@prefix : . @prefix owl: . @prefix rdf: . @prefix xml: . @prefix xsd: . @prefix rdfs: . @base . rdf:type owl:Ontology ; owl:versionIRI ; owl:imports ; "Hohimer Intelligence Strategies LLC" ; "A semantic threat ontology and research framework that serves as the evolutionary successor to the STONES ontology. It provides a forward-looking, extensible foundation for modeling next-generation cyber threat intelligence concepts, objects, relationships, workflows, and knowledge beyond the scope of STIX 2.1." ; ; "STONEWORK — Semantic Threat Ontology and Research Framework"@en ; rdfs:label "STONEWORK"@en ; owl:versionInfo "0.2.0" . ################################################################# # Object Properties ################################################################# ### https://cyberterrain.org/ns/stones#attributed_to rdf:type owl:ObjectProperty ; "Shortcut triple: source Campaign or IntrusionSet is attributed to target ThreatActor or IntrusionSet. Corresponds to STIX relationship_type 'attributed-to'." ; "attributed_to" . ### https://cyberterrain.org/ns/stones#detects rdf:type owl:ObjectProperty ; "Shortcut triple: source CourseOfAction or Indicator detects target. Corresponds to STIX relationship_type 'detects'." ; "detects" . ### https://cyberterrain.org/ns/stones#exploits rdf:type owl:ObjectProperty ; "Shortcut triple: source Malware or ThreatActor exploits target Vulnerability. Corresponds to STIX relationship_type 'exploits'." ; "exploits" . ### https://cyberterrain.org/ns/stones#indicates rdf:type owl:ObjectProperty ; "Shortcut triple: source Indicator indicates presence of target. Corresponds to STIX relationship_type 'indicates'." ; "indicates" . ### https://cyberterrain.org/ns/stones#mitigates rdf:type owl:ObjectProperty ; "Shortcut triple: source CourseOfAction mitigates target AttackPattern or Vulnerability. Corresponds to STIX relationship_type 'mitigates'." ; "mitigates" . ### https://cyberterrain.org/ns/stones#related_to rdf:type owl:ObjectProperty ; "Shortcut triple: generic relationship. Corresponds to STIX relationship_type 'related-to'." ; "related_to" . ### https://cyberterrain.org/ns/stones#revoked_by rdf:type owl:ObjectProperty ; "Shortcut triple: source STIX object is revoked and superseded by target. Corresponds to STIX relationship_type 'revoked-by'." ; "revoked_by" . ### https://cyberterrain.org/ns/stones#subtechnique_of rdf:type owl:ObjectProperty ; "Shortcut triple: source AttackPattern is a sub-technique of target AttackPattern. Corresponds to STIX relationship_type 'subtechnique-of' (hyphens converted to underscores in the predicate IRI)." ; "subtechnique_of" . ### https://cyberterrain.org/ns/stones#targets rdf:type owl:ObjectProperty ; "Shortcut triple: source targets the target Identity, Vulnerability, or Location. Corresponds to STIX relationship_type 'targets'." ; "targets" . ### https://cyberterrain.org/ns/stones#uses rdf:type owl:ObjectProperty ; rdfs:subPropertyOf :uses . ### https://cyberterrain.org/ns/stonework#affected :affected rdf:type owl:ObjectProperty ; rdfs:domain ; rdfs:range :Product ; "Relates a vulnerability to a product known to be affected by it." ; "affected" ; "The range is a stonework:Product individual whose IRI is derived deterministically from the CPE identifier. The product individual may be populated by a separate CPE ingest; references from CVE data precede that ingest and are resolved when CPE data is loaded." . ### https://cyberterrain.org/ns/stonework#exploitsWeakness :exploitsWeakness rdf:type owl:ObjectProperty ; rdfs:domain ; rdfs:range :Weakness ; "Relates a vulnerability to the weakness class it exploits or instantiates." ; "exploitsWeakness" ; "The range is a stonework:Weakness individual whose IRI is derived from the CWE identifier. The weakness individual may be populated by a separate CWE ingest." . ### https://cyberterrain.org/ns/stonework#hasMembers :hasMembers rdf:type owl:ObjectProperty ; rdfs:domain :Group ; "hasMembers" . ### https://cyberterrain.org/ns/stonework#hasTechnique :hasTechnique rdf:type owl:ObjectProperty ; rdfs:domain :Tactic ; rdfs:range :AttackTechnique ; "Relates a tactic to an offensive technique that serves that tactic's goal." ; "hasTechnique" . ### https://cyberterrain.org/ns/stonework#hasWeakness :hasWeakness rdf:type owl:ObjectProperty , owl:AsymmetricProperty ; rdfs:domain ; rdfs:range :Weakness ; "Relates a vulnerability to the weakness class it exploits or instantiates."@en ; "hasWeakness" ; "The range is a stonework:Weakness individual whose IRI is derived from the CWE identifier. The weakness individual may be populated by a separate CWE ingest."