Insider Threat Indicator Ontology
type: Ontology
revision: 1
creator: CERT Insider Threat Center
comment: This ontology is designed to provide an expression mechanism for potential indicators of malicious insider activity.

endMeetsBeginningOf
type: ObjectProperty
sub property of: temporallyRelatedTo
inverse of: startMeetsEndingOf
domain: TemporalThing
is defined by: This property links a temporal thing that follows immediatly after a second temporal thing. Adapted from Eric Peterson's SpaceTime ontology: http://semanic.org/OntDef/Cur/SpaceTime.owl

startMeetsEndingOf
type: ObjectProperty
sub property of: temporallyRelatedTo
domain: TemporalThing
is defined by: This predicate means that the TemporalThing subject starts immediately following the TemporalThing object. subject and object have no time points in common, but there is also no time point between the ending of object and the starting of subject. -Derived from OpenCyc 1.0. Adapted from Eric Peterson's SpaceTime ontology: http://semanic.org/OntDef/Cur/SpaceTime.owl

cotemporalWith
type: ObjectProperty
sub property of: temporallyRelatedTo
type: SymmetricProperty
type: TransitiveProperty
domain: TemporalThing
is defined by: This property means that the two temporal things have precisely the same temporal extent (see temporalExtent). -Derived from OpenCyc 1.0 Adapted from Eric Peterson's SpaceTime ontology: http://semanic.org/OntDef/Cur/SpaceTime.owl

finishedBy
type: ObjectProperty
sub property of: temporallyRelatedTo
inverse of: finishes
type: TransitiveProperty
domain: TemporalThing
is defined by: See inverse. Adapted from Eric Peterson's SpaceTime ontology: http://semanic.org/OntDef/Cur/SpaceTime.owl

finishes
type: ObjectProperty
sub property of: temporallyRelatedTo
type: TransitiveProperty
domain: TemporalThing
is defined by: This predicate means that subject and object end at the same time and that the subject starts after the object. Adapted from Eric Peterson's SpaceTime ontology: http://semanic.org/OntDef/Cur/SpaceTime.owl

hasAccessTo
type: ObjectProperty
domain: ComputerAccountAsset
range: Asset
is defined by: describes a computer account's access to an asset.

hasAccomplice
type: ObjectProperty
sub property of: hasEventRelation
inverse of: isAccompliceOf
domain: Person
range: Person
is defined by: This relation defines an accomplice to the insider during the event. An accomplice is a person who helps another commit a crime

hasAction
type: ObjectProperty
domain: Event
range: Action
is defined by: This property links an event to its action(s).

hasActor
type: ObjectProperty
inverse of: isActorOf
domain: Action
range: Actor
is defined by: This property links an action to its actor(s).

hasAdministrativeAssistant
type: ObjectProperty
sub property of: hasEmployee
inverse of: isAdministrativeAssistantOf
domain: Organization
range: Person
is defined by: This property links an organization to one of its administrative assistants. An administrative assistant is defined as an individual who provides various kinds of administrative support to people and groups in organizations.

hasAnalyst
type: ObjectProperty
sub property of: hasTechnicalEmployee
inverse of: isAnalystOf
domain: Organization
range: Person
is defined by: Links an organization to an analyst. An analyst is defined as an employee who analyzes or is skilled in analysis.

hasAsset
type: ObjectProperty
inverse of: isAssetOf
range: Asset
is defined by: This property links an asset or actor to an asset it owns.

hasBeneficiaryOrganization
type: ObjectProperty
sub property of: hasEventRelation
inverse of: isBeneficiaryOrganizationOf
domain: Event
range: Organization
is defined by: This links an event to the beneficiary organization for the event. The beneficiary organization is defined as the organization that the insider intended to provide some benefit to through their malicious actions. The beneficiary organization may or may not have been knowingly involved in the incident.

hasBoyfriend
type: ObjectProperty
sub property of: hasFriendRelation
inverse of: isBoyfriendOf
domain: Person
range: Person
is defined by: Relates a person to a male friend with whom that person has a romantic relationship.

hasBrother
type: ObjectProperty
sub property of: hasFamilyRelation
inverse of: isBrotherOf
domain: Person
range: Person
is defined by: Relates a male to other sons and daughters of his parents.

hasChiefExecutiveOfficer
type: ObjectProperty
sub property of: hasUppermanagementEmployee
inverse of: isChiefExecutiveOfficerOf
domain: Organization
range: Person
is defined by: Links an organization to a chief executive officer. A chief executive officer is defined as a top executive in an organization.

hasChiefFinancialOfficer
type: ObjectProperty
sub property of: hasUppermanagementEmployee
inverse of: isChiefFinancialOfficerOf
domain: Organization
range: Person
is defined by: Links an organization to a chief financial officer. A chief financial officer is a top executive who manages the finances of an organization.

hasChiefTechnicalOfficer
type: ObjectProperty
sub property of: hasUppermanagementEmployee
inverse of: isChiefTechnicalOfficerOf
domain: Organization
range: Person
is defined by: Links an organization to a chief technical officer. A chief technical officer is defined as a top executive who runs the technology groups within an organization.

hasColleague
type: ObjectProperty
sub property of: hasWorkRelation
inverse of: isColleagueOf
domain: Person
range: Person
is defined by: This property links colleagues. A colleague is defined as a fellow worker or member of a staff, department, profession, etc.

hasCompetitor
type: ObjectProperty
sub property of: hasWorkRelation
domain: Actor
range: Actor
definition references: http://dictionary.reference.com/browse/colleague
is defined by: This property links competing individuals or organizations.

hasConspirator
type: ObjectProperty
sub property of: hasEventRelation
inverse of: isConspiratorOf
domain: Person
range: Person
is defined by: This relation defines conspirator for the insider during the event. A conspirator is a person who is involved in a secret plan to do something harmful or illegal.

hasConsultant
type: ObjectProperty
sub property of: hasWorkRelation
inverse of: isConsultantOf
domain: Actor
range: Actor
definition references: http://www.shrm.org/TemplatesTools/Glossaries/HRTerms/Pages/c.aspx
is defined by: This property links a consulant to a customer. A consultant is defined as an individual who works independently to assist and advise client organizations with various organizational functions and responsibilities on a fee-for-service basis.

