Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add new Event object to uco-investigation #47

Closed
sbarnum opened this issue Aug 25, 2017 · 2 comments
Closed

Add new Event object to uco-investigation #47

sbarnum opened this issue Aug 25, 2017 · 2 comments

Comments

@sbarnum
Copy link
Contributor

sbarnum commented Aug 25, 2017

To support broader cyber investigation use cases, we should add a new Event object to uco-investigation.

The Event object would be a direct derivation of uco-core:ContextualCompilation.

It would be defined as "An occurence of some activity characterized by the observables indicating such action occured."

@sbarnum
Copy link
Contributor Author

sbarnum commented Jul 2, 2019

Event class derived from ContextualCompilation

  • eventType(string — controlled vocabulary) (1)
    -- Specifies the type of event
    -startTime(xsd:datetime) (0..1)
    -- Specifies the time that the event started.
  • endTime(xsd:datetime) (0..1)
    -- Specifies the time that the event ended.
  • objects(UcoObject) (0..*)
    -- Specifies a reference to an object that is related to this event.
  • eventAttribute(DictionaryEntry) (0..*)
    -- Specifies attributes of the event.
    -- This is a temporary catch all for other properties until they are deemed worthy of explicit property definition

DictionaryEntry is a dictionary structure type

  • key_name (1)
  • For an instance, only one of the following would be present
    -- Key_value(literal) (0..1)
    -- Object(UcoObject) (0..1)
    -- Dictionary(DictionaryEntry) (for nested dictionaries) (0..1)

@sbarnum sbarnum self-assigned this Jul 2, 2019
@sbarnum sbarnum added v0.4.0 and removed v0.3.0 labels Jul 12, 2019
@sbarnum sbarnum added 0.5.0 and removed v0.4.0 labels Feb 18, 2020
@ajnelson-nist ajnelson-nist added this to the UCO 1.3.0 milestone Aug 12, 2024
@ajnelson-nist
Copy link
Contributor

Closing as duplicated by #541 . Implemented in UCO 1.3.0.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants