Robert Louan
UniForeXT: A Unified Model for Cross-Tool Integration in Digital Forensic Triage
UniForeXT
Detection category for access related activity.
Access Detection
Detection indicating account tampering activity.
AccountTampering
Detection category for analytics or automated detection signals.
Analytics Detection
Detection produced by antivirus software.
Antivirus
Controlled ATT&CK tactic concept.
Attack Tactic
Controlled ATT&CK technique concept.
Attack Technique
Event associated with authentication or logon activity.
Authentication Event
Command observed in the forensic context.
Command
Computer or host involved in the forensic investigation.
Computer
Superclass for configuration-related events.
Configuration Event
Detection category for defense evasion activity.
Defense Evasion Detection
Independent evidence or alert produced by a security or forensic control.
Detection
Top-level domain category for all ontology entities.
Domain Entity
Occurrence recorded in logs or forensic evidence.
Event
Detection category for execution-related activity.
Execution Detection
Entity representing a concrete forensic object or occurrence.
Independent Entity
Detection indicating removal of indicators or traces.
IndicatorRemoval
Detection indicating lateral movement activity.
LateralMovement
Log file used as a forensic evidence source.
LogFile
Detection indicating tampering with log data.
LogTampering
Event capturing a logon or authentication occurrence.
Logon Event
Controlled value representing the logon type.
LogonType
Detection related to Microsoft Remote Desktop Services activity.
MicrosoftRDS
rdpLogon
networkLogon
localLogon
File system path or path-like string used in forensic evidence.
Path
Detection indicating persistence-related activity.
Persistence
Detection category for persistence-related activity.
Persistence Detection
Detection indicating a PowerShell engine state or execution context.
PowershellEngineState
Operating system process observed in the forensic context.
Process
Detection related to RDP attack activity.
RDPAttacks
Detection related to Remote Desktop Protocol events.
RDPEvents
Configuration event for registry loading activity.
Registry Load Configuration Event
Configuration event for registry modification activity.
Registry Modification Configuration Event
Configuration event for scheduled task creation.
Scheduled Task Creation Configuration Event
Configuration event for scheduled task deletion.
Scheduled Task Deletion Configuration Event
Detection indicating service installation activity.
ServiceInstallation
Configuration event for service installation.
Service Installation Configuration Event
User session associated with a logon event.
Session
Detection produced from Sigma rules or Sigma-based content.
Sigma
Suspected malicious activity or adversary-driven behavior.
Threat
User account or person associated with an event or entity.
User
Controlled conceptual value used to classify domain entities.
Value
Links an element to the ATT&CK tactic it is associated with.
hasAttackTactic
Links an element to the ATT&CK technique it is associated with.
hasAttackTechnique
Relates a process to one of its child processes.
hasChildrenProcess
Relates an entity to the command associated with it.
hasCommand
Relates an entity to the computer on which it occurred or was observed.
hasComputer
Stores the string content of a path-like value.
hasContent
Provides a human-readable description of an entity.
hasDescription
Links an event to the detection that identified it.
hasDetection
Stores the domain name associated with a computer.
hasDomain
Stores the identifier of an event in the source log or system.
hasEventID
Stores additional free-text information for an entity.
hasExtraInformation
Stores the hostname of a computer.
hasHostname
Stores the identifier of a detection record.
hasID
Stores the IP address associated with a computer.
hasIP
Stores the severity level associated with a detection.
hasLevel
Links an entity to the log file used as evidence or source.
hasLogFile
Associates a session with its logon event.
hasLogonEvent
Specifies the logon type associated with a logon event.
hasLogonType
Stores the name of an ontology entity.
hasName
Relates a process to its parent process.
hasParentProcess
Relates a file to its file system path.
hasPath
Relates an entity to a process associated with it.
hasProcess
Stores a technique identifier in string form.
hasTechnique
Stores the timestamp associated with an entity or event.
hasTimestamp
Relates an entity to the user associated with it.
hasUser
Stores the value used in registry modification events.
hasValue
Inverse of hasAttackTactic; associates an ATT&CK tactic to entities using it.
isAttackTacticOf
Inverse of hasAttackTechnique; associates an ATT&CK technique to entities using it.
isAttackTechniqueOf
Inverse of hasCommand; associates a command to entities that used it.
isCommandOf
Inverse of hasComputer; associates a computer to entities observed on it.
isComputerOf
Inverse of hasDetection; associates a detection to the events it identified.
isDetectionOf
Inverse of hasLogFile; associates a log file to entities that reference it.
isLogFileOf
Inverse of hasLogonEvent; associates a logon event to the session it created.
isLogonEventOf
Inverse of hasLogonType; associates a logon type to events using it.
isLogonTypeOf
Inverse of hasPath; associates a path to the file it belongs to.
isPathOf
Inverse of hasProcess; associates a process to entities that reference it.
isProcessOf
Inverse of hasUser; associates a user to entities related to them.
isUserOf
Inverse of modifier_property; associates values to entities that use them as modifiers.
modifiedBy_property
Auxiliary property group for modifier relations.
modifierProperty
Auxiliary super-property for relational links between ontology entities.
relationalProperty
Inverse of relational_property; generic super-property for inverse relational links.
relational_property_inverse