--- # Security Domain Ontology # # A MIF entity ontology for cybersecurity: threats and the techniques that # realize them, vulnerabilities and the weakness classes they instantiate, # controls and the frameworks that define them, threat actors, campaigns, # indicators of compromise, malware, supply-chain risk, policies, assessments, # and the OSCAL/STIX tooling around them. Extends the MIF base cognitive triad # with domain-specific entity types grounded in actively-maintained, standards- # body and community security vocabularies. # # Compatible with: mif-base v1.0.0, shared-traits v1.0.0 # # Version: 0.1.0 # # Provenance: authored from the `domain-ontology-pack-expansion` research session # (entity-inventory.json, 16 security `mint` rows; relationship-inventory.json, 12 # security edges; ontology-build-spec.md §2.1, §3.1, §9.1). This pack mints only # the 16 `mint` types; the 3 `extend` types (security-threat, security-framework, # security-incident) are added to the software-engineering pack and are referenced # here only as cross-pack relationship endpoints. Each type's schema.properties is # the inventory `schema_fields` set (snake-cased), the concrete fields an # implementer writes into the YAML. The control grounding is the gate-corrected # figure: ~1,196 controls across 20 families (the round-2 "~1007" figure is # inaccurate). # # Sources: # - MITRE ATT&CK (techniques, tactics, groups, campaigns, software, mitigations) https://attack.mitre.org/ # - MITRE CAPEC (attack-pattern dictionary) https://capec.mitre.org/ # - CVE / NVD (vulnerability instances) https://cve.mitre.org/ # - MITRE CWE (weakness classes) https://cwe.mitre.org/ # - NIST SP 800-53 Rev.5 (security controls, 20 families / ~1,196 controls) https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final # - NIST OSCAL (SSP, Profile, Assessment, POA&M models) https://pages.nist.gov/OSCAL/ # - NIST SP 800-161r1 (C-SCRM supply-chain risk) https://csrc.nist.gov/pubs/sp/800/161/r1/final # - OASIS STIX 2.1 (Indicator, Malware, Tool, Infrastructure, Report SDOs) https://oasis-open.github.io/cti-documentation/stix/intro # - OWASP (Top 10 / ASVS) https://owasp.org/ # - VERIS (incident schema) https://verisframework.org/ ontology: id: software-security version: "0.4.0" description: "Software-security domain ontology — the software-facing slice of security: threats, vulnerabilities, controls, actors, indicators, supply-chain, incidents, frameworks" extends: - engineering-base # =========================================================================== # CUSTOM NAMESPACES (nested under the mif-base cognitive triad) # =========================================================================== namespaces: semantic: children: threats: description: "Attack tactics, malware, and threat techniques" type_hint: semantic vulnerabilities: description: "CVE vulnerability instances" type_hint: semantic weaknesses: description: "CWE weakness classes" type_hint: semantic controls: description: "Security controls and safeguards" type_hint: semantic actors: description: "Threat actors and intrusion sets" type_hint: semantic indicators: description: "Indicators of compromise" type_hint: semantic supply-chain: description: "Supply-chain (C-SCRM) risks" type_hint: semantic episodic: children: campaigns: description: "Attack campaigns and threat-intelligence reports" type_hint: episodic assessments: description: "Security assessments and audits" type_hint: episodic procedural: children: policies: description: "Security policies and plans of action" type_hint: procedural # =========================================================================== # ENTITY TYPES (16 mint types; the 3 extend types live in software-engineering) # Each type's schema.properties == its inventory schema_fields (snake-cased). # =========================================================================== entity_types: # ----- Threats: tactics, techniques, malware ---------------------------- - name: attack-tactic description: "An adversary tactical objective (the why of a technique)" base: semantic # MITRE ATT&CK Tactic (x-mitre-tactic) traits: - cited schema: required: - tactic_id - name properties: name: type: string tactic_id: type: string shortname: type: string description: type: string external_references: type: array items: type: string techniques_count: type: integer source_vocab: MITRE ATT&CK source_class: Tactic prior_art: https://attack.mitre.org/tactics/ disposition: mint - name: attack-mitigation description: "A course of action that