hasContractor
type: ObjectProperty
sub property of: hasExternalEmployee
inverse of: isContractorOf
domain: Organization
range: Person
definition references: Links an organization to a contractor. A contractor is defined as a person or company that undertakes a contract to provide materials or labor to perform a service or do a job.

hasCustomer
type: ObjectProperty
sub property of: hasWorkRelation
inverse of: isCustomerOf
domain: Actor
range: Actor
is defined by: This property links an actor to a customer. A customer is defined as person or organization that buys goods or services from a business or an organization.

hasCustomerServiceRepresentative
type: ObjectProperty
sub property of: hasRepresentative
inverse of: isCustomerServiceRepresentativeOf
domain: Organization
range: Person
definition references: http://www.onetonline.org/link/summary/43-4051.00
is defined by: Links an organization to a customer service representative. A customer service representative is defined as an individual who interacts with customers to provide information in response to inquiries about products and services and to handle and resolve complaints.

hasDestination
type: ObjectProperty
sub property of: hasLocation
domain: DigitalAction
range: Asset
is defined by: See parent definition

hasEducationEmployee
type: ObjectProperty
sub property of: hasEmployee
inverse of: isEducationEmployeeOf
domain: Organization
range: Person
is defined by: This property links an organization to an employee in the education system.

hasEmployee
type: ObjectProperty
sub property of: hasWorkRelation
inverse of: isEmployeeOf
domain: Organization
range: Person
definition references: http://dictionary.reference.com/browse/employee
is defined by: This property links an organization to one of its employees. An employee is defined as a person working for another person or an organization for pay.

hasEventRelation
type: ObjectProperty
sub property of: hasRelation
inverse of: isEventRelationOf
range: Actor
is defined by: This property describes an actor's role in the insider event. This role can be in relation to the event itself or to another actor in the event.

hasExternalEmployee
type: ObjectProperty
sub property of: hasEmployee
inverse of: isExternalEmployeeOf
domain: Organization
range: Person
definition references: Links an organization to an individual who is not a direct employee of the organization.

hasFamilyRelation
type: ObjectProperty
sub property of: hasRelation
inverse of: isFamilyRelationOf
domain: Person
range: Person
is defined by: A connection between two people associated with familial ties.

hasFather
type: ObjectProperty
sub property of: hasFamilyRelation
inverse of: isFatherOf
is defined by: Relates a male to his child or children.

hasFriend
type: ObjectProperty
sub property of: hasFriendRelation
inverse of: isFriendOf
domain: Person
range: Person
is defined by: See parent definition.

hasFriendRelation
type: ObjectProperty
sub property of: hasRelation
inverse of: isFriendRelationOf
domain: Person
range: Person
is defined by: This defines friends of the insider who may have knowingly or unknowingly been involved in the event.

hasGirlfriend
type: ObjectProperty
sub property of: hasFriendRelation
inverse of: isGirlfriendOf
domain: Person
range: Person
is defined by: Relates a person to a female friend with whom that person has a romantic relationship.

hasHusband
type: ObjectProperty
sub property of: hasSpouse
inverse of: isHusbandOf
domain: Person
range: Person
is defined by: Relates a married man to his spouse.

hasInformation
type: ObjectProperty
domain: Asset
range: Information
is defined by: This property links an asset to the information it contains.

hasInstrument
type: ObjectProperty
domain: Action
range: Asset
is defined by: This links an action to an asset used in the action. This fits into an action as follows: "An actor performs an action on an object with an instrument."

hasLocation
type: ObjectProperty
range: Asset
is defined by: This property defines the logical or physical locations of information, an asset, or an actor.

hasManager
type: ObjectProperty
sub property of: hasEmployee
inverse of: isManagerOf
domain: Organization
range: Person
is defined by: LInks an organization to a manager. A manager is defined as an employee who manages a group within an organization.

hasMother
type: ObjectProperty
sub property of: hasFamilyRelation
inverse of: isMotherOf
is defined by: Relates a female to her child or children.

hasNetworkAdministrator
type: ObjectProperty
sub property of: hasTechnicalEmployee
inverse of: isNetworkAdministratorOf
domain: Organization
range: Person
is defined by: Links an organization to a network administrator. A network administrator is defined as an employee who is responsible for upkeep, configuration, and reliable operation of a network.

hasObject
type: ObjectProperty
sub property of: topObjectProperty
domain: Action
range: Asset
is defined by: This links an action to the object that was acted upon. This fits into an action as follows: "An actor performs an action on an object with an instrument."

hasOfficeManager
type: ObjectProperty
sub property of: hasManager
inverse of: isOfficeManagerOf
domain: Organization
range: Person
is defined by: Links an organization to an office manager. An office manager is defined as an employee that runs day-to-day operations within an office.

hasPoliceOfficer
type: ObjectProperty
sub property of: hasSecurityEmployee
inverse of: isPoliceOfficerOf
domain: Organization
range: Person
definition references: http://www.onetonline.org/link/summary/33-3051.00
is defined by: Links an organization to a a police officer. A police officer is defined as a person who maintains order and protects life and property by enforcing local, tribal, State, or Federal laws and ordinances. Performs a combination of the following duties: patrol a specific area; direct traffic; issue traffic summonses; investigate accidents; apprehend and arrest suspects, or serve legal processes of courts.

hasProfessor
type: ObjectProperty
sub property of: hasEducationEmployee
inverse of: isProfessorOf
domain: Organization
range: Person
definition references: http://dictionary.reference.com/browse/professor
is defined by: A teacher of the highest academic rank in a college or university.

hasReferenceTo
type: ObjectProperty
inverse of: isReferencedBy
domain: Information
is defined by: This property links a piece of information to a thing that it describes, is about, references, or makes mention to.

hasRelation
type: ObjectProperty
inverse of: isRelationOf
range: Actor
is defined by: This property describes how an actor or event is related to another actor.

hasRepresentative
type: ObjectProperty
sub property of: hasEmployee
inverse of: isRepresentativeOf
domain: Organization
range: Person
is defined by: Links an organization to a representative. A representative is defined as an employee who is chosen or appointed to act or speak for another or others, in particular.

hasResearcher
type: ObjectProperty
sub property of: hasEmployee
inverse of: isResearcherOf
domain: Organization
range: Person
is defined by: Links an organization to a researcher. A researcher is defined as an employee who investigates new areas of study and applications of technology.

hasRetailer
type: ObjectProperty
sub property of: hasSalesEmployee
inverse of: isRetailerOf
domain: Organization
range: Person
definition references: Links an organization to a retailer. A retailer is defined as a seller of goods or commodities in small quantities directly to consumers.
definition references: http://www.thefreedictionary.com/retailer

hasSalesEmployee
type: ObjectProperty
sub property of: hasEmployee
inverse of: isSalesEmployeeOf
domain: Organization
range: Person
is defined by: Links an organization to an employee that sells a product or service provided by the organization

hasSecurityEmployee
type: ObjectProperty
sub property of: hasEmployee
inverse of: isSecurityEmployeeOf
domain: Organization
range: Person
is defined by: Links an organization to a person who ensures the physical safety of people or assets.

hasSecurityGuard
type: ObjectProperty
sub property of: hasSecurityEmployee
inverse of: isSecurityGuardOf
domain: Organization
range: Person
definition references: http://www.onetonline.org/link/summary/33-9032.00
is defined by: Links an organization to a security guard. A security guard is defined as an employee who guard, patrols, or monitors premises to prevent theft, violence, or infractions of rules.

hasSister
type: ObjectProperty
sub property of: hasFamilyRelation
inverse of: isSisterOf
domain: Person
range: Person
is defined by: Relates a female to other sons and daughters of her parents.

hasSoftwareDeveloper
type: ObjectProperty
sub property of: hasTechnicalEmployee
inverse of: isSoftwareDeveloperOf
domain: Organization
range: Person
is defined by: Links an organization to an individual who creates software.

hasSource
type: ObjectProperty
sub property of: hasLocation
domain: DigitalAction
range: Asset
is defined by: See parent definition

hasSpouse
type: ObjectProperty
sub property of: hasFamilyRelation
inverse of: isSpouseOf
domain: Person
range: Person
is defined by: Relates a husband or wife to their partner.

hasSubcontractor
type: ObjectProperty
sub property of: hasExternalEmployee
inverse of: isSubcontractorOf
domain: Organization
range: Person
definition references: http://dictionary.reference.com/browse/subcontractor
is defined by: Links an organization to a subcontractor. A subcontractor is defined as a person or business that contracts to provide some service or material necessary for the performance of another's contract.

hasSystemAdministrator
type: ObjectProperty
sub property of: hasTechnicalEmployee
inverse of: isSystemAdministratorOf
domain: Organization
range: Person
is defined by: Links an organization to a system administrator. A system administrator is defined as an employee who is responsible for upkeep, configuration, and reliable operation of computer systems.

hasTechnicalEmployee
type: ObjectProperty
sub property of: hasEmployee
inverse of: isTechnicalEmployeeOf
domain: Organization
range: Person
is defined by: Links an organization to an employee whose duties typically involve copmuters or computer networks.

hasTechnicalManager
type: ObjectProperty
sub property of: hasManager
inverse of: isTechnicalManagerOf
domain: Organization
range: Person
is defined by: Links an organization to a technical manager. A technical manager is defined as an employee that provides technical direction and leadership for the development of products and projects.

hasTechnician
type: ObjectProperty
sub property of: hasTechnicalEmployee
inverse of: isTechnicianOf
domain: Organization
range: Person
definition references: http://dictionary.reference.com/browse/technician
is defined by: Links an organization to a technician. A technicial is defined as a person who is trained or skilled in the technicalities of a subject.

hasTrustedBusinessPartner
type: ObjectProperty
sub property of: hasWorkRelation
inverse of: isTrustedBusinessPartnerOf
domain: Organization
range: Actor
is defined by: This property defines a collaborative professional relationship between organizations or people involving some level of mutual trust.

hasUppermanagementEmployee
type: ObjectProperty
sub property of: hasEmployee
inverse of: isUppermanagementEmployeeOf
domain: Organization
range: Person
is defined by: Links an organization to an employee who holds an upper management position within the organization.

hasVendor
type: ObjectProperty
sub property of: hasSalesEmployee
inverse of: isVendorOf
domain: Organization
range: Person
definition references: http://dictionary.reference.com/browse/vendor
is defined by: Links an organization to a vendor. A vendor is defined as a person that sells something.

hasVictimOrganization
type: ObjectProperty
sub property of: hasEventRelation
inverse of: isVictimOrganizationOf
domain: Event
range: Organization
is defined by: This links an event to the victim organization for the event. A victim organization is an organization who suffers from the malicious actions of an insider.

hasWife
type: ObjectProperty
sub property of: hasSpouse
inverse of: isWifeOf
domain: Person
range: Person
is defined by: Relates a married woman to her spouse.

hasWorkRelation
type: ObjectProperty
sub property of: hasRelation
inverse of: isWorkRelationOf
domain: Actor
range: Actor
is defined by: This describes a professional relationship.

isAccompliceOf
type: ObjectProperty
sub property of: isEventRelationOf
domain: Person
range: Person
is defined by: See inverse.

isActorOf
type: ObjectProperty
domain: Actor
range: Action
is defined by: See inverse.

isAdministrativeAssistantOf
type: ObjectProperty
sub property of: isEmployeeOf
domain: Person
range: Organization
is defined by: See inverse.

isAnalystOf
type: ObjectProperty
sub property of: isTechnicalEmployeeOf
domain: Person
range: Organization
is defined by: See inverse.

isAssetOf
type: ObjectProperty
domain: Asset
is defined by: See inverse.

isBeneficiaryOrganizationOf
type: ObjectProperty
sub property of: isEventRelationOf
domain: Organization
range: Event
is defined by: See inverse.

isBoyfriendOf
type: ObjectProperty
sub property of: isFriendRelationOf
domain: Person
range: Person
is defined by: See inverse.

isBrotherOf
type: ObjectProperty
sub property of: isFamilyRelationOf
domain: Person
range: Person
is defined by: See inverse.

