Crossover CASE - Linked

Crossover CASE - Linked

The link between the two seemingly separate investigations is obtained by querying for email addresses.

The index of scenario portions is here.

SELECT ?nInvestigationName ?lAddress
WHERE {

  ?nInvestigation
    a case-investigation:Investigation ;
    uco-core:name ?nInvestigationName ;
    .

  ?nEmailAddress
    a uco-observable:EmailAddress ;
    uco-core:hasFacet ?nEmailAddressFacet ;
    .

  ?nEmailAddressFacet
    uco-observable:addressValue ?lAddress ;
    .
}
The results of this query list the Investigation and associated email address, which reveal a link.
?nInvestigationName ?lAddress
CROSSOVER_2018_11191001 aresthewerewolf@gmail.com
CROSSOVER_2018_11191001 badquinn3@gmail.com
CROSSOVER_2018_12111001 aresthewerewolf@gmail.com
CROSSOVER_2018_12111001 badquinn3@gmail.com

Disclaimers

Participation by contributors in the creation of the documentation of mentioned software is not intended to imply a recommendation or endorsement by the United States Government nor any of the contributors' employers, nor is it intended to imply that any specific software is necessarily the best available for the purpose.

Events, locations, tools, and people represented in this and other CASE narratives are presented, and at many times created, for illustration purposes only and do not necessarily represent real events, locations, tools, or people.