UniForeXT
type: Ontology
version IRI: http://www.semanticweb.org/robert_louan/ontologies/2026/1/unified-forensics-results/1.1.0
imports: http://www.w3.org/2006/time#2016
created: 2026-02-05
creator: Robert Louan
description: UniForeXT: A Unified Model for Cross-Tool Integration in Digital Forensic Triage
modified: 2026-05-28
version info: 1.0.0

hasAttackTactic
type: ObjectProperty
sub property of: relationalProperty
inverse of: isAttackTacticOf
domain: Domain Entity
range: Attack Tactic
comment: Links an element to the ATT&CK tactic it is associated with.

hasAttackTechnique
type: ObjectProperty
sub property of: relationalProperty
inverse of: isAttackTechniqueOf
domain: Domain Entity
range: Attack Technique
comment: Links an element to the ATT&CK technique it is associated with.

hasChildrenProcess
type: ObjectProperty
sub property of: hasProcess
inverse of: hasParentProcess
domain: Process
range: Process
comment: Relates a process to one of its child processes.

hasCommand
type: ObjectProperty
sub property of: relationalProperty
inverse of: isCommandOf
type: FunctionalProperty
domain: Independent Entity
range: Command
comment: Relates an entity to the command associated with it.

hasComputer
type: ObjectProperty
sub property of: relationalProperty
inverse of: isComputerOf
type: FunctionalProperty
domain: Independent Entity
range: Computer
comment: Relates an entity to the computer on which it occurred or was observed.

hasDetection
type: ObjectProperty
sub property of: relationalProperty
inverse of: isDetectionOf
domain: Event
range: Detection
comment: Links an event to the detection that identified it.

hasLogFile
type: ObjectProperty
sub property of: relationalProperty
inverse of: isLogFileOf
domain: Independent Entity
range: LogFile
comment: Links an entity to the log file used as evidence or source.

hasLogonEvent
type: ObjectProperty
sub property of: relationalProperty
inverse of: isLogonEventOf
type: FunctionalProperty
domain: Session
range: Logon Event
comment: Associates a session with its logon event.

hasLogonType
type: ObjectProperty
sub property of: relationalProperty
inverse of: isLogonTypeOf
type: FunctionalProperty
domain: Logon Event
range: LogonType
comment: Specifies the logon type associated with a logon event.

hasParentProcess
type: ObjectProperty
sub property of: hasProcess
type: FunctionalProperty
domain: Process
range: Process
comment: Relates a process to its parent process.

hasPath
type: ObjectProperty
sub property of: relationalProperty
inverse of: isPathOf
domain: Independent Entity
range: Path
comment: Relates a file to its file system path.

hasProcess
type: ObjectProperty
sub property of: relationalProperty
inverse of: isProcessOf
domain: Independent Entity
range: Process
comment: Relates an entity to a process associated with it.

hasUser
type: ObjectProperty
sub property of: relationalProperty
inverse of: isUserOf
type: FunctionalProperty
domain: Independent Entity
range: User
comment: Relates an entity to the user associated with it.

isAttackTacticOf
type: ObjectProperty
sub property of: relational_property_inverse
domain: Attack Tactic
range: Domain Entity
comment: Inverse of hasAttackTactic; associates an ATT&CK tactic to entities using it.

isAttackTechniqueOf
type: ObjectProperty
sub property of: relational_property_inverse
domain: Attack Technique
range: Domain Entity
comment: Inverse of hasAttackTechnique; associates an ATT&CK technique to entities using it.

isCommandOf
type: ObjectProperty
sub property of: relational_property_inverse
domain: Command
range: Independent Entity
comment: Inverse of hasCommand; associates a command to entities that used it.

isComputerOf
type: ObjectProperty
sub property of: relational_property_inverse
domain: Computer
range: Independent Entity
comment: Inverse of hasComputer; associates a computer to entities observed on it.

isDetectionOf
type: ObjectProperty
sub property of: relational_property_inverse
domain: Detection
range: Event
comment: Inverse of hasDetection; associates a detection to the events it identified.

isLogFileOf
type: ObjectProperty
sub property of: relational_property_inverse
domain: LogFile
range: Independent Entity
comment: Inverse of hasLogFile; associates a log file to entities that reference it.

isLogonEventOf
type: ObjectProperty
sub property of: relational_property_inverse
domain: Logon Event
range: Session
comment: Inverse of hasLogonEvent; associates a logon event to the session it created.

isLogonTypeOf
type: ObjectProperty
sub property of: relational_property_inverse
domain: LogonType
range: Logon Event
comment: Inverse of hasLogonType; associates a logon type to events using it.

isPathOf
type: ObjectProperty
sub property of: relational_property_inverse
domain: Path
range: LogFile
comment: Inverse of hasPath; associates a path to the file it belongs to.

isProcessOf
type: ObjectProperty
sub property of: relational_property_inverse
domain: Process
range: Independent Entity
comment: Inverse of hasProcess; associates a process to entities that reference it.

isUserOf
type: ObjectProperty
sub property of: relational_property_inverse
domain: User
range: Independent Entity
comment: Inverse of hasUser; associates a user to entities related to them.

modifiedBy_property
type: ObjectProperty
inverse of: modifierProperty
domain: Value
range: Domain Entity
comment: Inverse of modifier_property; associates values to entities that use them as modifiers.

modifierProperty
type: ObjectProperty
sub property of: topObjectProperty
domain: Domain Entity
range: Value
comment: Auxiliary property group for modifier relations.

relationalProperty
type: ObjectProperty
sub property of: topObjectProperty
inverse of: relational_property_inverse
domain: Domain Entity
range: Domain Entity
comment: Auxiliary super-property for relational links between ontology entities.

relational_property_inverse
type: ObjectProperty
domain: Domain Entity
range: Domain Entity
comment: Inverse of relational_property; generic super-property for inverse relational links.

hasContent
type: DatatypeProperty
domain: Path
range: string
comment: Stores the string content of a path-like value.

hasDescription
type: DatatypeProperty
sub property of: topDataProperty
type: FunctionalProperty
domain: Independent Entity
range: string
comment: Provides a human-readable description of an entity.

hasDomain
type: DatatypeProperty
type: FunctionalProperty
domain: Computer
range: string
comment: Stores the domain name associated with a computer.

hasEventID
type: DatatypeProperty
type: FunctionalProperty
domain: Event
range: unsignedLong
comment: Stores the identifier of an event in the source log or system.

hasExtraInformation
type: DatatypeProperty
domain: Independent Entity
range: string
comment: Stores additional free-text information for an entity.

hasHostname
type: DatatypeProperty
type: FunctionalProperty
domain: Computer
range: string
comment: Stores the hostname of a computer.

hasID
type: DatatypeProperty
type: FunctionalProperty
domain: Detection
range: unsignedLong
comment: Stores the identifier of a detection record.

hasIP
type: DatatypeProperty
type: FunctionalProperty
domain: Computer
range: string
comment: Stores the IP address associated with a computer.

hasLevel
type: DatatypeProperty
type: FunctionalProperty
domain: Detection
range: Datatype
  one of: High
  one of: Info
  one of: Low
  one of: Medium
comment: Stores the severity level associated with a detection.

hasName
type: DatatypeProperty
type: FunctionalProperty
domain: Independent Entity
range: string
comment: Stores the name of an ontology entity.

hasTechnique
type: DatatypeProperty
type: FunctionalProperty
domain: Independent Entity
range: string
comment: Stores a technique identifier in string form.

hasTimestamp
type: DatatypeProperty
type: FunctionalProperty
domain: Independent Entity
range: dateTimeStamp
comment: Stores the timestamp associated with an entity or event.

hasValue
type: DatatypeProperty
type: FunctionalProperty
domain: Registry Modification Configuration Event
range: decimal
comment: Stores the value used in registry modification events.

Access Detection
type: Class
subclass of: Detection
comment: Detection category for access related activity.

AccountTampering
type: Class
subclass of: Access Detection
comment: Detection indicating account tampering activity.

Analytics Detection
type: Class
subclass of: Detection
comment: Detection category for analytics or automated detection signals.

