Tree

action:ArrayOfAction
core:ExternalReference
core:Facet
action:ActionArgumentFacet
action:ActionEstimationFacet
action:ActionFrequencyFacet
action:ActionReferencesFacet
core:ConfidenceFacet
identity:IdentityFacet
identity:AddressFacet
identity:AffiliationFacet
identity:BirthInformationFacet
identity:CountryOfResidenceFacet
identity:EventsFacet
identity:IdentifierFacet
identity:LanguagesFacet
identity:NationalityFacet
identity:OccupationFacet
identity:OrganizationDetailsFacet
identity:PersonalDetailsFacet
identity:PhysicalInfoFacet
identity:QualificationFacet
identity:RelatedIdentityFacet
identity:SimpleNameFacet
identity:VisaFacet
location:GPSCoordinatesFacet
location:LatLongCoordinatesFacet
location:SimpleAddressFacet
observable:AccountAuthenticationFacet
observable:AccountFacet
observable:ApplicationAccountFacet
observable:ApplicationFacet
observable:ArchiveFileFacet
observable:AttachmentFacet
observable:AudioFacet
observable:AutonomousSystemFacet
observable:BrowserBookmarkFacet
observable:BrowserCookieFacet
observable:CalendarEntryFacet
observable:CalendarFacet
observable:CompressedStreamFacet
observable:ComputerSpecificationFacet
observable:ContactFacet
observable:WhoisContactFacet
observable:ContactListFacet
observable:ContentDataFacet
observable:DataRangeFacet
observable:DefinedEffectFacet
observable:PropertiesEnumeratedEffectFacet
observable:PropertyReadEffectFacet
observable:SendControlCodeEffectFacet
observable:StateChangeEffectFacet
observable:ValuesEnumeratedEffectFacet
observable:DeviceFacet
observable:DigitalAccountFacet
observable:DigitalAddressFacet
observable:EmailAddressFacet
observable:IPAddressFacet
observable:IPv4AddressFacet
observable:IPv6AddressFacet
observable:InstantMessagingAddressFacet
observable:MACAddressFacet
observable:BluetoothAddressFacet
observable:WifiAddressFacet
observable:SIPAddressFacet
observable:DigitalSignatureInfoFacet
observable:DiskFacet
observable:DiskPartitionFacet
observable:DomainNameFacet
observable:EXIFFacet
observable:EmailAccountFacet
observable:EmailMessageFacet
observable:EncodedStreamFacet
observable:EncryptedStreamFacet
observable:EventFacet
observable:ExtInodeFacet
observable:ExtractedStringsFacet
observable:FileFacet
observable:FilePermissionsFacet
observable:FileSystemFacet
observable:FragmentFacet
observable:GeoLocationEntryFacet
observable:GeoLocationLogFacet
observable:GeoLocationTrackFacet
observable:HTTPConnectionFacet
observable:ICMPConnectionFacet
observable:ImageFacet
observable:LibraryFacet
observable:MemoryFacet
observable:MessageFacet
observable:MessageThreadFacet
observable:MftRecordFacet
observable:MobileAccountFacet
observable:MobileDeviceFacet
observable:MutexFacet
observable:NTFSFileFacet
observable:NTFSFilePermissionsFacet
observable:NetworkConnectionFacet
observable:NetworkFlowFacet
observable:NetworkInterfaceFacet
observable:NoteFacet
observable:OnlineServiceFacet
observable:OperatingSystemFacet
observable:PDFFileFacet
observable:PathRelationFacet
observable:PhoneAccountFacet
observable:PhoneCallFacet
observable:ProcessFacet
observable:ProfileFacet
observable:PropertiesEnumeratedEffectFacet
observable:PropertyReadEffectFacet
observable:RasterPictureFacet
observable:SIMCardFacet
observable:SMSMessageFacet
observable:SQLiteBlobFacet
observable:SendControlCodeEffectFacet
observable:SoftwareFacet
observable:StateChangeEffectFacet
observable:SymbolicLinkFacet
observable:TCPConnectionFacet
observable:TwitterProfileFacet
observable:UNIXAccountFacet
observable:UNIXFilePermissionsFacet
observable:UNIXProcessFacet
observable:UNIXVolumeFacet
observable:URLFacet
observable:URLHistoryFacet
observable:URLVisitFacet
observable:UserAccountFacet
observable:UserSessionFacet
observable:ValuesEnumeratedEffectFacet