mitigates one or more ATT&CK techniques" negative_examples: - "Describes the range of techniques adversaries commonly employ to gain initial entry into a network, from social engineering via phishing to exploitation of unpatched systems and abuse of legitimate credentials." base: procedural # MITRE ATT&CK Mitigation (course-of-action, M-prefixed) traits: - cited schema: required: - mitigation_id - name properties: mitigation_id: type: string name: type: string description: type: string mitigates_techniques: type: array items: type: string related_controls: type: array items: type: string source_vocab: MITRE ATT&CK source_class: Mitigation (course-of-action) prior_art: https://attack.mitre.org/mitigations/ disposition: mint - name: malware description: "A malicious software family or instance" negative_examples: - "Software features or system components that can be selectively restricted or disabled to prevent their abuse by adversaries, including legacy protocols, scripting engines, and unnecessary services." - "A large-scale compromise of a third-party managed file-transfer platform used by thousands of organizations, resulting in unauthorized data access and exfiltration through exploitation of a critical software vulnerability." - "Compromise of a widely-used open-source package through insertion of obfuscated malicious code in build scripts or test files, targeting a critical downstream dependency used by millions of systems." - "A coordinated multi-phase attack operation targeting critical infrastructure, using wiper-style payloads and network spreading techniques to cause widespread disruptive impact across interconnected systems." - "A legitimate domain registered to support a kill-switch mechanism, serving to disable or control the behavior of a self-replicating worm if the kill-switch domain can be contacted." - "An extortion and encryption attack offered as a service, where criminals provide the ransomware toolkit and infrastructure in exchange for a percentage of recovery payments from victims." - "Stuxnet is cataloged as malware, but researchers attribute its development to a joint US-Israel operation targeting Natanz's centrifuges, a threat-actor question, not a malware catalog entry." base: semantic # STIX 2.1 Malware SDO / MITRE ATT&CK Software traits: - cited - dated - versioned schema: required: - name properties: name: type: string is_family: type: boolean malware_types: type: array items: type: string # STIX malware-type-ov (open) aliases: type: array items: type: string kill_chain_phases: type: array items: type: string capabilities: type: array items: type: string operating_system_refs: type: array items: type: string implementation_languages: type: array items: type: string first_seen: type: string format: date-time last_seen: type: string format: date-time source_vocab: MITRE ATT&CK / STIX 2.1 source_class: Software (ATT&CK - malware and tool subtypes) / malware SDO (STIX 2.1) prior_art: STIX 2.1 malware SDO disposition: mint # ----- Vulnerabilities & weaknesses ------------------------------------- - name: vulnerability description: "A CVE vulnerability instance in a product or component" negative_examples: - "An SBOM alone flags every CVE in its listed components; a VEX document, in OpenVEX or CSAF format, is what lets a vendor formally declare a finding unreachable and not affected." base: semantic # CVE / NVD vulnerability instance (chains CVE -> CWE -> CAPEC -> ATT&CK) traits: - cited - dated schema: required: - cve_id - vulnerability_name properties: cve_id: type: string vulnerability_name: type: string weakness_class: type: string cvss_score: type: number affected_product: type: string affected_versions: type: array items: type: string published_date: type: string format: date remediation: type: string source_vocab: CVE/CWE/NVD source_class: CVE Vulnerability Instance prior_art: https://cve.mitre.org/ disposition: mint - name: weakness description: "A CWE weakness class (a flaw type, distinct from a CVE instance)" base: semantic # MITRE CWE Weakness (abstraction levels Pillar > Class > Base > Variant) traits: - cited - versioned schema: required: - cwe_id - weakness_name properties: cwe_id: type: string weakness_name: type: string abstraction_level: type: string # CWE Abstraction (closed set) enum: - pillar - class - base - variant - compound description: type: string consequences: type: array items: type: string applicable_platforms: type: array items: type: string likelihood_of_exploit: type: string # CWE Likelihood Of Exploit (closed set; normalized to lowercase per the # template enum convention, cf. software-engineering incident severity) enum: - high - medium - low - unknown related_weaknesses: type: array items: type: string source_vocab: MITRE CWE source_class: Weakness prior_art: https://cwe.mitre.org/ disposition: mint # ----- Controls --------------------------------------------------------- - name: security-control description: "A security control or safeguard (the security specialization of the generic engineering-base `control`)" negative_examples: - "A prescriptive safeguard requires that code changes be reviewed and approved by a second person before merging, enforced through branch protection settings that reject pushes lacking required review status." - "An allowlist-based input validation design pattern rejects any input that does not match a known-safe pattern rather than trying to blacklist dangerous patterns, reducing the risk of bypass attacks." - "The failure to properly encode or sanitize user-supplied HTML and JavaScript in web application output, allowing an attacker to inject malicious scripts that execute in the browser of victim users." base: semantic subtype_of: - control # NIST SP 800-53 Rev.5 Security Control (20 families / ~1,196 controls) + OSCAL traits: - cited - versioned schema: required: - control_id - control_name properties: control_id: type: string control_name: type: string control_family: type: string objective: type: string implementation_guidance: type: string baseline: type: string # NIST SP 800-53B baselines (closed set; includes the Privacy baseline) enum: - low - moderate - high - privacy enhancements: type: array items: type: string source_vocab: NIST SP 800-53 Rev.5 source_class: Security Control prior_art: https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final disposition: mint # ----- Actors, campaigns, indicators ------------------------------------ - name: threat-actor description: "A threat actor or intrusion set" negative_examples: - "Zero-trust adoption was driven by the Colonial Pipeline breach, where one compromised VPN credential without MFA gave broad network access, a perimeter-model failure, not a threat-actor catalog entry." - "Falco detects runtime threats via kernel syscall events, such as a write to /etc/shadow, filling the gap static scanners and OPA/Gatekeeper miss, it's a security tool, not a threat actor." - "An organized series of coordinated attacks targeting multiple major corporations, employing sophisticated phishing and zero-day exploitation techniques to achieve intellectual property theft and surveillance access." - "A tiered command-and-control infrastructure consisting of multiple staged relay servers and domain registrations designed to obscure the true location and origin of attack communications." - "An attack vector leveraging weak credential validation at login endpoints, allowing unauthorized access through reuse of previously compromised username-password pairs across multiple services." - "A sophisticated, state-sponsored cyberweapon designed to target industrial control systems, featuring self-propagation across USB devices and zero-day exploitation of multiple operating system components." - "A continuous process of collecting, analyzing, and responding to security events and anomalies across an organization's infrastructure to detect unauthorized access, data exfiltration, and malicious activity." - "A large-scale retail data breach targeting millions of customer payment card records through exploitation of inadequately segmented network architecture and unpatched point-of-sale systems." base: semantic # MITRE ATT&CK Group / Intrusion Set (STIX intrusion-set SDO) traits: - cited - attributed schema: required: - name properties: name: type: string aliases: type: array items: type: string threat_actor_types: type: array items: type: string # STIX threat-actor-type-ov (open) roles: type: array items: type: string # STIX threat-actor-role-ov (open) goals: type: array items: type: string sophistication: type: string # STIX threat-actor-sophistication-ov (open) resource_level: type: string # STIX attack-resource-level-ov (open) primary_motivation: type: string # STIX attack-motivation-ov (open) first_seen: type: string format: date-time last_seen: type: string format: date-time source_vocab: MITRE ATT&CK source_class: Group / Intrusion Set prior_art: https://attack.mitre.org/groups/ disposition: mint - name: attack-campaign description: "A grouping of adversarial behaviour over a period of time" base: episodic # MITRE ATT&CK Campaign (STIX Campaign SDO, ATT&CK v14.0+) traits: - timeline - cited schema: required: - campaign_name properties: campaign_name: type: string first_seen: type: string format: date-time last_seen: type: string format: date-time attributed_to: type: string objectives: type: array items: type: string aliases: type: array items: type: string source_vocab: MITRE ATT&CK source_class: Campaign prior_art: https://attack.mitre.org/campaigns/ disposition: mint - name: indicator-of-compromise description: "An observable pattern that indicates malicious activity" base: semantic # STIX 2.1 Indicator SDO; MISP indicator sharing format traits: - cited - dated schema: required: - name - pattern properties: name: type: string pattern: type: string pattern_type: type: string # STIX pattern-type-ov (open) pattern_version: type: string valid_from: type: string format: date-time valid_until: type: string format: date-time indicator_types: type: array items: type: string # STIX indicator-type-ov (open) kill_chain_phases: type: array items: type: string source_vocab: STIX 2.1 / OASIS CTI source_class: Indicator (STIX Domain Object) prior_art: https://oasis-open.github.io/cti-documentation/stix/intro disposition: mint - name: security-infrastructure description: "Adversary or defensive infrastructure (servers, domains, hosting)" aliases: - "signing infrastructure" - "verification infrastructure" - "trust infrastructure" - "package security infrastructure" exemplars: - "A package manager automatically verifies a cryptographic checksum against a public transparency log before trusting a downloaded module" - "An extension marketplace now requires developer-registered private-key signing on every future upload, rejecting anything unsigned" - "An official plugin directory applies automated security review to listings but explicitly cannot verify every server a plugin might call" negative_examples: - "Enforcing mTLS at the service-mesh layer guarantees workload-identity-authenticated encryption on every internal connection, rejecting perimeter-only segmentation as insufficient against post-foothold lateral movement." base: semantic # STIX 2.1 Infrastructure SDO traits: - cited schema: required: - name properties: name: type: string infrastructure_types: type: array items: type: string # STIX infrastructure-type-ov (open) aliases: type: array items: type: string kill_chain_phases: type: array items: type: string first_seen: type: string format: date-time last_seen: type: string format: date-time description: type: string source_vocab: CIS / NIST source_class: Security Infrastructure Component prior_art: https://www.cisecurity.org/controls/ disposition: mint - name: security-tool description: "A legitimate tool that can be used by adversaries or defenders" aliases: - "verification tool" - "signing tool" - "attestation CLI tool" - "package security tool" exemplars: - "A package manager's chain-of-trust verifies a signed release manifest against trusted keys before installing anything, blocking by default on failure" - "A command-line tool verifies a file's signature keylessly by pinning a certificate identity and issuer rather than a static key" - "A package manager's opt-in attestation verification wraps another CLI tool to hard-fail an install when provenance verification fails" negative_examples: - "A TLS/SSL fingerprint artifact associated with a particular remote-access framework, allowing defenders to identify command-and-control communications even when encrypted." - "Cobalt Strike team servers serve both authorized red teams and criminal C2 infrastructure; defenders fingerprint them via JA3/JARM TLS and malleable-C2 beacon-interval analysis rather than default signatures." base: semantic # STIX 2.1 Tool SDO traits: - cited - versioned schema: required: - name properties: name: type: string tool_types: type: array items: type: string # STIX tool-type-ov (open) aliases: type: array items: type: string kill_chain_phases: type: array items: type: string tool_version: type: string description: type: string source_vocab: NIST source_class: Security Tool / Capability prior_art: https://csrc.nist.gov/ disposition: mint - name: threat-intelligence-report description: "A curated threat-intelligence report grouping related CTI objects" negative_examples: - "Mean time to detect (MTTD) and dwell time together measure the elapsed time from when a breach occurs (or evidence of compromise is logged) to when security operations detect and confirm it, serving as a key indicator of detection capability maturity." - "A sophisticated, long-duration attack operation targeting industrial control systems and critical infrastructure, employing living-off-the-land techniques and prioritizing stealth and persistence over disruptive impact." - "Equifax attackers lingered roughly 76 days, exfiltrating data on nearly half the US population, leading to a $700 million FTC settlement, a report on patch-delay consequences, not a threat actor." base: episodic # STIX 2.1 Report SDO traits: - cited - dated - documented schema: required: - name properties: name: type: string report_types: type: array items: type: string published: type: string format: date-time object_refs: type: array items: type: string description: type: string source_vocab: STIX 2.1 / OASIS CTI source_class: Report (STIX Domain Object) prior_art: https://oasis-open.github.io/cti-documentation/stix/intro disposition: mint # ----- Supply chain ----------------------------------------------------- - name: supply-chain-risk description: "A cyber supply-chain (C-SCRM) supplier or component risk" aliases: - "supply chain vulnerability" - "dependency risk" - "package supply chain threat" - "software supply-chain attack" exemplars: - "A package registry verifies integrity only by checksum, with no cryptographic signing yet, leaving a gap versus other language ecosystems" - "A verification command silently returned success even when no attestation existed at all, until a later patched version fixed it" - "An attacker compromised a maintainer's credentials and repointed every version tag of a widely used action to a malicious commit" base: semantic # NIST SP 800-161r1 C-SCRM Risk / Supplier Risk (SR control overlays, SBOM) traits: - cited - versioned schema: required: - risk_id - risk_statement properties: risk_id: type: string risk_statement: type: string supplier_name: type: string component_type: type: string likelihood: type: string # NIST SP 800-30 likelihood (closed set) enum: - very-low - low - moderate - high - very-high impact_level: type: string # NIST SP 800-30 impact (closed set) enum: - very-low - low - moderate - high - very-high risk_response: type: string # NIST SP 800-39 risk response (closed set: the five responses) enum: - accept - avoid - mitigate - share - transfer mitigation_controls: type: array items: type: string source_vocab: NIST SP 800-161r1 source_class: C-SCRM Risk / Supplier Risk prior_art: https://csrc.nist.gov/pubs/sp/800/161/r1/final disposition: mint # ----- Policies, assessments, plans of action --------------------------- - name: security-policy description: "A security policy grounded in an OSCAL system security plan / profile" negative_examples: - "An API gateway deployed as a policy enforcement point is a design pattern where all service-to-service requests flow through a gateway that applies authentication, authorization, and rate-limiting rules before forwarding." - "The implementation of multi-factor authentication across all user authentication endpoints as a required technical control for reducing unauthorized access risk through credential compromise." - "Technical implementation of cryptographic algorithms and key-management procedures for protecting data at rest and in transit, including cipher-strength requirements and key-derivation practices." base: procedural # NIST OSCAL System Security Plan (SSP) + Profile layer traits: - versioned - documented - cited schema: required: - policy_name properties: policy_name: type: string policy_version: type: string policy_status: type: string system_name: type: string system_id: type: string authorization_boundary: type: string control_implementations: type: array items: type: string responsible_parties: type: array items: type: string source_vocab: NIST OSCAL source_class: System Security Plan / Profile prior_art: https://pages.nist.gov/OSCAL/ disposition: mint - name: security-assessment description: "A security assessment, audit, or test of a system" negative_examples: - "Unlike a fixed-duration penetration test, a bug bounty program run through a platform like HackerOne or Bugcrowd operates continuously with a defined scope, an ongoing practice, not a discrete assessment." - "A control runs at push time to detect credentials matching known patterns before they reach shared branches, paired with a documented incident-response runbook for when real credentials are detected as already pushed." - "The metric tracking the number of open critical security findings in the backlog measures the aggregate count of unresolved