isChiefExecutiveOfficerOf
type: ObjectProperty
sub property of: isUppermanagementEmployeeOf
domain: Person
range: Organization
is defined by: See inverse.

isChiefFinancialOfficerOf
type: ObjectProperty
sub property of: isUppermanagementEmployeeOf
domain: Person
range: Organization
is defined by: See inverse.

isChiefTechnicalOfficerOf
type: ObjectProperty
sub property of: isUppermanagementEmployeeOf
domain: Person
range: Organization
is defined by: See inverse.

isColleagueOf
type: ObjectProperty
sub property of: isWorkRelationOf
domain: Person
range: Actor
is defined by: See inverse.

isConspiratorOf
type: ObjectProperty
sub property of: isEventRelationOf
domain: Person
range: Person
is defined by: See inverse.

isConsultantOf
type: ObjectProperty
sub property of: isWorkRelationOf
domain: Actor
range: Actor
is defined by: See inverse.

isContractorOf
type: ObjectProperty
sub property of: isExternalEmployeeOf
domain: Person
range: Organization
is defined by: See inverse.

isCustomerOf
type: ObjectProperty
sub property of: isWorkRelationOf
domain: Actor
range: Actor
is defined by: See inverse.

isCustomerServiceRepresentativeOf
type: ObjectProperty
sub property of: isRepresentativeOf
domain: Person
range: Organization
is defined by: See inverse.

isEducationEmployeeOf
type: ObjectProperty
sub property of: isEmployeeOf
domain: Person
range: Organization
is defined by: See inverse.

isEmployeeOf
type: ObjectProperty
sub property of: isWorkRelationOf
type: TransitiveProperty
domain: Person
range: Organization
is defined by: See inverse.

isEventRelationOf
type: ObjectProperty
sub property of: isRelationOf
domain: Actor
is defined by: See inverse.

isExternalEmployeeOf
type: ObjectProperty
sub property of: isEmployeeOf
domain: Person
range: Organization
is defined by: See inverse.

isFamilyRelationOf
type: ObjectProperty
sub property of: isRelationOf
domain: Person
range: Person
is defined by: See inverse.

isFatherOf
type: ObjectProperty
sub property of: isFamilyRelationOf
domain: Person
range: Person
is defined by: See inverse.

isFriendOf
type: ObjectProperty
sub property of: isFriendRelationOf
domain: Person
range: Person
is defined by: See inverse.

isFriendRelationOf
type: ObjectProperty
sub property of: isRelationOf
domain: Person
range: Person
is defined by: See inverse.

isGirlfriendOf
type: ObjectProperty
sub property of: isFriendRelationOf
domain: Person
range: Person
is defined by: See inverse.

isHusbandOf
type: ObjectProperty
sub property of: isSpouseOf
domain: Person
range: Person
is defined by: See inverse.

isManagerOf
type: ObjectProperty
sub property of: isEmployeeOf
domain: Person
range: Organization
is defined by: See inverse.

isMotherOf
type: ObjectProperty
sub property of: isFamilyRelationOf
domain: Person
range: Person
is defined by: See inverse.

isNetworkAdministratorOf
type: ObjectProperty
sub property of: isTechnicalEmployeeOf
domain: Person
range: Organization
is defined by: See inverse.

isOfficeManagerOf
type: ObjectProperty
sub property of: isManagerOf
domain: Person
range: Organization
is defined by: See inverse.

isPartnerOf
type: ObjectProperty
sub property of: isFamilyRelationOf
domain: Person
range: Person
is defined by: See inverse.

isPoliceOfficerOf
type: ObjectProperty
sub property of: isSecurityEmployeeOf
domain: Person
range: Organization
is defined by: See inverse.

isProfessorOf
type: ObjectProperty
sub property of: isEducationEmployeeOf
domain: Person
range: Organization
is defined by: See inverse.

isReferencedBy
type: ObjectProperty
sub property of: topObjectProperty
is defined by: See inverse.

isRelationOf
type: ObjectProperty
is defined by: See inverse.

isRepresentativeOf
type: ObjectProperty
sub property of: isEmployeeOf
domain: Person
range: Organization
is defined by: See inverse.

isResearcherOf
type: ObjectProperty
sub property of: isEmployeeOf
domain: Person
range: Organization
is defined by: See inverse.

isRetailerOf
type: ObjectProperty
sub property of: isSalesEmployeeOf
domain: Person
range: Organization
is defined by: See inverse.

isSalesEmployeeOf
type: ObjectProperty
sub property of: isEmployeeOf
domain: Person
range: Organization
is defined by: See inverse.

isSecurityEmployeeOf
type: ObjectProperty
sub property of: isEmployeeOf
domain: Person
range: Organization
is defined by: See inverse.

isSecurityGuardOf
type: ObjectProperty
sub property of: isSecurityEmployeeOf
domain: Person
range: Organization
is defined by: See inverse.

isSisterOf
type: ObjectProperty
sub property of: isFamilyRelationOf
domain: Person
range: Person
is defined by: See inverse.

isSoftwareDeveloperOf
type: ObjectProperty
sub property of: isTechnicalEmployeeOf
domain: Person
range: Organization
is defined by: See inverse.

isSpouseOf
type: ObjectProperty
sub property of: isFamilyRelationOf
domain: Person
range: Person
is defined by: See inverse.

isSubcontractorOf
type: ObjectProperty
sub property of: isExternalEmployeeOf
domain: Person
range: Organization
is defined by: See inverse.

isSystemAdministratorOf
type: ObjectProperty
sub property of: isTechnicalEmployeeOf
domain: Person
range: Organization
is defined by: See inverse.

isTechnicalEmployeeOf
type: ObjectProperty
sub property of: isEmployeeOf
domain: Person
range: Organization
is defined by: See inverse.

isTechnicalManagerOf
type: ObjectProperty
sub property of: isManagerOf
domain: Person
range: Organization
is defined by: See inverse.

isTechnicianOf
type: ObjectProperty
sub property of: isTechnicalEmployeeOf
domain: Person
range: Organization
is defined by: See inverse.

isTrustedBusinessPartnerOf
type: ObjectProperty
sub property of: isWorkRelationOf
domain: Actor
range: Organization
is defined by: See inverse.

isUppermanagementEmployeeOf
type: ObjectProperty
sub property of: isEmployeeOf
domain: Person
range: Organization
is defined by: See inverse.

isVendorOf
type: ObjectProperty
sub property of: isSalesEmployeeOf
domain: Person
range: Organization
is defined by: See inverse.

isVictimOrganizationOf
type: ObjectProperty
sub property of: isEventRelationOf
domain: Organization
range: Event
is defined by: See inverse.

isWifeOf
type: ObjectProperty
sub property of: isSpouseOf
domain: Person
range: Person
is defined by: See inverse.

isWorkRelationOf
type: ObjectProperty
sub property of: isRelationOf
domain: Actor
range: Actor
is defined by: See inverse.

istemporallySubsumedBy
type: ObjectProperty
sub property of: temporallyRelatedTo
inverse of: temporallySubsumes
domain: TemporalThing
is defined by: See inverse. Adapted from Eric Peterson's SpaceTime ontology: http://semanic.org/OntDef/Cur/SpaceTime.owl

overlapsEnd
type: ObjectProperty
sub property of: temporallyRelatedTo
inverse of: overlapsStart
domain: TemporalThing
is defined by: This property defines a temporal thing that starts after, partially occurs during, and ends after another temporal thing. Adapted from Eric Peterson's SpaceTime ontology: http://semanic.org/OntDef/Cur/SpaceTime.owl

overlapsStart
type: ObjectProperty
sub property of: temporallyRelatedTo
domain: TemporalThing
is defined by: This property defines a temporal thing that starts before, partially occurs during, and ends before another temporal thing. Adapted from Eric Peterson's SpaceTime ontology: http://semanic.org/OntDef/Cur/SpaceTime.owl

startedBy
type: ObjectProperty
sub property of: temporallyRelatedTo
inverse of: starts
type: TransitiveProperty
domain: TemporalThing
is defined by: This predicate means that subject and object start to occur or exist at the same time point (see startingPoint) and that subject ends or ceases to exist (see endingPoint) after object ends or ceases to exist. For example, subject might be a WeddingCeremony and object might be the bride's walk down the aisle. -Derived from OpenCyc 1.0 Adapted from Eric Peterson's SpaceTime ontology: http://semanic.org/OntDef/Cur/SpaceTime.owl

starts
type: ObjectProperty
sub property of: temporallyRelatedTo
type: TransitiveProperty
domain: TemporalThing
is defined by: See inverse. Adapted from Eric Peterson's SpaceTime ontology: http://semanic.org/OntDef/Cur/SpaceTime.owl

takesPlaceAfter
type: ObjectProperty
sub property of: temporallyRelatedTo
inverse of: takesPlaceBefore
domain: TemporalThing
is defined by: See inverse. Adapted from Eric Peterson's SpaceTime ontology: http://semanic.org/OntDef/Cur/SpaceTime.owl

takesPlaceBefore
type: ObjectProperty
sub property of: temporallyRelatedTo
domain: TemporalThing
is defined by: This property links a subject to an object such that the subject starts and ends before the object starts. Adapted from Eric Peterson's SpaceTime ontology: http://semanic.org/OntDef/Cur/SpaceTime.owl

temporallyRelatedTo
type: ObjectProperty
type: SymmetricProperty
domain: TemporalThing
range: TemporalThing
is defined by: This property links two entities so as to characterize their overlap in time.

temporallySubsumes
type: ObjectProperty
sub property of: temporallyRelatedTo
domain: TemporalThing
is defined by: This property defines a relationship between subject and object where the subject starts after and ends before the subject. Adapted from Eric Peterson's SpaceTime ontology: http://semanic.org/OntDef/Cur/SpaceTime.owl

duration
type: DatatypeProperty
sub property of: topDataProperty
domain: TemporalThing
range: float
is defined by: This property links a temporal thing with a non-reified float representing duration. It needn't be reified, because the temporal thing is a durational thing.

AllTime
type: Class
subclass of: TemporalInterval
is defined by: An instance of this class reporesents the infinite interval containing all time..

TimePoint
type: Class
subclass of: TemporalInterval
is defined by: Instances of this class are maximally small intervals - time pixels if you will. This size of a pixel corresponds with the smallest resolvable time unit on the machine implementation in use. Time points are to be shared among all events in the data store.

AcceptAction
type: Class
subclass of: JobChangeAction
is defined by: To agree to start or change to a specific job role.

AccessAction
type: Class
subclass of: DigitalAction
is defined by: The act of gaining access to a system.

AccountAuthenticationInformation
type: Class
subclass of: SystemInformation
disjoint with: SystemConfigurationInformation
is defined by: Information used to identify and authenticate a person on a computer or network

Action
type: Class
subclass of: TemporalThing
is defined by: A thing performed by a direct actor and indirect participants on a direct object, which may produce a result. Optionally happens at a location, and/or with the help of an instrument.

ActionModifier
type: Class
subclass of: Action
is defined by: Modifier that describes additional subjective details about an action.

Actor
type: Class
definition references: http://schema.org/agent
is defined by: The direct performer of driver of an action.

AnomalousEvent
type: Class
subclass of: Event
is defined by: Event that is determined to deviate from a set baseline.

ApplyAction
type: Class
subclass of: JobChangeAction
is defined by: To submit an application for a job.

Asset
type: Class
definition references: http://schema.org/Intangible
is defined by: A utility class that serves as the umbrella for a number of tangible and intangible things, such as data, hardware, personally identifiable information (PII), software, etc.

BackdoorSoftwareAsset
type: Class
subclass of: MalwareAsset
is defined by: A computer program designed to allow an unauthorized path into the network or a system.

BackupTapesAsset
type: Class
subclass of: PhysicalAsset
is defined by: A reserve copy of data, stored on magnetic tape media, for use if the original becomes lost or damaged.

BankAccountAsset
type: Class
subclass of: FinancialAsset
subclass of: Restriction
  on property: hasInformation
  some values from: BankAccountInformation
definition references: http://www.investopedia.com/terms/a/account.asp
is defined by: An arrangement by which an organization accepts a customer's financial assets and holds them on behalf of the customer at his or her discretion.

BankAccountInformation
type: Class
subclass of: FinancialInformation
is defined by: The information uniquely identifying a bank account, including account numbers and balance information.

BreachAction
type: Class
subclass of: JobChangeAction
definition references: http://www.shrm.org/templatestools/glossaries/hrterms/pages/b.aspx
is defined by: The act of not upholding or violating the terms of a contract or agreement.

BusinessInformation
type: Class
subclass of: Information
is defined by: Information about how a business is run

BusinessPolicyInformation
type: Class
subclass of: BusinessInformation
is defined by: Information contained in business policies. Policies provide high level criteria for developing business processes.

BusinessProcessInformation
type: Class
subclass of: BusinessInformation
is defined by: Information on how business processes are performed.

ClassifiedInformation
type: Class
subclass of: Information
is defined by: Sensitive information that requires special protections.

CompactDiskAsset
type: Class
subclass of: PhysicalAsset
definition references: http://www.webopedia.com/TERM/C/compact_disc.html
is defined by: A polycarbonate with one or more metal layers capable of storing digital information.

CompressAction
type: Class
subclass of: ModificationAction
disjoint with: DecompressAction
definition references: http://searchstorage.techtarget.com/definition/compression
is defined by: The reduction in size of data in order to save space or transmission time.

ComputerAccountAsset
type: Class
subclass of: DigitalAsset
subclass of: Class
  intersection of: Restriction
    on property: hasInformation
    some values from: PasswordInformation
  intersection of: Restriction
    on property: hasInformation
    some values from: UsernameInformation
definition references: http://msdn.microsoft.com/en-us/library/cc759279
is defined by: A means for authenticating and auditing computer access to a network or domain resources.

ComputerAsset
type: Class
subclass of: PhysicalAsset
type: NamedIndividual
definition references: http://www.oed.com/view/Entry/37975
is defined by: An electronic device (or system of devices) that is used to store, manipulate, and communicate information, perform complex calculations, or control or regulate other devices or machines and is capable of receiving information (data) and of processing it in accordance with variable procedural instructions (programs or software).

ConnectAction
type: Class
subclass of: AccessAction
disjoint with: LoginAction
definition references: http://www.merriam-webster.com/dictionary/connect
is defined by: To establish a communications connection.

CopyAction
type: Class
subclass of: DigitalAction
definition references: http://windows.microsoft.com/en-us/windows-vista/copy-a-file-or-folder
is defined by: To duplicate an original item that you can then modify, delete, or store independently of the original.

CreateAction
type: Class
subclass of: ModificationAction
disjoint with: DeleteAction
definition references: http://www.merriam-webster.com/dictionary/create
is defined by: To cause an asset to exist.

CreditCardAsset
type: Class
subclass of: FinancialAsset
subclass of: Restriction
  on property: hasInformation
  some values from: CreditCardNumber
definition references: http://www.investopedia.com/terms/c/creditcard.asp
is defined by: A card issued by a financial company giving the holder an option to borrow funds, usually at point of sale.

CreditCardNumber
type: Class
subclass of: FinancialInformation
is defined by: A unique number identifying a credit card account.

CreditReportInformation
type: Class
subclass of: FinancialInformation
is defined by: Information regarding an individual's history with borrowing money.

DataDeletionEvent
type: Class
subclass of: Event
definition references: http://nvlpubs.nist.gov/nistpubs/ir/2013/NIST.IR.7298r2.pdf
is defined by: The logical, but not necessarily physical, erasure of data from an operating system.

DataExfiltrationEvent
type: Class
subclass of: Event
definition references: http://whatis.techtarget.com/definition/data-exfiltration-data-extrusion
is defined by: The unauthorized transfer of data.

DataModificationEvent
type: Class
subclass of: Event
definition references: http://www.merriam-webster.com/dictionary/modification
is defined by: The act or process of changing parts of data.

DataRecordAsset
type: Class
subclass of: DigitalAsset
is defined by: A unit of data which can be held in a file or datastore.

DataStoreAsset
type: Class
subclass of: DigitalAsset
definition references: http://searchsqlserver.techtarget.com/definition/database
is defined by: A collection of information that is organized so that it can easily be accessed, managed, and updated.

DecompressAction
type: Class
subclass of: ModificationAction
definition references: http://whatis.techtarget.com/definition/uncompressing-or-decompressing
is defined by: The act of expanding a compressed file back into its original form.

DecryptAction
type: Class
subclass of: ModificationAction
disjoint with: EncryptAction
is defined by: To cryptographically restore cipher text to the plaintext form it had before encryption.

DeleteAction
type: Class
subclass of: ModificationAction
definition references: http://www.merriam-webster.com/dictionary/delete
is defined by: To remove (something, such as words, pictures, or computer files) from a document, recording, computer, etc.

DemoteAction
type: Class
subclass of: JobChangeAction
definition references: http://www.shrm.org/TemplatesTools/Glossaries/HRTerms/Pages/d.aspx
is defined by: A permanent reassignment to a position with a lower pay grade, skill requirement, or level of responsibility than the employee’s current position.

DepositAction
type: Class
subclass of: FinancialTransactionAction
definition references: https://www.bankofamerica.com/deposits/manage/glossary.go#alp-D
is defined by: To add money to a customer’s bank account.

DigitalAction
type: Class
subclass of: Action
is defined by: An action involving digital assets.

DigitalAsset
type: Class
subclass of: Asset
disjoint with: PhysicalAsset
is defined by: An asset in the digital realm

DisableAction
type: Class
subclass of: ModificationAction
definition references: http://www.merriam-webster.com/dictionary/disable
is defined by: To cause an asset to be unable to work in the normal way.

DriversLicenseNumber
type: Class
subclass of: UniquelyIdentifiableInformation
disjoint with: SocialSecurityNumber
is defined by: Unique number that identifies a person's drivers license

EmailAction
type: Class
subclass of: DigitalAction
type: NamedIndividual
has actor: Insider
has destination: Employee
has object: TradeSecretInformation
has source: ComputerAsset
is defined by: To send an email.

EncryptAction
type: Class
subclass of: ModificationAction
is defined by: To cryptographically transform data to produce cipher text.

Event
type: Class
subclass of: TemporalThing
is defined by: Defined class which includes one or more actions.

ExcessiveEvent
type: Class
subclass of: Event
is defined by: Action(s) performed in excess of organization-defined threshold for normal activity

FailedAction
type: Class
subclass of: ActionModifier
definition references: An unsuccessful action, such as a failed login attempt.

FileAsset
type: Class
subclass of: DigitalAsset
definition references: http://www.merriam-webster.com/dictionary/file
is defined by: a complete collection of data (as text or a program) treated by a computer as a unit especially for purposes of input and output

FinancialAsset
type: Class
subclass of: Asset
is defined by: An asset involving money.

FinancialInformation
type: Class
subclass of: Information
is defined by: Information about financial assets

FinancialTransactionAction
type: Class
subclass of: Action
is defined by: A transaction involving the movement of money.

FirewallAsset
type: Class
subclass of: SoftwareAsset
definition references: http://www.webopedia.com/TERM/F/firewall.html
is defined by: A system designed to prevent unauthorized connections to or from a private network.

FloppyDiskAsset
type: Class
subclass of: PhysicalAsset
definition references: http://en.wikipedia.org/wiki/Floppy_disk
is defined by: A disk storage medium composed of a disk of thin and flexible magnetic storage medium, sealed in a rectangular plastic carrier lined with fabric that removes dust particles.

FraudEvent
type: Class
subclass of: Event
definition references: http://www.merriam-webster.com/dictionary/fraud
is defined by: Intentional perversion of truth to induce another to part with something of value or to surrender a legal right.

FraudulentAction
type: Class
subclass of: ActionModifier
is defined by: A deliberately deceptive action. Examples include forging signatures on documents or falsifying PII.

HardDriveAsset
type: Class
subclass of: PhysicalAsset
definition references: http://www.oed.com/view/Entry/84122
is defined by: A high-capacity, self-contained storage device containing a read-write mechanism together with one or more hard disks inside a sealed unit.

IPAddress
type: Class
subclass of: NetworkInformation
disjoint with: MACAddress
is defined by: Address identifying a computer on a network.

IllegitimateAction
type: Class
subclass of: ActionModifier
is defined by: Action is not performed legitimately

Information
type: Class
is defined by: A representation of data

InstallAction
type: Class
subclass of: DigitalAction
definition references: http://en.wikipedia.org/wiki/Installation_(computer_programs)
is defined by: The act of making a program ready for execution.

IntellectualProperty
type: Class
subclass of: BusinessInformation
is defined by: Information about assets owned by the organization.

JobChangeAction
type: Class
subclass of: Action
is defined by: To change roles or positions at one's current employer or to begin a position with a new employer.

JobFunctionChangeEvent
type: Class
subclass of: Event
is defined by: Event where an individual's job function changes.

JobOfferAction
type: Class
subclass of: JobChangeAction
is defined by: To offer a job to a potential employee.

JobOfferEvent
type: Class
subclass of: Event
is defined by: Event where an individual is offered employment.

KeyLoggerAsset
type: Class
subclass of: SoftwareAsset
definition references: http://www.webopedia.com/TERM/K/keylogger.html
is defined by: A type of surveillance software that has the capability to record every keystroke made to a log file, usually encrypted.

LaptopAsset
type: Class
subclass of: PhysicalAsset
definition references: http://www.webopedia.com/TERM/L/laptop_computer.html
is defined by: A portable computer small enough to sit on your lap.

LoanAction
type: Class
subclass of: FinancialTransactionAction
definition references: http://www.investopedia.com/terms/l/loan.asp
is defined by: The act of giving money, property or other material goods to a another party in exchange for future repayment of the principal amount along with interest or other finance charges.

LogicBombAsset
type: Class
subclass of: MalwareAsset
is defined by: A malicious program that is coded to execute when a certain set of requirements are met.

LoginAction
type: Class
subclass of: AccessAction
definition references: https://definedterm.com/login
is defined by: The process of presenting an identity (typically a user ID) and authentication (a password, token, or other item) to gain access to information systems and resources.

MACAddress
type: Class
subclass of: NetworkInformation
is defined by: Unique address identifying a piece of networked hardware.

MaliciousCodeInformation
type: Class
subclass of: SourceCodeInformation
is defined by: Source code for a piece of software that performs malicious actions

MalwareAsset
type: Class
subclass of: SoftwareAsset
is defined by: A malicious piece of software.

MasqueradingEvent
type: Class
subclass of: Event
subclass of: Restriction
  on property: hasAction
  some values from: LoginAction
subclass of: Restriction
  on property: hasActor
  some values from: Person
definition references: http://www.sans.org/security-resources/glossary-of-terms/?pass=m (adapted)
is defined by: A system entity illegitimately poses as (assumes the identity of) another entity.

MedicalInformation
type: Class
subclass of: Information
is defined by: Information on an individual's medical history

ModificationAction
type: Class
subclass of: DigitalAction
is defined by: To change a file or system

MoneyAsset
type: Class
subclass of: FinancialAsset
definition references: http://www.investopedia.com/terms/m/money.asp
is defined by: An officially-issued legal tender generally consisting of currency and coin. Money is the circulating medium of exchange as defined by a government.

NationalSecurityInformation
type: Class
subclass of: Information
is defined by: Information classified by a government as having potential to cause harm to national security in the wrong hands.

NetworkAsset
type: Class
subclass of: PhysicalAsset
definition references: http://en.wikipedia.org/wiki/Computer_network
is defined by: A collection of computers and other hardware components interconnected by communication channels that allow sharing of resources and information.

NetworkInformation
type: Class
subclass of: TechnologyInformation
is defined by: Information identifying a computer or device on a network

Organization
type: Class
subclass of: Actor
disjoint with: Person
definition references: http://www.oed.com/view/Entry/132452
is defined by: An organized body of people with a particular purpose, as a business, government department, charity, etc.

PasswordCrackerAsset
type: Class
subclass of: SoftwareAsset
definition references: http://searchfinancialsecurity.techtarget.com/definition/password-cracker
is defined by: A program that is used to identify an unknown or forgotten password to a computer or network resource.

PasswordInformation
type: Class
subclass of: AccountAuthenticationInformation
disjoint with: UsernameInformation
is defined by: Secret used for authentication for a computer account.

Person
type: Class
subclass of: Actor
is defined by: A human being

PhysicalAsset
type: Class
subclass of: Asset
is defined by: An asset in the physical realm

PortScannerAsset
type: Class
subclass of: SoftwareAsset
is defined by: A software program which scans a network for systems with open ports.

PrintAction
type: Class
subclass of: DigitalAction
is defined by: To send a unit of work to a printer to create a physical representation of digital data on physical media, usually paper.

PrinterAsset
type: Class
subclass of: PhysicalAsset
definition references: http://whatis.techtarget.com/definition/printer
is defined by: A device that accepts text and graphic output from a computer and transfers the information to paper.

PromoteAction
type: Class
subclass of: JobChangeAction
definition references: http://www.shrm.org/templatestools/glossaries/hrterms/pages/p.aspx
is defined by: Career advancement within an organization, which includes increased authority, level of responsibility, status and pay.

ReassignAction
type: Class
subclass of: JobChangeAction
definition references: http://www.shrm.org/TemplatesTools/Glossaries/HRTerms/Pages/r.aspx
is defined by: Transferring individuals to alternative positions where their talents or skills may be best utilized to their own or the organization’s benefit or where they are better able to perform the job in accordance with required standards.

RecruitmentEvent
type: Class
subclass of: Event
definition references: http://www.shrm.org/TemplatesTools/Glossaries/HRTerms/Pages/r.aspx
is defined by: The practice of soliciting and actively seeking applicants to fill recently vacated or newly created positions using a variety of methods.

RejectAction
type: Class
subclass of: JobChangeAction
is defined by: To disagree to start or change to a specific job role.

ReprimandAction
type: Class
subclass of: JobChangeAction
definition references: http://www.shrm.org/TemplatesTools/Glossaries/HRTerms/Pages/r.aspx
is defined by: An oral or written reproach given to an employee as part of disciplinary action.

ResignationAction
type: Class
subclass of: JobChangeAction
is defined by: To terminate one's employment.

SDCardAsset
type: Class
subclass of: PhysicalAsset
definition references: http://searchstorage.techtarget.com/definition/Secure-Digital-card
is defined by: A tiny memory card used to make storage portable among various devices. An SD card is about the size of a postage stamp and weighs approximately two grams.

SabotageEvent
type: Class
subclass of: Event
definition references: http://www.oed.com/view/Entry/169373 (adapted)
is defined by: The act of deliberately destroying, damaging, or obstructing.

SearchAction
type: Class
subclass of: DigitalAction
definition references: http://www.oed.com/view/Entry/174308
is defined by: To peruse, look through, examine (writings, records) in order to discover whether certain things are contained there.

ServerAsset
type: Class
subclass of: PhysicalAsset
definition references: http://www.sans.org/security-resources/glossary-of-terms/
is defined by: A system entity that provides a service in response to requests from other system entities called clients.

ServiceAsset
type: Class
subclass of: SoftwareAsset
is defined by: A piece of software that runs in the background on a computer

SocialSecurityNumber
type: Class
subclass of: UniquelyIdentifiableInformation
is defined by: Unique number assigned by the federal government that uniquely identifies an individual

SoftwareAsset
type: Class
subclass of: DigitalAsset
definition references: http://www.oed.com/view/Entry/183938
is defined by: The programs and procedures required to enable a computer to perform a specific task, as opposed to the physical components of the system.

SourceCodeInformation
type: Class
subclass of: TechnologyInformation
is defined by: The code from which a piece of software is compiled

SuspendAction
type: Class
subclass of: JobChangeAction
is defined by: The prohibition of an individual from holding his or her usual post or carrying out his or her usual role for a particular length of time.

SuspiciousEvent
type: Class
subclass of: Event
is defined by: Event that falls under organization-defined criteria for being potentially malicious.

SystemConfigurationInformation
type: Class
subclass of: SystemInformation
is defined by: Settings that specify how a system operates

SystemInformation
type: Class
subclass of: TechnologyInformation
is defined by: Information about a computer or computer account

SystemModificationEvent
type: Class
subclass of: Event
is defined by: A software or hardware configuration change.

TechnologyInformation
type: Class
subclass of: Information
is defined by: Information about or involving technology

TerminateAction
type: Class
subclass of: JobChangeAction
definition references: http://www.shrm.org/templatestools/glossaries/hrterms/pages/t.aspx
is defined by: Separation from employment due to a voluntary resignation, layoff, retirement or dismissal.

TheftEvent
type: Class
subclass of: Event
definition references: http://www.merriam-webster.com/dictionary/theft http://www.merriam-webster.com/dictionary/stealing
is defined by: The act of taking something that does not belong to you in a way that is wrong or illegal.

TradeSecretInformation
type: Class
subclass of: BusinessInformation
type: NamedIndividual
type: BusinessInformation
is defined by: Information that is kept secret by the organization and is intended to provide some competitive advantage.

USBDriveAsset
type: Class
subclass of: PhysicalAsset
definition references: http://searchstorage.techtarget.com/definition/USB-drive
is defined by: A plug-and-play portable storage device that uses flash memory and is lightweight enough to attach to a key chain.

UnauthorizedAction
type: Class
subclass of: ActionModifier
is defined by: Action that was not authorized by the organization or data/system owner

UniquelyIdentifiableInformation
type: Class
subclass of: Information
is defined by: Information that is unique to an individual

UsernameInformation
type: Class
subclass of: AccountAuthenticationInformation
is defined by: Identifier for a user's computer account.

VirtualMachineAsset
type: Class
subclass of: SoftwareAsset
definition references: http://searchservervirtualization.techtarget.com/definition/virtual-machine
is defined by: A software implementation of a computing environment in which an operating system (OS) or program can be installed and run.

VirusAsset
type: Class
subclass of: MalwareAsset
is defined by: A program that is capable of replicating itself and has malicious purposes

WithdrawAction
type: Class
subclass of: FinancialTransactionAction
definition references: https://www.bankofamerica.com/deposits/manage/glossary.go#alp-D
is defined by: The removal of funds from an account.