Tree

action:ArrayOfAction
core:Facet
action:ActionArgument
action:ActionEstimation
action:ActionFrequency
action:ActionReferences
core:Confidence
core:ExternalReference
identity:IdentityFacet
identity:Address
identity:Affiliation
identity:BirthInformation
identity:CountriesOfResidence
identity:Events
identity:Identifier
identity:Languages
identity:Nationality
identity:Occupation
identity:OrganizationDetails
identity:PersonalDetails
identity:PhysicalInfo
identity:Qualification
identity:RelatedIdentity
identity:SimpleName
identity:Visa
location:GPSCoordinates
location:LatLongCoordinates
location:SimpleAddress
observable:AccountAuthenticationFacet
observable:AccountFacet
observable:ApplicationAccountFacet
observable:ApplicationFacet
observable:ArchiveFileFacet
observable:AttachmentFacet
observable:AudioFacet
observable:AutonomousSystemFacet
observable:BluetoothAddressFacet
observable:BrowserBookmarkFacet
observable:BrowserCookieFacet
observable:CalendarEntryFacet
observable:CalendarFacet
observable:CompressedStreamFacet
observable:ComputerSpecificationFacet
observable:ContactFacet
observable:ContentDataFacet
observable:DataRangeFacet
observable:DefinedEffectFacet
observable:PropertiesEnumeratedEffectFacet
observable:PropertyReadEffectFacet
observable:SendControlCodeEffectFacet
observable:StateChangeEffectFacet
observable:ValuesEnumeratedEffectFacet
observable:DeviceFacet
observable:DigitalAccountFacet
observable:DigitalSignatureInfoFacet
observable:DiskFacet
observable:DiskPartitionFacet
observable:DomainNameFacet
observable:EXIFFacet
observable:EmailAccountFacet
observable:EmailAddressFacet
observable:EmailMessageFacet
observable:EncodedStreamFacet
observable:EncryptedStreamFacet
observable:EventFacet
observable:ExtInodeFacet
observable:ExtractedStringsFacet
observable:FileFacet
observable:FilePermissionsFacet
observable:FileSystemFacet
observable:FragmentFacet
observable:GeoLocationEntryFacet
observable:GeoLocationLogFacet
observable:GeoLocationTrackFacet
observable:HTTPConnectionFacet
observable:ICMPConnectionFacet
observable:IPv4AddressFacet
observable:IPv6AddressFacet
observable:ImageFacet
observable:LibraryFacet
observable:MACAddressFacet
observable:MemoryFacet
observable:MessageFacet
observable:MessageThreadFacet
observable:MftRecordFacet
observable:MobileAccountFacet
observable:MobileDeviceFacet
observable:MutexFacet
observable:NTFSFilePermissionsFacet
observable:NTFSFileSystemFacet
observable:NetworkConnectionFacet
observable:NetworkFlowFacet
observable:NetworkInterfaceFacet
observable:NoteFacet
observable:OperatingSystemFacet
observable:PDFFileFacet
observable:PathRelationFacet
observable:PhoneAccountFacet
observable:PhoneCallFacet
observable:ProcessFacet
observable:PropertiesEnumeratedEffectFacet
observable:PropertyReadEffectFacet
observable:RasterPictureFacet
observable:SIMCardFacet
observable:SMSMessageFacet
observable:SQLiteBlobFacet
observable:SendControlCodeEffectFacet
observable:SoftwareFacet
observable:StateChangeEffectFacet
observable:SymbolicLinkFacet
observable:TCPConnectionFacet
observable:UNIXAccountFacet
observable:UNIXFilePermissionsFacet
observable:UNIXProcessFacet
observable:UNIXVolumeFacet
observable:URLFacet
observable:UserAccountFacet
observable:UserSessionFacet
observable:ValuesEnumeratedEffectFacet
observable:VolumeFacet
observable:WhoIsFacet
observable:WifiAddressFacet
observable:WindowsAccountFacet
observable:WindowsActiveDirectoryAccountFacet
observable:WindowsComputerSpecificationFacet
observable:WindowsPEBinaryFileFacet
observable:WindowsPrefetchFacet
