UniForeXT
type: Ontology
created: 2026-02-05
creator: Robert Louan
description: UniForeXT: A Unified Model for Cross-Tool Integration in Digital Forensic Triage
modified: 2026-05-28
imports: http://www.w3.org/2006/time#2016
version IRI: http://www.semanticweb.org/robert_louan/ontologies/2026/1/unified-forensics-results/1.1.0
version info: 1.0.0

Access Detection
type: Class
comment: Detection category for access related activity.
subclass of: Detection

AccountTampering
type: Class
comment: Detection indicating account tampering activity.
subclass of: Access Detection

Analytics Detection
type: Class
comment: Detection category for analytics or automated detection signals.
subclass of: Detection

Antivirus
type: Class
comment: Detection produced by antivirus software.
subclass of: Analytics Detection

Attack Tactic
type: Class
comment: Controlled ATT&CK tactic concept.
subclass of: Value

Attack Technique
type: Class
comment: Controlled ATT&CK technique concept.
subclass of: Value

Authentication Event
type: Class
comment: Event associated with authentication or logon activity.
subclass of: Event

Command
type: Class
comment: Command observed in the forensic context.
subclass of: Independent Entity
subclass of: Restriction
  max qualified cardinality: 1
  on class: Computer
  on property: hasComputer
subclass of: Restriction
  max qualified cardinality: 1
  on class: User
  on property: hasUser
subclass of: Restriction
  max qualified cardinality: 1
  on data range: string
  on property: hasDescription

Computer
type: Class
comment: Computer or host involved in the forensic investigation.
subclass of: Independent Entity
subclass of: Restriction
  max qualified cardinality: 1
  on data range: string
  on property: hasDomain
subclass of: Restriction
  max qualified cardinality: 1
  on data range: string
  on property: hasHostname
subclass of: Restriction
  max qualified cardinality: 1
  on data range: string
  on property: hasIP

Configuration Event
type: Class
comment: Superclass for configuration-related events.
subclass of: Event
subclass of: Restriction
  max qualified cardinality: 1
  on data range: string
  on property: hasName

Defense Evasion Detection
type: Class
comment: Detection category for defense evasion activity.
subclass of: Detection

Detection
type: Class
comment: Independent evidence or alert produced by a security or forensic control.
subclass of: Independent Entity
subclass of: Restriction
  on property: hasLogFile
  some values from: LogFile
subclass of: Restriction
  on property: hasUser
  some values from: User
subclass of: Restriction
  max qualified cardinality: 1
  on class: Computer
  on property: hasComputer
subclass of: Restriction
  on property: hasExtraInformation
  some values from: string
subclass of: Restriction
  on property: hasID
  some values from: unsignedLong
subclass of: Restriction
  on property: hasName
  some values from: string
subclass of: Restriction
  on property: hasTechnique
  some values from: string
subclass of: Restriction
  max qualified cardinality: 1
  on data range: string
  on property: hasDescription
subclass of: Restriction
  max qualified cardinality: 1
  on data range: dateTimeStamp
  on property: hasTimestamp

Domain Entity
type: Class
comment: Top-level domain category for all ontology entities.
equivalent class: Class
  union of: Independent Entity
  union of: Value

Event
type: Class
comment: Occurrence recorded in logs or forensic evidence.
subclass of: Independent Entity
subclass of: Restriction
  on property: hasDetection
  some values from: Detection
subclass of: Restriction
  max qualified cardinality: 1
  on class: Computer
  on property: hasComputer
subclass of: Restriction
  max qualified cardinality: 1
  on class: LogFile
  on property: hasLogFile
subclass of: Restriction
  max qualified cardinality: 1
  on class: User
  on property: hasUser
subclass of: Restriction
  on property: hasExtraInformation
  some values from: string
subclass of: Restriction
  max qualified cardinality: 1
  on data range: unsignedLong
  on property: hasEventID
subclass of: Restriction
  max qualified cardinality: 1
  on data range: dateTimeStamp
  on property: hasTimestamp

Execution Detection
type: Class
comment: Detection category for execution-related activity.
subclass of: Detection

Independent Entity
type: Class
comment: Entity representing a concrete forensic object or occurrence.
subclass of: Domain Entity
subclass of: Restriction
  max qualified cardinality: 1
  on class: Domain Entity
  on property: hasForensicTool
disjoint with: Value

IndicatorRemoval
type: Class
comment: Detection indicating removal of indicators or traces.
subclass of: Defense Evasion Detection

LateralMovement
type: Class
comment: Detection indicating lateral movement activity.
subclass of: Access Detection

LogFile
type: Class
comment: Log file used as a forensic evidence source.
subclass of: Independent Entity
subclass of: Restriction
  max qualified cardinality: 1
  on class: Path
  on property: hasPath

LogTampering
type: Class
comment: Detection indicating tampering with log data.
subclass of: Defense Evasion Detection

Logon Event
type: Class
comment: Event capturing a logon or authentication occurrence.
subclass of: Authentication Event
subclass of: Restriction
  max qualified cardinality: 1
  on class: LogonType
  on property: hasLogonType

LogonType
type: Class
comment: Controlled value representing the logon type.
subclass of: Value

MicrosoftRDS
type: Class
comment: Detection related to Microsoft Remote Desktop Services activity.
subclass of: Access Detection

rdpLogon
type: NamedIndividual
type: LogonType

networkLogon
type: NamedIndividual
type: LogonType

localLogon
type: NamedIndividual
type: LogonType

Path
type: Class
comment: File system path or path-like string used in forensic evidence.
subclass of: Independent Entity
subclass of: Restriction
  on property: hasContent
  some values from: string

Persistence
type: Class
comment: Detection indicating persistence-related activity.
subclass of: Persistence Detection

Persistence Detection
type: Class
comment: Detection category for persistence-related activity.
subclass of: Detection

PowershellEngineState
type: Class
comment: Detection indicating a PowerShell engine state or execution context.
subclass of: Execution Detection

Process
type: Class
comment: Operating system process observed in the forensic context.
subclass of: Independent Entity
subclass of: Restriction
  max qualified cardinality: 1
  on class: Command
  on property: hasCommand
subclass of: Restriction
  max qualified cardinality: 1
  on class: Computer
  on property: hasComputer
subclass of: Restriction
  max qualified cardinality: 1
  on class: Process
  on property: hasParentProcess
subclass of: Restriction
  max qualified cardinality: 1
  on data range: string
  on property: hasName

RDPAttacks
type: Class
comment: Detection related to RDP attack activity.
subclass of: Access Detection

RDPEvents
type: Class
comment: Detection related to Remote Desktop Protocol events.
subclass of: Access Detection

Registry Load Configuration Event
type: Class
comment: Configuration event for registry loading activity.
subclass of: Configuration Event

Registry Modification Configuration Event
type: Class
comment: Configuration event for registry modification activity.
subclass of: Configuration Event
subclass of: Restriction
  max qualified cardinality: 1
  on data range: decimal
  on property: hasValue

Scheduled Task Creation Configuration Event
type: Class
comment: Configuration event for scheduled task creation.
subclass of: Configuration Event

Scheduled Task Deletion Configuration Event
type: Class
comment: Configuration event for scheduled task deletion.
subclass of: Configuration Event

ServiceInstallation
type: Class
comment: Detection indicating service installation activity.
subclass of: Persistence Detection

Service Installation Configuration Event
type: Class
comment: Configuration event for service installation.
subclass of: Configuration Event

Session
type: Class
comment: User session associated with a logon event.
subclass of: Independent Entity
subclass of: Restriction
  max qualified cardinality: 1
  on class: Logon Event
  on property: hasLogonEvent
subclass of: Restriction
  max qualified cardinality: 1
  on class: User
  on property: hasUser

Sigma
type: Class
comment: Detection produced from Sigma rules or Sigma-based content.
subclass of: Analytics Detection

Threat
type: Class
comment: Suspected malicious activity or adversary-driven behavior.
subclass of: Independent Entity
subclass of: Restriction
  max qualified cardinality: 1
  on class: Command
  on property: hasCommand
subclass of: Restriction
  max qualified cardinality: 1
  on class: Computer
  on property: hasComputer
subclass of: Restriction
  max qualified cardinality: 1
  on class: Process
  on property: hasProcess
subclass of: Restriction
  max qualified cardinality: 1
  on class: User
  on property: hasUser
subclass of: Restriction
  on property: hasName
  some values from: string
subclass of: Restriction
  on property: hasTechnique
  some values from: string
subclass of: Restriction
  on property: hasTimestamp
  some values from: dateTimeStamp

User
type: Class
comment: User account or person associated with an event or entity.
subclass of: Independent Entity
subclass of: Restriction
  on property: hasName
  some values from: string

Value
type: Class
comment: Controlled conceptual value used to classify domain entities.
subclass of: Domain Entity

hasAttackTactic
type: ObjectProperty
comment: Links an element to the ATT&CK tactic it is associated with.
domain: Domain Entity
range: Attack Tactic
sub property of: relationalProperty
inverse of: isAttackTacticOf

hasAttackTechnique
type: ObjectProperty
comment: Links an element to the ATT&CK technique it is associated with.
domain: Domain Entity
range: Attack Technique
sub property of: relationalProperty
inverse of: isAttackTechniqueOf

hasChildrenProcess
type: ObjectProperty
comment: Relates a process to one of its child processes.
domain: Process
range: Process
sub property of: hasProcess
inverse of: hasParentProcess

hasCommand
type: ObjectProperty
type: FunctionalProperty
comment: Relates an entity to the command associated with it.
domain: Independent Entity
range: Command
sub property of: relationalProperty
inverse of: isCommandOf

hasComputer
type: ObjectProperty
type: FunctionalProperty
comment: Relates an entity to the computer on which it occurred or was observed.
domain: Independent Entity
range: Computer
sub property of: relationalProperty
inverse of: isComputerOf

hasContent
type: DatatypeProperty
comment: Stores the string content of a path-like value.
domain: Path
range: string

hasDescription
type: DatatypeProperty
type: FunctionalProperty
comment: Provides a human-readable description of an entity.
domain: Independent Entity
range: string
sub property of: topDataProperty

hasDetection
type: ObjectProperty
comment: Links an event to the detection that identified it.
domain: Event
range: Detection
sub property of: relationalProperty
inverse of: isDetectionOf

hasDomain
type: DatatypeProperty
type: FunctionalProperty
comment: Stores the domain name associated with a computer.
domain: Computer
range: string

hasEventID
type: DatatypeProperty
type: FunctionalProperty
comment: Stores the identifier of an event in the source log or system.
domain: Event
range: unsignedLong

hasExtraInformation
type: DatatypeProperty
comment: Stores additional free-text information for an entity.
domain: Independent Entity
range: string

hasHostname
type: DatatypeProperty
type: FunctionalProperty
comment: Stores the hostname of a computer.
domain: Computer
range: string

hasID
type: DatatypeProperty
type: FunctionalProperty
comment: Stores the identifier of a detection record.
domain: Detection
range: unsignedLong

hasIP
type: DatatypeProperty
type: FunctionalProperty
comment: Stores the IP address associated with a computer.
domain: Computer
range: string

hasLevel
type: DatatypeProperty
type: FunctionalProperty
comment: Stores the severity level associated with a detection.
domain: Detection
range: Datatype
  one of: High
  one of: Info
  one of: Low
  one of: Medium

hasLogFile
type: ObjectProperty
comment: Links an entity to the log file used as evidence or source.
domain: Independent Entity
range: LogFile
sub property of: relationalProperty
inverse of: isLogFileOf

hasLogonEvent
type: ObjectProperty
type: FunctionalProperty
comment: Associates a session with its logon event.
domain: Session
range: Logon Event
sub property of: relationalProperty
inverse of: isLogonEventOf

hasLogonType
type: ObjectProperty
type: FunctionalProperty
comment: Specifies the logon type associated with a logon event.
domain: Logon Event
range: LogonType
sub property of: relationalProperty
inverse of: isLogonTypeOf

hasName
type: DatatypeProperty
type: FunctionalProperty
comment: Stores the name of an ontology entity.
domain: Independent Entity
range: string

hasParentProcess
type: ObjectProperty
type: FunctionalProperty
comment: Relates a process to its parent process.
domain: Process
range: Process
sub property of: hasProcess

hasPath
type: ObjectProperty
comment: Relates a file to its file system path.
domain: Independent Entity
range: Path
sub property of: relationalProperty
inverse of: isPathOf

hasProcess
type: ObjectProperty
comment: Relates an entity to a process associated with it.
domain: Independent Entity
range: Process
sub property of: relationalProperty
inverse of: isProcessOf

hasTechnique
type: DatatypeProperty
type: FunctionalProperty
comment: Stores a technique identifier in string form.
domain: Independent Entity
range: string

hasTimestamp
type: DatatypeProperty
type: FunctionalProperty
comment: Stores the timestamp associated with an entity or event.
domain: Independent Entity
range: dateTimeStamp

hasUser
type: ObjectProperty
type: FunctionalProperty
comment: Relates an entity to the user associated with it.
domain: Independent Entity
range: User
sub property of: relationalProperty
inverse of: isUserOf

hasValue
type: DatatypeProperty
type: FunctionalProperty
comment: Stores the value used in registry modification events.
domain: Registry Modification Configuration Event
range: decimal

isAttackTacticOf
type: ObjectProperty
comment: Inverse of hasAttackTactic; associates an ATT&CK tactic to entities using it.
domain: Attack Tactic
range: Domain Entity
sub property of: relational_property_inverse

isAttackTechniqueOf
type: ObjectProperty
comment: Inverse of hasAttackTechnique; associates an ATT&CK technique to entities using it.
domain: Attack Technique
range: Domain Entity
sub property of: relational_property_inverse

isCommandOf
type: ObjectProperty
comment: Inverse of hasCommand; associates a command to entities that used it.
domain: Command
range: Independent Entity
sub property of: relational_property_inverse

isComputerOf
type: ObjectProperty
comment: Inverse of hasComputer; associates a computer to entities observed on it.
domain: Computer
range: Independent Entity
sub property of: relational_property_inverse

isDetectionOf
type: ObjectProperty
comment: Inverse of hasDetection; associates a detection to the events it identified.
domain: Detection
range: Event
sub property of: relational_property_inverse

isLogFileOf
type: ObjectProperty
comment: Inverse of hasLogFile; associates a log file to entities that reference it.
domain: LogFile
range: Independent Entity
sub property of: relational_property_inverse

isLogonEventOf
type: ObjectProperty
comment: Inverse of hasLogonEvent; associates a logon event to the session it created.
domain: Logon Event
range: Session
sub property of: relational_property_inverse

isLogonTypeOf
type: ObjectProperty
comment: Inverse of hasLogonType; associates a logon type to events using it.
domain: LogonType
range: Logon Event
sub property of: relational_property_inverse

isPathOf
type: ObjectProperty
comment: Inverse of hasPath; associates a path to the file it belongs to.
domain: Path
range: LogFile
sub property of: relational_property_inverse

isProcessOf
type: ObjectProperty
comment: Inverse of hasProcess; associates a process to entities that reference it.
domain: Process
range: Independent Entity
sub property of: relational_property_inverse

isUserOf
type: ObjectProperty
comment: Inverse of hasUser; associates a user to entities related to them.
domain: User
range: Independent Entity
sub property of: relational_property_inverse

modifiedBy_property
type: ObjectProperty
comment: Inverse of modifier_property; associates values to entities that use them as modifiers.
domain: Value
range: Domain Entity
inverse of: modifierProperty

modifierProperty
type: ObjectProperty
comment: Auxiliary property group for modifier relations.
domain: Domain Entity
range: Value
sub property of: topObjectProperty

relationalProperty
type: ObjectProperty
comment: Auxiliary super-property for relational links between ontology entities.
domain: Domain Entity
range: Domain Entity
sub property of: topObjectProperty
inverse of: relational_property_inverse

relational_property_inverse
type: ObjectProperty
comment: Inverse of relational_property; generic super-property for inverse relational links.
domain: Domain Entity
range: Domain Entity