| _cpeid |
"Specifies the Common Platform Enumeration identifier for the software |
| _creator |
"The creator organization for a particular tool |
| _endTime |
"The time at which performance of the action ended |
| _index |
A number identifying the position, starting from 1, of a particular list item... |
| _object |
"The things that the action is performed on/against |
| _references |
"References to information describing a particular tool |
| _startTime |
"The time at which performance of the action began |
| _swid |
"Specifies the SWID tag for the software |
| _value |
"A specific property value |
| _version |
"An appropriate version descriptor of a particular tool |
| abbreviation |
"The abbreviation of a global flag |
| accessedDirectory |
"Directories accessed by the prefetch application during startup |
| accessedFile |
" files (e |
| accessedTime |
"The date and time at which the Object was accessed |
| account |
"Specifies the account referenced in an event log entry or used to run the sc... |
| accountIdentifier |
"The unique identifier for the account |
| accountIssuer |
"The issuer of this account |
| accountLogin |
"The login identifier for the digital account |
| accountLogonType |
"Specifies the security logon method required to run the tasks associated wit... |
| accountRunLevel |
"Specifies the permission level of the account that the task will be run at |
| accountType |
"The type of account, for instance bank, phone, application, service, etc |
| AccountTypeVocab |
|
| action |
"A characterization of a single action |
| ActionArgumentNameVocab |
"Defines an open-vocabulary for common arguments of cyber actions |
| actionCount |
"The number of times that the action was performed |
| actionID |
"Specifies the user-defined identifier for the action |
| actionList |
"Specifies a list of actions to be performed by the scheduled task |
| ActionNameVocab |
"Defines an open-vocabulary of common specific cyber action names |
| ActionRelationshipTypeVocab |
"Defines an open-vocabulary for capturing types of relationships between acti... |
| actionStatus |
"The current state of the action |
| ActionStatusTypeVocab |
"Defines an open-vocabulary of action status types |
| actionType |
"Specifies the type of the action |
| ActionTypeVocab |
"Defines an open-vocabulary of common general action types |
| activeDirectoryGroups |
|
| adapterName |
"Specifies the name of the network adapter used by the networkInterface |
| address |
|
| addressOfEntryPoint |
"Specifies the address of the entry point relative to the imageBase when the ... |
| addressType |
The type of the address, for instance home or work |
| addressValue |
"The value of an address |
| advertisingID |
"Advertising ID as a UUID |
| allocationStatus |
"The allocation status of a file |
| alternateDataStreams |
|
| altitude |
The altitude coordinate of a geolocation |
| androidFingerprint |
"A string that uniquely identifies a build of the Android operating system |
| androidID |
"A 64-bit number (expressed as a hexadecimal string), unique to each combinat... |
| androidVersion |
"The user-visible version string |
| antennaHeight |
"The height (in meters) of the antenna from the ground |
| application |
"The application associated with this object |
| applicationFileName |
"Name of the executable of the prefetch file |
| applicationIdentifier |
|
| archiveType |
"The type of a file archive, e |
| argumentName |
"The identifying label of an argument |
| arguments |
"A list of arguments utilized in initiating the process |
| asHandle |
|
| aslrEnabled |
|
| attendant |
"The attendants of the event |
| audioType |
"The type of a audio |
| authorityKeyIdentifier |
|
| authorizedIdentities |
Specifies the identities that are authorized to access the data to which the ... |
| availableRam |
"Specifies the amount of physical memory available on the system, in bytes |
| azimuth |
"The median rotation in degrees around a vertical axis of the cell antenna se... |
| baseOfCode |
"Specifies the address that is relative to the imageBase of the beginning-of-... |
| baseStation |
"The baseStation |
| basicConstraints |
|
| bcc |
"Allows the sender of a message to conceal the person entered in the BCC fiel... |
| binary |
|
| biosDate |
"Specifies the date of the BIOS (e |
| biosManufacturer |
"Specifies the manufacturer of the BIOS |
| biosReleaseDate |
"Specifies the date the BIOS was released |
| biosSerialNumber |
"Specifies the serialNumber of the BIOS |
| biosVersion |
"Specifies the version of the BIOS |
| birthdate |
|
| bitness |
"Specifies the bitness of the operating system (i |
| BitnessVocab |
"Defines an open-vocabulary of word sizes that define classes of operating sy... |
| bitRate |
"The bitrate of the audio in bits per second |
| bitsPerPixel |
|
| blockType |
"The blockType property specifies the blockType of a particular memory object |
| bluetoothDeviceName |
"Name configured withing Bluetooth settings on a device |
| body |
"Text forming the main content of a printed or digital work (as opposed to ad... |
| bodyMultipart |
"A list of the MIME parts that make up the email body |
| bodyRaw |
|
| bookmarkPath |
"The folder containing the bookmark |
| browserInformation |
"Specifies information about the particular Web Browser |
| browserUserProfile |
"Specifies the web browserUserProfile for which the URL history entry was cre... |
| buildConfiguration |
"How the build utility was configured for a particular build of a particular ... |
| buildID |
"An externally defined unique identifier for a particular build of a software |
| buildInformation |
"Describes how a particular tool was built |
| buildLabel |
"Relevant label for a particular build of a particular software |
| buildOutputLog |
"The output log of the build process for a software |
| buildProject |
"The project name of a build of a software |
| buildScript |
"The actual build script for a particular build of a particular software |
| buildUtility |
"Identifies the utility used to build a software |
| buildUtilityName |
"The informally defined name of the utility used to build a particular softwa... |
| buildVersion |
"The appropriate version descriptor of a particular build of a particular sof... |
| byteOrder |
|
| byteStringValue |
"Specifies the raw, byte-string representation of the extracted string |
| callType |
"The type of a phone call,for example incoming, outgoing, missed |
| camera |
"The name/make of the camera that was used for taking the picture |
| canEscalatePrivs |
|
| captureCellSite |
"Specifies the cell site accessed |
| carrier |
"Telecommunications service provider that sold the SIM card |
| categories |
"Categories applied to the object |
| cc |
"Carbon copy: technique of producing one or more copies simultaneously |
| cellSiteCountryCode |
"The country code represents the country of the cell site |
| cellSiteIdentifier |
"Specifies the unique number used to identify each Cell Site within a locatio... |
| cellSiteLocationAreaCode |
"The location area code is a unique number of current location area of the ce... |
| cellSiteNetworkCode |
"This code identifies the mobile operator of the cell site |
| cellSiteType |
"Specifies the technology used by the Cell Site (e |
| certificateIssuer |
|
| certificatePolicies |
"Object identifiers (OIDS), comma separated" |
| certificateSubject |
|
| CharacterEncodingVocab |
"Defines an open-vocabulary of character encodings |
| characteristics |
"Specifies the flags that indicate the file’s characteristics |
| checksum |
"Specifies the checksum of the PE binary |
| class |
"A specific classification class |
| classification |
"An asserted classification of an analyzed artifact resulting from the analys... |
| classificationConfidence |
"The level of confidence that a classification assertion is correct |
| clockSetting |
"The generalizedTime value on the mobile device when it was processed |
| clusterSize |
"The size of cluster allocation units in a file system |
| columnName |
"Identifier, Column name expressions" |
| comClassID |
"Specifies the ID of the COM action |
| comData |
"Specifies the data associated with the COM handler |
| comment |
|
| compilationDate |
"The compilation date for the build of a software |
| compilerInformalDescription |
"An informal description of a compiler |
| compilers |
"The compilers utilized during a particular build of a particular software |
| compressionMethod |
"The algorithm used to compress the data |
| compressionRatio |
"The compressionRatio of the compressed data |
| confidence |
An asserted level of certainty in the accuracy of some information |
| configurationEntry |
A single configuration setting entry item for a tool or other software |
| constrainingVocabularyName |
The name of an explicitly constrained set of string values |
| constrainingVocabularyReference |
A reference to a specification for an explicitly constrained set of string va... |
| contact |
"contact specifies information characterizing contact details for a single en... |
| contactAddress |
"contactAddress specifies information characterizing a geolocation address of... |
| contactAddressScope |
"contactAddressScope specifies the relevant scope (home, work, school, etc) f... |
| ContactAddressScopeVocab |
"Defines an open-vocabulary of scopes for address entries of digital contacts |
| contactAffiliation |
"contactAffiliation specifies information characterizing details of an organi... |
| contactEmail |
"contactEmail specifies information characterizing details for contacting a c... |
| contactEmailScope |
"contactEmailScope specifies the relevant scope (home, work, school, etc) of ... |
| ContactEmailScopeVocab |
"Defines an open-vocabulary of scopes for email entries of digital contacts |
| contactGroup |
"contactGroup specifies the name/tag of a particular named/tagged grouping of... |
| contactID |
"Specifies an ID for the contact |
| contactMessaging |
"contactMessaging specifies information characterizing details for contacting... |
| contactMessagingPlatform |
"A contactMessagingPlatform specifies a digital messaging platform associated... |
| contactNote |
"contactNote specifies a comment/note associated with a given contact |
| contactOrganization |
"The name of the organization a contact works for or is assocciated with |
| contactPhone |
"contactPhone specifies information characterizing details for contacting a c... |
| contactPhoneNumber |
"contactPhoneNumber specifies a telephone service account number for contacti... |
| contactPhoneScope |
"contactPhoneScope specifies the relevant scope (home, work, school, etc) of ... |
| ContactPhoneScopeVocab |
"Defines an open-vocabulary of scopes for phone entries of digital contacts |
| contactProfile |
"contactProfile specifies information characterizing details for contacting a... |
| contactProfilePlatform |
"A contactProfile platform specifies an online service platform associated wi... |
| contactSIP |
"contactSIP specifies information characterizing details for contacting a con... |
| contactSIPScope |
"contactSIPScope specifies the relevant scope (home, work, school, etc) of de... |
| ContactSIPScopeVocab |
"Defines an open-vocabulary of scopes for Session Initiation Protocol (SIP) e... |
| contactURL |
"contactURL specifies information characterizing details for contacting a con... |
| contactURLScope |
"contact url scope specifies the relevant scope (homepage, home, work, school... |
| ContactURLScopeVocab |
"Defines an open-vocabulary of scopes for URL entries of digital contacts |
| contentDisposition |
|
| contentRecoveredStatus |
"Specifies the recoverability status of the content of an object |
| contentSelectors |
"Explicit specification of exactly which portions of a UCO object to apply Ma... |
| contentType |
|
| context |
A description of particular contextual affinity |
| controlCode |
"Specifies the actual controlCode that was sent to the observable object |
| cookieDomain |
"The domain for which the cookie is stored, for example nfi |
| cookieName |
"The name of the cookie |
| cookiePath |
"String representation of the path of the cookie |
| country |
The name of the geolocation country |
| cpeid |
"Specifies the Common Platform Enumeration identifier for the software |
| cpu |
"Specifies the name of the CPU used by the system |
| cpuFamily |
"Specifies the name of the CPU family used by the system |
| createdBy |
The identity that created a characterization of a concept |
| creationDate |
"Specifies the date in which the registered domain was created |
| creationFlags |
|
| creationTime |
|
| creator |
"Specifies the name of the creator of the registry key |
| creatorUser |
"The user that created/owns the process |
| crlDistributionPoints |
|
| currentSystemDate |
"Specifies the current date on the system |
| currentWorkingDirectory |
|
| cyberAction |
"The action taken in response to the event |
| data |
Information arranged for automatic processing |
| dataPayload |
|
| dataPayloadReferenceURL |
|
| dataType |
|
| definingContext |
A description of the context relevant to the definition of a particular exter... |
| definition |
Explicit specification of a data marking instance |
| definitionType |
Specifies the Marking Model for a Marking Definition |
| depEnabled |
|
| dependencies |
The relevant configuration dependencies for a tool, application, software, or... |
| dependencyDescription |
A description of a tool or other software dependency |
| dependencyType |
The type of a tool or other software dependency |
| description |
A human-readable description of an entity |
| descriptions |
|
| destination |
"The destination of a global flag |
| destinationFlags |
"Specifies the destination TCP flags |
| destinationPort |
"Specifies the destinationPort used in the connection, as an integer in the r... |
| deviceType |
|
| dhcpLeaseExpires |
"Specifies the date/time that the DHCP lease obtained on the networkInterface... |
| dhcpLeaseObtained |
"Specifies the date/time that the DHCP lease was obtained on the networkInter... |
| dhcpServer |
"Specifies the list of DHCP server IP Addresses used by the networkInterface |
| diskPartitionType |
"Specifies the type of partition being characterized |
| diskSize |
"The size of the disk, in bytes |
| diskType |
"The type of disk being characterized, e |
| DiskTypeVocab |
"Defines an open-vocabulary of disk types |
| displayName |
"Display name specifies the name to display for some entity within a user int... |
| dllCharacteristics |
"Specifies the flags that characterize the PE binary |
| dnssec |
"Specifies the DNSSEC property associated with a Whois entry |
| documentInformationDictionary |
|
| domain |
"The domain(s) that the system belongs to |
| domainID |
"Specifies the domain id for the domain associated with a Whois entry |
| domainName |
"Specifies the corresponding domainName for a Whois entry |
| driveLetter |
"Specifies the driveLetter of a windows volume |
| driveType |
"Specifies the driveType of a windows volume |
| dst |
"Specifies the destination(s) of the network connection |
| dstBytes |
|
| dstPackets |
|
| dstPayload |
|
| duration |
"The duration of the phone call in seconds |
| effectiveGroup |
"Specifies the name of the effectiveGroup used in the user session |
| effectiveGroupID |
"Specifies the effectiveGroupID of the group used in the user session |
| effectiveUser |
"Specifies the effectiveUser details used in the user session |
| element |
The link to the members of a collection |
| elementOf |
The link to a collection in which the object is member |
| elevation |
"The angle in degrees of the antenna from the local horizontal plane |
| emailAddress |
"An emailAddress |
| encoding |
"The encodingMethod used for the extracted string |
| encodingMethod |
|
| encryptionIV |
|
| encryptionKey |
|
| encryptionMethod |
|
| encryptionMode |
|
| EndiannessTypeVocab |
"Defines an open-vocabulary of byte ordering methods |
| endTime |
The ending time of a time range |
| englishTranslation |
"Specifies the English translation of the string, if it is not written in Eng... |
| entropy |
"Shannon entropy (a measure of randomness) of the data |
| entry |
"A dictionary entry |
| entryID |
"A unique identifier for the file within the filesystem |
| environment |
"The environment wherein an action occurs |
| environmentVariables |
"A list of environmentVariables associated with the process |
| error |
"A characterization of the differences between the expected and the actual pe... |
| ESN |
"Electronic Serial Number |
| estimatedCost |
"An estimation of the cost if the action is performed |
| estimatedEfficacy |
"An estimation of the effectiveness of the action at achieving its objective ... |
| estimatedImpact |
"An estimation of the impact if the action is performed |
| eventID |
|
| eventRecordDevice |
"The device on which the log entry was generated |
| eventRecordID |
"The identifier of the event record |
| eventRecordRaw |
"The complete raw content of the event record |
| eventRecordServiceName |
"The service that generated the event record |
| eventRecordText |
"The textual representation of the event |
| eventStatus |
"The status of the event, for instance accepted, pending or cancelled |
| eventType |
"The type of the event, for example 'information', 'warning' or 'error' |
| execArguments |
"Specifies the arguments associated with the command-line operation launched ... |
| execProgramHashes |
"Specifies the hashes of the executable file launched by the action |
| execProgramPath |
"Specifies the path to the executable file launched by the action |
| execWorkingDirectory |
"Specifies the directory that contains either the executable file or the file... |
| exifData |
|
| exitCode |
"Specifies the last exitCode of the scheduled task |
| exitStatus |
"A small number passed from the process to the parent process when it has fin... |
| exitTime |
"The time at which the process exited |
| expirationDate |
"Specifies the date in which the registered domain will expire |
| expirationTime |
"The date and time at which the validity of the object expires |
| extDeletionTime |
"Specifies the time at which the file represented by an Inode was 'deleted' |
| extendedKeyUsage |
|
| extension |
"The fileName extension: everything after the last dot |
| externalIdentifier |
An identifier for some information defined external to the UCO context |
| externalReference |
Specifies a reference to a resource outside of the UCO |
| extFileType |
"Specifies the EXT file type (FIFO, Directory, Regular file, Symbolic link, e... |
| extFlags |
"Specifies user flags to further protect (limit its use and modification) the... |
| extHardLinkCount |
"Specifies a count of how many hard links point to an Inode |
| extInodeChangeTime |
"The date and time at which the file Inode metadata was last modified |
| extInodeID |
"Specifies a single Inode identifier |
| extPermissions |
"Specifies the read/write/execute permissions for the file represented by an ... |
| extSGID |
"Specifies the group ID for the file represented by an Inode |
| extSUID |
"Specifies the user ID that 'owns' the file represented by an Inode |
| familyName |
|
| favoritesCount |
"Specifies the number of times that this profile has favorited a tweet" |
| fileAlignment |
"Specifies the factor (in bytes) that is used to align the raw data of sectio... |
| fileHeaderHashes |
"Specifies any hashes that were computed for the file header |
| fileName |
"Specifies the name associated with a file in a file system |
| filePath |
"Specifies the filePath for the location of a file within a filesystem |
| fileSystemType |
"The specific type of a file system |
| firstItem |
The link to the first item of the list |
| firstItemOf |
The link to a list in which the item is first item |
| firstLoginTime |
"The date and time of the first login of the account |
| firstName |
"The firstName of a person |
| firstRun |
"Timestamp of when the prefetch application was firstRun |
| firstVisit |
"Specifies the date/time that the URL referred to by the URL field was first ... |
| flags |
"Specifies any flags that modify the behavior of the scheduled task |
| followedBy |
The link to the following item in a list |
| followersCount |
"Specifies the followersCount associated with the twitter profile" |
| format |
"The format of the audio |
| fragment |
"fragment pointing to a specific part in the resource |
| fragmentIndex |
|
| freeSpace |
"The amount of freeSpace on the disk, in bytes |
| friendsCount |
"Specifies the friendsCount associated with the twitter profile" |
| from |
"The phone number of the initiating party |
| fromURLVisit |
"Specifies the URL visit origination point (i |
| fullValue |
"The full stringValue of the URL |
| geoLocationAddress |
"An administrative address for a particular geolocation |
| geoLocationEntry |
|
| gid |
|
| givenName |
|
| globalFlagList |
"A list of global flags |
| gpu |
"Specifies the name of the GPU used by the system |
| gpuFamily |
"Specifies the name of the GPU family used by the system |
| groupName |
|
| groups |
|
| hasChanged |
|
| hasFacet |
Further sets of properties characterizing a concept based on the particular c... |
| hash |
"Hash values of the data |
| hashes |
"Specifies any hashes computed over the section |
| hashMethod |
"A particular cryptographic hashing method (e |
| HashNameVocab |
"Defines an open-vocabulary of hashing algorithm names |
| hashValue |
"A cryptographic hash value |
| hdop |
The horizontal dilution of precision of the GPS location |
| headerRaw |
|
| hexadecimalValue |
"The hexadecimalValue of a global flag |
| hiveType |
"The type of a registry hive |
| homeDirectory |
|
| honorificPrefix |
|
| honorificSuffix |
|
| horizontalBeamWidth |
"The width of the antenna beam in degrees |
| host |
"Domain name or IP address where the resource is located |
| hostname |
"Specifies the hostname of the system |
| httpMessageBodyData |
"Specifies the data contained in an HTTP message body |
| httpMessageBodyLength |
"Specifies the length of an HTTP message body in bytes |
| httpRequestHeader |
"Specifies all of the HTTP header fields that may be found in the HTTP client... |
| ICCID |
"Integrated circuit card identifier (http://www |
| icmpCode |
"Specifies the ICMP code byte |
| icmpType |
"Specifies the ICMP type byte |
| iComHandlerAction |
"Specifies the data associated with the task action-fired COM handler |
| identifier |
An identifier is a string conformant to the specified UUID-based format for U... |
| iEmailAction |
"Specifies an action that sends an e-mail, which in this context refers to ac... |
| iExecAction |
"Specifies an action that executes a command-line operation |
| imageBase |
"Specifies the address that is relative to the imageBase of the beginning-of-... |
| imageCompressionMethod |
|
| imageName |
"Specifies the imageName for the task |
| imageType |
"The type of the image, e |
| IMEI |
"International Mobile Equipment Identity (IMEI) |
| impHash |
"Specifies the special import hash, or ‘imphash’, calculated for the PE B... |
| IMSI |
"An International Mobile Subscriber Identity (IMSI) is a unique identificatio... |
| inetLocation |
"Specifies a location on the Internet" |
| inhibitAnyPolicy |
|
| inReplyTo |
"One of more unique identifiers for identifying the email(s) this email is a ... |
| installDate |
"Specifies the date the operating sytem or application was installed |
| installedVersionHistory |
"Specifies the history of installed application version(s) |
| instrument |
"The things used to perform an action |
| interceptedCallState |
"State of the call in a call Detail Record (e |
| ip |
"Specifies the list of IP addresses used by the networkInterface |
| ipAddress |
"Specifies the corresponding ip address for a Whois entry |
| ipfix |
"Specifies any IP Flow Information Export (IPFIX) data for the network traffi... |
| ipGateway |
"Specifies the list of IP Gateway IP Addresses used by the networkInterface |
| isActive |
"Indicates whether the network connection is still active |
| isADBRootEnabled |
"Root access through the Android Debug Bridge (ADB) daemon observed to be ena... |
| isConfigurationOf |
The object which has been configured to run in a more specified manner than a... |
| isDirectional |
A specification whether or not a relationship assertion is limited to the con... |
| isDirectory |
"Specifies whether a file entry represents a directory |
| isDisabled |
"Is the digital account disabled?" |
| isEnabled |
"Specifies whether the trigger isEnabled |
| isEncrypted |
|
| isHidden |
"The isHidden property specifies whether the process isHidden or not |
| iShowMessageAction |
"Specifies an action that shows a message box when a task is activated |
| isInjected |
"The isInjected property specifies whether or not the particular memory objec... |
| isLimitAdTrackingEnabled |
"Limits advertising tracking if enabled |
| isMapped |
"The isMapped property specifies whether or not the particular memory object ... |
| isMimeEncoded |
|
| isMultipart |
|
| isNamed |
|
| isOptimized |
|
| isPrivate |
"Is the event marked as private?" |
| isPrivileged |
|
| isProtected |
"The isProtected property specifies whether or not the particular memory obje... |
| isRead |
|
| isSecure |
"Is the cookie secure? If the cookie isSecure it cannot be delivered over an ... |
| isSelfSigned |
|
| isServiceAccount |
|
| issuer |
|
| issuerAlternativeName |
|
| issuerHash |
"A hash calculated on the certificate Issuer name |
| isSURootEnabled |
"Root access through Linux SU binary observed to be enabled |
| isTLD |
|
| isVolatile |
"The isVolatile property specifies whether or not the particular memory objec... |
| item |
The link to every item of the bag |
| itemContent |
The link to the actual resource to which the item refers |
| itemContentOf |
The link to the item that refers to the resource |
| itemDescription |
A description of a configuration setting entry item |
| itemName |
The name of a configuration setting entry item |
| itemObject |
The structured value of a configuration setting entry instance |
| itemOf |
The link to a bag in which the item is member |
| itemType |
The type of a configuration setting entry item |
| itemValue |
The value of a configuration setting entry instance |
| key |
"A key property of a single dictionary entry |
| keypadUnlockCode |
"A code or password set on a device for security that must be entered to gain... |
| keyUsage |
|
| keywordSearchTerm |
"Specifies a string representing a keywordSearchTerm contained within the URL... |
| kindOfRelationship |
A characterization of the nature of a relationship between objects |
| labels |
"Named and colored label |
| language |
"Specifies the language the string is written in, e |
| lastItem |
The link to the last item of the list |
| lastItemOf |
The link to a list in which the item is last item |
| lastLoginTime |
"The date and time of the last login of the account |
| lastName |
"The lastName of a person |
| lastRun |
"Timestamp of when the prefetch application was lastRun |
| lastShutdownDate |
"Specifies the date on which the device was last shutdown |
| lastTimeContacted |
"Last time contacted specifies the date and time that a particular contact wa... |
| lastVisit |
"Specifies the date/time that the URL referred to by the URL field was lastVi... |
| latitude |
The latitude coordinate of a geolocation |
| length |
"Specifies the length, in characters, of the extracted string |
| libraries |
"The libraries incorporated into a particular build of a software |
| libraryName |
"The name of the library |
| libraryType |
"Specifies the type of library being characterized |
| LibraryTypeVocab |
"Defines an open-vocabulary of library types |
| libraryVersion |
"The version of the library |
| license |
Specifies the identifier for the type of license |
| list |
|
| listedCount |
"Specifies the number of public lists that this profile is associated with |
| listItem |
|
| loaderFlags |
"Specifies the reserved loaderFlags" |
| locality |
The name of the geolocation locality (e |
| localTime |
"Specifies the localTime on the system |
| location |
"The locations where an action occurs |
| loginTime |
"Specifies the date/time of the login for the user session |
| logoutTime |
"Specifies the date/time of the logout for the user session |
| longitude |
The longitude coordinate of a geolocation |
| lookupDate |
"Specifies the date and time that the Whois record was queried |
| macAddress |
"Specifies the MAC or hardware address of the physical network card |
| machine |
"Specifies the type of target machine |
| magic |
"Specifies the value that indicates the type of the PE binary |
| magicNumber |
|
| majorImageVersion |
"Specifies the major version number of the image |
| majorLinkerVersion |
"Specifies the linker major version number |
| majorOSVersion |
"Specifies the major version number of the required operating system |
| majorSubsystemVersion |
"Specifies the major version number of the subsystem |
| manuallyEnteredCount |
"Specifies the number of times the URL referred to by the URL field was manua... |
| manufacturer |
|
| marking |
Represents specific MarkingDefinitions to be applied to UCO data |
| maxRunTime |
"Specifies the maximum run time of the scheduled task before terminating, in ... |
| MemoryBlockTypeVocab |
"Defines an open-vocabulary of types of memory blocks |
| messageID |
"An unique identifier for the message |
| messageText |
"The contents of the message |
| messageThread |
|
| messageThreadOrderedItems |
"The contents of ordered items in the Thread linked by messageThread must be ... |
| messageThreadOriginItems |
"The contents of origin items in the Thread linked by messageThread must be M... |
| messageThreadTerminalItems |
"The contents of terminal items in the Thread linked by messageThread must be... |
| messageThreadUnorderedItems |
"The contents of unordered items in the Thread linked by messageThread must b... |
| messageType |
"messageType specifies what sort of message (email, chat, SMS, etc) a message... |
| messagingAddress |
"A messagingAddress specifies details of an identifier for digital messsaging... |
| metadataChangeTime |
"The date and time at which the file metadata was last modified |
| metadataRecoveredStatus |
"Specifies the recoverability status of the metadata of an object |
| mftFileID |
"Specifies the record number for the file within an NTFS Master file Table |
| mftFileNameAccessedTime |
"The access date and time recorded in an MFT entry $ file_Name attribute |
| mftFileNameCreatedTime |
"The creationDate and time recorded in an MFT entry $ file_Name attribute |
| mftFileNameLength |
" Specifies the length of an NTFS fileName, in unicode characters |
| mftFileNameModifiedTime |
"The modification date and time recorded in an MFT entry $ file_Name attribut... |
| mftFileNameRecordChangeTme |
"The metadata modification date and time recorded in an MFT entry $ file_Name... |
| mftFlags |
"Specifies basic permissions for the file (Read-Only, Hidden, Archive, Compre... |
| mftParentID |
"Specifies the record number within an NTFS Master file Table for parent dire... |
| mftRecordChangeTime |
"The date and time at which an NTFS file metadata was last modified |
| middleName |
"The middleName of a person |
| mimeClass |
|
| mimeType |
"MIME type of the data |
| minorImageVersion |
"Specifies the minor version number of the image |
| minorLinkerVersion |
"Specifies the linker minor version number |
| minorOSVersion |
"Specifies the minor version number of the required operating system |
| minorSubsystemVersion |
"Specifies the minor version number of the subsystem |
| mockLocationsAllowed |
"??? |
| model |
|
| modifiedTime |
Specifies the time that this particular version of the object was modified |
| mostRecentRunTime |
"Specifies the most recent run date/time of this scheduled task |
| mountPoint |
"Specifies the mountPoint of the partition |
| MSISDN |
"Mobile Station International Subscriber Directory Number (MSISDN) is a numbe... |
| MSISDNType |
"??? |
| msProductID |
"The Microsoft Product ID |
| msProductName |
"The Microsoft ProductName of the current installation of Windows |
| mutexName |
"Specifies the name identifier for a specific instance of a mechanism that en... |
| name |
The name of a particular concept characterization |
| nameConstraints |
|
| namePhonetic |
"Name phonetic specifies the phonetic pronunciation of the name of a person |
| namePrefix |
"Name prefix specifies an honorific prefix (coming ordinally before first/giv... |
| nameRecoveredStatus |
"Specifies the recoverability status of the name of an object |
| nameServer |
"Specifies a list of nameServer entries for a Whois entry |
| nameSuffix |
"Name suffix specifies an suffix (coming ordinally after last/family name) fo... |
| namingAuthority |
Specifies the naming authority that issued the name of the entity |
| nativeFormatString |
"Specifies data in its native format of some external language |
| netBIOSName |
"Specifies the NetBIOS (network Basic Input/Output System) name of the Windo... |
