1. Home
  2. Entities
  3. Classes

Classes Tree

Tree

co:Bag
types:Thread
co:Item
co:ListItem
types:ThreadItem
core:UcoThing
core:UcoInherentCharacterizationThing
action:ArrayOfAction
analysis:ArtifactClassification
configuration:ConfigurationEntry
configuration:Dependency
core:ExternalReference
core:Facet
action:ActionArgumentFacet
action:ActionEstimationFacet
action:ActionFrequencyFacet
analysis:AnalyticResultFacet
analysis:ArtifactClassificationResultFacet
core:ConfidenceFacet
identity:IdentityFacet
identity:AddressFacet
identity:AffiliationFacet
identity:BirthInformationFacet
identity:CountryOfResidenceFacet
identity:EventsFacet
identity:IdentifierFacet
identity:LanguagesFacet
identity:NationalityFacet
identity:OccupationFacet
identity:OrganizationDetailsFacet
identity:PersonalDetailsFacet
identity:PhysicalInfoFacet
identity:QualificationFacet
identity:RelatedIdentityFacet
identity:SimpleNameFacet
identity:VisaFacet
location:GPSCoordinatesFacet
location:LatLongCoordinatesFacet
location:SimpleAddressFacet
observable:AccountAuthenticationFacet
observable:AccountFacet
observable:AlternateDataStreamFacet
observable:AndroidDeviceFacet
observable:AntennaFacet
observable:ApplicationAccountFacet
observable:ApplicationFacet
observable:ArchiveFileFacet
observable:AudioFacet
observable:AutonomousSystemFacet
observable:BrowserBookmarkFacet
observable:BrowserCookieFacet
observable:CalendarEntryFacet
observable:CalendarFacet
observable:CallFacet
...ervable:CapturedTelecommunicationsInformationFacet
observable:CellSiteFacet
observable:CompressedStreamFacet
observable:ComputerSpecificationFacet
observable:ContactFacet
observable:WhoisContactFacet
observable:ContactListFacet
observable:ContentDataFacet
observable:DataRangeFacet
observable:DefinedEffectFacet
observable:PropertiesEnumeratedEffectFacet
observable:PropertyReadEffectFacet
observable:SendControlCodeEffectFacet
observable:StateChangeEffectFacet
observable:ValuesEnumeratedEffectFacet
observable:DeviceFacet
observable:DigitalAccountFacet
observable:DigitalAddressFacet
observable:EmailAddressFacet
observable:IPAddressFacet
observable:IPv4AddressFacet
observable:IPv6AddressFacet
observable:InstantMessagingAddressFacet
observable:MACAddressFacet
observable:BluetoothAddressFacet
observable:WifiAddressFacet
observable:SIPAddressFacet
observable:DigitalSignatureInfoFacet
observable:DiskFacet
observable:DiskPartitionFacet
observable:DomainNameFacet
observable:EXIFFacet
observable:EmailAccountFacet
observable:EmailMessageFacet
observable:EncodedStreamFacet
observable:EncryptedStreamFacet
observable:EventRecordFacet
observable:ExtInodeFacet
observable:ExtractedStringsFacet
observable:FileFacet
observable:FilePermissionsFacet
observable:FileSystemFacet
observable:FragmentFacet
observable:GeoLocationEntryFacet
observable:GeoLocationLogFacet
observable:GeoLocationTrackFacet
observable:HTTPConnectionFacet
observable:ICMPConnectionFacet
observable:ImageFacet
observable:LibraryFacet
observable:MemoryFacet
observable:MessageFacet
observable:MessageThreadFacet
observable:MftRecordFacet
observable:MobileAccountFacet
observable:MobileDeviceFacet
observable:MutexFacet
observable:NTFSFileFacet
observable:NTFSFilePermissionsFacet
observable:NetworkConnectionFacet
observable:NetworkFlowFacet
observable:NetworkInterfaceFacet
observable:NoteFacet
observable:OnlineServiceFacet
observable:OperatingSystemFacet
observable:PDFFileFacet
observable:PathRelationFacet
observable:PhoneAccountFacet
observable:ProcessFacet
observable:ProfileFacet
observable:PropertiesEnumeratedEffectFacet
observable:RasterPictureFacet
observable:RecoveredObjectFacet
observable:SIMCardFacet
observable:SMSMessageFacet
observable:SQLiteBlobFacet
observable:SoftwareFacet
observable:StorageMediumFacet
observable:SymbolicLinkFacet
observable:TCPConnectionFacet
observable:TableFieldFacet
observable:TwitterProfileFacet
observable:UNIXAccountFacet
observable:UNIXFilePermissionsFacet
observable:UNIXProcessFacet
observable:UNIXVolumeFacet
observable:URLFacet
observable:URLHistoryFacet
observable:URLVisitFacet
observable:UserAccountFacet
observable:UserSessionFacet
observable:VolumeFacet
observable:WhoIsFacet
observable:WindowsAccountFacet
observable:WindowsActiveDirectoryAccountFacet
observable:WindowsComputerSpecificationFacet
observable:WindowsPEBinaryFileFacet
observable:WindowsPrefetchFacet
observable:WindowsProcessFacet
observable:WindowsRegistryHiveFacet
observable:WindowsRegistryKeyFacet
observable:WindowsServiceFacet
observable:WindowsTaskFacet
observable:WindowsThreadFacet
observable:WindowsVolumeFacet
observable:WirelessNetworkConnectionFacet
observable:X509CertificateFacet
observable:X509V3ExtensionsFacet
tool:BuildFacet
marking:GranularMarking
marking:MarkingModel
marking:LicenseMarking
marking:ReleaseToMarking
marking:StatementMarking
marking:TermsOfUseMarking
observable:ApplicationVersion
observable:ContactAddress
observable:ContactAffiliation
observable:ContactEmail
observable:ContactMessaging
observable:ContactPhone
observable:ContactProfile
observable:ContactSIP
observable:ContactURL
observable:EnvironmentVariable
observable:ExtractedString
observable:GlobalFlagType
observable:IComHandlerActionType
observable:IExecActionType
observable:IShowMessageActionType
observable:MimePartType
observable:TaskActionType
observable:TriggerType
observable:URLHistoryEntry
observable:WhoisRegistrarInfoType
observable:WindowsPEFileHeader
observable:WindowsPEOptionalHeader
observable:WindowsPESection
observable:WindowsRegistryValue
pattern:PatternExpression
tool:BuildInformationType
tool:BuildUtilityType
tool:CompilerType
tool:LibraryType
types:Dictionary
types:ControlledDictionary
types:DictionaryEntry
types:ControlledDictionaryEntry
types:Hash
core:UcoObject
investigation:Authorization
action:Action
investigation:InvestigativeAction
action:ActionLifecycle
investigation:ExaminerActionLifecycle
investigation:SubjectActionLifecycle
investigation:VictimActionLifecycle
action:ActionPattern
analysis:Analysis
observable:ObservableAction
observable:Observation
configuration:Configuration
core:Assertion
analysis:AnalyticResult
core:Annotation
core:AttributedName
core:Compilation
core:ContextualCompilation
investigation:Investigation
investigation:ProvenanceRecord
core:Grouping
core:EnclosingCompilation
core:Bundle
core:ControlledVocabulary
core:Event
core:IdentityAbstraction
identity:Identity
identity:Organization
identity:Person
core:Item
observable:ObservableObject
observable:API
observable:ARPCache
observable:ARPCacheEntry
observable:Account
observable:DigitalAccount
observable:ApplicationAccount
observable:EmailAccount
observable:MobileAccount
observable:PhoneAccount
observable:UNIXAccount
observable:UserAccount
observable:WindowsAccount
observable:WindowsActiveDirectoryAccount
observable:Address
observable:DigitalAddress
observable:EmailAddress
observable:IPAddress
observable:IPv4Address
observable:IPv6Address
observable:InstantMessagingAddress
observable:MACAddress
observable:BluetoothAddress
observable:WifiAddress
observable:SIPAddress
observable:SocketAddress
observable:AlternateDataStream
observable:Application
observable:Audio
observable:AutonomousSystem
observable:BotConfiguration
observable:BrowserBookmark
observable:BrowserCookie
observable:Calendar
observable:CalendarEntry
observable:Call
observable:CapturedTelecommunicationsInformation
observable:CellSite
observable:Code
observable:ComputerSpecification
observable:Contact
observable:ContactList
observable:ContentData
observable:CookieHistory
observable:Credential
observable:CredentialDump
observable:DNSCache
observable:DNSRecord
observable:Device
observable:Adaptor
observable:AndroidDevice
observable:AndroidPhone
observable:AppleDevice
observable:IPhone
observable:Appliance
observable:NetworkAppliance
observable:SecurityAppliance
observable:Computer
observable:Laptop
observable:Server
observable:SmartPhone
observable:AndroidPhone
observable:BlackberryPhone
observable:IPhone
observable:Tablet
observable:DigitalCamera
observable:EmbeddedDevice
observable:GamingConsole
observable:MobileDevice
observable:Drone
observable:MobilePhone
observable:SmartPhone
observable:AndroidPhone
observable:BlackberryPhone
observable:IPhone
observable:Tablet
observable:ProtocolConverter
observable:SIMCard
observable:SmartDevice
observable:SmartPhone
observable:AndroidPhone
observable:BlackberryPhone
observable:IPhone
observable:Tablet
observable:WearableDevice
observable:StorageMedium
observable:WriteBlocker
observable:DigitalSignatureInfo
observable:Disk
observable:DiskPartition
observable:DomainName
observable:EventLog
observable:EventRecord
observable:FileSystem
observable:FileSystemObject
observable:BlockDeviceNode
observable:CharacterDeviceNode
observable:Directory
observable:File
observable:ArchiveFile
observable:NTFSFile
observable:PDFFile
observable:RasterPicture
observable:UNIXFile
observable:WindowsPEBinaryFile
observable:Junction
observable:NamedPipe
observable:ReparsePoint
observable:Snapshot
observable:Socket
observable:SymbolicLink
observable:GUI
observable:GenericObservableObject
observable:GeoLocationEntry
observable:GeoLocationLog
observable:GeoLocationTrack
observable:Hostname
observable:IPNetmask
observable:Image
observable:Library
observable:Memory
observable:Message
observable:EmailMessage
observable:ForumPost
observable:ForumPrivateMessage
observable:Post
observable:SMSMessage
observable:Tweet
observable:MessageThread
observable:Mutex
observable:NetworkConnection
observable:HTTPConnection
observable:ICMPConnection
observable:TCPConnection
observable:WirelessNetworkConnection
observable:NetworkFlow
observable:NetworkInterface
observable:NetworkProtocol
observable:NetworkRoute
observable:NetworkSubnet
observable:Note
observable:OnlineService
observable:OperatingSystem
observable:PaymentCard
observable:Pipe
observable:Process
observable:UNIXProcess
observable:WindowsProcess
observable:ProcessThread
observable:WindowsThread
observable:Profile
observable:RecoveredObject
observable:SQLiteBlob
observable:Semaphore
observable:ShopListing
observable:Software
observable:ConfiguredSoftware
observable:TableField
observable:URL
observable:URLHistory
observable:URLVisit
observable:UserSession
observable:Volume
observable:WebPage
observable:WhoIs
observable:Wiki
observable:WikiArticle
observable:WindowsComputerSpecification
observable:WindowsCriticalSection
observable:WindowsEvent
observable:WindowsFilemapping
observable:WindowsHandle
observable:WindowsHook
observable:WindowsMailslot
observable:WindowsNetworkShare
observable:WindowsPrefetch
observable:WindowsRegistryHive
observable:WindowsRegistryKey
observable:WindowsService
observable:WindowsSystemRestore
observable:WindowsTask
observable:WindowsWaitableTime
observable:X509Certificate
observable:X509V3Certificate
core:MarkingDefinitionAbstraction
marking:MarkingDefinition
core:ModusOperandi
core:Relationship
observable:ObservableRelationship
location:Location
observable:Observable
observable:ObservableAction
observable:ObservableObject
observable:API
observable:ARPCache
observable:ARPCacheEntry
observable:Account
observable:DigitalAccount
observable:ApplicationAccount
observable:EmailAccount
observable:MobileAccount
observable:PhoneAccount
observable:UNIXAccount
observable:UserAccount
observable:WindowsAccount
observable:WindowsActiveDirectoryAccount
observable:Address
observable:DigitalAddress
observable:EmailAddress
observable:IPAddress
observable:IPv4Address
observable:IPv6Address
observable:InstantMessagingAddress
observable:MACAddress
observable:BluetoothAddress
observable:WifiAddress
observable:SIPAddress
observable:SocketAddress
observable:AlternateDataStream
observable:Application
observable:Audio
observable:AutonomousSystem
observable:BotConfiguration
observable:BrowserBookmark
observable:BrowserCookie
observable:Calendar
observable:CalendarEntry
observable:Call
observable:CapturedTelecommunicationsInformation
observable:CellSite
observable:Code
observable:ComputerSpecification
observable:Contact
observable:ContactList
observable:ContentData
observable:CookieHistory
observable:Credential
observable:CredentialDump
observable:DNSCache
observable:DNSRecord
observable:Device
observable:Adaptor
observable:AndroidDevice
observable:AndroidPhone
observable:AppleDevice
observable:IPhone
observable:Appliance
observable:NetworkAppliance
observable:SecurityAppliance
observable:Computer
observable:Laptop
observable:Server
observable:SmartPhone
observable:AndroidPhone
observable:BlackberryPhone
observable:IPhone
observable:Tablet
observable:DigitalCamera
observable:EmbeddedDevice
observable:GamingConsole
observable:MobileDevice
observable:Drone
observable:MobilePhone
observable:SmartPhone
observable:AndroidPhone
observable:BlackberryPhone
observable:IPhone
observable:Tablet
observable:ProtocolConverter
observable:SIMCard
observable:SmartDevice
observable:SmartPhone
observable:AndroidPhone
observable:BlackberryPhone
observable:IPhone
observable:Tablet
observable:WearableDevice
observable:StorageMedium
observable:WriteBlocker
observable:DigitalSignatureInfo
observable:Disk
observable:DiskPartition
observable:DomainName
observable:EventLog
observable:EventRecord
observable:FileSystem
observable:FileSystemObject
observable:BlockDeviceNode
observable:CharacterDeviceNode
observable:Directory
observable:File
observable:ArchiveFile
observable:NTFSFile
observable:PDFFile
observable:RasterPicture
observable:UNIXFile
observable:WindowsPEBinaryFile
observable:Junction
observable:NamedPipe
observable:ReparsePoint
observable:Snapshot
observable:Socket
observable:SymbolicLink
observable:GUI
observable:GenericObservableObject
observable:GeoLocationEntry
observable:GeoLocationLog
observable:GeoLocationTrack
observable:Hostname
observable:IPNetmask
observable:Image
observable:Library
observable:Memory
observable:Message
observable:EmailMessage
observable:ForumPost
observable:ForumPrivateMessage
observable:Post
observable:SMSMessage
observable:Tweet
observable:MessageThread
observable:Mutex
observable:NetworkConnection
observable:HTTPConnection
observable:ICMPConnection
observable:TCPConnection
observable:WirelessNetworkConnection
observable:NetworkFlow
observable:NetworkInterface
observable:NetworkProtocol
observable:NetworkRoute
observable:NetworkSubnet
observable:Note
observable:OnlineService
observable:OperatingSystem
observable:PaymentCard
observable:Pipe
observable:Process
observable:UNIXProcess
observable:WindowsProcess
observable:ProcessThread
observable:WindowsThread
observable:Profile
observable:RecoveredObject
observable:SQLiteBlob
observable:Semaphore
observable:ShopListing
observable:Software
observable:ConfiguredSoftware
observable:TableField
observable:URL
observable:URLHistory
observable:URLVisit
observable:UserSession
observable:Volume
observable:WebPage
observable:WhoIs
observable:Wiki
observable:WikiArticle
observable:WindowsComputerSpecification
observable:WindowsCriticalSection
observable:WindowsEvent
observable:WindowsFilemapping
observable:WindowsHandle
observable:WindowsHook
observable:WindowsMailslot
observable:WindowsNetworkShare
observable:WindowsPrefetch
observable:WindowsRegistryHive
observable:WindowsRegistryKey
observable:WindowsService
observable:WindowsSystemRestore
observable:WindowsTask
observable:WindowsWaitableTime
observable:X509Certificate
observable:X509V3Certificate
observable:ObservablePattern
observable:ObservableRelationship
pattern:Pattern
action:ActionPattern
pattern:LogicalPattern
role:Role
investigation:Attorney
investigation:Examiner
investigation:Investigator
investigation:Subject
role:BenevolentRole
role:MaliciousRole
role:NeutralRole
victim:Victim
victim:VictimTargeting
tool:Tool
tool:AnalyticTool
tool:ConfiguredTool
tool:DefensiveTool
tool:MaliciousTool
types:Thread
types:ThreadItem
vocabulary:WhoisDNSSECTypeVocab
vocabulary:WindowsVolumeAttributeVocab