From b01b0bb62bb11059e6a8595602bf58ec8d9ac91e Mon Sep 17 00:00:00 2001 From: Brett Heffelfinger Date: Fri, 6 Jun 2025 10:54:05 -0600 Subject: [PATCH 1/2] Implement class for STIX Windows Integrity Level Enumeration --- ontologies/vocabs.ttl | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/ontologies/vocabs.ttl b/ontologies/vocabs.ttl index af35ec1..c985d0e 100644 --- a/ontologies/vocabs.ttl +++ b/ontologies/vocabs.ttl @@ -168,6 +168,21 @@ gist:ThreatActorType rdfs:subClassOf gist:StixCategoryObject ; . +gist:WindowsIntegrityLevel + a owl:Class ; + rdfs:subClassOf gist:StixCategoryObject ; + skos:definition """STIX 2.1 description: +The Windows integrity level enumeration is currently used in the following STIX Cyber-observable Object(s): +● Process (Windows Process extension) + + +Windows integrity levels are a security feature and represent the trustworthiness of an object."""^^xsd:string ; + skos:example ""^^xsd:string ; + skos:note "This is described in STIX as an enumeration but no order of the enumeration is given."^^xsd:string ; + skos:prefLabel "Windows™ Integrity Level Enumeration"^^xsd:string ; + gist:stixTerm "windows-integrity-level-enum"^^xsd:string ; + . + gist:_AccountType_facebook a gist:AccountType ; rdfs:label "Facebook"^^xsd:string ; From 1a9dff4fa20e5d2680b7524a24ab231d6509eb08 Mon Sep 17 00:00:00 2001 From: Brett Heffelfinger Date: Fri, 6 Jun 2025 10:56:35 -0600 Subject: [PATCH 2/2] Instantiate WindowsIntegrityLevel instances --- ontologies/vocabs.ttl | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/ontologies/vocabs.ttl b/ontologies/vocabs.ttl index c985d0e..ea562a6 100644 --- a/ontologies/vocabs.ttl +++ b/ontologies/vocabs.ttl @@ -2488,6 +2488,38 @@ There is not enough information available to determine the type of threat actor. skos:prefLabel "unknown"^^xsd:string ; . +gist:_WindowsIntegrityLevel_high + a gist:WindowsIntegrityLevel ; + skos:definition """STIX 2.1 description: +A high level of integrity."""^^xsd:string ; + skos:prefLabel "High Integrity Level"^^xsd:string ; + gist:stixTerm "high"^^xsd:string ; + . + +gist:_WindowsIntegrityLevel_low + a gist:WindowsIntegrityLevel ; + skos:definition """STIX 2.1 description: +A low level of integrity."""^^xsd:string ; + skos:prefLabel "Low Integrity Level"^^xsd:string ; + gist:stixTerm "low"^^xsd:string ; + . + +gist:_WindowsIntegrityLevel_medium + a gist:WindowsIntegrityLevel ; + skos:definition """STIX 2.1 description: +A medium level of integrity."""^^xsd:string ; + skos:prefLabel "Medium Integrity Level"^^xsd:string ; + gist:stixTerm "medium"^^xsd:string ; + . + +gist:_WindowsIntegrityLevel_system + a gist:WindowsIntegrityLevel ; + skos:definition """STIX 2.1 description: +A system level of integrity."""^^xsd:string ; + skos:prefLabel "System Integrity Level"^^xsd:string ; + gist:stixTerm "system"^^xsd:string ; + . + gist:stixTerm a owl:AnnotationProperty ; .