Getting Started just the basics
About UCO
Unified Cyber Ontology (UCO) is a community-developed ontology/model, which is intended to serve as a consistent foundation for standardized information representation across the cyber security domain/ecosystem.
Specific information representations focused on individual cyber security subdomains (cyber investigation, cyber risk management, threat intelligence, malware analysis, security operations, supply chain security, vulnerability research, active cyber defense, etc.) can be be based on UCO and defined as context-specific extensions within the consistent overall UCO ecosystem.
Through this approach not only are domain-focused representations defined consistently but they also can take advantage of shared APIs/tooling and information can flow in an automated fashion across subdomain boundaries.
Use cases include:
- Exchanging a large and diverse set of cyber information in standardized form while avoiding duplication
- Interoperability between systems and tools, allowing for automation, normalization, combination, and correlation
- Integration of information across subdomain boundaries within the overall cyber domain
- Providing structure to enhance intelligent analysis (e.g., pattern recognition, machine learning, visualization, semantic inferencing)
- Enhancing tool testing and validation of their results
- Controlling access to privileged, proprietary, and personal information (via data markings)
- Support for custom or non-standardized structures (enabling tools containing these to still use and share information)
The project roadmap, updated quarterly as progress is made, is viewable here.
Site Navigation
Websites & Email
- https://unifiedcyberontology.org - official website of the UCO Ontology and Community
- https://github.com/ucoProject/ - official GitHub Organization
- Contacts & Emails
Ontological Exploration Tools
- Protégé - graph visualizations, Javadoc generation, etc.
- Ontospy - CLI interface for stepping through tree visualizations of ontologies and autogeneration of documentation
Scope
It is unnecessary to know everything about the ontology if focused on domain-specific ontology refinement, or mapping/adoption concerning a specific tool. Determine your scope below and then read the pertinent guide to further understand the details, organization, and workflow of participating in the CASE community under that role.
If not familiar with ontologies, the Ontology Components Wikipedia page, OWL2 primer, and Ontology 101 document will help create a conceptual foundation that will enable better communication with the community/teams and clarify the connected parts present between the ontology's specification (structure/design), it's content (vocabulary, encoded in Turtle or other formats), and the Python API (usage of the defined vocabulary to create validated objects for import/export into JSON-LD).
Request to join the CASE Community by visiting the Membership Application page. At your request, you will be added to the respective Github Teams, Mailing Lists and additional resources.
Roles
Ontologists
Responsibilities:
- Have a deep understanding of the goals of UCO and how representing information differently best achieves them
- Collaborate with individuals/organizations who have domain-specific knowledge to draft proposals
- Create and review Github issues to propose ontology changes to the objects/properties in the Natural Language Glossary based on gaps, ambiguities, and improvements noted by Mappers. To learn more about proposals and voting, please see the Community Bylaws.
Mappers
Responsibilities:
- Have an understanding of which UCO objects should be used to represent which types of information and when unsure consult Ontologists
- Collaborate with Adopters to note inadequacies for Ontologists to review
- Map internal/proprietary objects from Adopters' tools to the correct UCO objects (while guiding namespace usage)
- Create Github issues for inadequacies so that UCO community discussion can occur (and continue until possible options are identified for representing the data, then a proposal is put forth by the Ontologists team)
Adopters
Responsibilities:
- Have an understanding of their use cases
- Collaborate with Mappers to map objects in their tools to UCO objects
- Integrate the UCO API into their tool
- Create issues for bugs in the UCO API and supporting tools, or that are tool-specific
- Participate in discussions on Github issues concerning data representation as UCO community members
- If a member of your organization is contributing to UCO ontology development because of domain-specific knowledge they should join the Ontologists team, or discuss one-on-one so that Ontologists and Mappers can shepherd the concept through (only Mappers or Ontologists should make Github issues for something not tool-specific)
Discussors
Responsibilities: