Currently all observable content in UCO is specified in a single huge monolithic observable.ttl file.
There are several issues with this current state including:
The file is so big that it causes some rdf tools to hang or crash
It requires a take it all or nothing choice to adopters. Different use cases have a need for different sets of observable types. Just like the rest of UCO, observables should be modularized so that adopters can choose to adopt the portions they wish and ignore other parts.
It is difficult to find any specific class or property in the huge monolith.
It is difficult to pull together sets of classes and properties relevant for any particular observable type.
The above problems will only become more and more pronounced as expressive coverage for more observables is added. In the near future a great deal more are likely to be added.
Propose to break up observable.ttl into a set of more granular ttl files where each is focused on a particular type of observable (e.g., account.ttl, autonomous-system.ttl, file.ttl, etc.)
Currently all observable content in UCO is specified in a single huge monolithic observable.ttl file. There are several issues with this current state including:
Propose to break up observable.ttl into a set of more granular ttl files where each is focused on a particular type of observable (e.g., account.ttl, autonomous-system.ttl, file.ttl, etc.)