What changed in the knowledge bundle, a day to an entry, newest first. https://w3id.org/lmodel/attack/knowledge/log 2026-10-31T12:17:51Z Noel McLoughlin CC BY 4.0 https://w3id.org/lmodel/attack/knowledge/log#2026-10-31 2026-10-31T11:50:48Z 2026-10-31T12:17:51Z <ul> <li><strong>Changed</strong>: lmodel/stix modules names stix v0.1.0, the release the six files equal, which <code>tests/test_stix_import.py</code> and NOTICE now pin.</li> <li><strong>Prose</strong>: reworded 2 concept bodies in plain English. No fact, link, number or frontmatter changed.</li> <li><strong>Changed</strong>: Test data and tests says <code>tests/test_upstream.py</code> also lists the 44 breaches across a bundle, in KNOWN_BUNDLE_DEPARTURES.</li> <li><strong>Changed</strong>: Where the data departs from the ATT&amp;CK Data Model adds the four groups of breaches across a bundle that KNOWN_BUNDLE_DEPARTURES lists.</li> <li><strong>Changed</strong>: lmodel/stix modules names stix commit 267064d, which <code>tests/test_stix_import.py</code> and NOTICE now pin.</li> <li><strong>Changed</strong>: Test data and tests counts 72 counter-examples, since <code>tests/data/invalid/</code> gained one for a citation name with a colon.</li> <li><strong>Prose</strong>: reworded 13 concept bodies in plain English. No fact, link, number or frontmatter changed.</li> <li><strong>Changed</strong>: the documentation site's description names its address as code, so the index bullets carry no bare address.</li> <li><strong>Changed</strong>: the map leaves out <code>docs/elements/.gitkeep</code>, the marker of the folder gen-doc fills.</li> <li><strong>Added</strong>: Build and test (main.yaml), from <code>.github/workflows/main.yaml</code>.</li> <li><strong>Added</strong>: Lint and docs (lint-and-docs.yaml), from <code>.github/workflows/lint-and-docs.yaml</code>.</li> <li><strong>Added</strong>: Upstream watch (upstream-watch.yaml), from <code>.github/workflows/upstream-watch.yaml</code>.</li> <li><strong>Added</strong>: Semantic release (semantic-release.yml), from <code>.github/workflows/semantic-release.yml</code>.</li> <li><strong>Added</strong>: Knowledge Librarian (knowledge-librarian.yaml), from <code>.github/workflows/knowledge-librarian.yaml</code>.</li> <li><strong>Added</strong>: Knowledge Registrar (knowledge-registrar.yaml), from <code>.github/workflows/knowledge-registrar.yaml</code>.</li> <li><strong>Added</strong>: Knowledge Release (knowledge-release.yaml), from <code>.github/workflows/knowledge-release.yaml</code>.</li> <li><strong>Added</strong>: Knowledge sync (knowledge-sync.yaml), from <code>.github/workflows/knowledge-sync.yaml</code>.</li> <li><strong>Added</strong>: Knowledge website (knowledge-website.yaml), from <code>.github/workflows/knowledge-website.yaml</code>.</li> <li><strong>Added</strong>: Knowledge sources map, the bundle's map of where its concepts come from.</li> <li><strong>Added</strong>: Regenerate and test the schema, from <code>CONTRIBUTING.md</code> and the <code>justfile</code>.</li> <li><strong>Added</strong>: Release the schema, from <code>CONTRIBUTING.md</code> and <code>.releaserc.json</code>.</li> <li><strong>Added</strong>: Update the upstream pins, from <code>scripts/check_upstream_release.py</code>.</li> <li><strong>Added</strong>: Validate ATT&amp;CK data, from <code>docs/index.md</code>.</li> <li><strong>Added</strong>: AI covenant, from <code>AI_COVENANT.md</code>.</li> <li><strong>Added</strong>: Licence and attribution, from <code>NOTICE</code>.</li> <li><strong>Added</strong>: Security policy, from <code>SECURITY.md</code>.</li> <li><strong>Added</strong>: Documentation site, from <code>website/site.config.mjs</code>.</li> <li><strong>Removal</strong>: Example Service A, the sidecar's placeholder, now that real concepts stand in its place.</li> <li><strong>Removal</strong>: Example Service B, the sidecar's placeholder, now that real concepts stand in its place.</li> <li><strong>Added</strong>: Technique, from the class <code>AttackTechnique</code>.</li> <li><strong>Added</strong>: Tactic, from the class <code>AttackTactic</code>.</li> <li><strong>Added</strong>: Group, from the class <code>AttackGroup</code>.</li> <li><strong>Added</strong>: Campaign, from the class <code>AttackCampaign</code>.</li> <li><strong>Added</strong>: Software, from the class <code>AttackMalware</code>.</li> <li><strong>Added</strong>: Mitigation, from the class <code>AttackMitigation</code>.</li> <li><strong>Added</strong>: Detection strategy, from the class <code>AttackDetectionStrategy</code>.</li> <li><strong>Added</strong>: Analytic, from the class <code>AttackAnalytic</code>.</li> <li><strong>Added</strong>: Data component, from the class <code>AttackDataComponent</code>.</li> <li><strong>Added</strong>: Asset, from the class <code>AttackAsset</code>.</li> <li><strong>Added</strong>: ATT&amp;CK domain, from the class <code>AttackMatrix</code>.</li> <li><strong>Added</strong>: ATT&amp;CK ID, from the class <code>AttackTechnique</code>.</li> <li><strong>Added</strong>: attack LinkML schema, from <code>src/attack/schema/attack.yaml</code>.</li> <li><strong>Added</strong>: lmodel/stix modules, from <code>src/attack/schema/stix/</code>.</li> <li><strong>Added</strong>: Pinned ATT&amp;CK v20.0 bundles, from <code>tests/data/attack-stix-data/manifest.json</code>.</li> <li><strong>Added</strong>: Test data and tests, from <code>tests/</code>.</li> <li><strong>Added</strong>: Generated artefacts, from <code>project/</code> and <code>src/attack/datamodel/</code>.</li> <li><strong>Added</strong>: MITRE's ATT&amp;CK STIX data, the v20.0 release.</li> <li><strong>Added</strong>: ATT&amp;CK Data Model, the v4.11.7 release.</li> <li><strong>Added</strong>: lmodel/stix, the STIX schema the ATT&amp;CK schema imports.</li> <li><strong>Added</strong>: Element names and the shared namespace, from <code>docs/about.md</code> and <code>tests/test_schema_rules.py</code>.</li> <li><strong>Added</strong>: Scope, influences and mappings, from <code>README.md</code>.</li> <li><strong>Added</strong>: Where the data departs from the ATT&amp;CK Data Model, from <code>tests/test_upstream.py</code>.</li> <li><strong>Initialization</strong>: Scaffolded the LOKF bundle for attack with placeholder services. Real concepts to follow.</li> </ul>