You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
eventType(string — controlled vocabulary) (1)
-- Specifies the type of event
-startTime(xsd:datetime) (0..1)
-- Specifies the time that the event started.
endTime(xsd:datetime) (0..1)
-- Specifies the time that the event ended.
objects(UcoObject) (0..*)
-- Specifies a reference to an object that is related to this event.
eventAttribute(DictionaryEntry) (0..*)
-- Specifies attributes of the event.
-- This is a temporary catch all for other properties until they are deemed worthy of explicit property definition
DictionaryEntry is a dictionary structure type
key_name (1)
For an instance, only one of the following would be present
-- Key_value(literal) (0..1)
-- Object(UcoObject) (0..1)
-- Dictionary(DictionaryEntry) (for nested dictionaries) (0..1)
To support broader cyber investigation use cases, we should add a new Event object to uco-investigation.
The Event object would be a direct derivation of uco-core:ContextualCompilation.
It would be defined as "An occurence of some activity characterized by the observables indicating such action occured."
The text was updated successfully, but these errors were encountered: