diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7160391..fe16600 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,11 +1,14 @@ +# Portions of this file contributed by NIST are governed by the +# following statement: +# # This software was developed at the National Institute of Standards # and Technology by employees of the Federal Government in the course -# of their official duties. Pursuant to title 17 Section 105 of the -# United States Code this software is not subject to copyright -# protection and is in the public domain. NIST assumes no -# responsibility whatsoever for its use by other parties, and makes -# no guarantees, expressed or implied, about its quality, -# reliability, or any other characteristic. +# of their official duties. Pursuant to Title 17 Section 105 of the +# United States Code, this software is not subject to copyright +# protection within the United States. NIST assumes no responsibility +# whatsoever for its use by other parties, and makes no guarantees, +# expressed or implied, about its quality, reliability, or any other +# characteristic. # # We would appreciate acknowledgement if the software is used. @@ -26,8 +29,8 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 - - uses: actions/setup-java@v3 + - uses: actions/checkout@v4 + - uses: actions/setup-java@v4 with: distribution: 'temurin' java-version: '11' diff --git a/ChangeLog b/ChangeLog index 572c76b..053bd62 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,48 @@ +2025-03-18 + * (7ecdaf4) UCO Issue 629: Revise vocabulary pattern + +2025-02-13 + * (256b474) UCO Issue 640: Add `core:informalType` and link as parent of type-describing properties + +2024-12-19 + * (a0a62e9) Issue 167: Adjust top Makefile dependency ordering in submodule initialization + +2024-11-23 + * (b5720af) UCO Issue 624: Add cpeid to DeviceFacet + +2024-11-08 + * (96d45fb) UCO Issue 632: Prepare OperatingSystem to become a subclass of Software + * (f759e47) Pull Request 164: Update NIST licensing text + * (2eb3991) UCO Pull Request 642: Update NIST licensing text + +2024-11-07 + * (820d63d) UCO Pull Request 639: Bump GitHub Action versions + * (cc5535e) UCO Pull Request 638: Refresh validation files to reflect validation tool template updates + +2024-10-18 + * (557269c) UCO Issue 593: Remove owl:onDatatype from vocabulary definitions + +2024-10-16 + * (8a353f8) UCO Issue 612: Warn if a `Disk` instance is not also a `StorageMedium` + +2024-09-11 + * (8ba5929) UCO Issue 549: Add `core:objectStatus` + +2024-07-26 + * (b93add7) UCO Issue 602: Warn about key-uniqueness enforcement to `types:Dictionary` + +2024-06-18 + * (0d409cc) UCO Issue 609: Fix typo + +2024-06-10 + * (5cf57b7) UCO Issues 586, 590: Warn of prior disjointedness declarations in `core:` and `types:`; warn if an `AlternateDataStream` instance is not also a `FileSystemObject` + +2024-05-01 + * (50eb05b) UCO Issues 573, 584, 599: Warn if target or source on an `ObservableRelationship` are not `Observable`s; replace errant reference to non-existent concept `owl:Datatype`; remove 1-member minimum on `core:ContextualCompilation` + +2024-01-24 + * OCCASE-495: Release CASE 1.3.0, with release notes at https://caseontology.org/releases/1.3.0/ + 2024-01-24 * (79afa93) UCO Pull Request 579: Update change request template diff --git a/Makefile b/Makefile index 15fa466..686adf9 100644 --- a/Makefile +++ b/Makefile @@ -1,13 +1,16 @@ #!/usr/bin/make -f +# Portions of this file contributed by NIST are governed by the +# following statement: +# # This software was developed at the National Institute of Standards # and Technology by employees of the Federal Government in the course -# of their official duties. Pursuant to title 17 Section 105 of the -# United States Code this software is not subject to copyright -# protection and is in the public domain. NIST assumes no -# responsibility whatsoever for its use by other parties, and makes -# no guarantees, expressed or implied, about its quality, -# reliability, or any other characteristic. +# of their official duties. Pursuant to Title 17 Section 105 of the +# United States Code, this software is not subject to copyright +# protection within the United States. NIST assumes no responsibility +# whatsoever for its use by other parties, and makes no guarantees, +# expressed or implied, about its quality, reliability, or any other +# characteristic. # # We would appreciate acknowledgement if the software is used. @@ -43,7 +46,6 @@ all: \ # The two CASE-Utility... files are to trigger rebuilds based on command-line interface changes or version increments. .venv.done.log: \ - .git_submodule_init.done.log \ dependencies/UCO/dependencies/CASE-Utility-SHACL-Inheritance-Reviewer/case_shacl_inheritance_reviewer/__init__.py \ dependencies/UCO/dependencies/CASE-Utility-SHACL-Inheritance-Reviewer/setup.cfg \ dependencies/UCO/requirements.txt @@ -100,14 +102,26 @@ clean: @rm -rf \ venv +# This recipe maintains timestamp order. +# The target file creation is handled by recursive initialization done +# in the recipe for .git_submodule_init.done.log. dependencies/UCO/dependencies/CASE-Utility-SHACL-Inheritance-Reviewer/case_shacl_inheritance_reviewer/__init__.py: \ .git_submodule_init.done.log - $(MAKE) \ - --directory dependencies/UCO \ - dependencies/CASE-Utility-SHACL-Inheritance-Reviewer/case_shacl_inheritance_reviewer/__init__.py + test -r $@ + touch -c $@ +# This recipe maintains timestamp order. +# The target file creation is handled by recursive initialization done +# in the recipe for .git_submodule_init.done.log. dependencies/UCO/dependencies/CASE-Utility-SHACL-Inheritance-Reviewer/setup.cfg: \ .git_submodule_init.done.log - $(MAKE) \ - --directory dependencies/UCO \ - dependencies/CASE-Utility-SHACL-Inheritance-Reviewer/setup.cfg + test -r $@ + touch -c $@ + +# This recipe maintains timestamp order. +# The target file creation is handled by initialization done in the +# recipe for .git_submodule_init.done.log. +dependencies/UCO/requirements.txt: \ + .git_submodule_init.done.log + test -r $@ + touch -c $@ diff --git a/dependencies/UCO b/dependencies/UCO index 9f16831..8335d32 160000 --- a/dependencies/UCO +++ b/dependencies/UCO @@ -1 +1 @@ -Subproject commit 9f168313453bb577141248e3968198bc00e7d39b +Subproject commit 8335d32d600f717b7b4f43d74cf40efdf07aa340 diff --git a/ontology/Makefile b/ontology/Makefile index 21ba472..3ec849d 100644 --- a/ontology/Makefile +++ b/ontology/Makefile @@ -1,13 +1,16 @@ #!/usr/bin/make -f +# Portions of this file contributed by NIST are governed by the +# following statement: +# # This software was developed at the National Institute of Standards # and Technology by employees of the Federal Government in the course -# of their official duties. Pursuant to title 17 Section 105 of the -# United States Code this software is not subject to copyright -# protection and is in the public domain. NIST assumes no -# responsibility whatsoever for its use by other parties, and makes -# no guarantees, expressed or implied, about its quality, -# reliability, or any other characteristic. +# of their official duties. Pursuant to Title 17 Section 105 of the +# United States Code, this software is not subject to copyright +# protection within the United States. NIST assumes no responsibility +# whatsoever for its use by other parties, and makes no guarantees, +# expressed or implied, about its quality, reliability, or any other +# characteristic. # # We would appreciate acknowledgement if the software is used. diff --git a/ontology/investigation/Makefile b/ontology/investigation/Makefile index 549c381..3314096 100644 --- a/ontology/investigation/Makefile +++ b/ontology/investigation/Makefile @@ -1,13 +1,16 @@ #!