@en . ### https://cyberterrain.org/ns/stonework#membersOf :membersOf rdf:type owl:ObjectProperty ; owl:inverseOf :hasMembers ; rdfs:range :Group ; "membersOf" . ### https://cyberterrain.org/ns/stonework#mitigatesAttackPattern :mitigatesAttackPattern rdf:type owl:ObjectProperty ; rdfs:domain :Control ; rdfs:range ; "Relates a security control to an attack pattern or technique it helps mitigate or counter." ; "mitigatesAttackPattern" ; "Range is stones:AttackPattern, which covers both abstract attack pattern classes (e.g. CAPEC) and operationalized techniques (e.g. ATT&CK), both of which are typed attack-pattern in STIX 2.1." . ### https://cyberterrain.org/ns/stonework#relatedAttackPattern :relatedAttackPattern rdf:type owl:ObjectProperty ; rdfs:domain ; rdfs:range ; "Relates any STIX object to an attack pattern it exploits, instantiates, or operationalizes." ; "relatedAttackPattern" ; "Covers two cross-dataset links: (1) CWE weakness → CAPEC attack pattern (exploits/instantiates), and (2) CAPEC attack pattern → ATT&CK technique (operationalizes). Both subjects are stones:StixObject individuals." . ### https://cyberterrain.org/ns/stonework#techniqueOf :techniqueOf rdf:type owl:ObjectProperty ; owl:inverseOf :hasTechnique ; rdfs:domain :Technique ; "techniqueOf"@en . ### https://cyberterrain.org/ns/stonework#uses :uses rdf:type owl:ObjectProperty ; rdfs:domain ; rdfs:range ; "Relates a threat actor group or campaign to an offensive technique they are known to employ." ; "uses" ; "Sub-property stones:uses carries the shortcut triples emitted by the STIX 2.1 transform for relationship_type 'uses'." . ### https://cyberterrain.org/ns/stonework#weaknessOf :weaknessOf rdf:type owl:ObjectProperty ; owl:inverseOf :hasWeakness ; rdfs:domain :Weakness ; rdfs:range ; "Relates a weakness to the vulnerability that exploits or instantiates it."@en ; "weaknessOf"@en ; "The range is a vulnerability individual. The weakness individual (domain) is a stonework:Weakness whose IRI is derived from the CWE identifier. The weakness individual may be populated by a separate CWE ingest."@en . ################################################################# # Data properties ################################################################# ### https://cyberterrain.org/ns/stones#relationshipType rdf:type owl:DatatypeProperty , owl:FunctionalProperty ; rdfs:domain ; rdfs:range xsd:string ; "The relationship_type string value from the STIX 2.1 SRO (e.g. 'uses', 'mitigates', 'subtechnique-of'). Drawn from the STIX 2.1 open vocabulary; corresponding named individuals are declared as stones:RelationshipTypeVocabulary instances in vocabularies.ttl. A shortcut object property is also asserted: stones: from source to target." ; "relationshipType" . ################################################################# # Classes ################################################################# ### https://cyberterrain.org/ns/stones#AlternateDataStream rdf:type owl:Class ; rdfs:subClassOf , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "An NTFS Alternate Data Stream (ADS) attached to a file, identified by name with optional hashes and size." ; "Alternate Data Stream"@en . ### https://cyberterrain.org/ns/stones#ArtifactObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "artifact" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf ; rdfs:isDefinedBy ; "Represents a sequence of bytes, such as the content of a file, a raw stream of network traffic, or a data blob captured from memory. The content may be embedded directly via payload_bin or referenced via url." ; "Artifact Object"@en . ### https://cyberterrain.org/ns/stones#AttackPattern rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "attack-pattern" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "A type of Tactics, Techniques, and Procedures (TTP) that describes ways that adversaries attempt to compromise targets. Often maps to MITRE ATT&CK techniques." ; "Attack Pattern"@en . ### https://cyberterrain.org/ns/stones#AutonomousSystemObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "autonomous-system" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf ; rdfs:isDefinedBy ; "Represents an Autonomous System (AS), a collection of IP routing prefixes under the control of a single administrative entity, identified by its AS number." ; "Autonomous System Object"@en . ### https://cyberterrain.org/ns/stones#Campaign rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "campaign" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "A grouping of adversary behaviours and resources with a common objective pursued over a period of time. Campaigns may be attributed to intrusion sets or threat actors." ; "Campaign"@en . ### https://cyberterrain.org/ns/stones#CourseOfAction rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "course-of-action" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "A recommendation for a specific measure to be taken in response to an attack. May describe automated responses, playbook steps, or manual mitigations." ; "Course of Action"@en . ### https://cyberterrain.org/ns/stones#DirectoryObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "directory" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf ; rdfs:isDefinedBy ; "Represents a file system directory, conveying its path and timestamps. May reference the files and sub-directories it contains." ; "Directory Object"@en . ### https://cyberterrain.org/ns/stones#DomainNameObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "domain-name" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf ; rdfs:isDefinedBy ; "Represents a network domain name. Can reference the IP addresses it resolves to." ; "Domain Name Object"@en . ### https://cyberterrain.org/ns/stones#EmailAddressObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "email-addr" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf ; rdfs:isDefinedBy ; "Represents a single email address, optionally associating it with a display name and a user account." ; "Email Address Object"@en . ### https://cyberterrain.org/ns/stones#EmailMessageObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "email-message" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf ; rdfs:isDefinedBy ; "Represents an email message, including its headers, body, and any MIME parts." ; "Email Message Object"@en . ### https://cyberterrain.org/ns/stones#EmailMimePart rdf:type owl:Class ; rdfs:subClassOf ; rdfs:isDefinedBy ; "A single MIME part within a multipart email message, including its body content, content type, and content disposition." ; "Email MIME Part"@en . ### https://cyberterrain.org/ns/stones#ExtensionDefinitionObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "extension-definition" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf ; rdfs:isDefinedBy ; "Defines a schema extension to STIX 2.1. Allows producers to add new properties or new object types in a structured, interoperable way." ; "Extension Definition Object"@en . ### https://cyberterrain.org/ns/stones#ExternalReference rdf:type owl:Class ; rdfs:subClassOf , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "A structured reference to non-STIX information, such as a CVE entry, MITRE ATT&CK technique, or external URL. Used to link STIX content to authoritative external sources." ; "External Reference"@en . ### https://cyberterrain.org/ns/stones#FileObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "file" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf ; rdfs:isDefinedBy ; "Represents a file with its metadata and optional content reference. Supports extensions for archive files, NTFS streams, PE binaries, PDF documents, and raster images." ; "File Object"@en . ### https://cyberterrain.org/ns/stones#GranularMarking rdf:type owl:Class ; rdfs:subClassOf , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "A property-level data handling marking that applies a marking definition to specific named fields of a STIX object, enabling fine-grained access control." ; "Granular Marking"@en . ### https://cyberterrain.org/ns/stones#Grouping rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "grouping" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "Explicitly asserts that a set of STIX objects share a common context without implying the existence of a threat report. Useful for linking related objects without a formal report." ; "Grouping"@en . ### https://cyberterrain.org/ns/stones#HashEntry rdf:type owl:Class ; rdfs:subClassOf , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "A single cryptographic hash entry associating a hashing algorithm with its hex-encoded digest value. Used to represent entries in the STIX hashes dictionary." ; "Hash Entry"@en . ### https://cyberterrain.org/ns/stones#IPv4AddressObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "ipv4-addr" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf ; rdfs:isDefinedBy ; "Represents one or more IPv4 addresses expressed using CIDR notation." ; "IPv4 Address Object"@en . ### https://cyberterrain.org/ns/stones#IPv6AddressObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "ipv6-addr" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf ; rdfs:isDefinedBy ; "Represents one or more IPv6 addresses expressed using CIDR notation." ; "IPv6 Address Object"@en . ### https://cyberterrain.org/ns/stones#Identity rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "identity" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "Actual individuals, organisations, or groups, as well as classes of individuals, organisations, systems, or groups. Used to represent victims, producers, or any other real-world actor." ; "Identity"@en . ### https://cyberterrain.org/ns/stones#Indicator rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "indicator" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "Contains a pattern that can be used to detect suspicious or malicious cyber activity. Patterns are expressed using the STIX Patterning Language or another supported pattern language." ; "Indicator"@en . ### https://cyberterrain.org/ns/stones#Infrastructure rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "infrastructure" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "Represents systems, software services, or any group of resources used to conduct cyber operations. Infrastructure is used by threat actors and intrusion sets both offensively and defensively." ; "Infrastructure"@en . ### https://cyberterrain.org/ns/stones#IntrusionSet rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "intrusion-set" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "A grouped set of adversarial behaviours and resources with common properties, believed to be orchestrated by a single organisation. Often represents a named APT group." ; "Intrusion Set"@en . ### https://cyberterrain.org/ns/stones#KillChainPhase rdf:type owl:Class ; rdfs:subClassOf , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "Represents a phase within a named kill chain framework, such as the MITRE ATT&CK or Lockheed Martin Cyber Kill Chain, used to categorise the stage of an attack." ; "Kill Chain Phase"@en . ### https://cyberterrain.org/ns/stones#LanguageContentObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "language-content" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf ; rdfs:isDefinedBy ; "Provides translations of string properties of another STIX object into different languages. Allows internationalisation without modifying the original object." ; "Language Content Object"@en . ### https://cyberterrain.org/ns/stones#Location rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "location" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf , [ rdf:type owl:Restriction ; owl:onProperty ; owl:maxCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty ; owl:maxCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty ; owl:maxCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty ; owl:maxCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "Represents a geographic location. May be as specific as a latitude/longitude coordinate or as broad as a continent. At least one of region, country, or latitude/longitude must be provided." ; "Location"@en . ### https://cyberterrain.org/ns/stones#MACAddressObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "mac-addr" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf ; rdfs:isDefinedBy ; "Represents a single MAC address expressed in lowercase IEEE 802 colon-hexadecimal notation." ; "MAC Address Object"@en . ### https://cyberterrain.org/ns/stones#Malware rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "malware" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "A type of TTP that represents malicious code. Captures both malware families (when is_family is true) and specific instances or samples." ; "Malware"@en . ### https://cyberterrain.org/ns/stones#MalwareAnalysis rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "malware-analysis" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "Captures the results of a malware analysis process, whether static or dynamic. Represents the output of a specific analysis run on a specific sample." ; "Malware Analysis"@en . ### https://cyberterrain.org/ns/stones#MarkingDefinitionObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "marking-definition" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf ; rdfs:isDefinedBy ; "Defines a data handling marking used to restrict or label how STIX data can be shared or handled, such as TLP markings. Referenced by object_marking_refs or granular_markings." ; "Marking Definition Object"@en . ### https://cyberterrain.org/ns/stones#MutexObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "mutex" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf ; rdfs:isDefinedBy ; "Represents a named mutual-exclusion object, commonly created or checked by malware to prevent multiple concurrent instances from running." ; "Mutex Object"@en . ### https://cyberterrain.org/ns/stones#NetworkTrafficObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "network-traffic" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf ; rdfs:isDefinedBy ; "Represents an arbitrary network traffic flow between source and destination endpoints. Supports extensions for HTTP, ICMP, socket, and TCP specifics." ; "Network Traffic Object"@en . ### https://cyberterrain.org/ns/stones#Note rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "note" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "Conveys informational text to provide further context and/or to assess the accuracy of existing STIX information. Similar to a comment or annotation on other STIX objects." ; "Note"@en . ### https://cyberterrain.org/ns/stones#ObservedData rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "observed-data" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "Conveys information observed on systems and networks, wrapping one or more SCO references together with observation metadata such as first and last observed timestamps." ; "Observed Data"@en . ### https://cyberterrain.org/ns/stones#Opinion rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "opinion" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "An assessment of the correctness of information in one or more STIX objects. Allows analysts to express agreement or disagreement with existing intelligence." ; "Opinion"@en . ### https://cyberterrain.org/ns/stones#ProcessObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "process" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf ; rdfs:isDefinedBy ; "Represents a running or terminated process on a host. Supports extensions for Windows-specific process and service attributes." ; "Process Object"@en . ### https://cyberterrain.org/ns/stones#Relationship rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "relationship" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "A directed link between two STIX Core Objects. The semantics of the link are defined by the relationship_type property." ; "Relationship"@en . ### https://cyberterrain.org/ns/stones#Report rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "report" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "A collection of threat intelligence focused on one or more topics, such as a description of a threat actor, malware, or attack technique. Used to package related STIX content." ; "Report"@en . ### https://cyberterrain.org/ns/stones#Sighting rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "sighting" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "Records that a STIX object such as an indicator, malware, tool, or threat actor was seen. Wraps observation metadata around a reference to the sighted object." ; "Sighting"@en . ### https://cyberterrain.org/ns/stones#SoftwareObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "software" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf ; rdfs:isDefinedBy ; "Represents a software product, including commercial applications, operating systems, libraries, and utilities." ; "Software Object"@en . ### https://cyberterrain.org/ns/stones#StixBundle rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "bundle" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf ; rdfs:isDefinedBy ; "A collection of arbitrary STIX objects used as a transport container. Bundles are not Core Objects, carry no modified timestamp, and cannot be referenced by identifier." ; "STIX Bundle"@en . ### https://cyberterrain.org/ns/stones#StixCoreObject rdf:type owl:Class ; rdfs:subClassOf , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "Abstract class for STIX Core Objects, comprising SDOs, SCOs, and SROs. Core objects carry a type-qualified identifier and created/modified timestamps, and may be referenced by other objects." ; "STIX Core Object"@en . ### https://cyberterrain.org/ns/stones#StixCyberobservableObject rdf:type owl:Class ; rdfs:subClassOf ; rdfs:isDefinedBy ; "Abstract class for STIX Cyber Observable Objects (SCOs), which represent technical observations such as IP addresses, files, network traffic, and processes." ; "STIX Cyber Observable Object"@en . ### https://cyberterrain.org/ns/stones#StixDomainObject rdf:type owl:Class ; rdfs:subClassOf ; rdfs:isDefinedBy ; "Abstract class for STIX Domain Objects (SDOs), which represent modelled cyber threat intelligence concepts such as malware, campaigns, threat actors, and vulnerabilities." ; "STIX Domain Object"@en . ### https://cyberterrain.org/ns/stones#StixMetaObject rdf:type owl:Class ; rdfs:subClassOf ; rdfs:isDefinedBy ; "Abstract class for STIX Meta Objects, which provide supporting infrastructure for the STIX ecosystem, including data markings, language translations, and extension definitions." ; "STIX Meta Object"@en . ### https://cyberterrain.org/ns/stones#StixObject rdf:type owl:Class ; rdfs:subClassOf [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; owl:disjointWith ; owl:hasKey ( ) ; rdfs:isDefinedBy ; "The top-level abstract class for all STIX objects, encompassing STIX Core Objects (SDOs, SCOs, SROs), Meta Objects, and Bundles." ; "STIX Object"@en . ### https://cyberterrain.org/ns/stones#StixRelationshipObject rdf:type owl:Class ; rdfs:subClassOf ; rdfs:isDefinedBy ; "Abstract class for STIX Relationship Objects (SROs), which link Core Objects to express directed relationships and sightings between them." ; "STIX Relationship Object"@en . ### https://cyberterrain.org/ns/stones#StixSubType rdf:type owl:Class ; rdfs:isDefinedBy ; "Abstract class for structured sub-types defined by the STIX 2.1 specification that are embedded as property values within STIX objects. Instances are not STIX objects: they carry no identifier, type, spec_version, created, or modified properties and cannot be referenced by identifier from other objects. Subclasses include ExternalReference, GranularMarking, KillChainPhase, HashEntry, EmailMimePart, AlternateDataStream, WindowsPeSection, WindowsRegistryValue, and X509V3Extensions." ; "STIX Sub-Type"@en . ### https://cyberterrain.org/ns/stones#ThreatActor rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "threat-actor" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "Actual individuals, groups, or organisations believed to be operating with malicious intent. Unlike Identity, a ThreatActor carries adversarial connotations." ; "Threat Actor"@en . ### https://cyberterrain.org/ns/stones#Tool rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "tool" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "Legitimate software that can be used by threat actors to perform attacks. Distinguishable from malware by being designed for benign purposes but repurposed maliciously." ; "Tool"@en . ### https://cyberterrain.org/ns/stones#URLObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "url" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf ; rdfs:isDefinedBy ; "Represents a Uniform Resource Locator conforming to RFC 3986." ; "URL Object"@en . ### https://cyberterrain.org/ns/stones#UserAccountObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "user-account" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf ; rdfs:isDefinedBy ; "Represents a user account on a system or service, including local OS accounts, cloud accounts, and social media accounts. Supports a unix-account extension for POSIX attributes." ; "User Account Object"@en . ### https://cyberterrain.org/ns/stones#Vulnerability rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "vulnerability" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "A mistake in software that can be directly used by a threat actor to gain access to a system or network. Typically identified by a CVE number via an external reference." ; "Vulnerability"@en . ### https://cyberterrain.org/ns/stones#WindowsPeSection rdf:type owl:Class ; rdfs:subClassOf , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "A single section entry within a Windows PE (Portable Executable) binary, described by its name, size, and optional entropy value." ; "Windows PE Section"@en . ### https://cyberterrain.org/ns/stones#WindowsRegistryKeyObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "windows-registry-key" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf ; rdfs:isDefinedBy ; "Represents a Windows Registry key with its full path, value entries, modification timestamp, and creator." ; "Windows Registry Key Object"@en . ### https://cyberterrain.org/ns/stones#WindowsRegistryValue rdf:type owl:Class ; rdfs:subClassOf , [ rdf:type owl:Restriction ; owl:onProperty ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "A single value entry within a Windows Registry key, comprising a name, a data string, and a registry data type." ; "Windows Registry Value"@en . ### https://cyberterrain.org/ns/stones#X509CertificateObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:hasValue "x509-certificate" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf ; rdfs:isDefinedBy ; "Represents an X.509 digital certificate, capturing its subject, issuer, validity window, public key details, and optional v3 extensions." ; "X.509 Certificate Object"@en . ### https://cyberterrain.org/ns/stones#X509V3Extensions rdf:type owl:Class ; rdfs:subClassOf ; rdfs:isDefinedBy ; "The set of X.509 version 3 extension fields present in a digital certificate, such as key usage, subject alternative names, and CRL distribution points." ; "X.509 v3 Extensions"@en . ### https://cyberterrain.org/ns/stonework#Agent :Agent rdf:type owl:Class ; rdfs:subClassOf ; rdfs:seeAlso ; "Any entity that can act, perform actions, or be attributed responsibility in a cyber or sociotechnical context."@en ; "Agent" ; "Covers human individuals, groups, organizations, and other actors (e.g. threat actors, vendors, government bodies). Used as the top-level superclass for identity-related objects in alignment with STIX Identity."@en . ### https://cyberterrain.org/ns/stonework#AttackTechnique :AttackTechnique rdf:type owl:Class ; rdfs:subClassOf :CyberTechnique ; "A prescribed offensive method used by an adversary to achieve a specific tactical objective within a target environment." ; "AttackTechnique" ; "Aligns with MITRE ATT&CK techniques and D3FEND OffensiveTechnique. Not a subclass of stones:AttackPattern — attack patterns (e.g. CAPEC) are abstract descriptions of attack classes, whereas AttackTechnique is an operationalized plan for execution. Framework-specific subclasses (e.g. attack:Technique) provide the concrete individuals." . ### https://cyberterrain.org/ns/stonework#Control :Control rdf:type owl:Class ; rdfs:subClassOf ; rdfs:comment "Instances of stonework:Control may represent individual controls, control enhancements, or sub‑controls. Framework‑specific identifiers (e.g., \"AC‑2\", \"CIS 4.1\") SHOULD be modeled using explicit properties rather than encoded in the class IRI. Control text SHOULD be referenced via citations rather than reproduced verbatim." ; "A prescribed security or privacy safeguard that specifies an action, capability, or condition intended to reduce risk, enforce policy, or achieve a defined protection objective within an information system or organization." ; "Control" ; "This class provides a semantic representation of security and privacy controls from frameworks such as NIST SP 800‑53 and the CIS Controls. It supports mapping to external control identifiers and families without embedding copyrighted control text." . ### https://cyberterrain.org/ns/stonework#CyberTechnique :CyberTechnique rdf:type owl:Class ; rdfs:subClassOf :Technique ; "A technique performed within or against cyberspace, encompassing both offensive and defensive cyber operations." ; "CyberTechnique" ; "Mirrors D3FEND's CyberTechnique class. Subclassed by stonework:AttackTechnique (offensive) and stonework:DefendTechnique (defensive), enabling a single property chain to span both ATT&CK and D3FEND individuals." . ### https://cyberterrain.org/ns/stonework#DefendTechnique :DefendTechnique rdf:type owl:Class ; rdfs:subClassOf :CyberTechnique ; "A prescribed defensive method used to detect, prevent, or respond to adversary behavior within a target environment." ; "DefendTechnique" ; "Aligns with MITRE D3FEND DefensiveTechnique. Framework-specific subclasses (e.g. d3fend:DefensiveTechnique) extend this class when D3FEND data is loaded." . ### https://cyberterrain.org/ns/stonework#Group :Group rdf:type owl:Class ; rdfs:subClassOf :Agent ; "Any collection of Persons, Organizations, or other Groups that share a common purpose or identity but do not necessarily have formal legal structure."@en ; "Group" ; "Used for informal collectives, communities, ad-hoc teams, criminal syndicates, or loose alliances. More general than Organization. Can contain other Groups or Organizations."@en . ### https://cyberterrain.org/ns/stonework#Impact :Impact rdf:type owl:Class ; rdfs:subClassOf ; rdfs:comment "Instances of stonework:Impact SHOULD specify the affected asset or mission, the type of consequence, and the severity level. Impact SHOULD be represented using explicit properties rather than encoded in class IRIs or labels." ; "The magnitude of harm, loss, or adverse effects that would result if a threat were realized and a compromise occurred, expressed in terms of mission, business, operational, or technical consequences." ; "Impact" ; "Impact represents the severity of consequences associated with a compromise. It may include effects on confidentiality, integrity, availability, safety, mission success, financial loss, or reputational damage. Impact values may be qualitative or quantitative." . ### https://cyberterrain.org/ns/stonework#Likelihood :Likelihood rdf:type owl:Class ; rdfs:subClassOf ; rdfs:comment "Instances of stonework:Likelihood may incorporate assumptions, uncertainty, adversary behavior, historical frequency, or environmental conditions. Likelihood SHOULD be represented using explicit properties rather than encoded in class IRIs or labels." ; "The estimated probability, plausibility, or frequency with which a threat could be realized and lead to a compromise under specified conditions." ; "Likelihood" ; "Likelihood reflects the chance that a compromise will occur, considering adversary capability, intent, opportunity, preconditions, and environmental factors. Likelihood values may be qualitative, ordinal, or quantitative." . ### https://cyberterrain.org/ns/stonework#Organization :Organization rdf:type owl:Class ; rdfs:subClassOf :Group ; rdfs:seeAlso ; "A formal or semi-formal structured entity such as a company, government agency, non-profit, military unit, or consortium with defined boundaries and usually legal identity."@en ; "Organization" ; "Corresponds to STIX Identity with identity_class = 'organization'. Includes corporations, government bodies, NGOs, universities, etc. Distinguished from Group by having more persistent structure, roles, and often legal standing."@en . ### https://cyberterrain.org/ns/stonework#Person :Person rdf:type owl:Class ; rdfs:subClassOf :Agent ; rdfs:seeAlso ; "A single human individual."@en ; "Person" ; "Represents real named people (e.g. employees, threat actors, researchers). Does not include legal entities or groups. Corresponds to STIX Identity with identity_class = 'individual'."@en . ### https://cyberterrain.org/ns/stonework#Procedure :Procedure rdf:type owl:Class ; rdfs:subClassOf ; rdfs:comment "Procedures are instances or patterns of execution that realize a technique. They may include command lines, API calls, malware behaviors, or operator playbook steps. Procedures are distinct from techniques, which describe generalized methods." ; "A concrete, observable sequence of actions, commands, or behaviors that implements a technique in a specific operational context." ; "Procedure" ; "Procedures describe the actual steps an adversary takes, such as specific commands, scripts, tools, or configurations. They represent the most granular level of adversary behavior." . ### https://cyberterrain.org/ns/stonework#Product :Product rdf:type owl:Class ; rdfs:subClassOf ; rdfs:comment "Instances of stonework:Product may include operating systems, applications, libraries, devices, or embedded components. Versioning, vendor attribution, and edition details SHOULD be represented using explicit properties rather than encoded strings."@en ; rdfs:isDefinedBy "https://cyberterrain.org/ns/stonework#" ; "A software, hardware, or firmware entity identified by its vendor, product name, and version characteristics, used to represent a specific platform or component within vulnerability, configuration, or threat‑intelligence contexts."@en ; "Product" ; "This class provides a semantic representation of platform entities commonly identified using CPE naming schemes. It does not require the use of CPE, but supports mapping to CPE identifiers when available."@en . ### https://cyberterrain.org/ns/stonework#Risk :Risk rdf:type owl:Class ; rdfs:subClassOf ; rdfs:comment "Instances of stonework:Risk may reference the threat being considered, the assets affected, the expected impact of compromise, and the likelihood of occurrence. Risk values may be qualitative or quantitative, and SHOULD be represented using explicit properties rather than encoded in class IRIs or labels." ; "A measure of the potential for loss or adverse effects arising from the realization of a threat, expressed as a function of the impact of compromise and the likelihood that the compromise will occur." ; "Risk" ; "This class represents the assessed or estimated level of exposure to harm for a specific asset, mission, or organization. Risk is typically derived from the combination of impact and likelihood, and may incorporate assumptions, uncertainty, and contextual factors." . ### https://cyberterrain.org/ns/stonework#Tactic :Tactic rdf:type owl:Class ; rdfs:subClassOf ; rdfs:comment "Instances of stonework:Tactic SHOULD correspond to high‑level adversary goals. Techniques are typically modeled as children or members of a tactic." ; "A high‑level adversary objective or strategic goal that groups related techniques by the purpose they serve during an intrusion or operation." ; "Tactic" ; "Tactics represent the strategic intent behind adversary behavior, such as gaining initial access, executing code, or exfiltrating data. They serve as conceptual categories for techniques." . ### https://cyberterrain.org/ns/stonework#Technique :Technique rdf:type owl:Class ; rdfs:subClassOf ; rdfs:comment "Mirrors D3FEND's Technique class and reflects the PROV-O Plan philosophy: a technique is a plan that describes how an action should be carried out, distinct from the activity that executes it. Subclassed by stonework:CyberTechnique for cyber-specific methods." ; "A reusable, prescribed method for achieving an objective, which may be instantiated as a concrete execution by an actor or system." ; "Technique" ; "Technique is intentionally not a subclass of stones:AttackPattern. Attack patterns (e.g. CAPEC) are abstract descriptions of attack classes in the STIX sense; techniques are operationalized plans. See stonework:CyberTechnique, stonework:AttackTechnique, stonework:DefendTechnique." . ### https://cyberterrain.org/ns/stonework#Threat :Threat rdf:type owl:Class ; rdfs:subClassOf ; rdfs:comment "Instances of stonework:Threat may describe adversary capabilities, strategic objectives, targeting patterns, or environmental conditions that increase the likelihood of harmful action. Threats may be linked to threat actors, campaigns, malware, TTPs, weaknesses, or assets, but are conceptually distinct from the actions or events that realize them." ; "A potential or actual source of harm arising from an adversary's capability, intent, and opportunity to exploit weaknesses or create adverse effects within a system, organization, or mission." ; "Threat" ; "This class represents the abstract notion of a cyber threat, independent of specific threat actors, campaigns, or events. It provides a semantic foundation for modeling adversary capabilities, intentions, targeting, and conditions that give rise to harmful outcomes." . ### https://cyberterrain.org/ns/stonework#ThreatScenario :ThreatScenario rdf:type owl:Class ; rdfs:subClassOf ; rdfs:comment "Instances of stonework:ThreatScenario may include assumptions, triggering conditions, targeted assets, adversary profiles, attack paths, and expected impacts. Threat scenarios are distinct from threats, attacks, or incidents; they represent hypothetical or anticipated sequences rather than observed events." ; "A structured description of how a threat could materialize against specific assets or missions, incorporating adversary intent, capability, opportunity, preconditions, and potential consequences." ; "ThreatScenario" ; "Threat scenarios describe plausible or anticipated sequences of adversarial behavior and environmental conditions that could lead to harmful outcomes. They support risk assessment, prioritization, and strategic planning by expressing how threats may be realized in a given organizational context." . ### https://cyberterrain.org/ns/stonework#Weakness :Weakness rdf:type owl:Class ; rdfs:subClassOf ; rdfs:comment "Instances of stonework:Weakness may represent base weaknesses, variant weaknesses, or compound weaknesses. CWE identifiers (e.g., \"CWE‑79\") SHOULD be modeled using explicit properties rather than encoded in the class IRI. Descriptions and extended details SHOULD be referenced via citations rather than reproduced verbatim." ; "A type of flaw, fault, or design condition in software, hardware, or system architecture that can enable vulnerabilities, reduce security assurance, or increase the likelihood of exploitable behavior." ; "Weakness" ; "This class provides a semantic representation of weakness types defined in the Common Weakness Enumeration (CWE). It supports hierarchical relationships, abstraction levels, and mappings to related attack patterns, vulnerabilities, and security controls." . ################################################################# # General axioms ################################################################# [ rdf:type owl:AllDisjointClasses ; owl:members ( ) ] . ### Generated by the OWL API (version 5.1.18) https://github.com/owlcs/owlapi/