Skip to content

Commit

Permalink
Bump pointers and regenerate Make-managed files
Browse files Browse the repository at this point in the history
References:
* ucoProject/UCO#632

Signed-off-by: Alex Nelson <[email protected]>
  • Loading branch information
ajnelson-nist committed Oct 21, 2024
1 parent 565124f commit 2e84bad
Show file tree
Hide file tree
Showing 25 changed files with 319 additions and 79 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ http://www.w3.org/2001/XMLSchema#string Attachment_Of
http://www.w3.org/2001/XMLSchema#string Contained_Within
http://www.w3.org/2001/XMLSchema#string Has_Account
http://www.w3.org/2001/XMLSchema#string Has_Device
http://www.w3.org/2001/XMLSchema#string Has_Operating_System
http://www.w3.org/2001/XMLSchema#string Has_Role
http://www.w3.org/2001/XMLSchema#string Initiated
http://www.w3.org/2001/XMLSchema#string Located_At
Original file line number Diff line number Diff line change
Expand Up @@ -94,13 +94,14 @@ https://ontology.unifiedcyberontology.org/uco/observable/MobileAccount
https://ontology.unifiedcyberontology.org/uco/observable/MobileAccountFacet
https://ontology.unifiedcyberontology.org/uco/observable/MobileDeviceFacet
https://ontology.unifiedcyberontology.org/uco/observable/ObservableRelationship
https://ontology.unifiedcyberontology.org/uco/observable/OperatingSystemFacet
https://ontology.unifiedcyberontology.org/uco/observable/OperatingSystem
https://ontology.unifiedcyberontology.org/uco/observable/PathRelationFacet
https://ontology.unifiedcyberontology.org/uco/observable/PhoneAccount
https://ontology.unifiedcyberontology.org/uco/observable/PhoneAccountFacet
https://ontology.unifiedcyberontology.org/uco/observable/RasterPicture
https://ontology.unifiedcyberontology.org/uco/observable/SMSMessage
https://ontology.unifiedcyberontology.org/uco/observable/Software
https://ontology.unifiedcyberontology.org/uco/observable/SoftwareFacet
https://ontology.unifiedcyberontology.org/uco/observable/URL
https://ontology.unifiedcyberontology.org/uco/observable/URLFacet
https://ontology.unifiedcyberontology.org/uco/observable/WifiAddressFacet
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ http://www.w3.org/2001/XMLSchema#string Attachment_Of
http://www.w3.org/2001/XMLSchema#string Contained_Within
http://www.w3.org/2001/XMLSchema#string Has_Account
http://www.w3.org/2001/XMLSchema#string Has_Device
http://www.w3.org/2001/XMLSchema#string Has_Operating_System
http://www.w3.org/2001/XMLSchema#string Has_Role
http://www.w3.org/2001/XMLSchema#string Initiated
http://www.w3.org/2001/XMLSchema#string Located_At
12 changes: 6 additions & 6 deletions tests/CASE-Examples/examples/illustrations/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -36,23 +36,23 @@ The following table is the count of undefined concepts used in each example file
The following table is the count of undefined relationship literals used in each example file:

```
7 Oresteia/undefined_kindOfRelationships.tsv
8 Oresteia/undefined_kindOfRelationships.tsv
2 accounts/undefined_kindOfRelationships.tsv
0 analysis/undefined_kindOfRelationships.tsv
2 bulk_extractor_forensic_path/undefined_kindOfRelationships.tsv
0 call_log/undefined_kindOfRelationships.tsv
3 cell_site/undefined_kindOfRelationships.tsv
4 cell_site/undefined_kindOfRelationships.tsv
0 configured_tool/undefined_kindOfRelationships.tsv
3 database_records/undefined_kindOfRelationships.tsv
0 device/undefined_kindOfRelationships.tsv
1 device/undefined_kindOfRelationships.tsv
0 event/undefined_kindOfRelationships.tsv
1 exif_data/undefined_kindOfRelationships.tsv
0 existence_intervals/undefined_kindOfRelationships.tsv
5 file/undefined_kindOfRelationships.tsv
6 file/undefined_kindOfRelationships.tsv
2 forensic_lifecycle/undefined_kindOfRelationships.tsv
0 location/undefined_kindOfRelationships.tsv
1 message/undefined_kindOfRelationships.tsv
2 mobile_device_and_sim_card/undefined_kindOfRelationships.tsv
3 mobile_device_and_sim_card/undefined_kindOfRelationships.tsv
2 multipart_file/undefined_kindOfRelationships.tsv
