Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
43 commits
Select commit Hold shift + click to select a range
49dd8f3
Bump UCO to post-1.3.0 develop state
ajnelson-nist Jan 24, 2024
4aaadea
Merge pull request #149 from casework/release-1.3.0
plbt5 Jan 26, 2024
ad7eab3
Bump UCO to current state of develop
ajnelson-nist Apr 30, 2024
50eb05b
Merge pull request #151 from casework/bump_uco_to_current_develop
plbt5 May 1, 2024
61241be
Bump UCO to current state of develop
ajnelson-nist Jun 10, 2024
5cf57b7
Merge pull request #153 from casework/bump_uco_to_current_develop
plbt5 Jun 14, 2024
2812fb3
Bump UCO to current state of develop
ajnelson-nist Jun 17, 2024
0d409cc
Merge pull request #154 from casework/bump_uco_to_current_develop
plbt5 Jun 18, 2024
2f17d94
Bump UCO to current state of develop
ajnelson-nist Jul 26, 2024
b93add7
Merge pull request #156 from casework/bump_uco_to_current_develop
plbt5 Jul 26, 2024
8d5148a
Bump UCO to current state of develop
ajnelson-nist Aug 30, 2024
b202454
Remove owl:onDatatype from vocabulary definitions
ajnelson-nist Sep 11, 2024
8ba5929
Merge pull request #158 from casework/bump_uco_to_current_develop
plbt5 Sep 11, 2024
10f36f6
Bump UCO to state of `develop` incorporating Issue 612
ajnelson-nist Oct 16, 2024
8a353f8
Merge pull request #160 from casework/UCO-Feature-Issue-612
plbt5 Oct 16, 2024
bd3ea32
Bump UCO to current state of `develop`
ajnelson-nist Oct 16, 2024
6c02224
Merge branch 'develop' into UCO-Feature-Issue-593
ajnelson-nist Oct 16, 2024
557269c
Merge pull request #159 from casework/UCO-Feature-Issue-593
plbt5 Oct 18, 2024
b404837
UCO Issue 640: Link core:informalType as parent of type-describing pr…
ajnelson-nist Oct 28, 2024
cc5535e
Bump UCO to current state of develop
ajnelson-nist Oct 29, 2024
820d63d
Bump GitHub Action versions
ajnelson-nist Oct 29, 2024
06a806a
Merge pull request #163 from casework/bump_github_actions_and_regener…
plbt5 Nov 7, 2024
2eb3991
Bump UCO to current state of develop
ajnelson-nist Nov 7, 2024
f759e47
Update NIST licensing text
ajnelson-nist Nov 7, 2024
97006d2
Merge pull request #164 from casework/update_nist_licensing_text
plbt5 Nov 8, 2024
96d45fb
Bump UCO to current state of develop
ajnelson-nist Nov 8, 2024
26bd54e
Merge pull request #165 from casework/UCO-Feature-Issue-632
plbt5 Nov 8, 2024
a0a62e9
Adjust top Makefile dependency ordering in submodule initialization
ajnelson-nist Nov 22, 2024
b5720af
Bump UCO to current state of develop
ajnelson-nist Nov 22, 2024
462cd10
Merge pull request #169 from casework/UCO-Feature-Issue-624
plbt5 Nov 23, 2024
d380b87
Merge pull request #168 from casework/BugFix-Issue-167
plbt5 Dec 19, 2024
256b474
Bump UCO to current state of develop
ajnelson-nist Dec 19, 2024
1080685
Merge branch 'develop' into UCO-Feature-Issue-640
ajnelson-nist Feb 12, 2025
6df0bea
Merge pull request #162 from casework/UCO-Feature-Issue-640
plbt5 Feb 13, 2025
4482054
Revise vocabulary pattern for `investigation:investigationForm`
ajnelson-nist Feb 21, 2025
aafa90e
Move sh:in review to named PropertyShape
ajnelson-nist Feb 26, 2025
7ecdaf4
Bump UCO to current state of develop
ajnelson-nist Mar 17, 2025
54aac69
Merge pull request #172 from casework/UCO-BugFix-Issue-629
plbt5 Mar 18, 2025
c68aa34
Bump UCO to 1.4.0 release state; update import IRIs
ajnelson-nist May 28, 2025
2e01743
Regenerate Make-managed files
ajnelson-nist May 28, 2025
ba2e7a7
Bump version
ajnelson-nist May 28, 2025
523dc48
Regenerate Make-managed files
ajnelson-nist May 28, 2025
1cb7c31
Log changes
ajnelson-nist May 29, 2025
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 11 additions & 8 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
@@ -1,11 +1,14 @@
# Portions of this file contributed by NIST are governed by the
# following statement:
#
# This software was developed at the National Institute of Standards
# and Technology by employees of the Federal Government in the course
# of their official duties. Pursuant to title 17 Section 105 of the
# United States Code this software is not subject to copyright
# protection and is in the public domain. NIST assumes no
# responsibility whatsoever for its use by other parties, and makes
# no guarantees, expressed or implied, about its quality,
# reliability, or any other characteristic.
# of their official duties. Pursuant to Title 17 Section 105 of the
# United States Code, this software is not subject to copyright
# protection within the United States. NIST assumes no responsibility
# whatsoever for its use by other parties, and makes no guarantees,
# expressed or implied, about its quality, reliability, or any other
# characteristic.
#
# We would appreciate acknowledgement if the software is used.