Antivirus
type: Class
subclass of: Analytics Detection
comment: Detection produced by antivirus software.

Attack Tactic
type: Class
subclass of: Value
comment: Controlled ATT&CK tactic concept.

Attack Technique
type: Class
subclass of: Value
comment: Controlled ATT&CK technique concept.

Authentication Event
type: Class
subclass of: Event
comment: Event associated with authentication or logon activity.

Command
type: Class
subclass of: Independent Entity
subclass of: Restriction
  on property: hasComputer
  max qualified cardinality: 1
  on class: Computer
subclass of: Restriction
  on property: hasUser
  max qualified cardinality: 1
  on class: User
subclass of: Restriction
  on property: hasDescription
  max qualified cardinality: 1
  on data range: string
comment: Command observed in the forensic context.

Computer
type: Class
subclass of: Independent Entity
subclass of: Restriction
  on property: hasDomain
  max qualified cardinality: 1
  on data range: string
subclass of: Restriction
  on property: hasHostname
  max qualified cardinality: 1
  on data range: string
subclass of: Restriction
  on property: hasIP
  max qualified cardinality: 1
  on data range: string
comment: Computer or host involved in the forensic investigation.

Configuration Event
type: Class
subclass of: Event
subclass of: Restriction
  on property: hasName
  max qualified cardinality: 1
  on data range: string
comment: Superclass for configuration-related events.

Defense Evasion Detection
type: Class
subclass of: Detection
comment: Detection category for defense evasion activity.

Detection
type: Class
subclass of: Independent Entity
subclass of: Restriction
  on property: hasLogFile
  some values from: LogFile
subclass of: Restriction
  on property: hasUser
  some values from: User
subclass of: Restriction
  on property: hasComputer
  max qualified cardinality: 1
  on class: Computer
subclass of: Restriction
  on property: hasExtraInformation
  some values from: string
subclass of: Restriction
  on property: hasID
  some values from: unsignedLong
subclass of: Restriction
  on property: hasName
  some values from: string
subclass of: Restriction
  on property: hasTechnique
  some values from: string
subclass of: Restriction
  on property: hasDescription
  max qualified cardinality: 1
  on data range: string
subclass of: Restriction
  on property: hasTimestamp
  max qualified cardinality: 1
  on data range: dateTimeStamp
comment: Independent evidence or alert produced by a security or forensic control.

Domain Entity
type: Class
equivalent class: Class
  union of: Independent Entity
  union of: Value
comment: Top-level domain category for all ontology entities.

Event
type: Class
subclass of: Independent Entity
subclass of: Restriction
  on property: hasDetection
  some values from: Detection
subclass of: Restriction
  on property: hasComputer
  max qualified cardinality: 1
  on class: Computer
subclass of: Restriction
  on property: hasLogFile
  max qualified cardinality: 1
  on class: LogFile
subclass of: Restriction
  on property: hasUser
  max qualified cardinality: 1
  on class: User
subclass of: Restriction
  on property: hasExtraInformation
  some values from: string
subclass of: Restriction
  on property: hasEventID
  max qualified cardinality: 1
  on data range: unsignedLong
subclass of: Restriction
  on property: hasTimestamp
  max qualified cardinality: 1
  on data range: dateTimeStamp
comment: Occurrence recorded in logs or forensic evidence.

Execution Detection
type: Class
subclass of: Detection
comment: Detection category for execution-related activity.

Independent Entity
type: Class
subclass of: Domain Entity
subclass of: Restriction
  on property: hasForensicTool
  max qualified cardinality: 1
  on class: Domain Entity
disjoint with: Value
comment: Entity representing a concrete forensic object or occurrence.

IndicatorRemoval
type: Class
subclass of: Defense Evasion Detection
comment: Detection indicating removal of indicators or traces.

LateralMovement
type: Class
subclass of: Access Detection
comment: Detection indicating lateral movement activity.

LogFile
type: Class
subclass of: Independent Entity
subclass of: Restriction
  on property: hasPath
  max qualified cardinality: 1
  on class: Path
comment: Log file used as a forensic evidence source.