/usr/bin/make -f +# Portions of this file contributed by NIST are governed by the +# following statement: +# # This software was developed at the National Institute of Standards # and Technology by employees of the Federal Government in the course -# of their official duties. Pursuant to title 17 Section 105 of the -# United States Code this software is not subject to copyright -# protection and is in the public domain. NIST assumes no -# responsibility whatsoever for its use by other parties, and makes -# no guarantees, expressed or implied, about its quality, -# reliability, or any other characteristic. +# of their official duties. Pursuant to Title 17 Section 105 of the +# United States Code, this software is not subject to copyright +# protection within the United States. NIST assumes no responsibility +# whatsoever for its use by other parties, and makes no guarantees, +# expressed or implied, about its quality, reliability, or any other +# characteristic. # # We would appreciate acknowledgement if the software is used. diff --git a/ontology/investigation/catalog-v001.xml b/ontology/investigation/catalog-v001.xml index 07e8525..c11624f 100644 --- a/ontology/investigation/catalog-v001.xml +++ b/ontology/investigation/catalog-v001.xml @@ -2,14 +2,14 @@ - - - - - - - - - + + + + + + + + + diff --git a/ontology/investigation/investigation.ttl b/ontology/investigation/investigation.ttl index fa1b970..a572ba4 100644 --- a/ontology/investigation/investigation.ttl +++ b/ontology/investigation/investigation.ttl @@ -1,6 +1,6 @@ -# imports: https://ontology.caseontology.org/case/vocabulary/1.3.0 -# imports: https://ontology.unifiedcyberontology.org/uco/action/1.3.0 -# imports: https://ontology.unifiedcyberontology.org/uco/role/1.3.0 +# imports: https://ontology.caseontology.org/case/vocabulary/1.4.0 +# imports: https://ontology.unifiedcyberontology.org/uco/action/1.4.0 +# imports: https://ontology.unifiedcyberontology.org/uco/role/1.4.0 @prefix investigation: . @prefix owl: . @@ -17,14 +17,14 @@ a owl:Ontology ; rdfs:label "investigation"@en ; rdfs:comment "This ontology defines key concepts, and their associated properties and relationships, for characterizing cyber-investigations in the broadest range of contexts, including security incidents, criminal investigations, civil and regulatory matters, intelligence operations, international disputes, accident inquiries, policy violations, and others." ; - owl:backwardCompatibleWith investigation:1.2.0 ; + owl:backwardCompatibleWith investigation:1.3.0 ; owl:imports - vocabulary:1.3.0 , - uco-action:1.3.0 , - uco-role:1.3.0 + vocabulary:1.4.0 , + uco-action:1.4.0 , + uco-role:1.4.0 ; - owl:priorVersion investigation:1.2.0 ; - owl:versionIRI investigation:1.3.0 ; + owl:priorVersion investigation:1.3.0 ; + owl:versionIRI investigation:1.4.0 ; . investigation:Attorney @@ -105,6 +105,7 @@ investigation:Investigation rdfs:label "Investigation"@en ; rdfs:comment "An investigation is a grouping of characteristics unique to an exploration of the facts involved in a cyber-relevant set of suspicious activity."@en ; sh:property + investigation:Investigation-investigationForm-in-shape , [ sh:class investigation:Authorization ; sh:nodeKind sh:BlankNodeOrIRI ; @@ -130,49 +131,36 @@ investigation:Investigation ] , [ sh:datatype xsd:string ; - sh:nodeKind sh:Literal ; - sh:path investigation:focus ; - ] , - [ - sh:datatype vocabulary:InvestigationFormVocab ; - sh:message "Value is outside the default vocabulary InvestigationFormVocab." ; + sh:message "As of CASE 1.4.0, the datatype to use for investigation:investigationForm should be xsd:string. Not using xsd:string will be an error in CASE 2.0.0." ; sh:path investigation:investigationForm ; - sh:severity sh:Info ; + sh:severity sh:Warning ; ] , [ - sh:maxCount "1"^^xsd:integer ; + sh:datatype xsd:string ; sh:nodeKind sh:Literal ; - sh:or ( - [ - sh:datatype vocabulary:InvestigationFormVocab ; - ] - [ - sh:datatype xsd:string ; - ] - ) ; - sh:path investigation:investigationForm ; + sh:path investigation:focus ; ] , [ - sh:message "Value is not member of the vocabulary InvestigationFormVocab." ; - sh:or ( - [ - sh:datatype vocabulary:InvestigationFormVocab ; - sh:in ( - "case"^^vocabulary:InvestigationFormVocab - "incident"^^vocabulary:InvestigationFormVocab - "suspicious-activity"^^vocabulary:InvestigationFormVocab - ) ; - ] - [ - sh:datatype xsd:string ; - ] - ) ; + sh:maxCount "1"^^xsd:integer ; + sh:nodeKind sh:Literal ; sh:path investigation:investigationForm ; ] ; sh:targetClass investigation:Investigation ; . +investigation:Investigation-investigationForm-in-shape + a sh:PropertyShape ; + sh:in ( + "case" + "incident" + "suspicious-activity" + ) ; + sh:message "Value is not member of the vocabulary InvestigationFormVocab." ; + sh:path investigation:investigationForm ; + sh:severity sh:Info ; + . + investigation:InvestigativeAction a owl:Class , @@ -267,6 +255,7 @@ investigation:authorizationIdentifier investigation:authorizationType a owl:DatatypeProperty ; + rdfs:subPropertyOf uco-core:informalType ; rdfs:label "authorizationType"@en ; rdfs:comment "A label categorizing a type of authorization (e.g. warrant)"@en ; rdfs:range xsd:string ; @@ -288,6 +277,7 @@ investigation:focus investigation:investigationForm a owl:DatatypeProperty ; + rdfs:subPropertyOf uco-core:informalType ; rdfs:label "investigationForm"@en ; rdfs:comment "A label categorizing a type of investigation (case, incident, suspicious-activity, etc.)"@en ; rdfs:range [ diff --git a/ontology/master/Makefile b/ontology/master/Makefile index f2420e4..d35febb 100644 --- a/ontology/master/Makefile +++ b/ontology/master/Makefile @@ -1,13 +1,16 @@ #!/usr/bin/make -f +# Portions of this file contributed by NIST are governed by the +# following statement: +# # This software was developed at the National Institute of Standards # and Technology by employees of the Federal Government in the course -# of their official duties. Pursuant to title 17 Section 105 of the -# United States Code this software is not subject to copyright -# protection and is in the public domain. NIST assumes no -# responsibility whatsoever for its use by other parties, and makes -# no guarantees, expressed or implied, about its quality, -# reliability, or any other characteristic. +# of their official duties. Pursuant to Title 17 Section 105 of the +# United States Code, this software is not subject to copyright +# protection within the United States. NIST assumes no responsibility +# whatsoever for its use by other parties, and makes no guarantees, +# expressed or implied, about its quality, reliability, or any other +# characteristic. # # We would appreciate acknowledgement if the software is used. diff --git a/ontology/master/case.ttl b/ontology/master/case.ttl index baad03d..3fdc368 100644 --- a/ontology/master/case.ttl +++ b/ontology/master/case.ttl @@ -1,6 +1,6 @@ -# imports: https://ontology.caseontology.org/case/investigation/1.3.0 -# imports: https://ontology.caseontology.org/case/vocabulary/1.3.0 -# imports: https://ontology.unifiedcyberontology.org/uco/uco/1.3.0 +# imports: https://ontology.caseontology.org/case/investigation/1.4.0 +# imports: https://ontology.caseontology.org/case/vocabulary/1.4.0 +# imports: https://ontology.unifiedcyberontology.org/uco/uco/1.4.0 @prefix dct: . @prefix owl: . @@ -16,14 +16,14 @@ rdfs:label "case-master"@en ; rdfs:comment "The Cyber-investigation Analysis Standard Expression (CASE) ontology is a community-developed standard that defines concepts used in a broad range of cyber-investigation domains, including digital forensic science, incident response, counter-terrorism, criminal justice, forensic intelligence, and situational awareness. CASE includes all aspects of the digital forensic process, from evidence-gathering and chain of custody, to generating a final report. The goal is to increase sharing and interoperability of cyber-investigation information among organizations and between forensic analytic tools. CASE aligns with and extends the Unified Cyber Ontology (UCO). The preferred namespace abbreviation for this ontology is: case-master."@en ; dct:title "Cyber-investigation Analysis Standard Expression (CASE)"@en ; - owl:backwardCompatibleWith ; + owl:backwardCompatibleWith ; owl:imports - , - , - + , + , + ; - owl:priorVersion ; - owl:versionIRI ; - owl:versionInfo "1.3.0" ; + owl:priorVersion ; + owl:versionIRI ; + owl:versionInfo "1.4.0" ; . diff --git a/ontology/master/catalog-v001.xml b/ontology/master/catalog-v001.xml index 49ac868..bc112a2 100644 --- a/ontology/master/catalog-v001.xml +++ b/ontology/master/catalog-v001.xml @@ -2,25 +2,25 @@ - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + diff --git a/ontology/vocabulary/Makefile b/ontology/vocabulary/Makefile index 1e8522e..2e741e8 100644 --- a/ontology/vocabulary/Makefile +++ b/ontology/vocabulary/Makefile @@ -1,13 +1,16 @@ #!