Expand All @@ -26,8 +29,8 @@ jobs:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v2
- uses: actions/setup-java@v3
- uses: actions/checkout@v4
- uses: actions/setup-java@v4
with:
distribution: 'temurin'
java-version: '11'
Expand Down
45 changes: 45 additions & 0 deletions ChangeLog
Original file line number Diff line number Diff line change
@@ -1,3 +1,48 @@
2025-03-18
* (7ecdaf4) UCO Issue 629: Revise vocabulary pattern

2025-02-13
* (256b474) UCO Issue 640: Add `core:informalType` and link as parent of type-describing properties

2024-12-19
* (a0a62e9) Issue 167: Adjust top Makefile dependency ordering in submodule initialization

2024-11-23
* (b5720af) UCO Issue 624: Add cpeid to DeviceFacet

2024-11-08
* (96d45fb) UCO Issue 632: Prepare OperatingSystem to become a subclass of Software
* (f759e47) Pull Request 164: Update NIST licensing text
* (2eb3991) UCO Pull Request 642: Update NIST licensing text

2024-11-07
* (820d63d) UCO Pull Request 639: Bump GitHub Action versions
* (cc5535e) UCO Pull Request 638: Refresh validation files to reflect validation tool template updates

2024-10-18
* (557269c) UCO Issue 593: Remove owl:onDatatype from vocabulary definitions

2024-10-16
* (8a353f8) UCO Issue 612: Warn if a `Disk` instance is not also a `StorageMedium`

2024-09-11
* (8ba5929) UCO Issue 549: Add `core:objectStatus`

2024-07-26
* (b93add7) UCO Issue 602: Warn about key-uniqueness enforcement to `types:Dictionary`

2024-06-18
* (0d409cc) UCO Issue 609: Fix typo

2024-06-10
* (5cf57b7) UCO Issues 586, 590: Warn of prior disjointedness declarations in `core:` and `types:`; warn if an `AlternateDataStream` instance is not also a `FileSystemObject`

2024-05-01
* (50eb05b) UCO Issues 573, 584, 599: Warn if target or source on an `ObservableRelationship` are not `Observable`s; replace errant reference to non-existent concept `owl:Datatype`; remove 1-member minimum on `core:ContextualCompilation`

2024-01-24
* OCCASE-495: Release CASE 1.3.0, with release notes at https://caseontology.org/releases/1.3.0/

2024-01-24
* (79afa93) UCO Pull Request 579: Update change request template

Expand Down
40 changes: 27 additions & 13 deletions Makefile
Original file line number Diff line number Diff line change
@@ -1,13 +1,16 @@
#!/usr/bin/make -f