vulnerabilities above a severity threshold, updated daily to reflect the current remediation queue depth." - "The fail-secure design pattern ensures that when a system encounters an error or component failure, it defaults to denying access or rejecting operations rather than inadvertently granting permissions." - "A security design review gate discipline requires that all architectural changes above a size threshold undergo formal security design review by the security team before implementation, documenting the threat model and mitigations." - "A dual-purpose network utility that performs port scanning and service enumeration through TCP/IP-level probes, equally useful for both legitimate infrastructure inventory and attacker reconnaissance." - "A behavioral pattern in Windows Event Logs showing access to the LSASS process memory in a manner consistent with credential extraction, used to identify systems with unauthorized access activity." - "A documented remediation plan that schedules correction of identified compliance deficiencies against a baseline security framework, including specific actions, responsible parties, and target completion dates." - "A compliance requirement from a payment-card security standard for maintaining separate network segments containing systems that store, process, or transmit cardholder data." base: episodic # NIST OSCAL Assessment Layer (Assessment Plan + Assessment Results) traits: - timeline - cited - documented schema: required: - assessment_id properties: assessment_id: type: string assessment_subject: type: string assessment_scope: type: string assessment_activities: type: array items: type: string start_date: type: string format: date end_date: type: string format: date findings: type: array items: type: string risks_identified: type: array items: type: string source_vocab: NIST OSCAL source_class: Assessment Plan / Assessment Results prior_art: https://pages.nist.gov/OSCAL/learn/concepts/layer/assessment/ disposition: mint - name: poam description: "A plan of action and milestones tracking risks to remediation" negative_examples: - "A coordinated vulnerability disclosure process discipline defines the steps for responsible reporting of security flaws (notification timelines, embargo periods, credit assignment) to avoid alarming users before patches are available." base: procedural # NIST OSCAL Plan of Action and Milestones (POA&M) model traits: - cited - dated - documented schema: required: - poam_id - system_id properties: poam_id: type: string system_id: type: string risks: type: array items: type: string observations: type: array items: type: string poam_items: type: array items: type: string milestones: type: array items: type: string remediation_tracking: type: string status: type: string source_vocab: NIST OSCAL source_class: Plan of Action and Milestones (POA&M) prior_art: https://pages.nist.gov/OSCAL/ disposition: mint # =========================================================================== # SDLC-FACING SUPERTYPES (0.2.0 ontology-spine-relayering — moved here from # software-engineering under fork-b). These coarse, SDLC-facing types are the # supertypes the finer STIX/ATT&CK/CWE types above refine; security-threat is the # mitigation/realization target, security-framework defines controls, and # security-incident is the VERIS breach record. # =========================================================================== - name: security-threat description: "A security threat, attack class, or vulnerability affecting the software lifecycle (SDLC-facing supertype refined by attack-tactic/weakness/vulnerability)" aliases: - "attack vector" - "vulnerability" - "exploit" - "threat class" - "injection attack" - "supply chain compromise" exemplars: - "Malicious instructions embedded in tool descriptions parsed as trusted context" - "Silently altering approved tool definitions to inject behavior without re-authorization" - "A command injection chain of published vulnerabilities sharing one unsanitized root cause" - "Poisoned release tags exfiltrating credentials from continuous integration" negative_examples: - "Generating an SBOM automatically at build time, rather than manually, was chosen because the Log4j incident showed exposure often traces through unexpected transitive dependencies, not itself a security threat." - "Mean time to remediation (MTTR) for critical vulnerabilities measures the elapsed time from a critical vulnerability being identified to a fix being deployed to production, tracked as a team performance