From 4482054bc10e2d7544801a96feb1c9ac15cc519f Mon Sep 17 00:00:00 2001 From: Alex Nelson Date: Fri, 21 Feb 2025 09:50:25 -0500 Subject: [PATCH 1/3] Revise vocabulary pattern for `investigation:investigationForm` No effects were observed on Make-managed files. References: * https://github.com/ucoProject/UCO/issues/629 Signed-off-by: Alex Nelson --- dependencies/UCO | 2 +- ontology/investigation/investigation.ttl | 39 ++++++++---------------- ontology/vocabulary/vocabulary.ttl | 6 ++-- 3 files changed, 16 insertions(+), 31 deletions(-) diff --git a/dependencies/UCO b/dependencies/UCO index 0405eac..e6decb6 160000 --- a/dependencies/UCO +++ b/dependencies/UCO @@ -1 +1 @@ -Subproject commit 0405eac9c93f1fc6f06ef731f784f4b00cbc339c +Subproject commit e6decb6f6db604ea106d52365105663df282f0a7 diff --git a/ontology/investigation/investigation.ttl b/ontology/investigation/investigation.ttl index 532a702..90781cd 100644 --- a/ontology/investigation/investigation.ttl +++ b/ontology/investigation/investigation.ttl @@ -128,45 +128,30 @@ investigation:Investigation sh:nodeKind sh:Literal ; sh:path investigation:investigationStatus ; ] , + [ + sh:datatype xsd:string ; + sh:message "As of CASE 1.4.0, the datatype to use for investigation:investigationForm should be xsd:string. Not using xsd:string will be an error in CASE 2.0.0." ; + sh:path investigation:investigationForm ; + sh:severity sh:Warning ; + ] , [ sh:datatype xsd:string ; sh:nodeKind sh:Literal ; sh:path investigation:focus ; ] , [ - sh:datatype vocabulary:InvestigationFormVocab ; - sh:message "Value is outside the default vocabulary InvestigationFormVocab." ; + sh:in ( + "case" + "incident" + "suspicious-activity" + ) ; + sh:message "Value is not member of the vocabulary InvestigationFormVocab." ; sh:path investigation:investigationForm ; sh:severity sh:Info ; ] , [ sh:maxCount "1"^^xsd:integer ; sh:nodeKind sh:Literal ; - sh:or ( - [ - sh:datatype vocabulary:InvestigationFormVocab ; - ] - [ - sh:datatype xsd:string ; - ] - ) ; - sh:path investigation:investigationForm ; - ] , - [ - sh:message "Value is not member of the vocabulary InvestigationFormVocab." ; - sh:or ( - [ - sh:datatype vocabulary:InvestigationFormVocab ; - sh:in ( - "case"^^vocabulary:InvestigationFormVocab - "incident"^^vocabulary:InvestigationFormVocab - "suspicious-activity"^^vocabulary:InvestigationFormVocab - ) ; - ] - [ - sh:datatype xsd:string ; - ] - ) ; sh:path investigation:investigationForm ; ] ; diff --git a/ontology/vocabulary/vocabulary.ttl b/ontology/vocabulary/vocabulary.ttl index b470af5..e2a34f2 100644 --- a/ontology/vocabulary/vocabulary.ttl +++ b/ontology/vocabulary/vocabulary.ttl @@ -19,9 +19,9 @@ vocab:InvestigationFormVocab owl:equivalentClass [ a rdfs:Datatype ; owl:oneOf ( - "case"^^vocab:InvestigationFormVocab - "incident"^^vocab:InvestigationFormVocab - "suspicious-activity"^^vocab:InvestigationFormVocab + "case" + "incident" + "suspicious-activity" ) ; ] ; . From aafa90ee04a5dc0427a59847f0ee60efed310561 Mon Sep 17 00:00:00 2001 From: Alex Nelson Date: Wed, 26 Feb 2025 11:22:41 -0500 Subject: [PATCH 2/3] Move sh:in review to named PropertyShape No effects were observed on Make-managed files. References: * https://github.com/ucoProject/UCO/issues/629 Signed-off-by: Alex Nelson --- dependencies/UCO | 2 +- ontology/investigation/investigation.ttl | 23 +++++++++++++---------- 2 files changed, 14 insertions(+), 11 deletions(-) diff --git a/dependencies/UCO b/dependencies/UCO index e6decb6..d524b8e 160000 --- a/dependencies/UCO +++ b/dependencies/UCO @@ -1 +1 @@ -Subproject commit e6decb6f6db604ea106d52365105663df282f0a7 +Subproject commit d524b8eb57549e54eb475f37d2b6ce523815bbbf diff --git a/ontology/investigation/investigation.ttl b/ontology/investigation/investigation.ttl index 90781cd..7c82faf 100644 --- a/ontology/investigation/investigation.ttl +++ b/ontology/investigation/investigation.ttl @@ -105,6 +105,7 @@ investigation:Investigation rdfs:label "Investigation"@en ; rdfs:comment "An investigation is a grouping of characteristics unique to an exploration of the facts involved in a cyber-relevant set of suspicious activity."@en ; sh:property + investigation:Investigation-investigationForm-in-shape , [ sh:class investigation:Authorization ; sh:nodeKind sh:BlankNodeOrIRI ; @@ -139,16 +140,6 @@ investigation:Investigation sh:nodeKind sh:Literal ; sh:path investigation:focus ; ] , - [ - sh:in ( - "case" - "incident" - "suspicious-activity" - ) ; - sh:message "Value is not member of the vocabulary InvestigationFormVocab." ; - sh:path investigation:investigationForm ; - sh:severity sh:Info ; - ] , [ sh:maxCount "1"^^xsd:integer ; sh:nodeKind sh:Literal ; @@ -158,6 +149,18 @@ investigation:Investigation sh:targetClass investigation:Investigation ; . +investigation:Investigation-investigationForm-in-shape + a sh:PropertyShape ; + sh:in ( + "case" + "incident" + "suspicious-activity" + ) ; + sh:message "Value is not member of the vocabulary InvestigationFormVocab." ; + sh:path investigation:investigationForm ; + sh:severity sh:Info ; + . + investigation:InvestigativeAction a owl:Class , From 7ecdaf4184e38a059ac8d2d756a271b8f9f32b60 Mon Sep 17 00:00:00 2001 From: Alex Nelson Date: Mon, 17 Mar 2025 14:33:50 -0400 Subject: [PATCH 3/3] Bump UCO to current state of develop No effects were observed on Make-managed files. References: * https://github.com/ucoProject/UCO/issues/629 Signed-off-by: Alex Nelson --- dependencies/UCO | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dependencies/UCO b/dependencies/UCO index d524b8e..eff5e3b 160000 --- a/dependencies/UCO +++ b/dependencies/UCO @@ -1 +1 @@ -Subproject commit d524b8eb57549e54eb475f37d2b6ce523815bbbf +Subproject commit eff5e3bc3c646d52347c669b3dccffd6e77e7216