investigation:Investigation leaf node





An investigation is a grouping of characteristics unique to an exploration of the facts involved in a cyber-relevant set of suspicious activity.


Instances of investigation:Investigation can have the following properties:

From class investigation:Investigation
investigation:focus owl:DatatypeProperty Specifies the topical focus of an investigation. xs:string
investigation:investigationForm owl:DatatypeProperty A label categorizing a type of investigation (case, incident, suspicious-activity, etc.) vocab1:InvestigationFormVocab
investigation:investigationStatus owl:DatatypeProperty A label characterizing the status of an investigation (open, closed, etc.). xs:string
investigation:relevantAuthorization owl:ObjectProperty Specifies an authorization relevant to a particular investigation. investigation:Authorization
From class core:ContextualCompilation
core:object owl:ObjectProperty One or more UcoObject identifers referencing other objects. - One or more UcoObjects. core:UcoObject
From class core:UcoObject
core:createdTime owl:DatatypeProperty The time at which a characterization of a concept is created. xs:dateTime
core:description owl:DatatypeProperty A description of a particular concept characterization. xs:string
core:id owl:DatatypeProperty A globally unique identifier for a characterization of a concept. types:Identifier
core:modifiedTime owl:DatatypeProperty Specifies the time that this particular version of the object was modified. The object creator can use the time it deems most appropriate as the time this version of the object was modified. The value of the modified property for a given object version MUST be later than or equal to the value of the created property. Object creators MUST update the modified property when creating a new version of an object. The modified timestamp MUST be precise to the nearest millisecond (exactly three digits after the decimal place in seconds). xs:dateTime
core:name owl:DatatypeProperty The name of a particular concept characterization. xs:string
core:specVersion owl:DatatypeProperty The version of UCO used to characterize a concept. xs:string
core:tag owl:DatatypeProperty A generic tag/label. xs:string
core:type owl:DatatypeProperty The explicitly-defined type of characterization of a concept. xs:string
core:createdBy owl:ObjectProperty The identity that created a characterization of a concept. identity:Identity
core:hasFacet owl:ObjectProperty Further sets of properties characterizing a concept based on the particular context of the class and of the particular instance of the concept being characterized. core:Facet
core:objectMarking owl:ObjectProperty Marking definitions to be applied to a particular concept characterization in its entirety. marking:MarkingDefinition
From class owl:Thing
observable:pictureType owl:DatatypeProperty The type of a picture, for example a thumbnail. xs:string
observable:thumbprintHash owl:ObjectProperty A hash calculated on the entire certificate including signature. types:Hash


@prefix investigation: <> .
@prefix owl: <> .
@prefix rdfs: <> .
@prefix uco-core: <> .
@prefix xsd: <> .

investigation:Investigation a owl:Class ;
    rdfs:label "Investigation"@en ;
    rdfs:comment "An investigation is a grouping of characteristics unique to an exploration of the facts involved in a cyber-relevant set of suspicious activity."@en ;
    rdfs:subClassOf [ a owl:Restriction ;
            owl:maxCardinality "1"^^xsd:nonNegativeInteger ;
            owl:onProperty uco-core:startTime ],
        [ a owl:Restriction ;
            owl:cardinality "1"^^xsd:nonNegativeInteger ;
            owl:onProperty investigation:investigationForm ],
        [ a owl:Restriction ;
            owl:maxCardinality "1"^^xsd:nonNegativeInteger ;
            owl:onProperty investigation:investigationStatus ],
        [ a owl:Restriction ;
            owl:maxCardinality "1"^^xsd:nonNegativeInteger ;
            owl:onProperty uco-core:endTime ],
        uco-core:ContextualCompilation .