/usr/bin/make -f +# Portions of this file contributed by NIST are governed by the +# following statement: +# # This software was developed at the National Institute of Standards # and Technology by employees of the Federal Government in the course -# of their official duties. Pursuant to title 17 Section 105 of the -# United States Code this software is not subject to copyright -# protection and is in the public domain. NIST assumes no -# responsibility whatsoever for its use by other parties, and makes -# no guarantees, expressed or implied, about its quality, -# reliability, or any other characteristic. +# of their official duties. Pursuant to Title 17 Section 105 of the +# United States Code, this software is not subject to copyright +# protection within the United States. NIST assumes no responsibility +# whatsoever for its use by other parties, and makes no guarantees, +# expressed or implied, about its quality, reliability, or any other +# characteristic. # # We would appreciate acknowledgement if the software is used. diff --git a/ontology/vocabulary/vocabulary.ttl b/ontology/vocabulary/vocabulary.ttl index 080e956..5affbb4 100644 --- a/ontology/vocabulary/vocabulary.ttl +++ b/ontology/vocabulary/vocabulary.ttl @@ -7,9 +7,9 @@ a owl:Ontology ; rdfs:label "vocabularies"@en ; - owl:backwardCompatibleWith vocab:1.2.0 ; - owl:priorVersion vocab:1.2.0 ; - owl:versionIRI vocab:1.3.0 ; + owl:backwardCompatibleWith vocab:1.3.0 ; + owl:priorVersion vocab:1.3.0 ; + owl:versionIRI vocab:1.4.0 ; . vocab:InvestigationFormVocab @@ -18,11 +18,10 @@ vocab:InvestigationFormVocab rdfs:comment "Defines an open-vocabulary of investigation forms."@en-US ; owl:equivalentClass [ a rdfs:Datatype ; - owl:onDatatype xsd:string ; owl:oneOf ( - "case"^^vocab:InvestigationFormVocab - "incident"^^vocab:InvestigationFormVocab - "suspicious-activity"^^vocab:InvestigationFormVocab + "case" + "incident" + "suspicious-activity" ) ; ] ; . diff --git a/tests/Makefile b/tests/Makefile index ab00709..ded42d1 100644 --- a/tests/Makefile +++ b/tests/Makefile @@ -1,13 +1,16 @@ #!/usr/bin/make -f +# Portions of this file contributed by NIST are governed by the +# following statement: +# # This software was developed at the National Institute of Standards # and Technology by employees of the Federal Government in the course -# of their official duties. Pursuant to title 17 Section 105 of the -# United States Code this software is not subject to copyright -# protection and is in the public domain. NIST assumes no -# responsibility whatsoever for its use by other parties, and makes -# no guarantees, expressed or implied, about its quality, -# reliability, or any other characteristic. +# of their official duties. Pursuant to Title 17 Section 105 of the +# United States Code, this software is not subject to copyright +# protection within the United States. NIST assumes no responsibility +# whatsoever for its use by other parties, and makes no guarantees, +# expressed or implied, about its quality, reliability, or any other +# characteristic. # # We would appreciate acknowledgement if the software is used. diff --git a/tests/examples/Makefile b/tests/examples/Makefile index b80ad56..f79c2a5 100644 --- a/tests/examples/Makefile +++ b/tests/examples/Makefile @@ -1,13 +1,16 @@ #!/usr/bin/make -f +# Portions of this file contributed by NIST are governed by the +# following statement: +# # This software was developed at the National Institute of Standards # and Technology by employees of the Federal Government in the course -# of their official duties. Pursuant to title 17 Section 105 of the -# United States Code this software is not subject to copyright -# protection and is in the public domain. NIST assumes no -# responsibility whatsoever for its use by other parties, and makes -# no guarantees, expressed or implied, about its quality, -# reliability, or any other characteristic. +# of their official