observable:VolumeFacet
observable:WhoIsFacet
observable:WindowsAccountFacet
observable:WindowsActiveDirectoryAccountFacet
observable:WindowsComputerSpecificationFacet
observable:WindowsPEBinaryFileFacet
observable:WindowsPrefetchFacet
observable:WindowsProcessFacet
observable:WindowsRegistryHiveFacet
observable:WindowsRegistryKeyFacet
observable:WindowsServiceFacet
observable:WindowsTaskFacet
observable:WindowsThreadFacet
observable:WindowsVolumeFacet
observable:WirelessNetworkConnectionFacet
observable:X509CertificateFacet
observable:X509V3ExtensionsFacet
tool:BuildFacet
tool:ToolConfigurationTypeFacet
core:UcoObject
investigation:Authorization
action:Action
investigation:InvestigativeAction
action:ActionLifecycle
investigation:ExaminerActionLifecylce
investigation:SubjectActionLifecycle
investigation:VictimActionLifecycle
action:ActionPattern
observable:ObservableAction
observable:Observation
core:Assertion
core:Annotation
core:AttributedName
core:Compilation
core:ContextualCompilation
investigation:Investigation
investigation:ProvenanceRecord
core:Grouping
core:EnclosingCompilation
core:Bundle
core:ControlledVocabulary
core:IdentityAbstraction
identity:Identity
identity:Organization
identity:Person
core:Item
observable:ObservableObject
observable:API
observable:ARPCache
observable:ARPCacheEntry
observable:Account
observable:DigitalAccount
observable:ApplicationAccount
observable:EmailAccount
observable:MobileAccount
observable:PhoneAccount
observable:UNIXAccount
observable:UserAccount
observable:WindowsAccount
observable:WindowsActiveDirectoryAccount
observable:Address
observable:DigitalAddress
observable:EmailAddress
observable:IPAddress
observable:IPv4Address
observable:IPv6Address
observable:InstantMessagingAddress
observable:MACAddress
observable:BluetoothAddress
observable:WifiAddress
observable:SIPAddress
observable:SocketAddress
observable:Application
observable:Audio
observable:AutonomousSystem
observable:BotConfiguration
observable:BrowserBookmark
observable:BrowserCookie
observable:Calendar
observable:CalendarEntry
observable:Code
observable:ComputerSpecification
observable:Contact
observable:ContactList
observable:ContentData
observable:CookieHistory
observable:Credential
observable:CredentialDump
observable:DNSCache
observable:DNSRecord
observable:Device
observable:Appliance
observable:NetworkAppliance
observable:SecurityAppliance
observable:MobileDevice
observable:SIMCard
observable:DigitalSignatureInfo
observable:Disk
observable:DiskPartition
observable:DomainName
observable:Event
observable:EventLog
observable:FileSystem
observable:FileSystemObject
observable:BlockDeviceNode
observable:CharacterDeviceNode
observable:Directory
observable:File
observable:ArchiveFile
observable:NTFSFile
observable:PDFFile
observable:RasterPicture
observable:UNIXFile
observable:WindowsPEBinaryFile
observable:Junction
observable:NamedPipe
observable:ReparsePoint
observable:Snapshot
observable:Socket
observable:SymbolicLink
observable:GUI
observable:GenericObservableObject
observable:GeoLocationEntry
observable:GeoLocationLog
observable:GeoLocationTrack
observable:Hostname
observable:IPNetmask
observable:Image
observable:Library
observable:Memory
observable:Message
observable:EmailMessage
observable:ForumPost
observable:ForumPrivateMessage
observable:Post
observable:SMSMessage
observable:Tweet
observable:MessageThread
observable:Mutex
observable:NetworkConnection
observable:HTTPConnection
observable:ICMPConnection
observable:TCPConnection
observable:WirelessNetworkConnection
observable:NetworkFlow
observable:NetworkInterface
observable:NetworkProtocol
observable:NetworkRoute
observable:NetworkSubnet
observable:Note
observable:OnlineService
observable:OperatingSystem