1 network_connection/undefined_kindOfRelationships.tsv
4 partitions/undefined_kindOfRelationships.tsv
Expand All @@ -61,5 +61,5 @@ The following table is the count of undefined relationship literals used in each
0 recoverability/undefined_kindOfRelationships.tsv
1 sms_and_contacts/undefined_kindOfRelationships.tsv
5 spear_phishing/undefined_kindOfRelationships.tsv
23 undefined_kindOfRelationships.tsv
24 undefined_kindOfRelationships.tsv
```
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
http://www.w3.org/2001/XMLSchema#string Connected_To
http://www.w3.org/2001/XMLSchema#string Contained_Within
http://www.w3.org/2001/XMLSchema#string Has_Operating_System
http://www.w3.org/2001/XMLSchema#string Located_At
Original file line number Diff line number Diff line change
Expand Up @@ -31,9 +31,11 @@ https://ontology.unifiedcyberontology.org/uco/observable/MobileAccount
https://ontology.unifiedcyberontology.org/uco/observable/MobileAccountFacet
https://ontology.unifiedcyberontology.org/uco/observable/MobileDeviceFacet
https://ontology.unifiedcyberontology.org/uco/observable/ObservableRelationship
https://ontology.unifiedcyberontology.org/uco/observable/OperatingSystemFacet
https://ontology.unifiedcyberontology.org/uco/observable/OperatingSystem
https://ontology.unifiedcyberontology.org/uco/observable/SIMCard
https://ontology.unifiedcyberontology.org/uco/observable/SIMCardFacet
https://ontology.unifiedcyberontology.org/uco/observable/Software
https://ontology.unifiedcyberontology.org/uco/observable/SoftwareFacet
https://ontology.unifiedcyberontology.org/uco/observable/WifiAddressFacet
https://ontology.unifiedcyberontology.org/uco/observable/accountIdentifier
https://ontology.unifiedcyberontology.org/uco/observable/addressValue
Expand Down
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
http://www.w3.org/2001/XMLSchema#string Connected_To
http://www.w3.org/2001/XMLSchema#string Contained_Within
http://www.w3.org/2001/XMLSchema#string Has_Operating_System
http://www.w3.org/2001/XMLSchema#string Located_At
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
http://www.w3.org/2001/XMLSchema#string Has_Operating_System
Original file line number Diff line number Diff line change
@@ -1,14 +1,22 @@
http://example.org/local#location
https://ontology.unifiedcyberontology.org/uco/core/Facet
https://ontology.unifiedcyberontology.org/uco/core/hasFacet
https://ontology.unifiedcyberontology.org/uco/core/isDirectional
https://ontology.unifiedcyberontology.org/uco/core/kindOfRelationship
https://ontology.unifiedcyberontology.org/uco/core/name
https://ontology.unifiedcyberontology.org/uco/core/source
https://ontology.unifiedcyberontology.org/uco/core/target
https://ontology.unifiedcyberontology.org/uco/identity/Organization
https://ontology.unifiedcyberontology.org/uco/observable/ComputerSpecificationFacet
https://ontology.unifiedcyberontology.org/uco/observable/Device
https://ontology.unifiedcyberontology.org/uco/observable/DeviceFacet
https://ontology.unifiedcyberontology.org/uco/observable/DomainNameFacet
https://ontology.unifiedcyberontology.org/uco/observable/IPv4AddressFacet
https://ontology.unifiedcyberontology.org/uco/observable/ObservableRelationship
https://ontology.unifiedcyberontology.org/uco/observable/OperatingSystem
https://ontology.unifiedcyberontology.org/uco/observable/OperatingSystemFacet
https://ontology.unifiedcyberontology.org/uco/observable/Software
https://ontology.unifiedcyberontology.org/uco/observable/SoftwareFacet
https://ontology.unifiedcyberontology.org/uco/observable/addressValue
https://ontology.unifiedcyberontology.org/uco/observable/biosVersion
https://ontology.unifiedcyberontology.org/uco/observable/cpuFamily
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
http://www.w3.org/2001/XMLSchema#string Has_Operating_System
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,5 @@ http://www.w3.org/2001/XMLSchema#string Contained_Within
http://www.w3.org/2001/XMLSchema#string Decoded_From
http://www.w3.org/2001/XMLSchema#string Decrypted_From
http://www.w3.org/2001/XMLSchema#string Forensic_Image_Of