# Portions of this file contributed by NIST are governed by the
# following statement:
#
# This software was developed at the National Institute of Standards
# and Technology by employees of the Federal Government in the course
# of their official duties. Pursuant to title 17 Section 105 of the
# United States Code this software is not subject to copyright
# protection and is in the public domain. NIST assumes no
# responsibility whatsoever for its use by other parties, and makes
# no guarantees, expressed or implied, about its quality,
# reliability, or any other characteristic.
# of their official duties. Pursuant to Title 17 Section 105 of the
# United States Code, this software is not subject to copyright
# protection within the United States. NIST assumes no responsibility
# whatsoever for its use by other parties, and makes no guarantees,
# expressed or implied, about its quality, reliability, or any other
# characteristic.
#
# We would appreciate acknowledgement if the software is used.

Expand Down Expand Up @@ -43,7 +46,6 @@ all: \

# The two CASE-Utility... files are to trigger rebuilds based on command-line interface changes or version increments.
.venv.done.log: \
.git_submodule_init.done.log \
dependencies/UCO/dependencies/CASE-Utility-SHACL-Inheritance-Reviewer/case_shacl_inheritance_reviewer/__init__.py \
dependencies/UCO/dependencies/CASE-Utility-SHACL-Inheritance-Reviewer/setup.cfg \
dependencies/UCO/requirements.txt
Expand Down Expand Up @@ -100,14 +102,26 @@ clean:
@rm -rf \
venv

# This recipe maintains timestamp order.
# The target file creation is handled by recursive initialization done
# in the recipe for .git_submodule_init.done.log.
dependencies/UCO/dependencies/CASE-Utility-SHACL-Inheritance-Reviewer/case_shacl_inheritance_reviewer/__init__.py: \
.git_submodule_init.done.log
$(MAKE) \
--directory dependencies/UCO \
dependencies/CASE-Utility-SHACL-Inheritance-Reviewer/case_shacl_inheritance_reviewer/__init__.py
test -r $@
touch -c $@

# This recipe maintains timestamp order.
# The target file creation is handled by recursive initialization done
# in the recipe for .git_submodule_init.done.log.
dependencies/UCO/dependencies/CASE-Utility-SHACL-Inheritance-Reviewer/setup.cfg: \
.git_submodule_init.done.log
$(MAKE) \
--directory dependencies/UCO \
dependencies/CASE-Utility-SHACL-Inheritance-Reviewer/setup.cfg
test -r $@
touch -c $@

# This recipe maintains timestamp order.
# The target file creation is handled by initialization done in the
# recipe for .git_submodule_init.done.log.
dependencies/UCO/requirements.txt: \
.git_submodule_init.done.log
test -r $@
touch -c $@
2 changes: 1 addition & 1 deletion dependencies/UCO
Submodule UCO updated 79 files
+12 −9 .github/workflows/ci.yml
+9 −6 Makefile
+2 −2 README.md
+9 −6 lib/Makefile
+9 −6 ontology/Makefile
+9 −6 ontology/co/Makefile
+3 −3 ontology/co/co.ttl
+9 −6 ontology/owl/Makefile
+5 −5 ontology/owl/owl.ttl
+9 −6 ontology/uco/Makefile
+48 −72 ontology/uco/action/action.ttl
+6 −6 ontology/uco/action/catalog-v001.xml
+5 −5 ontology/uco/analysis/analysis.ttl
+7 −7 ontology/uco/analysis/catalog-v001.xml
+1 −1 ontology/uco/configuration/catalog-v001.xml
+7 −5 ontology/uco/configuration/configuration.ttl
+59 −5 ontology/uco/core/core.ttl
+2 −2 ontology/uco/identity/catalog-v001.xml
+7 −7 ontology/uco/identity/identity.ttl
+1 −1 ontology/uco/location/catalog-v001.xml
+6 −5 ontology/uco/location/location.ttl
+1 −1 ontology/uco/marking/catalog-v001.xml
+6 −5 ontology/uco/marking/marking.ttl
+17 −17 ontology/uco/master/catalog-v001.xml
+38 −38 ontology/uco/master/uco.ttl
+9 −9 ontology/uco/observable/catalog-v001.xml
+591 −765 ontology/uco/observable/observable.ttl
+1 −1 ontology/uco/pattern/catalog-v001.xml
+5 −5 ontology/uco/pattern/pattern.ttl
+1 −1 ontology/uco/role/catalog-v001.xml
+5 −5 ontology/uco/role/role.ttl
+1 −1 ontology/uco/time/catalog-v001.xml
+5 −5 ontology/uco/time/time.ttl
+4 −4 ontology/uco/tool/catalog-v001.xml
+8 −7 ontology/uco/tool/tool.ttl
+3 −3 ontology/uco/types/catalog-v001.xml
+156 −48 ontology/uco/types/types.ttl
+2 −2 ontology/uco/victim/catalog-v001.xml
+5 −5 ontology/uco/victim/victim.ttl
+781 −825 ontology/uco/vocabulary/vocabulary.ttl
+8 −8 src/create-catalog-v001.xml.py
+9 −6 src/populate_node_kind.py
+9 −6 src/review.mk
+9 −6 tests/Makefile
+9 −6 tests/dependencies/Makefile
+23 −6 tests/examples/Makefile
+26 −0 tests/examples/README.md
+2 −8 tests/examples/action_inheritance_PASS.json
+3 −9 tests/examples/action_inheritance_PASS_validation.ttl
+0 −61 tests/examples/action_inheritance_XFAIL_validation.ttl
+21 −0 tests/examples/alternate_data_stream_PASS.json
+28 −0 tests/examples/alternate_data_stream_PASS_validation.ttl
+1 −1 tests/examples/co_XFAIL_validation.ttl
+1 −1 tests/examples/configuration_setting_XFAIL_validation.ttl
+2 −2 tests/examples/database_records_XFAIL_validation.ttl
+125 −0 tests/examples/dictionary_PASS.json
+46 −0 tests/examples/dictionary_PASS_validation.ttl
+122 −0 tests/examples/dictionary_XFAIL.json
+141 −0 tests/examples/dictionary_XFAIL_validation.ttl
+18 −0 tests/examples/disjointedness_PASS.json
+21 −0 tests/examples/disjointedness_PASS_validation.ttl
+32 −0 tests/examples/hash_PASS.json
+74 −0 tests/examples/hash_PASS_validation.ttl
+3 −39 tests/examples/hash_XFAIL.json
+16 −141 tests/examples/hash_XFAIL_validation.ttl
+13 −0 tests/examples/object_status_PASS.json
+11 −0 tests/examples/object_status_PASS_validation.ttl
+26 −0 tests/examples/object_status_XFAIL.json
+43 −0 tests/examples/object_status_XFAIL_validation.ttl
+48 −0 tests/examples/operating_system_PASS.json
+58 −0 tests/examples/operating_system_PASS_validation.ttl
+3 −3 tests/examples/rdf_list_XFAIL_validation.ttl
+102 −13 tests/examples/test_validation.py
+1 −1 tests/examples/thread_XFAIL_validation.ttl
+9 −6 tests/shapes/Makefile
+9 −6 tests/shapes/examples_uco_owl/Makefile
+9 −6 tests/shapes/examples_uco_qc/Makefile
+9 −6 tests/shapes/test_qc_shapes.py
+76 −39 tests/test_uco_monolithic.py
15 changes: 9 additions & 6 deletions ontology/Makefile
Original file line number Diff line number Diff line change
@@ -1,13 +1,16 @@
#!/usr/bin/make -f

# Portions of this file contributed by NIST are governed by the
# following statement:
#
# This software was developed at the National Institute of Standards
# and Technology by employees of the Federal Government in the course
# of their official duties. Pursuant to title 17 Section 105 of the
# United States Code this software is not subject to copyright
# protection and is in the public domain. NIST assumes no
# responsibility whatsoever for its use by other parties, and makes
# no guarantees, expressed or implied, about its quality,
# reliability, or any other characteristic.
# of their official duties. Pursuant to Title 17 Section 105 of the
# United States Code, this software is not subject to copyright
# protection within the United States. NIST assumes no responsibility
# whatsoever for its use by other parties, and makes no guarantees,
# expressed or implied, about its quality, reliability, or any other
# characteristic.
#
# We would appreciate acknowledgement if the software is used.