observable:WindowsProcessFacet
observable:WindowsRegistryHiveFacet
observable:WindowsRegistryKeyFacet
observable:WindowsServiceFacet
observable:WindowsTaskFacet
observable:WindowsThreadFacet
observable:WindowsVolumeFacet
observable:WirelessNetworkConnectionFacet
observable:X509CertificateFacet
observable:X509V3ExtensionsFacet
tool:Build
tool:ToolConfigurationType
core:RelatedIdentity
core:UcoObject
investigation:Authorization
action:Action
investigation:InvestigativeAction
action:ActionLifecycle
investigation:ExaminerActionLifecylce
investigation:SubjectActionLifecycle
investigation:VictimActionLifecycle
action:ActionPattern
observable:ObservableAction
observable:Observation
core:Assertion
core:Annotation
core:Compilation
core:ContextualCompilation
investigation:Investigation
investigation:ProvenanceRecord
core:Grouping
core:EnclosingCompilation
core:Bundle
core:ControlledVocabulary
core:Item
observable:ObservableObject
core:ModusOperandi
core:Relationship
observable:ObservableRelationship
identity:Identity
identity:Organization
identity:Person
location:Location
marking:MarkingDefinition
observable:Observable
observable:ObservableAction
observable:ObservableObject
observable:ObservablePattern
observable:ObservableRelationship
pattern:Pattern
action:ActionPattern
pattern:LogicalPattern
role:Role
investigation:Attorney
investigation:Examiner
investigation:Investigator
investigation:Subject
role:BenevolentRole
role:MaliciousRole
role:NeutralRole
victim:Victim
victim:VictimTargeting
tool:Tool
tool:AnalyticTool
tool:DefensiveTool
tool:MaliciousTool
investigation1:Authorization
marking:GranularMarking
marking:MarkingModel
marking:LicenseMarking
marking:ReleaseToMarking
marking:StatementMarking
marking:TermsOfUseMarking
observable:AlternateDataStream
observable:ComputerSpecificationFacetFacet
observable:EnvironmentVariable
observable:ExtractedString
observable:GlobalFlagType
observable:IComHandlerActionType
observable:IExecActionType
observable:IShowMessageActionType
observable:MimePartType
observable:PDFFIle
observable:TaskActionType
observable:TriggerType
observable:WhoisContactType
observable:WhoisRegistrarInfoType
observable:WindowsPEFileHeader
observable:WindowsPEOptionalHeader
observable:WindowsPESection
observable:WindowsRegistryValue
pattern:PatternExpression
tool:BuildConfigurationType
tool:BuildInformationType
tool:BuildUtilityType
tool:CompilerType
tool:ConfigurationSettingType
tool:DependencyType
tool:LibraryType
types:ControlledDictionary
types:ControlledDictionaryEntry
types:Dictionary
types:DictionaryEntry
types:Hash
types:Identifier
vocab1:InvestigationFormVocab
vocab:AccountTypeVocab
vocab:ActionArgumentNameVocab
vocab:ActionNameVocab
vocab:ActionRelationshipTypeVocab
vocab:ActionStatusTypeVocab
vocab:ActionTypeVocab
vocab:BitnessVocab
vocab:CharacterEncodingVocab
vocab:DiskTypeVocab
vocab:EndiannessTypeVocab
vocab:HashNameVocab
vocab:LibraryTypeVocab
vocab:MemoryBlockTypeVocab
vocab:ObservableObjectRelationshipVocab
vocab:ObservableObjectStateVocab
vocab:PartitionTypeVocab
vocab:ProcessorArchVocab
vocab:RegionalRegistryTypeVocab
vocab:RegistryDatatypeVocab
vocab:SIMFormVocab
vocab:SIMTypeVocab
vocab:TaskActionTypeVocab
vocab:TaskFlagVocab
vocab:TaskPriorityVocab
vocab:TaskStatusVocab
vocab:ThreadRunningStatusVocab
vocab:TimestampPrecisionVocab
vocab:TrendVocab
vocab:TriggerFrequencyVocab
vocab:TriggerTypeVocab
vocab:UnixProcessStateVocab
vocab:WhoisContactTypeVocab
vocab:WhoisDNSSECTypeVocab
vocab:WhoisStatusTypeVocab
vocab:WindowsDriveTypeVocab
vocab:WindowsVolumeAttributeVocab