Cyber-investigation Analysis Standard Expression (CASE)

1.5.0

The Cyber-investigation Analysis Standard Expression (CASE) ontology is a community-developed standard that defines concepts used in a broad range of cyber-investigation domains, including digital forensic science, incident response, counter-terrorism, criminal justice, forensic intelligence, and situational awareness. CASE includes all aspects of the digital forensic process, from evidence-gathering and chain of custody, to generating a final report. The goal is to increase sharing and interoperability of cyber-investigation information among organizations and between forensic analytic tools. CASE aligns with and extends the Unified Cyber Ontology (UCO). The preferred namespace abbreviation for this ontology is: case-master.

case-master

This ontology defines key concepts, and their associated properties and relationships, for characterizing cyber-investigations in the broadest range of contexts, including security incidents, criminal investigations, civil and regulatory matters, intelligence operations, international disputes, accident inquiries, policy violations, and others.

investigation

vocabularies

This ontology defines SHACL shapes to supplement the OWL 2 DL definitions in the Collections Ontology.

uco-co

This ontology defines SHACL shapes to perform conformance testing of OWL 2 DL. Some of these shapes follow rules specified from the canonical, subtractive parsing process of Section 3 of the OWL 2 mapping to RDF. From the last line of that document's Section 3, 'At the end of this process, the graph G MUST be empty,' anything not strictly matching patterns specified in that section cause the input graph to be non-conformant with OWL 2 DL.

uco-owl

This ontology defines classes and properties for characterizing actions.

uco-action

This ontology defines classes and properties for characterizing analytic actions and results.

uco-analysis

This ontology defines classes and properties for characterizing configurations.

uco-configuration

This ontology defines classes and properties that are shared across the various UCO ontologies. At a high-level, the UCO core ontology provides base classes, relationship-oriented classes, content-aggregation classes, and shared classes.

uco-core

uco-identity

uco-location

Data markings represent restrictions, permissions, and other guidance for how data can be used and shared.

uco-marking

uco-observable

uco-pattern

uco-role

uco-time

uco-tool

uco-types

1.5.0

uco-master

uco-victim

uco-vocabularies