Expand Down
15 changes: 9 additions & 6 deletions ontology/investigation/Makefile
Original file line number Diff line number Diff line change
@@ -1,13 +1,16 @@
#!/usr/bin/make -f

# Portions of this file contributed by NIST are governed by the
# following statement:
#
# This software was developed at the National Institute of Standards
# and Technology by employees of the Federal Government in the course
# of their official duties. Pursuant to title 17 Section 105 of the
# United States Code this software is not subject to copyright
# protection and is in the public domain. NIST assumes no
# responsibility whatsoever for its use by other parties, and makes
# no guarantees, expressed or implied, about its quality,
# reliability, or any other characteristic.
# of their official duties. Pursuant to Title 17 Section 105 of the
# United States Code, this software is not subject to copyright
# protection within the United States. NIST assumes no responsibility
# whatsoever for its use by other parties, and makes no guarantees,
# expressed or implied, about its quality, reliability, or any other
# characteristic.
#
# We would appreciate acknowledgement if the software is used.

Expand Down
18 changes: 9 additions & 9 deletions ontology/investigation/catalog-v001.xml
Original file line number Diff line number Diff line change
Expand Up @@ -2,14 +2,14 @@
<catalog xmlns="urn:oasis:names:tc:entity:xmlns:xml:catalog" prefer="public">
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/dependencies/collections-ontology/collections.owl" name="http://purl.org/co"/>
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/dependencies/error/docs/current/error.ttl" name="http://purl.org/spar/error"/>
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/co/co.ttl" name="https://ontology.unifiedcyberontology.org/co/1.3.0"/>
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/uco/action/action.ttl" name="https://ontology.unifiedcyberontology.org/uco/action/1.3.0"/>
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/uco/core/core.ttl" name="https://ontology.unifiedcyberontology.org/uco/core/1.3.0"/>
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/uco/location/location.ttl" name="https://ontology.unifiedcyberontology.org/uco/location/1.3.0"/>
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/uco/pattern/pattern.ttl" name="https://ontology.unifiedcyberontology.org/uco/pattern/1.3.0"/>
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/uco/role/role.ttl" name="https://ontology.unifiedcyberontology.org/uco/role/1.3.0"/>
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/uco/types/types.ttl" name="https://ontology.unifiedcyberontology.org/uco/types/1.3.0"/>
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/uco/vocabulary/vocabulary.ttl" name="https://ontology.unifiedcyberontology.org/uco/vocabulary/1.3.0"/>
<uri id="User Entered Import Resolution" uri="../vocabulary/vocabulary.ttl" name="https://ontology.caseontology.org/case/vocabulary/1.3.0"/>
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/co/co.ttl" name="https://ontology.unifiedcyberontology.org/co/1.4.0"/>
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/uco/action/action.ttl" name="https://ontology.unifiedcyberontology.org/uco/action/1.4.0"/>
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/uco/core/core.ttl" name="https://ontology.unifiedcyberontology.org/uco/core/1.4.0"/>
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/uco/location/location.ttl" name="https://ontology.unifiedcyberontology.org/uco/location/1.4.0"/>
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/uco/pattern/pattern.ttl" name="https://ontology.unifiedcyberontology.org/uco/pattern/1.4.0"/>
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/uco/role/role.ttl" name="https://ontology.unifiedcyberontology.org/uco/role/1.4.0"/>
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/uco/types/types.ttl" name="https://ontology.unifiedcyberontology.org/uco/types/1.4.0"/>
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/uco/vocabulary/vocabulary.ttl" name="https://ontology.unifiedcyberontology.org/uco/vocabulary/1.4.0"/>
<uri id="User Entered Import Resolution" uri="../vocabulary/vocabulary.ttl" name="https://ontology.caseontology.org/case/vocabulary/1.4.0"/>
<uri id="User Entered Import Resolution" uri="investigation.ttl" name="https://ontology.caseontology.org/case/investigation"/>
</catalog>
70 changes: 30 additions & 40 deletions ontology/investigation/investigation.ttl
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# imports: https://ontology.caseontology.org/case/vocabulary/1.3.0
# imports: https://ontology.unifiedcyberontology.org/uco/action/1.3.0
# imports: https://ontology.unifiedcyberontology.org/uco/role/1.3.0
# imports: https://ontology.caseontology.org/case/vocabulary/1.4.0
# imports: https://ontology.unifiedcyberontology.org/uco/action/1.4.0
# imports: https://ontology.unifiedcyberontology.org/uco/role/1.4.0

