How STONEWORK models what an adversary planned, what actually happened, and whether the prediction held, using a worked ATT&CK T1003.001 example and the SPARQL to query it.
A live demonstration of STONES, a faithful OWL binding for STIX 2.1 — and why STONEWORK, not STIX, is the ground-truth ontology underneath it.
A traversal of CVE-2021-44228 through STONEWORK’s shared vocabulary surfaces a real, cross-framework gap: a technique used by 27 known threat-actor groups with zero mapped controls in CIS or NIST SP 800-53.