http://www.w3.org/2001/XMLSchema#string Has_Operating_System
http://www.w3.org/2001/XMLSchema#string Stored_On
Original file line number Diff line number Diff line change
Expand Up @@ -22,9 +22,11 @@ https://ontology.unifiedcyberontology.org/uco/observable/FileFacet
https://ontology.unifiedcyberontology.org/uco/observable/FileSystem
https://ontology.unifiedcyberontology.org/uco/observable/Image
https://ontology.unifiedcyberontology.org/uco/observable/ObservableRelationship
https://ontology.unifiedcyberontology.org/uco/observable/OperatingSystemFacet
https://ontology.unifiedcyberontology.org/uco/observable/OperatingSystem
https://ontology.unifiedcyberontology.org/uco/observable/PathRelationFacet
https://ontology.unifiedcyberontology.org/uco/observable/SQLiteBlobFacet
https://ontology.unifiedcyberontology.org/uco/observable/Software
https://ontology.unifiedcyberontology.org/uco/observable/SoftwareFacet
https://ontology.unifiedcyberontology.org/uco/observable/accessedTime
https://ontology.unifiedcyberontology.org/uco/observable/biosVersion
https://ontology.unifiedcyberontology.org/uco/observable/byteOrder
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,5 @@ http://www.w3.org/2001/XMLSchema#string Contained_Within
http://www.w3.org/2001/XMLSchema#string Decoded_From
http://www.w3.org/2001/XMLSchema#string Decrypted_From
http://www.w3.org/2001/XMLSchema#string Forensic_Image_Of
http://www.w3.org/2001/XMLSchema#string Has_Operating_System
http://www.w3.org/2001/XMLSchema#string Stored_On
Original file line number Diff line number Diff line change
Expand Up @@ -19,8 +19,8 @@ https://ontology.unifiedcyberontology.org/uco/observable/MessageThread
https://ontology.unifiedcyberontology.org/uco/observable/MessageThreadFacet
https://ontology.unifiedcyberontology.org/uco/observable/ObservableRelationship
https://ontology.unifiedcyberontology.org/uco/observable/OperatingSystem
https://ontology.unifiedcyberontology.org/uco/observable/OperatingSystemFacet
https://ontology.unifiedcyberontology.org/uco/observable/Software
https://ontology.unifiedcyberontology.org/uco/observable/SoftwareFacet
https://ontology.unifiedcyberontology.org/uco/observable/URL
https://ontology.unifiedcyberontology.org/uco/observable/URLFacet
https://ontology.unifiedcyberontology.org/uco/observable/application
Expand Down
Original file line number Diff line number Diff line change
@@ -1,2 +1,3 @@
http://www.w3.org/2001/XMLSchema#string Contained_Within
http://www.w3.org/2001/XMLSchema#string Has_Account
http://www.w3.org/2001/XMLSchema#string Has_Operating_System
Original file line number Diff line number Diff line change
Expand Up @@ -19,12 +19,15 @@ https://ontology.unifiedcyberontology.org/uco/observable/MobileAccountFacet
https://ontology.unifiedcyberontology.org/uco/observable/MobileDevice
https://ontology.unifiedcyberontology.org/uco/observable/MobileDeviceFacet
https://ontology.unifiedcyberontology.org/uco/observable/ObservableRelationship
https://ontology.unifiedcyberontology.org/uco/observable/OperatingSystem
https://ontology.unifiedcyberontology.org/uco/observable/OperatingSystemFacet
https://ontology.unifiedcyberontology.org/uco/observable/PhoneAccount
https://ontology.unifiedcyberontology.org/uco/observable/SIMCard
https://ontology.unifiedcyberontology.org/uco/observable/SIMCardFacet
https://ontology.unifiedcyberontology.org/uco/observable/SIMForm
https://ontology.unifiedcyberontology.org/uco/observable/SIMType
https://ontology.unifiedcyberontology.org/uco/observable/Software
https://ontology.unifiedcyberontology.org/uco/observable/SoftwareFacet
https://ontology.unifiedcyberontology.org/uco/observable/WifiAddressFacet
https://ontology.unifiedcyberontology.org/uco/observable/addressValue
https://ontology.unifiedcyberontology.org/uco/observable/carrier
Expand Down
Original file line number Diff line number Diff line change
@@ -1,2 +1,3 @@
http://www.w3.org/2001/XMLSchema#string Contained_Within
http://www.w3.org/2001/XMLSchema#string Has_Account
http://www.w3.org/2001/XMLSchema#string Has_Operating_System
