ucoProject / UCO

This repository is for development of the Unified Cyber Ontology.
Apache License 2.0
73 stars 34 forks source link

`observable:AlternateDataStream` is not a subclass of `FileSystemObject`, but `File` and `ReparsePoint` are #590

Closed ajnelson-nist closed 2 weeks ago

ajnelson-nist commented 4 months ago

Bug description

These lines in UCO 1.3.0 designate AlternateDataStream as a "top-level" class under ObservableObject. However, the rdfs:comment definition scopes the concept to being specific to NTFS files (and hence NTFS file systems).

It seems AlternateDataStream should be moved under observable:FileSystemObject.

Steps to reproduce

See disparity between AlternateDataStream and, e.g., ReparsePoint, another NTFS-specific file system object.

Coordination

ajnelson-nist commented 4 months ago

I think the right thing to do here is:

sbarnum commented 4 months ago

I concur with this proposal and the suggested approach for 2.0.0 and 1.4.0 in the above comment.

ajnelson-nist commented 1 month ago

I intend to handle this as a fast-track proposal. The ultimate change for UCO 2.0.0 is a 1-liner in the ontology, but we haven't held any votes yet on the "pre-2.0.0 soft warning" style of subclass hierarchy rearrangement that I've put into PR #604 .

ajnelson-nist commented 1 month ago

Noting for the sake of review: I tested (for another proposal) whether the documentation build system would render the anonymous shape on the generated class page, when linked by rdfs:seeAlso. It does.

ajnelson-nist commented 1 month ago

Noting for today's vote:

Unit tests have been updated, and CI passes, on both attached Pull Requests.

The PRs have not yet run through the review checklist that has often been done before holding a Solutions Approval vote.

The review checklists are in place to catch when there would be effects on any of the examples posted across CASE's example repositories. At the moment, per this data-driven list of ontology concepts used in CASE's examples, there are no instances of uco-observable:AlternateDataStream. So, the review checklist is unlikely to raise any issues.