duties. Pursuant to Title 17 Section 105 of the +# United States Code, this software is not subject to copyright +# protection within the United States. NIST assumes no responsibility +# whatsoever for its use by other parties, and makes no guarantees, +# expressed or implied, about its quality, reliability, or any other +# characteristic. # # We would appreciate acknowledgement if the software is used. diff --git a/tests/examples/test_validation.py b/tests/examples/test_validation.py index f34c7fb..d873012 100644 --- a/tests/examples/test_validation.py +++ b/tests/examples/test_validation.py @@ -1,13 +1,16 @@ #!/usr/bin/env python3 +# Portions of this file contributed by NIST are governed by the +# following statement: +# # This software was developed at the National Institute of Standards # and Technology by employees of the Federal Government in the course -# of their official duties. Pursuant to title 17 Section 105 of the -# United States Code this software is not subject to copyright -# protection and is in the public domain. NIST assumes no -# responsibility whatsoever for its use by other parties, and makes -# no guarantees, expressed or implied, about its quality, -# reliability, or any other characteristic. +# of their official duties. Pursuant to Title 17 Section 105 of the +# United States Code, this software is not subject to copyright +# protection within the United States. NIST assumes no responsibility +# whatsoever for its use by other parties, and makes no guarantees, +# expressed or implied, about its quality, reliability, or any other +# characteristic. # # We would appreciate acknowledgement if the software is used. diff --git a/tests/shapes/Makefile b/tests/shapes/Makefile index 7181de0..03d308d 100644 --- a/tests/shapes/Makefile +++ b/tests/shapes/Makefile @@ -1,13 +1,16 @@ #!/usr/bin/make -f +# Portions of this file contributed by NIST are governed by the +# following statement: +# # This software was developed at the National Institute of Standards # and Technology by employees of the Federal Government in the course -# of their official duties. Pursuant to title 17 Section 105 of the -# United States Code this software is not subject to copyright -# protection and is in the public domain. NIST assumes no -# responsibility whatsoever for its use by other parties, and makes -# no guarantees, expressed or implied, about its quality, -# reliability, or any other characteristic. +# of their official duties. Pursuant to Title 17 Section 105 of the +# United States Code, this software is not subject to copyright +# protection within the United States. NIST assumes no responsibility +# whatsoever for its use by other parties, and makes no guarantees, +# expressed or implied, about its quality, reliability, or any other +# characteristic. # # We would appreciate acknowledgement if the software is used. diff --git a/tests/test_case_monolithic.py b/tests/test_case_monolithic.py index 83eb869..2b19382 100644 --- a/tests/test_case_monolithic.py +++ b/tests/test_case_monolithic.py @@ -1,13 +1,16 @@ #!/usr/bin/env python3 +# Portions of this file contributed by NIST are governed by the +# following statement: +# # This software was developed at the National Institute of Standards # and Technology by employees of the Federal Government in the course -# of their official duties. Pursuant to title 17 Section 105 of the -# United States Code this software is not subject to copyright -# protection and is in the public domain. NIST assumes no -# responsibility whatsoever for its use by other parties, and makes -# no guarantees, expressed or implied, about its quality, -# reliability, or any other characteristic. +# of their official duties. Pursuant to Title 17 Section 105 of the +# United States Code, this software is not subject to copyright +# protection within the United States. NIST assumes no responsibility +# whatsoever for its use by other parties, and makes no guarantees, +# expressed or implied, about its quality, reliability, or any other +# characteristic. # # We would appreciate acknowledgement if the software is used.