observable:PaymentCard
observable:PhoneCall
observable:Pipe
observable:Process
observable:UNIXProcess
observable:WindowsProcess
observable:Profile
observable:SQLiteBlob
observable:Semaphore
observable:ShopListing
observable:Software
observable:Thread
observable:WindowsThread
observable:URL
observable:URLHistory
observable:URLVisit
observable:UserSession
observable:Volume
observable:WebPage
observable:WhoIs
observable:Wiki
observable:WikiArticle
observable:WindowsComputerSpecification
observable:WindowsCriticalSection
observable:WindowsEvent
observable:WindowsFilemapping
observable:WindowsHandle
observable:WindowsHook
observable:WindowsMailslot
observable:WindowsNetworkShare
observable:WindowsPrefetch
observable:WindowsRegistryHive
observable:WindowsRegistryKey
observable:WindowsService
observable:WindowsSystemRestore
observable:WindowsTask
observable:WindowsWaitableTime
observable:X509Certificate
observable:X509V3Certificate
core:MarkingDefinitionAbstraction
marking:MarkingDefinition
core:ModusOperandi
core:Relationship
observable:ObservableRelationship
location:Location
observable:Observable
observable:ObservableAction
observable:ObservableObject
observable:API
observable:ARPCache
observable:ARPCacheEntry
observable:Account
observable:DigitalAccount
observable:ApplicationAccount
observable:EmailAccount
observable:MobileAccount
observable:PhoneAccount
observable:UNIXAccount
observable:UserAccount
observable:WindowsAccount
observable:WindowsActiveDirectoryAccount
observable:Address
observable:DigitalAddress
observable:EmailAddress
observable:IPAddress
observable:IPv4Address
observable:IPv6Address
observable:InstantMessagingAddress
observable:MACAddress
observable:BluetoothAddress
observable:WifiAddress
observable:SIPAddress
observable:SocketAddress
observable:Application
observable:Audio
observable:AutonomousSystem
observable:BotConfiguration
observable:BrowserBookmark
observable:BrowserCookie
observable:Calendar
observable:CalendarEntry
observable:Code
observable:ComputerSpecification
observable:Contact
observable:ContactList
observable:ContentData
observable:CookieHistory
observable:Credential
observable:CredentialDump
observable:DNSCache
observable:DNSRecord
observable:Device
observable:Appliance
observable:NetworkAppliance
observable:SecurityAppliance
observable:MobileDevice
observable:SIMCard
observable:DigitalSignatureInfo
observable:Disk
observable:DiskPartition
observable:DomainName
observable:Event
observable:EventLog
observable:FileSystem
observable:FileSystemObject
observable:BlockDeviceNode
observable:CharacterDeviceNode
observable:Directory
observable:File
observable:ArchiveFile
observable:NTFSFile
observable:PDFFile
observable:RasterPicture
observable:UNIXFile
observable:WindowsPEBinaryFile
observable:Junction
observable:NamedPipe
observable:ReparsePoint
observable:Snapshot
observable:Socket
observable:SymbolicLink
observable:GUI
observable:GenericObservableObject
observable:GeoLocationEntry
observable:GeoLocationLog
observable:GeoLocationTrack
observable:Hostname
observable:IPNetmask
observable:Image
observable:Library
observable:Memory
observable:Message
observable:EmailMessage
observable:ForumPost
observable:ForumPrivateMessage
observable:Post
observable:SMSMessage
observable:Tweet
observable:MessageThread
observable:Mutex
observable:NetworkConnection
observable:HTTPConnection
observable:ICMPConnection
observable:TCPConnection
observable:WirelessNetworkConnection
observable:NetworkFlow
observable:NetworkInterface
observable:NetworkProtocol
observable:NetworkRoute
observable:NetworkSubnet
observable:Note
observable:OnlineService
observable:OperatingSystem
observable:PaymentCard
observable:PhoneCall
observable:Pipe
observable:Process
observable:UNIXProcess
observable:WindowsProcess
observable:Profile
observable:SQLiteBlob
observable:Semaphore
observable:ShopListing
observable:Software
observable:Thread
observable:WindowsThread
observable:URL
observable:URLHistory
observable:URLVisit
observable:UserSession
observable:Volume
observable:WebPage
observable:WhoIs
observable:Wiki
observable:WikiArticle
observable:WindowsComputerSpecification
observable:WindowsCriticalSection
observable:WindowsEvent
observable:WindowsFilemapping
observable:WindowsHandle
observable:WindowsHook
observable:WindowsMailslot
observable:WindowsNetworkShare
observable:WindowsPrefetch
observable:WindowsRegistryHive
observable:WindowsRegistryKey
observable:WindowsService
observable:WindowsSystemRestore
observable:WindowsTask
observable:WindowsWaitableTime
observable:X509Certificate
observable:X509V3Certificate
observable:ObservablePattern
observable:ObservableRelationship
pattern:Pattern
action:ActionPattern
pattern:LogicalPattern
role:Role
investigation:Attorney
investigation:Examiner
investigation:Investigator
investigation:Subject
role:BenevolentRole
role:MaliciousRole
role:NeutralRole
victim:Victim
victim:VictimTargeting
tool:Tool
tool:AnalyticTool
tool:DefensiveTool
tool:MaliciousTool
marking:GranularMarking
marking:MarkingModel
marking:LicenseMarking
marking:ReleaseToMarking
marking:StatementMarking
marking:TermsOfUseMarking
observable:AlternateDataStream
observable:ContactAddress
observable:ContactAffiliation
observable:ContactEmail
observable:ContactMessaging
observable:ContactPhone
observable:ContactProfile
observable:ContactSIP
observable:ContactURL
observable:EnvironmentVariable
observable:ExtractedString
observable:GlobalFlagType
observable:IComHandlerActionType
observable:IExecActionType
observable:IShowMessageActionType
observable:MimePartType
observable:TaskActionType
observable:TriggerType
observable:URLHistoryEntry
observable:WhoisRegistrarInfoType
observable:WindowsPEFileHeader
observable:WindowsPEOptionalHeader
observable:WindowsPESection
observable:WindowsRegistryValue
pattern:PatternExpression
tool:BuildConfigurationType
tool:BuildInformationType
tool:BuildUtilityType
tool:CompilerType
tool:ConfigurationSettingType
tool:DependencyType
tool:LibraryType
types:ControlledDictionary
types:ControlledDictionaryEntry
types:Dictionary
types:DictionaryEntry
types:Hash
types:Identifier
vocab:InvestigationFormVocab
vocabulary1:AccountTypeVocab
vocabulary1:ActionArgumentNameVocab
vocabulary1:ActionNameVocab
vocabulary1:ActionRelationshipTypeVocab
vocabulary1:ActionStatusTypeVocab
vocabulary1:ActionTypeVocab
vocabulary1:BitnessVocab
vocabulary1:CharacterEncodingVocab
vocabulary1:ContactAddressScopeVocab
vocabulary1:ContactEmailScopeVocab
vocabulary1:ContactPhoneScopeVocab
vocabulary1:ContactSIPScopeVocab
vocabulary1:ContactURLScopeVocab
vocabulary1:DiskTypeVocab
vocabulary1:EndiannessTypeVocab
vocabulary1:HashNameVocab
vocabulary1:LibraryTypeVocab
vocabulary1:MemoryBlockTypeVocab
vocabulary1:ObservableObjectRelationshipVocab
vocabulary1:ObservableObjectStateVocab
vocabulary1:PartitionTypeVocab
vocabulary1:ProcessorArchVocab
vocabulary1:RegionalRegistryTypeVocab
vocabulary1:RegistryDatatypeVocab
vocabulary1:SIMFormVocab
vocabulary1:SIMTypeVocab
vocabulary1:TaskActionTypeVocab
vocabulary1:TaskFlagVocab
vocabulary1:TaskPriorityVocab
vocabulary1:TaskStatusVocab
vocabulary1:ThreadRunningStatusVocab
vocabulary1:TimestampPrecisionVocab
vocabulary1:TrendVocab
vocabulary1:TriggerFrequencyVocab
vocabulary1:TriggerTypeVocab
vocabulary1:URLTransitionTypeVocab
vocabulary1:UnixProcessStateVocab
vocabulary1:WhoisContactTypeVocab
vocabulary1:WhoisDNSSECTypeVocab
vocabulary1:WhoisStatusTypeVocab
vocabulary1:WindowsDriveTypeVocab
vocabulary1:WindowsVolumeAttributeVocab