Skip to content

Commit e21d2a6

Browse files
plbt5plbt5
authored
Merge pull request #175 from casework/release-1.4.0
Release 1.4.0
2 parents fa84ffb + 1cb7c31 commit e21d2a6

File tree

18 files changed

+240
-162
lines changed

18 files changed

+240
-162
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,14 @@
1+
# Portions of this file contributed by NIST are governed by the
2+
# following statement:
3+
#
14
# This software was developed at the National Institute of Standards
25
# and Technology by employees of the Federal Government in the course
3-
# of their official duties. Pursuant to title 17 Section 105 of the
4-
# United States Code this software is not subject to copyright
5-
# protection and is in the public domain. NIST assumes no
6-
# responsibility whatsoever for its use by other parties, and makes
7-
# no guarantees, expressed or implied, about its quality,
8-
# reliability, or any other characteristic.
6+
# of their official duties. Pursuant to Title 17 Section 105 of the
7+
# United States Code, this software is not subject to copyright
8+
# protection within the United States. NIST assumes no responsibility
9+
# whatsoever for its use by other parties, and makes no guarantees,
10+
# expressed or implied, about its quality, reliability, or any other
11+
# characteristic.
912
#
1013
# We would appreciate acknowledgement if the software is used.
1114

@@ -26,8 +29,8 @@ jobs:
2629
runs-on: ubuntu-latest
2730

2831
steps:
29-
- uses: actions/checkout@v2
30-
- uses: actions/setup-java@v3
32+
- uses: actions/checkout@v4
33+
- uses: actions/setup-java@v4
3134
with:
3235
distribution: 'temurin'
3336
java-version: '11'

‎ChangeLog‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,48 @@
1+
2025-03-18
2+
* (7ecdaf4) UCO Issue 629: Revise vocabulary pattern
3+
4+
2025-02-13
5+
* (256b474) UCO Issue 640: Add `core:informalType` and link as parent of type-describing properties
6+
7+
2024-12-19
8+
* (a0a62e9) Issue 167: Adjust top Makefile dependency ordering in submodule initialization
9+
10+
2024-11-23
11+
* (b5720af) UCO Issue 624: Add cpeid to DeviceFacet
12+
13+
2024-11-08
14+
* (96d45fb) UCO Issue 632: Prepare OperatingSystem to become a subclass of Software
15+
* (f759e47) Pull Request 164: Update NIST licensing text
16+
* (2eb3991) UCO Pull Request 642: Update NIST licensing text
17+
18+
2024-11-07
19+
* (820d63d) UCO Pull Request 639: Bump GitHub Action versions
20+
* (cc5535e) UCO Pull Request 638: Refresh validation files to reflect validation tool template updates
21+
22+
2024-10-18
23+
* (557269c) UCO Issue 593: Remove owl:onDatatype from vocabulary definitions
24+
25+
2024-10-16
26+
* (8a353f8) UCO Issue 612: Warn if a `Disk` instance is not also a `StorageMedium`
27+
28+
2024-09-11
29+
* (8ba5929) UCO Issue 549: Add `core:objectStatus`
30+
31+
2024-07-26
32+
* (b93add7) UCO Issue 602: Warn about key-uniqueness enforcement to `types:Dictionary`
33+
34+
2024-06-18
35+
* (0d409cc) UCO Issue 609: Fix typo
36+
37+
2024-06-10
38+
* (5cf57b7) UCO Issues 586, 590: Warn of prior disjointedness declarations in `core:` and `types:`; warn if an `AlternateDataStream` instance is not also a `FileSystemObject`
39+
40+
2024-05-01
41+
* (50eb05b) UCO Issues 573, 584, 599: Warn if target or source on an `ObservableRelationship` are not `Observable`s; replace errant reference to non-existent concept `owl:Datatype`; remove 1-member minimum on `core:ContextualCompilation`
42+
43+
2024-01-24
44+
* OCCASE-495: Release CASE 1.3.0, with release notes at https://caseontology.org/releases/1.3.0/
45+
146
2024-01-24
247
* (79afa93) UCO Pull Request 579: Update change request template
348

‎Makefile‎

Lines changed: 27 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,16 @@
11
#!/usr/bin/make -f
22

3+
# Portions of this file contributed by NIST are governed by the
4+
# following statement:
5+
#
36
# This software was developed at the National Institute of Standards
47
# and Technology by employees of the Federal Government in the course
5-
# of their official duties. Pursuant to title 17 Section 105 of the
6-
# United States Code this software is not subject to copyright
7-
# protection and is in the public domain. NIST assumes no
8-
# responsibility whatsoever for its use by other parties, and makes
9-
# no guarantees, expressed or implied, about its quality,
10-
# reliability, or any other characteristic.
8+
# of their official duties. Pursuant to Title 17 Section 105 of the
9+
# United States Code, this software is not subject to copyright
10+
# protection within the United States. NIST assumes no responsibility
11+
# whatsoever for its use by other parties, and makes no guarantees,
12+
# expressed or implied, about its quality, reliability, or any other
13+
# characteristic.
1114
#
1215
# We would appreciate acknowledgement if the software is used.
1316

@@ -43,7 +46,6 @@ all: \
4346

4447
# The two CASE-Utility... files are to trigger rebuilds based on command-line interface changes or version increments.
4548
.venv.done.log: \
46-
.git_submodule_init.done.log \
4749
dependencies/UCO/dependencies/CASE-Utility-SHACL-Inheritance-Reviewer/case_shacl_inheritance_reviewer/__init__.py \
4850
dependencies/UCO/dependencies/CASE-Utility-SHACL-Inheritance-Reviewer/setup.cfg \
4951
dependencies/UCO/requirements.txt
@@ -100,14 +102,26 @@ clean:
100102
@rm -rf \
101103
venv
102104

105+
# This recipe maintains timestamp order.
106+
# The target file creation is handled by recursive initialization done
107+
# in the recipe for .git_submodule_init.done.log.
103108
dependencies/UCO/dependencies/CASE-Utility-SHACL-Inheritance-Reviewer/case_shacl_inheritance_reviewer/__init__.py: \
104109
.git_submodule_init.done.log
105-
$(MAKE) \
106-
--directory dependencies/UCO \
107-
dependencies/CASE-Utility-SHACL-Inheritance-Reviewer/case_shacl_inheritance_reviewer/__init__.py
110+
test -r $@
111+
touch -c $@
108112

113+
# This recipe maintains timestamp order.
114+
# The target file creation is handled by recursive initialization done
115+
# in the recipe for .git_submodule_init.done.log.
109116
dependencies/UCO/dependencies/CASE-Utility-SHACL-Inheritance-Reviewer/setup.cfg: \
110117
.git_submodule_init.done.log
111-
$(MAKE) \
112-
--directory dependencies/UCO \
113-
dependencies/CASE-Utility-SHACL-Inheritance-Reviewer/setup.cfg
118+
test -r $@
119+
touch -c $@
120+
121+
# This recipe maintains timestamp order.
122+
# The target file creation is handled by initialization done in the
123+
# recipe for .git_submodule_init.done.log.
124+
dependencies/UCO/requirements.txt: \
125+
.git_submodule_init.done.log
126+
test -r $@
127+
touch -c $@

‎dependencies/UCO‎

Submodule UCO updated 79 files

‎ontology/Makefile‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,16 @@
11
#!/usr/bin/make -f
22

3+
# Portions of this file contributed by NIST are governed by the
4+
# following statement:
5+
#
36
# This software was developed at the National Institute of Standards
47
# and Technology by employees of the Federal Government in the course
5-
# of their official duties. Pursuant to title 17 Section 105 of the
6-
# United States Code this software is not subject to copyright
7-
# protection and is in the public domain. NIST assumes no
8-
# responsibility whatsoever for its use by other parties, and makes
9-
# no guarantees, expressed or implied, about its quality,
10-
# reliability, or any other characteristic.
8+
# of their official duties. Pursuant to Title 17 Section 105 of the
9+
# United States Code, this software is not subject to copyright
10+
# protection within the United States. NIST assumes no responsibility
11+
# whatsoever for its use by other parties, and makes no guarantees,
12+
# expressed or implied, about its quality, reliability, or any other
13+
# characteristic.
1114
#
1215
# We would appreciate acknowledgement if the software is used.
1316

‎ontology/investigation/Makefile‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,16 @@
11
#!/usr/bin/make -f
22

3+
# Portions of this file contributed by NIST are governed by the
4+
# following statement:
5+
#
36
# This software was developed at the National Institute of Standards
47
# and Technology by employees of the Federal Government in the course
5-
# of their official duties. Pursuant to title 17 Section 105 of the
6-
# United States Code this software is not subject to copyright
7-
# protection and is in the public domain. NIST assumes no
8-
# responsibility whatsoever for its use by other parties, and makes
9-
# no guarantees, expressed or implied, about its quality,
10-
# reliability, or any other characteristic.
8+
# of their official duties. Pursuant to Title 17 Section 105 of the
9+
# United States Code, this software is not subject to copyright
10+
# protection within the United States. NIST assumes no responsibility
11+
# whatsoever for its use by other parties, and makes no guarantees,
12+
# expressed or implied, about its quality, reliability, or any other
13+
# characteristic.
1114
#
1215
# We would appreciate acknowledgement if the software is used.
1316

‎ontology/investigation/catalog-v001.xml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,14 @@
22
<catalog xmlns="urn:oasis:names:tc:entity:xmlns:xml:catalog" prefer="public">
33
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/dependencies/collections-ontology/collections.owl" name="http://purl.org/co"/>
44
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/dependencies/error/docs/current/error.ttl" name="http://purl.org/spar/error"/>
5-
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/co/co.ttl" name="https://ontology.unifiedcyberontology.org/co/1.3.0"/>
6-
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/uco/action/action.ttl" name="https://ontology.unifiedcyberontology.org/uco/action/1.3.0"/>
7-
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/uco/core/core.ttl" name="https://ontology.unifiedcyberontology.org/uco/core/1.3.0"/>
8-
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/uco/location/location.ttl" name="https://ontology.unifiedcyberontology.org/uco/location/1.3.0"/>
9-
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/uco/pattern/pattern.ttl" name="https://ontology.unifiedcyberontology.org/uco/pattern/1.3.0"/>
10-
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/uco/role/role.ttl" name="https://ontology.unifiedcyberontology.org/uco/role/1.3.0"/>
11-
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/uco/types/types.ttl" name="https://ontology.unifiedcyberontology.org/uco/types/1.3.0"/>
12-
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/uco/vocabulary/vocabulary.ttl" name="https://ontology.unifiedcyberontology.org/uco/vocabulary/1.3.0"/>
13-
<uri id="User Entered Import Resolution" uri="../vocabulary/vocabulary.ttl" name="https://ontology.caseontology.org/case/vocabulary/1.3.0"/>
5+
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/co/co.ttl" name="https://ontology.unifiedcyberontology.org/co/1.4.0"/>
6+
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/uco/action/action.ttl" name="https://ontology.unifiedcyberontology.org/uco/action/1.4.0"/>
7+
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/uco/core/core.ttl" name="https://ontology.unifiedcyberontology.org/uco/core/1.4.0"/>
8+
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/uco/location/location.ttl" name="https://ontology.unifiedcyberontology.org/uco/location/1.4.0"/>
9+
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/uco/pattern/pattern.ttl" name="https://ontology.unifiedcyberontology.org/uco/pattern/1.4.0"/>
10+
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/uco/role/role.ttl" name="https://ontology.unifiedcyberontology.org/uco/role/1.4.0"/>
11+
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/uco/types/types.ttl" name="https://ontology.unifiedcyberontology.org/uco/types/1.4.0"/>
12+
<uri id="User Entered Import Resolution" uri="../../dependencies/UCO/ontology/uco/vocabulary/vocabulary.ttl" name="https://ontology.unifiedcyberontology.org/uco/vocabulary/1.4.0"/>
13+
<uri id="User Entered Import Resolution" uri="../vocabulary/vocabulary.ttl" name="https://ontology.caseontology.org/case/vocabulary/1.4.0"/>
1414
<uri id="User Entered Import Resolution" uri="investigation.ttl" name="https://ontology.caseontology.org/case/investigation"/>
1515
</catalog>

‎ontology/investigation/investigation.ttl‎

Lines changed: 30 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
# imports: https://ontology.caseontology.org/case/vocabulary/1.3.0
2-
# imports: https://ontology.unifiedcyberontology.org/uco/action/1.3.0
3-
# imports: https://ontology.unifiedcyberontology.org/uco/role/1.3.0
1+
# imports: https://ontology.caseontology.org/case/vocabulary/1.4.0
2+
# imports: https://ontology.unifiedcyberontology.org/uco/action/1.4.0
3+
# imports: https://ontology.unifiedcyberontology.org/uco/role/1.4.0
44

55
@prefix investigation: <https://ontology.caseontology.org/case/investigation/> .
66
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@@ -17,14 +17,14 @@
1717
a owl:Ontology ;
1818
rdfs:label "investigation"@en ;
1919
rdfs:comment "This ontology defines key concepts, and their associated properties and relationships, for characterizing cyber-investigations in the broadest range of contexts, including security incidents, criminal investigations, civil and regulatory matters, intelligence operations, international disputes, accident inquiries, policy violations, and others." ;
20-
owl:backwardCompatibleWith investigation:1.2.0 ;
20+
owl:backwardCompatibleWith investigation:1.3.0 ;
2121
owl:imports
22-
vocabulary:1.3.0 ,
23-
uco-action:1.3.0 ,
24-
uco-role:1.3.0
22+
vocabulary:1.4.0 ,
23+
uco-action:1.4.0 ,
24+
uco-role:1.4.0
2525
;
26-
owl:priorVersion investigation:1.2.0 ;
27-
owl:versionIRI investigation:1.3.0 ;
26+
owl:priorVersion investigation:1.3.0 ;
27+
owl:versionIRI investigation:1.4.0 ;
2828
.
2929

3030
investigation:Attorney
@@ -105,6 +105,7 @@ investigation:Investigation
105105
rdfs:label "Investigation"@en ;
106106
rdfs:comment "An investigation is a grouping of characteristics unique to an exploration of the facts involved in a cyber-relevant set of suspicious activity."@en ;
107107
sh:property
108+
investigation:Investigation-investigationForm-in-shape ,
108109
[
109110
sh:class investigation:Authorization ;
110111
sh:nodeKind sh:BlankNodeOrIRI ;
@@ -130,49 +131,36 @@ investigation:Investigation
130131
] ,
131132
[
132133
sh:datatype xsd:string ;
133-
sh:nodeKind sh:Literal ;
134-
sh:path investigation:focus ;
135-
] ,
136-
[
137-
sh:datatype vocabulary:InvestigationFormVocab ;
138-
sh:message "Value is outside the default vocabulary InvestigationFormVocab." ;
134+
sh:message "As of CASE 1.4.0, the datatype to use for investigation:investigationForm should be xsd:string. Not using xsd:string will be an error in CASE 2.0.0." ;
139135
sh:path investigation:investigationForm ;
140-
sh:severity sh:Info ;
136+
sh:severity sh:Warning ;
141137
] ,
142138
[
143-
sh:maxCount "1"^^xsd:integer ;
139+
sh:datatype xsd:string ;
144140
sh:nodeKind sh:Literal ;
145-
sh:or (
146-
[
147-
sh:datatype vocabulary:InvestigationFormVocab ;
148-
]
149-
[
150-
sh:datatype xsd:string ;
151-
]
152-
) ;
153-
sh:path investigation:investigationForm ;
141+
sh:path investigation:focus ;
154142
] ,
155143
[
156-
sh:message "Value is not member of the vocabulary InvestigationFormVocab." ;
157-
sh:or (
158-
[
159-
sh:datatype vocabulary:InvestigationFormVocab ;
160-
sh:in (
161-
"case"^^vocabulary:InvestigationFormVocab
162-
"incident"^^vocabulary:InvestigationFormVocab
163-
"suspicious-activity"^^vocabulary:InvestigationFormVocab
164-
) ;
165-
]
166-
[
167-
sh:datatype xsd:string ;
168-
]
169-
) ;
144+
sh:maxCount "1"^^xsd:integer ;
145+
sh:nodeKind sh:Literal ;
170146
sh:path investigation:investigationForm ;
171147
]
172148
;
173149
sh:targetClass investigation:Investigation ;
174150
.
175151

152+
investigation:Investigation-investigationForm-in-shape
153+
a sh:PropertyShape ;
154+
sh:in (
155+
"case"
156+
"incident"
157+
"suspicious-activity"
158+
) ;
159+
sh:message "Value is not member of the vocabulary InvestigationFormVocab." ;
160+
sh:path investigation:investigationForm ;
161+
sh:severity sh:Info ;
162+
.
163+
176164
investigation:InvestigativeAction
177165
a
178166
owl:Class ,
@@ -267,6 +255,7 @@ investigation:authorizationIdentifier
267255

268256
investigation:authorizationType
269257
a owl:DatatypeProperty ;
258+
rdfs:subPropertyOf uco-core:informalType ;
270259
rdfs:label "authorizationType"@en ;
271260
rdfs:comment "A label categorizing a type of authorization (e.g. warrant)"@en ;
272261
rdfs:range xsd:string ;
@@ -288,6 +277,7 @@ investigation:focus
288277

289278
investigation:investigationForm
290279
a owl:DatatypeProperty ;
280+
rdfs:subPropertyOf uco-core:informalType ;
291281
rdfs:label "investigationForm"@en ;
292282
rdfs:comment "A label categorizing a type of investigation (case, incident, suspicious-activity, etc.)"@en ;
293283
rdfs:range [

‎ontology/master/Makefile‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,16 @@
11
#!/usr/bin/make -f
22

3+
# Portions of this file contributed by NIST are governed by the
4+
# following statement:
5+
#
36
# This software was developed at the National Institute of Standards
47
# and Technology by employees of the Federal Government in the course
5-
# of their official duties. Pursuant to title 17 Section 105 of the
6-
# United States Code this software is not subject to copyright
7-
# protection and is in the public domain. NIST assumes no
8-
# responsibility whatsoever for its use by other parties, and makes
9-
# no guarantees, expressed or implied, about its quality,
10-
# reliability, or any other characteristic.
8+
# of their official duties. Pursuant to Title 17 Section 105 of the
9+
# United States Code, this software is not subject to copyright
10+
# protection within the United States. NIST assumes no responsibility
11+
# whatsoever for its use by other parties, and makes no guarantees,
12+
# expressed or implied, about its quality, reliability, or any other
13+
# characteristic.
1114
#
1215
# We would appreciate acknowledgement if the software is used.
1316

‎ontology/master/case.ttl‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
# imports: https://ontology.caseontology.org/case/investigation/1.3.0
2-
# imports: https://ontology.caseontology.org/case/vocabulary/1.3.0
3-
# imports: https://ontology.unifiedcyberontology.org/uco/uco/1.3.0
1+
# imports: https://ontology.caseontology.org/case/investigation/1.4.0
2+
# imports: https://ontology.caseontology.org/case/vocabulary/1.4.0
3+
# imports: https://ontology.unifiedcyberontology.org/uco/uco/1.4.0
44

55
@prefix dct: <http://purl.org/dc/terms/> .
66
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@@ -16,14 +16,14 @@
1616
rdfs:label "case-master"@en ;
1717
rdfs:comment "The Cyber-investigation Analysis Standard Expression (CASE) ontology is a community-developed standard that defines concepts used in a broad range of cyber-investigation domains, including digital forensic science, incident response, counter-terrorism, criminal justice, forensic intelligence, and situational awareness. CASE includes all aspects of the digital forensic process, from evidence-gathering and chain of custody, to generating a final report. The goal is to increase sharing and interoperability of cyber-investigation information among organizations and between forensic analytic tools. CASE aligns with and extends the Unified Cyber Ontology (UCO). The preferred namespace abbreviation for this ontology is: case-master."@en ;
1818
dct:title "Cyber-investigation Analysis Standard Expression (CASE)"@en ;
19-
owl:backwardCompatibleWith <https://ontology.caseontology.org/case/case/1.2.0> ;
19+
owl:backwardCompatibleWith <https://ontology.caseontology.org/case/case/1.3.0> ;
2020
owl:imports
21-
<https://ontology.caseontology.org/case/investigation/1.3.0> ,
22-
<https://ontology.caseontology.org/case/vocabulary/1.3.0> ,
23-
<https://ontology.unifiedcyberontology.org/uco/uco/1.3.0>
21+
<https://ontology.caseontology.org/case/investigation/1.4.0> ,
22+
<https://ontology.caseontology.org/case/vocabulary/1.4.0> ,
23+
<https://ontology.unifiedcyberontology.org/uco/uco/1.4.0>
2424
;
25-
owl:priorVersion <https://ontology.caseontology.org/case/case/1.2.0> ;
26-
owl:versionIRI <https://ontology.caseontology.org/case/case/1.3.0> ;
27-
owl:versionInfo "1.3.0" ;
25+
owl:priorVersion <https://ontology.caseontology.org/case/case/1.3.0> ;
26+
owl:versionIRI <https://ontology.caseontology.org/case/case/1.4.0> ;
27+
owl:versionInfo "1.4.0" ;
2828
.
2929

0 commit comments

Comments
 (0)