search

oasis-open / tac-ontology

OASIS Threat Actor Context (TAC) TC: Creating an ontology for expressing the rich context around Threat Actors. https://github.com/oasis-open/tac-ontology
BSD 3-Clause "New" or "Revised" License
9 stars 4 forks source link

IRI for STIX vocabulary values? #61

Open peternowee opened 5 months ago

peternowee commented 5 months ago

Hi,

More a support question, but perhaps a feature request:

I am looking for an IRI to use instead of a string when referring to STIX vocabulary values.

For example, if I want to refer to the value organizational-gain from the Attack Motivation Vocabulary attack-motivation-ov as defined in stix/vocabularies/vocabularies.owl:

<owl:NamedIndividual rdf:about="&stix;_Organizational-gain-amov">
    <rdf:type rdf:resource="&stix;AttackMotivationOv"/>
</owl:NamedIndividual>

Now if I have this example triple...

@prefix example: <http://example/ns/> .
@prefix stix: <http://docs.oasis-open.org/cti/ns/stix#> .
example:intrusion-set--9e759eb6-d189-11ee-bcf6-4761ad7c56c4 a stix:StixObject ;
    stix:primary_motivation "organizational-gain" .

Can I replace that last line with the following?

    stix:primary_motivation stix:_Organizational-gain-amov .

The underscore at the start (_Organizational-gain-amov) gives the impression that it is for internal use only. I know it is used "internally" in the SWRL rules in threat-actor.owl and intrusion-set.owl, but can I refer to that IRI directly "externally" as well?

If not, is some other IRI for vocabulary values foreseen, or am I completely misunderstanding? Hope to hear your thoughts. Thanks!

rhohimer commented 1 month ago

@peternowee I'm so sorry for this epic failure. The intension of the underscore at the start of the _Organizational-gain-amov is as a visual clue that it is and instance (owl:NamedIndividual). This is an instance of rdf:type stix:AttackMotivationOv

You have highlighted an error in the current ontology. In the STIX 2.1 Specification, the property of primary_motivation is to be of type string. In the stix ontology (stix.owl), the primary_motivation SHOULD BE an Object Property, not a Data Type Property.

It is my opinion that instances (owl:NamedIndividual) should have as a datatype property their STIX 2.1 Specification string value. Allowing the triple: stix:_Organizational-gain-amov stix:has-specification-string "organizational-gain"^^xsd:string

If you are still interested, and looking at this, I am available to discuss further. In the meantime, I will correct the error in the current ontology. If I can, I will implement a use case to illustrate the use of the vocabularies.