@prefix investigation: <https://ontology.caseontology.org/case/investigation/> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
Expand All @@ -17,14 +17,14 @@
a owl:Ontology ;
rdfs:label "investigation"@en ;
rdfs:comment "This ontology defines key concepts, and their associated properties and relationships, for characterizing cyber-investigations in the broadest range of contexts, including security incidents, criminal investigations, civil and regulatory matters, intelligence operations, international disputes, accident inquiries, policy violations, and others." ;
owl:backwardCompatibleWith investigation:1.2.0 ;
owl:backwardCompatibleWith investigation:1.3.0 ;
owl:imports
vocabulary:1.3.0 ,
uco-action:1.3.0 ,
uco-role:1.3.0
vocabulary:1.4.0 ,
uco-action:1.4.0 ,
uco-role:1.4.0
;
owl:priorVersion investigation:1.2.0 ;
owl:versionIRI investigation:1.3.0 ;
owl:priorVersion investigation:1.3.0 ;
owl:versionIRI investigation:1.4.0 ;
.

investigation:Attorney
Expand Down Expand Up @@ -105,6 +105,7 @@ investigation:Investigation
rdfs:label "Investigation"@en ;
rdfs:comment "An investigation is a grouping of characteristics unique to an exploration of the facts involved in a cyber-relevant set of suspicious activity."@en ;
sh:property
investigation:Investigation-investigationForm-in-shape ,
[
sh:class investigation:Authorization ;
sh:nodeKind sh:BlankNodeOrIRI ;
Expand All @@ -130,49 +131,36 @@ investigation:Investigation
] ,
[
sh:datatype xsd:string ;
sh:nodeKind sh:Literal ;
sh:path investigation:focus ;
] ,
[
sh:datatype vocabulary:InvestigationFormVocab ;
sh:message "Value is outside the default vocabulary InvestigationFormVocab." ;
sh:message "As of CASE 1.4.0, the datatype to use for investigation:investigationForm should be xsd:string. Not using xsd:string will be an error in CASE 2.0.0." ;
sh:path investigation:investigationForm ;
sh:severity sh:Info ;
sh:severity sh:Warning ;
] ,
[
sh:maxCount "1"^^xsd:integer ;
sh:datatype xsd:string ;
sh:nodeKind sh:Literal ;
sh:or (
[
sh:datatype vocabulary:InvestigationFormVocab ;
]
[
sh:datatype xsd:string ;
]
) ;
sh:path investigation:investigationForm ;
sh:path investigation:focus ;
] ,
[
sh:message "Value is not member of the vocabulary InvestigationFormVocab." ;
sh:or (
[
sh:datatype vocabulary:InvestigationFormVocab ;
sh:in (
"case"^^vocabulary:InvestigationFormVocab
"incident"^^vocabulary:InvestigationFormVocab
"suspicious-activity"^^vocabulary:InvestigationFormVocab
) ;
]
[
sh:datatype xsd:string ;
]
) ;
sh:maxCount "1"^^xsd:integer ;
sh:nodeKind sh:Literal ;
sh:path investigation:investigationForm ;
]
;
sh:targetClass investigation:Investigation ;
.

investigation:Investigation-investigationForm-in-shape
a sh:PropertyShape ;
sh:in (
"case"
"incident"
"suspicious-activity"
) ;
sh:message "Value is not member of the vocabulary InvestigationFormVocab." ;
sh:path investigation:investigationForm ;
sh:severity sh:Info ;
.