metric to monitor patch velocity." - "Threat modeling using STRIDE is an engineering practice where teams systematically enumerate potential security threats to a system across spoofing, tampering, repudiation, information disclosure, denial of service, and elevation categories." - "The improper handling of special characters in user-supplied input when constructing database queries allows attackers to manipulate query logic and gain unauthorized access to sensitive data." - "A vulnerability in a transitive dependency inherited through a software package's supply chain, exposing downstream applications to exploitation even though the application itself has no direct vulnerable code." - "Physical or logical isolation of security-critical network segments from general-purpose networks to limit the blast radius of a compromise and prevent lateral movement across organizational boundaries." - "An exploitation framework providing payload generation, multi-stage delivery, and post-exploitation automation for penetration testers, equally valuable for defenders simulating attacks and adversaries conducting real intrusions." base: semantic traits: - cited - versioned schema: required: - threat_name - attack_vector properties: threat_name: type: string attack_vector: type: string description: "How the threat is exploited" impact: type: string description: "What an attacker gains or breaks" mitigation_summary: type: string description: "Primary defenses against this threat" references: type: array items: type: string attack_id: type: string description: "ATT&CK technique/sub-technique (e.g. T1566) or CAPEC ID" tactic: type: string description: "ATT&CK tactic / kill-chain phase" adversary: type: string description: "Intrusion set / ATT&CK Group" source_vocab: MITRE ATT&CK source_class: Technique (attack-pattern) prior_art: https://attack.mitre.org/ disposition: extend - name: security-framework description: "A security or assurance framework, taxonomy, or standard (e.g. OWASP Top 10, MITRE ATLAS, SLSA, NIST SSDF/CSF)" aliases: - "security standard" - "controls framework" - "vulnerability taxonomy" - "assurance framework" - "compliance framework" exemplars: - "A peer-reviewed top-ten risk taxonomy for an emerging application class" - "A provenance standard defining leveled requirements from machine-readable to isolated builds" - "A management-system standard with a reference set of controls in an annex" - "Federal guidance organizing risk actions across govern, map, measure, and manage functions" negative_examples: - "A secure SDLC gating discipline requires that each stage of the software development lifecycle (design, development, testing, deployment) must pass defined security criteria and automated scans before proceeding to the next stage." - "Under DoD RMF, a POA&M, tracked operationally in eMASS, is the remediation record an Authorizing Official reviews; RMF is the framework itself, not the POA&M." - "A classification scheme for sensitive data based on compliance frameworks, including categories like public, internal-use-only, confidential, and restricted, with associated handling and protection requirements." base: semantic traits: - cited - versioned - documented schema: required: - framework_name - scope properties: framework_name: type: string scope: type: string description: "What the framework governs (e.g. application risk, supply-chain integrity, adversary TTPs)" maintainer: type: string description: "Organization that maintains the framework" relationship: type: string description: "How it relates to or composes with other frameworks" version: type: string description: "Framework version/edition (e.g. CSF 2.0, OWASP Top 10:2025)" structure: type: string description: "Framework structure (e.g. CSF: 6 functions / 22 categories / 106 subcategories)" source_vocab: NIST CSF / OWASP source_class: Security Framework prior_art: https://www.nist.gov/cyberframework disposition: extend - name: security-incident description: "A security breach/incident carrying the VERIS four A's (Actor + Action + Asset + Attribute)" base: episodic traits: - timeline - stakeholders - cited schema: required: - severity - impact - resolution properties: severity: type: string enum: - critical - high - medium - low impact: type: string resolution: type: string actor: type: string description: "VERIS Actor — external / internal / partner" action: type: string description: "VERIS Action — malware / hacking / social / error / misuse" asset: type: string description: "VERIS Asset — the device/data