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@ https://ontology.unifiedcyberontology.org/uco/observable/OperatingSystem
https://ontology.unifiedcyberontology.org/uco/observable/OperatingSystemFacet
https://ontology.unifiedcyberontology.org/uco/observable/ProcessFacet
https://ontology.unifiedcyberontology.org/uco/observable/Software
https://ontology.unifiedcyberontology.org/uco/observable/SoftwareFacet
https://ontology.unifiedcyberontology.org/uco/observable/URL
https://ontology.unifiedcyberontology.org/uco/observable/URLFacet
https://ontology.unifiedcyberontology.org/uco/observable/UserAccount
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ http://www.w3.org/2001/XMLSchema#string Forensic_Image_Of
http://www.w3.org/2001/XMLSchema#string Has_Account
http://www.w3.org/2001/XMLSchema#string Has_Device
http://www.w3.org/2001/XMLSchema#string Has_Fragment
http://www.w3.org/2001/XMLSchema#string Has_Operating_System
http://www.w3.org/2001/XMLSchema#string Has_Role
http://www.w3.org/2001/XMLSchema#string Initiated
http://www.w3.org/2001/XMLSchema#string Located_At
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ http://www.w3.org/2001/XMLSchema#string Forensic_Image_Of
http://www.w3.org/2001/XMLSchema#string Has_Account
http://www.w3.org/2001/XMLSchema#string Has_Device
http://www.w3.org/2001/XMLSchema#string Has_Fragment
http://www.w3.org/2001/XMLSchema#string Has_Operating_System
http://www.w3.org/2001/XMLSchema#string Has_Role
http://www.w3.org/2001/XMLSchema#string Initiated
http://www.w3.org/2001/XMLSchema#string Located_At
Expand Down
Original file line number Diff line number Diff line change
@@ -1,20 +1,20 @@
7 Oresteia/undefined_kindOfRelationships.tsv
8 Oresteia/undefined_kindOfRelationships.tsv
2 accounts/undefined_kindOfRelationships.tsv
0 analysis/undefined_kindOfRelationships.tsv
2 bulk_extractor_forensic_path/undefined_kindOfRelationships.tsv
0 call_log/undefined_kindOfRelationships.tsv
3 cell_site/undefined_kindOfRelationships.tsv
4 cell_site/undefined_kindOfRelationships.tsv
0 configured_tool/undefined_kindOfRelationships.tsv
3 database_records/undefined_kindOfRelationships.tsv
0 device/undefined_kindOfRelationships.tsv
1 device/undefined_kindOfRelationships.tsv
0 event/undefined_kindOfRelationships.tsv
1 exif_data/undefined_kindOfRelationships.tsv
0 existence_intervals/undefined_kindOfRelationships.tsv
5 file/undefined_kindOfRelationships.tsv
6 file/undefined_kindOfRelationships.tsv
2 forensic_lifecycle/undefined_kindOfRelationships.tsv
0 location/undefined_kindOfRelationships.tsv
1 message/undefined_kindOfRelationships.tsv
2 mobile_device_and_sim_card/undefined_kindOfRelationships.tsv
3 mobile_device_and_sim_card/undefined_kindOfRelationships.tsv
2 multipart_file/undefined_kindOfRelationships.tsv
1 network_connection/undefined_kindOfRelationships.tsv
4 partitions/undefined_kindOfRelationships.tsv
Expand All @@ -23,4 +23,4 @@
0 recoverability/undefined_kindOfRelationships.tsv
1 sms_and_contacts/undefined_kindOfRelationships.tsv
5 spear_phishing/undefined_kindOfRelationships.tsv
23 undefined_kindOfRelationships.tsv
24 undefined_kindOfRelationships.tsv
88 changes: 88 additions & 0 deletions tests/kb-case_prov_check.ttl
Original file line number Diff line number Diff line change
Expand Up @@ -889,6 +889,50 @@
sh:sourceShape case-prov:chain-of-derivation-shape ;
sh:value <http://example.org/kb/observation-21841f2a-6c14-48d7-b9d3-f081d43bc19b> ;
] ,
[
a sh:ValidationResult ;
sh:focusNode <http://example.org/kb/operating-system-c56dde27-0a50-49dc-ae9e-8a0473e80137> ;
sh:resultMessage "Chain of derivation for focusNode does not link back to prov:EmptyCollection. Please review the generating InvestigativeAction (if found) for any incomplete ProvenanceRecord links." ;
sh:resultSeverity sh:Warning ;
sh:sourceConstraint [
a sh:SparqlConstraint ;
sh:message "Chain of derivation for focusNode does not link back to prov:EmptyCollection. Please review the generating InvestigativeAction (if found) for any incomplete ProvenanceRecord links."@en ;
sh:select """
SELECT $this
WHERE {
FILTER NOT EXISTS {
$this prov:wasDerivedFrom ?nOtherEntity .