LogTampering
type: Class
subclass of: Defense Evasion Detection
comment: Detection indicating tampering with log data.

Logon Event
type: Class
subclass of: Authentication Event
subclass of: Restriction
  on property: hasLogonType
  max qualified cardinality: 1
  on class: LogonType
comment: Event capturing a logon or authentication occurrence.

LogonType
type: Class
subclass of: Value
comment: Controlled value representing the logon type.

MicrosoftRDS
type: Class
subclass of: Access Detection
comment: Detection related to Microsoft Remote Desktop Services activity.

Path
type: Class
subclass of: Independent Entity
subclass of: Restriction
  on property: hasContent
  some values from: string
comment: File system path or path-like string used in forensic evidence.

Persistence
type: Class
subclass of: Persistence Detection
comment: Detection indicating persistence-related activity.

Persistence Detection
type: Class
subclass of: Detection
comment: Detection category for persistence-related activity.

PowershellEngineState
type: Class
subclass of: Execution Detection
comment: Detection indicating a PowerShell engine state or execution context.

Process
type: Class
subclass of: Independent Entity
subclass of: Restriction
  on property: hasCommand
  max qualified cardinality: 1
  on class: Command
subclass of: Restriction
  on property: hasComputer
  max qualified cardinality: 1
  on class: Computer
subclass of: Restriction
  on property: hasParentProcess
  max qualified cardinality: 1
  on class: Process
subclass of: Restriction
  on property: hasName
  max qualified cardinality: 1
  on data range: string
comment: Operating system process observed in the forensic context.

RDPAttacks
type: Class
subclass of: Access Detection
comment: Detection related to RDP attack activity.

RDPEvents
type: Class
subclass of: Access Detection
comment: Detection related to Remote Desktop Protocol events.

Registry Load Configuration Event
type: Class
subclass of: Configuration Event
comment: Configuration event for registry loading activity.

Registry Modification Configuration Event
type: Class
subclass of: Configuration Event
subclass of: Restriction
  on property: hasValue
  max qualified cardinality: 1
  on data range: decimal
comment: Configuration event for registry modification activity.

Scheduled Task Creation Configuration Event
type: Class
subclass of: Configuration Event
comment: Configuration event for scheduled task creation.

Scheduled Task Deletion Configuration Event
type: Class
subclass of: Configuration Event
comment: Configuration event for scheduled task deletion.

ServiceInstallation
type: Class
subclass of: Persistence Detection
comment: Detection indicating service installation activity.

Service Installation Configuration Event
type: Class
subclass of: Configuration Event
comment: Configuration event for service installation.

Session
type: Class
subclass of: Independent Entity
subclass of: Restriction
  on property: hasLogonEvent
  max qualified cardinality: 1
  on class: Logon Event
subclass of: Restriction
  on property: hasUser
  max qualified cardinality: 1
  on class: User
comment: User session associated with a logon event.

Sigma
type: Class
subclass of: Analytics Detection
comment: Detection produced from Sigma rules or Sigma-based content.

Threat
type: Class
subclass of: Independent Entity
subclass of: Restriction
  on property: hasCommand
  max qualified cardinality: 1
  on class: Command
subclass of: Restriction
  on property: hasComputer
  max qualified cardinality: 1
  on class: Computer
subclass of: Restriction
  on property: hasProcess
  max qualified cardinality: 1
  on class: Process
subclass of: Restriction
  on property: hasUser
  max qualified cardinality: 1
  on class: User
subclass of: Restriction
  on property: hasName
  some values from: string
subclass of: Restriction
  on property: hasTechnique
  some values from: string
subclass of: Restriction
  on property: hasTimestamp
  some values from: dateTimeStamp
comment: Suspected malicious activity or adversary-driven behavior.

User
type: Class
subclass of: Independent Entity
subclass of: Restriction
  on property: hasName
  some values from: string
comment: User account or person associated with an event or entity.

Value
type: Class
subclass of: Domain Entity
comment: Controlled conceptual value used to classify domain entities.

rdpLogon
type: NamedIndividual
type: LogonType

networkLogon
type: NamedIndividual
type: LogonType

localLogon
type: NamedIndividual
type: LogonType