investigation:InvestigativeAction
a
owl:Class ,
Expand Down Expand Up @@ -267,6 +255,7 @@ investigation:authorizationIdentifier

investigation:authorizationType
a owl:DatatypeProperty ;
rdfs:subPropertyOf uco-core:informalType ;
rdfs:label "authorizationType"@en ;
rdfs:comment "A label categorizing a type of authorization (e.g. warrant)"@en ;
rdfs:range xsd:string ;
Expand All @@ -288,6 +277,7 @@ investigation:focus

investigation:investigationForm
a owl:DatatypeProperty ;
rdfs:subPropertyOf uco-core:informalType ;
rdfs:label "investigationForm"@en ;
rdfs:comment "A label categorizing a type of investigation (case, incident, suspicious-activity, etc.)"@en ;
rdfs:range [
Expand Down
15 changes: 9 additions & 6 deletions ontology/master/Makefile
Original file line number Diff line number Diff line change
@@ -1,13 +1,16 @@
#!/usr/bin/make -f

# Portions of this file contributed by NIST are governed by the
# following statement:
#
# This software was developed at the National Institute of Standards
# and Technology by employees of the Federal Government in the course
# of their official duties. Pursuant to title 17 Section 105 of the
# United States Code this software is not subject to copyright
# protection and is in the public domain. NIST assumes no
# responsibility whatsoever for its use by other parties, and makes
# no guarantees, expressed or implied, about its quality,
# reliability, or any other characteristic.
# of their official duties. Pursuant to Title 17 Section 105 of the
# United States Code, this software is not subject to copyright
# protection within the United States. NIST assumes no responsibility
# whatsoever for its use by other parties, and makes no guarantees,
# expressed or implied, about its quality, reliability, or any other
# characteristic.
#
# We would appreciate acknowledgement if the software is used.

Expand Down
20 changes: 10 additions & 10 deletions ontology/master/case.ttl
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# imports: https://ontology.caseontology.org/case/investigation/1.3.0
# imports: https://ontology.caseontology.org/case/vocabulary/1.3.0
# imports: https://ontology.unifiedcyberontology.org/uco/uco/1.3.0
# imports: https://ontology.caseontology.org/case/investigation/1.4.0
# imports: https://ontology.caseontology.org/case/vocabulary/1.4.0
# imports: https://ontology.unifiedcyberontology.org/uco/uco/1.4.0

@prefix dct: <http://purl.org/dc/terms/> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
Expand All @@ -16,14 +16,14 @@
rdfs:label "case-master"@en ;
rdfs:comment "The Cyber-investigation Analysis Standard Expression (CASE) ontology is a community-developed standard that defines concepts used in a broad range of cyber-investigation domains, including digital forensic science, incident response, counter-terrorism, criminal justice, forensic intelligence, and situational awareness. CASE includes all aspects of the digital forensic process, from evidence-gathering and chain of custody, to generating a final report. The goal is to increase sharing and interoperability of cyber-investigation information among organizations and between forensic analytic tools. CASE aligns with and extends the Unified Cyber Ontology (UCO). The preferred namespace abbreviation for this ontology is: case-master."@en ;
dct:title "Cyber-investigation Analysis Standard Expression (CASE)"@en ;
owl:backwardCompatibleWith <https://ontology.caseontology.org/case/case/1.2.0> ;
owl:backwardCompatibleWith <https://ontology.caseontology.org/case/case/1.3.0> ;
owl:imports
<https://ontology.caseontology.org/case/investigation/1.3.0> ,
<https://ontology.caseontology.org/case/vocabulary/1.3.0> ,
<https://ontology.unifiedcyberontology.org/uco/uco/1.3.0>
<https://ontology.caseontology.org/case/investigation/1.4.0> ,
<https://ontology.caseontology.org/case/vocabulary/1.4.0> ,
<https://ontology.unifiedcyberontology.org/uco/uco/1.4.0>
;
owl:priorVersion <https://ontology.caseontology.org/case/case/1.2.0> ;
owl:versionIRI <https://ontology.caseontology.org/case/case/1.3.0> ;
owl:versionInfo "1.3.0" ;
owl:priorVersion <https://ontology.caseontology.org/case/case/1.3.0> ;
owl:versionIRI <https://ontology.caseontology.org/case/case/1.4.0> ;
owl:versionInfo "1.4.0" ;
.

Loading