Unlocked"^^vocab:CyberItemRelationshipVocab - "Unlocked_By"^^vocab:CyberItemRelationshipVocab - "Unpacked"^^vocab:CyberItemRelationshipVocab - "Unpacked_By"^^vocab:CyberItemRelationshipVocab - "Uploaded"^^vocab:CyberItemRelationshipVocab - "Uploaded_By"^^vocab:CyberItemRelationshipVocab - "Uploaded_From"^^vocab:CyberItemRelationshipVocab - "Uploaded_To"^^vocab:CyberItemRelationshipVocab - "Used"^^vocab:CyberItemRelationshipVocab - "Used_By"^^vocab:CyberItemRelationshipVocab - "Values_Enumerated"^^vocab:CyberItemRelationshipVocab - "Values_Enumerated_By"^^vocab:CyberItemRelationshipVocab - "Written_To_By"^^vocab:CyberItemRelationshipVocab - "Wrote_To"^^vocab:CyberItemRelationshipVocab - ) ; - . - -vocab:CyberItemStateVocab - a rdfs:Datatype ; - rdfs:subClassOf rdfs:Resource ; - rdfs:label "Cyber Item State Vocabulary"@en-US ; - rdfs:comment "Defines an open-vocabulary of cyberitem states."@en ; - owl:oneOf ( - "Active"^^vocab:CyberItemStateVocab - "Closed"^^vocab:CyberItemStateVocab - "Does Not Exist"^^vocab:CyberItemStateVocab - "Exists"^^vocab:CyberItemStateVocab - "Inactive"^^vocab:CyberItemStateVocab - "Locked"^^vocab:CyberItemStateVocab - "Open"^^vocab:CyberItemStateVocab - "Started"^^vocab:CyberItemStateVocab - "Stopped"^^vocab:CyberItemStateVocab - "Unlocked"^^vocab:CyberItemStateVocab - ) ; - . - vocab:DiskTypeVocab a rdfs:Datatype ; rdfs:subClassOf rdfs:Resource ; @@ -670,18 +506,6 @@ vocab:HashNameVocab ) ; . -vocab:InvestigationFormVocab - a rdfs:Datatype ; - rdfs:subClassOf rdfs:Resource ; - rdfs:label "Investigation Form Vocabulary"@en-US ; - rdfs:comment "Defines an open-vocabulary of investigation forms."@en-US ; - owl:oneOf ( - "case"^^vocab:InvestigationFormVocab - "incident"^^vocab:InvestigationFormVocab - "suspicious-activity"^^vocab:InvestigationFormVocab - ) ; - . - vocab:LibraryTypeVocab a rdfs:Datatype ; rdfs:subClassOf rdfs:Resource ; @@ -710,6 +534,170 @@ vocab:MemoryBlockTypeVocab ) ; . +vocab:ObservableObjectRelationshipVocab + a rdfs:Datatype ; + rdfs:subClassOf rdfs:Resource ; + rdfs:label "Cyber Item Relationship Vocabulary"@en-US ; + rdfs:comment "Defines an open-vocabulary of inter-observable object relationships."@en ; + owl:oneOf ( + "Allocated"^^vocab:ObservableObjectRelationshipVocab + "Allocated_By"^^vocab:ObservableObjectRelationshipVocab + "Bound"^^vocab:ObservableObjectRelationshipVocab + "Bound_By"^^vocab:ObservableObjectRelationshipVocab + "Characterized_By"^^vocab:ObservableObjectRelationshipVocab + "Characterizes"^^vocab:ObservableObjectRelationshipVocab + "Child_Of"^^vocab:ObservableObjectRelationshipVocab + "Closed"^^vocab:ObservableObjectRelationshipVocab + "Closed_By"^^vocab:ObservableObjectRelationshipVocab + "Compressed"^^vocab:ObservableObjectRelationshipVocab + "Compressed_By"^^vocab:ObservableObjectRelationshipVocab + "Compressed_From"^^vocab:ObservableObjectRelationshipVocab + "Compressed_Into"^^vocab:ObservableObjectRelationshipVocab + "Connected_From"^^vocab:ObservableObjectRelationshipVocab + "Connected_To"^^vocab:ObservableObjectRelationshipVocab + "Contained_Within"^^vocab:ObservableObjectRelationshipVocab + "Contains"^^vocab:ObservableObjectRelationshipVocab + "Copied"^^vocab:ObservableObjectRelationshipVocab + "Copied_By"^^vocab:ObservableObjectRelationshipVocab + "Copied_From"^^vocab:ObservableObjectRelationshipVocab + "Copied_To"^^vocab:ObservableObjectRelationshipVocab + "Created"^^vocab:ObservableObjectRelationshipVocab + "Created_By"^^vocab:ObservableObjectRelationshipVocab + "Decoded"^^vocab:ObservableObjectRelationshipVocab + "Decoded_By"^^vocab:ObservableObjectRelationshipVocab + "Decompressed"^^vocab:ObservableObjectRelationshipVocab + "Decompressed_By"^^vocab:ObservableObjectRelationshipVocab + "Decrypted"^^vocab:ObservableObjectRelationshipVocab + "Decrypted_By"^^vocab:ObservableObjectRelationshipVocab + "Deleted"^^vocab:ObservableObjectRelationshipVocab + "Deleted_By"^^vocab:ObservableObjectRelationshipVocab + "Deleted_From"^^vocab:ObservableObjectRelationshipVocab + "Downloaded"^^vocab:ObservableObjectRelationshipVocab + "Downloaded_By"^^vocab:ObservableObjectRelationshipVocab + "Downloaded_From"^^vocab:ObservableObjectRelationshipVocab + "Downloaded_To"^^vocab:ObservableObjectRelationshipVocab + "Dropped"^^vocab:ObservableObjectRelationshipVocab + "Dropped_By"^^vocab:ObservableObjectRelationshipVocab + "Encoded"^^vocab:ObservableObjectRelationshipVocab + "Encoded_By"^^vocab:ObservableObjectRelationshipVocab + "Encrypted"^^vocab:ObservableObjectRelationshipVocab + "Encrypted_By"^^vocab:ObservableObjectRelationshipVocab + "Encrypted_From"^^vocab:ObservableObjectRelationshipVocab + "Encrypted_To"^^vocab:ObservableObjectRelationshipVocab + "Extracted_From"^^vocab:ObservableObjectRelationshipVocab + "FQDN_Of"^^vocab:ObservableObjectRelationshipVocab + "Freed"^^vocab:ObservableObjectRelationshipVocab + "Freed_By"^^vocab:ObservableObjectRelationshipVocab + "Hooked"^^vocab:ObservableObjectRelationshipVocab + "Hooked_By"^^vocab:ObservableObjectRelationshipVocab + "Initialized_By"^^vocab:ObservableObjectRelationshipVocab + "Initialized_To"^^vocab:ObservableObjectRelationshipVocab + "Injected"^^vocab:ObservableObjectRelationshipVocab + "Injected_As"^^vocab:ObservableObjectRelationshipVocab + "Injected_By"^^vocab:ObservableObjectRelationshipVocab + "Injected_Into"^^vocab:ObservableObjectRelationshipVocab + "Installed"^^vocab:ObservableObjectRelationshipVocab + "Installed_By"^^vocab:ObservableObjectRelationshipVocab + "Joined"^^vocab:ObservableObjectRelationshipVocab + "Joined_By"^^vocab:ObservableObjectRelationshipVocab + "Killed"^^vocab:ObservableObjectRelationshipVocab + "Killed_By"^^vocab:ObservableObjectRelationshipVocab + "Listened_On"^^vocab:ObservableObjectRelationshipVocab + "Listened_On_By"^^vocab:ObservableObjectRelationshipVocab + "Loaded_From"^^vocab:ObservableObjectRelationshipVocab + "Loaded_Into"^^vocab:ObservableObjectRelationshipVocab + "Locked"^^vocab:ObservableObjectRelationshipVocab + "Locked_By"^^vocab:ObservableObjectRelationshipVocab + "Mapped_By"^^vocab:ObservableObjectRelationshipVocab + "Mapped_Into"^^vocab:ObservableObjectRelationshipVocab + "Merged"^^vocab:ObservableObjectRelationshipVocab + "Merged_By"^^vocab:ObservableObjectRelationshipVocab + "Modified_Properties_Of"^^vocab:ObservableObjectRelationshipVocab + "Monitored"^^vocab:ObservableObjectRelationshipVocab + "Monitored_By"^^vocab:ObservableObjectRelationshipVocab + "Moved"^^vocab:ObservableObjectRelationshipVocab + "Moved_By"^^vocab:ObservableObjectRelationshipVocab + "Moved_From"^^vocab:ObservableObjectRelationshipVocab + "Moved_To"^^vocab:ObservableObjectRelationshipVocab + "Opened"^^vocab:ObservableObjectRelationshipVocab + "Opened_By"^^vocab:ObservableObjectRelationshipVocab + "Packed"^^vocab:ObservableObjectRelationshipVocab + "Packed_By"^^vocab:ObservableObjectRelationshipVocab + "Packed_From"^^vocab:ObservableObjectRelationshipVocab + "Packed_Into"^^vocab:ObservableObjectRelationshipVocab + "Parent_Of"^^vocab:ObservableObjectRelationshipVocab + "Paused"^^vocab:ObservableObjectRelationshipVocab + "Paused_By"^^vocab:ObservableObjectRelationshipVocab + "Previously_Contained"^^vocab:ObservableObjectRelationshipVocab + "Properties_Modified_By"^^vocab:ObservableObjectRelationshipVocab + "Properties_Queried"^^vocab:ObservableObjectRelationshipVocab + "Properties_Queried_By"^^vocab:ObservableObjectRelationshipVocab + "Read_From"^^vocab:ObservableObjectRelationshipVocab + "Read_From_By"^^vocab:ObservableObjectRelationshipVocab + "Received"^^vocab:ObservableObjectRelationshipVocab + "Received_By"^^vocab:ObservableObjectRelationshipVocab + "Received_From"^^vocab:ObservableObjectRelationshipVocab + "Received_Via_Upload"^^vocab:ObservableObjectRelationshipVocab + "Redirects_To"^^vocab:ObservableObjectRelationshipVocab + "Related_To"^^vocab:ObservableObjectRelationshipVocab + "Renamed"^^vocab:ObservableObjectRelationshipVocab + "Renamed_By"^^vocab:ObservableObjectRelationshipVocab + "Renamed_From"^^vocab:ObservableObjectRelationshipVocab + "Renamed_To"^^vocab:ObservableObjectRelationshipVocab + "Resolved_To"^^vocab:ObservableObjectRelationshipVocab + "Resumed"^^vocab:ObservableObjectRelationshipVocab + "Resumed_By"^^vocab:ObservableObjectRelationshipVocab + "Root_Domain_Of"^^vocab:ObservableObjectRelationshipVocab + "Searched_For"^^vocab:ObservableObjectRelationshipVocab + "Searched_For_By"^^vocab:ObservableObjectRelationshipVocab + "Sent"^^vocab:ObservableObjectRelationshipVocab + "Sent_By"^^vocab:ObservableObjectRelationshipVocab + "Sent_To"^^vocab:ObservableObjectRelationshipVocab + "Sent_Via_Upload"^^vocab:ObservableObjectRelationshipVocab + "Set_From"^^vocab:ObservableObjectRelationshipVocab + "Set_To"^^vocab:ObservableObjectRelationshipVocab + "Sub-domain_Of"^^vocab:ObservableObjectRelationshipVocab + "Supra-domain_Of"^^vocab:ObservableObjectRelationshipVocab + "Suspended"^^vocab:ObservableObjectRelationshipVocab + "Suspended_By"^^vocab:ObservableObjectRelationshipVocab + "Unhooked"^^vocab:ObservableObjectRelationshipVocab + "Unhooked_By"^^vocab:ObservableObjectRelationshipVocab + "Unlocked"^^vocab:ObservableObjectRelationshipVocab + "Unlocked_By"^^vocab:ObservableObjectRelationshipVocab + "Unpacked"^^vocab:ObservableObjectRelationshipVocab + "Unpacked_By"^^vocab:ObservableObjectRelationshipVocab + "Uploaded"^^vocab:ObservableObjectRelationshipVocab + "Uploaded_By"^^vocab:ObservableObjectRelationshipVocab + "Uploaded_From"^^vocab:ObservableObjectRelationshipVocab + "Uploaded_To"^^vocab:ObservableObjectRelationshipVocab + "Used"^^vocab:ObservableObjectRelationshipVocab + "Used_By"^^vocab:ObservableObjectRelationshipVocab + "Values_Enumerated"^^vocab:ObservableObjectRelationshipVocab + "Values_Enumerated_By"^^vocab:ObservableObjectRelationshipVocab + "Written_To_By"^^vocab:ObservableObjectRelationshipVocab + "Wrote_To"^^vocab:ObservableObjectRelationshipVocab + ) ; + . + +vocab:ObservableObjectStateVocab + a rdfs:Datatype ; + rdfs:subClassOf rdfs:Resource ; + rdfs:label "Cyber Item State Vocabulary"@en-US ; + rdfs:comment "Defines an open-vocabulary of observable object states."@en ; + owl:oneOf ( + "Active"^^vocab:ObservableObjectStateVocab + "Closed"^^vocab:ObservableObjectStateVocab + "Does Not Exist"^^vocab:ObservableObjectStateVocab + "Exists"^^vocab:ObservableObjectStateVocab + "Inactive"^^vocab:ObservableObjectStateVocab + "Locked"^^vocab:ObservableObjectStateVocab + "Open"^^vocab:ObservableObjectStateVocab + "Started"^^vocab:ObservableObjectStateVocab + "Stopped"^^vocab:ObservableObjectStateVocab + "Unlocked"^^vocab:ObservableObjectStateVocab + ) ; + . + vocab:PartitionTypeVocab a rdfs:Datatype ; rdfs:subClassOf rdfs:Resource ;