affected" attribute: type: string description: "VERIS Attribute — how affected (CIA)" source_vocab: VERIS source_class: Incident (Actor+Action+Asset+Attribute) prior_art: https://verisframework.org/ disposition: extend # =========================================================================== # RELATIONSHIPS (12, grounded in STIX 2.1 SROs, NIST OSCAL, MITRE CWE, OBO RO) # =========================================================================== # All relationship endpoints now resolve WITHIN this pack: the security-threat / # security-framework / security-incident supertypes were moved here in 0.2.0 # (fork-b), so the formerly cross-pack edges (defines, mitigates_threat, realizes) # are local. relationships: attributed_to: description: "A campaign is attributed to a threat actor (stix:attributed-to)" from: - attack-campaign to: - threat-actor symmetric: false categorizes: description: "A weakness class categorizes a vulnerability instance (CWE CanPrecede / rdfs:subClassOf)" from: - weakness to: - vulnerability symmetric: false defines: description: "A framework defines a control (OSCAL profile import->include-controls)" from: - security-framework to: - security-control symmetric: false documents: description: "A threat-intelligence report documents a campaign (STIX Report object_refs)" from: - threat-intelligence-report to: - attack-campaign symmetric: false exploits: description: "Malware exploits a vulnerability (stix:exploits, Malware -> Vulnerability)" from: - malware to: - vulnerability symmetric: false hosts: description: "Infrastructure hosts malware (stix:hosts, Infrastructure -> Malware)" from: - security-infrastructure to: - malware symmetric: false indicates: description: "An indicator of compromise indicates malware (stix:indicates, Indicator -> Malware)" from: - indicator-of-compromise to: - malware symmetric: false mitigates_threat: # Inventory relationship `mitigates` (attack-mitigation -> security-threat); renamed # to avoid a name collision with the control->vulnerability `mitigates` edge below, # since `relationships` is a name-keyed map. Source: stix:mitigates (course-of-action # -> attack-pattern). description: "A mitigation mitigates a threat technique (stix:mitigates, course-of-action -> attack-pattern)" from: - attack-mitigation to: - security-threat symmetric: false mitigates: description: "A control mitigates a vulnerability (RO:0000056 participates-in; OSCAL control satisfies risk)" from: - security-control to: - vulnerability symmetric: false realizes: description: "An incident realizes a threat (RO:0000056 participates-in)" from: - security-incident to: - security-threat symmetric: false tracks: description: "A POA&M tracks a vulnerability to remediation (OSCAL poam:risks / poam-item)" from: - poam to: - vulnerability symmetric: false uses: description: "A threat actor uses a security tool (stix:uses, threat-actor -> tool)" from: - threat-actor to: - security-tool symmetric: false # =========================================================================== # DISCOVERY PATTERNS # =========================================================================== discovery: enabled: true confidence_threshold: 0.8 patterns: - content_pattern: "\\b(CVE-\\d{4}-\\d{4,})\\b" suggest_entity: vulnerability suggest_namespace: _semantic/vulnerabilities - content_pattern: "\\bCWE-\\d+\\b" suggest_entity: weakness suggest_namespace: _semantic/weaknesses - content_pattern: "\\b(AC|AU|SC|SI|IA)-\\d+\\b" suggest_entity: security-control suggest_namespace: _semantic/controls - content_pattern: "\\b(APT\\d+|Lazarus Group|FIN\\d+|Sandworm|Volt Typhoon)\\b" suggest_entity: threat-actor suggest_namespace: _semantic/actors - content_pattern: "\\b(Operation|Campaign)\\s+[A-Z][a-zA-Z]+\\b" suggest_entity: attack-campaign suggest_namespace: _episodic/campaigns - content_pattern: "\\b(IOC|YARA|Sigma rule|STIX pattern|TLP:)\\b" suggest_entity: indicator-of-compromise suggest_namespace: _semantic/indicators - content_pattern: "\\b(supply chain|SBOM|C-SCRM)\\b" suggest_entity: supply-chain-risk suggest_namespace: _semantic/supply-chain - content_pattern: "\\b(pen test|red team|audit finding|compliance review)\\b" suggest_entity: security-assessment suggest_namespace: _episodic/assessments - content_pattern: "\\b(acceptable use policy|data classification policy)\\b" suggest_entity: security-policy suggest_namespace: _procedural/policies - content_pattern: "\\b(Mimikatz|WannaCry|Cobalt Strike|S\\d{4})\\b" suggest_entity: malware suggest_namespace: _semantic/threats