}
FILTER ($this != prov:EmptyCollection)
}
""" ;
] ;
sh:sourceConstraintComponent sh:SPARQLConstraintComponent ;
sh:sourceShape case-prov:chain-of-derivation-shape ;
sh:value <http://example.org/kb/operating-system-c56dde27-0a50-49dc-ae9e-8a0473e80137> ;
] ,
[
a sh:ValidationResult ;
sh:focusNode <http://example.org/kb/operating-system-cbba474a-d58c-4715-a7fa-5854d811021d> ;
sh:resultMessage "Chain of derivation for focusNode does not link back to prov:EmptyCollection. Please review the generating InvestigativeAction (if found) for any incomplete ProvenanceRecord links." ;
sh:resultSeverity sh:Warning ;
sh:sourceConstraint [
a sh:SparqlConstraint ;
sh:message "Chain of derivation for focusNode does not link back to prov:EmptyCollection. Please review the generating InvestigativeAction (if found) for any incomplete ProvenanceRecord links."@en ;
sh:select """
SELECT $this
WHERE {
FILTER NOT EXISTS {
$this prov:wasDerivedFrom ?nOtherEntity .
}
FILTER ($this != prov:EmptyCollection)
}
""" ;
] ;
sh:sourceConstraintComponent sh:SPARQLConstraintComponent ;
sh:sourceShape case-prov:chain-of-derivation-shape ;
sh:value <http://example.org/kb/operating-system-cbba474a-d58c-4715-a7fa-5854d811021d> ;
] ,
[
a sh:ValidationResult ;
sh:focusNode <http://example.org/kb/os-ca81c2d9-d496-4a06-a0f5-0b6bd5647a9e> ;
Expand Down Expand Up @@ -1109,6 +1153,50 @@
sh:sourceShape case-prov:chain-of-derivation-shape ;
sh:value <http://example.org/kb/provenancerecord-c462c7de-0391-4c88-a17c-1f9607fb0c46> ;
] ,
[
a sh:ValidationResult ;
sh:focusNode <http://example.org/kb/relationship-aca6d788-12e4-45d1-8f00-06a63579309d> ;
sh:resultMessage "Chain of derivation for focusNode does not link back to prov:EmptyCollection. Please review the generating InvestigativeAction (if found) for any incomplete ProvenanceRecord links." ;
sh:resultSeverity sh:Warning ;
sh:sourceConstraint [
a sh:SparqlConstraint ;
sh:message "Chain of derivation for focusNode does not link back to prov:EmptyCollection. Please review the generating InvestigativeAction (if found) for any incomplete ProvenanceRecord links."@en ;
sh:select """
SELECT $this
WHERE {
FILTER NOT EXISTS {
$this prov:wasDerivedFrom ?nOtherEntity .
}
FILTER ($this != prov:EmptyCollection)
}
""" ;
] ;
sh:sourceConstraintComponent sh:SPARQLConstraintComponent ;
sh:sourceShape case-prov:chain-of-derivation-shape ;
sh:value <http://example.org/kb/relationship-aca6d788-12e4-45d1-8f00-06a63579309d> ;
] ,
[
a sh:ValidationResult ;
sh:focusNode <http://example.org/kb/relationship-b41ecf43-d68c-440e-a8ae-b5978ebcbf98> ;
sh:resultMessage "Chain of derivation for focusNode does not link back to prov:EmptyCollection. Please review the generating InvestigativeAction (if found) for any incomplete ProvenanceRecord links." ;
sh:resultSeverity sh:Warning ;
sh:sourceConstraint [
a sh:SparqlConstraint ;
sh:message "Chain of derivation for focusNode does not link back to prov:EmptyCollection. Please review the generating InvestigativeAction (if found) for any incomplete ProvenanceRecord links."@en ;
sh:select """
SELECT $this
WHERE {
FILTER NOT EXISTS {
$this prov:wasDerivedFrom ?nOtherEntity .
}
FILTER ($this != prov:EmptyCollection)
}
""" ;
] ;
sh:sourceConstraintComponent sh:SPARQLConstraintComponent ;
sh:sourceShape case-prov:chain-of-derivation-shape ;
sh:value <http://example.org/kb/relationship-b41ecf43-d68c-440e-a8ae-b5978ebcbf98> ;
] ,
[
a sh:ValidationResult ;
sh:focusNode <http://example.org/kb/sd_card-590667ed-4763-4e5b-967a-2300368211b8> ;
Expand Down
Loading

0 comments on commit 2e84bad

Please sign in to comment.