| network |
Network allowing computers to share resources and communicate with each other |
| networkInterface |
"Specifies the list of networkInterfaces present on the system |
| newObject |
"Specifies the observable object and its properties as they are after the sta... |
| nextItem |
The link to the next item in a list |
| nextRunTime |
"Specifies the next run date/time of the scheduled task |
| nickname |
"Nickname specifies an alternate, unofficial and typically informal name for ... |
| ntfsHardLinkCount |
"Specifies the number of directory entries that reference an NTFS file record |
| ntfsOwnerID |
"Specifies the identifier of the file owner, from the security index |
| ntfsOwnerSID |
"Specifies the security ID (key in the $SII Index and $SDS DataStream in the ... |
| number |
|
| numberOfLaunches |
|
| numberOfRVAAndSizes |
"Specifies the number of data-directory entries in the remainder of the optio... |
| numberOfSections |
"Specifies the numberOfSections in the PE binary, as a non-negative integer |
| numberOfSubkeys |
|
| numberOfSymbols |
"Specifies the number of entries in the symbol table of the PE binary, as a n... |
| numberTimesContacted |
"Number times contacted specifies the number of times a particular contact ha... |
| object |
Specifies one or more UcoObjects |
| objectCreatedTime |
The time at which a characterization of a concept is created |
| objectGUID |
|
| objective |
"The intended purpose for performing the action |
| objectMarking |
Marking definitions to be applied to a particular concept characterization in... |
| observableCreatedTime |
"The date and time at which the observable object being characterized was cre... |
| ObservableObjectRelationshipVocab |
"Defines an open-vocabulary of inter-observable object relationships |
| ObservableObjectStateVocab |
"Defines an open-vocabulary of observable object states |
| obSize |
"Specifies the size of the section, in bytes |
| oldObject |
"Specifies the observable object and its properties as they were before the s... |
| openFileDescriptor |
"Specifies a listing of the current file descriptors used by the Unix process |
| operatingSystem |
|
| optionalHeader |
"Specifies the PE optional header of the PE binary |
| options |
"Specifies any options used when mounting the volume |
| organizationDepartment |
"Specifies a particular suborganization (division, branch, office, etc |
| organizationLocation |
"Specifies a geolocation address of an organization |
| organizationPosition |
"Specifies the title or role that a person plays within an organization |
| originatingAnalysis |
"The analysis action that resulted in an analytic result |
| osInstallDate |
"Specifies the date on which the operating system (OS) was installed |
| osLastUpgradeDate |
"Specifies the date on which the operating system (OS) was last upgraded |
| otherHeaders |
|
| owner |
"Specifies the owner of an observable Object |
| ownerSID |
|
| pageTitle |
"Specifies the title of a web page |
| parameterAddress |
|
| parameters |
"Specifies the command line parameters used to launch the scheduled task |
| parent |
"The process that created this process |
| participant |
"The supporting (non-primary) performers of an action |
| partition |
"The partitions that reside on the disk |
| partitionID |
"Specifies the identifier of the partition, as provided by the containing par... |
| partitionLength |
"Specifies the length of the partition, in bytes |
| partitionOffset |
"Specifies the starting offset of the partition, in bytes |
| PartitionTypeVocab |
"Defines an open-vocabulary of partition types |
| password |
"Specifies an authentication password |
| passwordLastChanged |
"The date and time that the password was last changed |
| passwordType |
"The type of password, for instance plain-text or encrypted |
| path |
"Specifies the location of one object within another containing object |
| patternExpression |
An explicit logical pattern expression |
| pdfCreationDate |
"The PDF CreationDate property is defined in ISO 32000-1:2008 as 'The date an... |
| pdfId0 |
|
| pdfId1 |
|
| pdfModDate |
"The PDF ModDate property is defined in ISO 32000-1:2008 as 'The date and tim... |
| pdop |
The positional (3D) dilution of precision of the GPS location |
| performer |
"The primary performer of an action |
| peType |
"Specifies the type of the PE binary |
| phase |
"The ordered set of actions or sub action-lifecycles that represent the actio... |
| phoneActivationTime |
"The date and time that a device was activated |
| phoneNumber |
"A phoneNumber(account) |
| pictureHeight |
|
| pictureType |
"The type of a picture, for example a thumbnail |
| pictureWidth |
"The width of the picture in pixels |
| pid |
"The process ID, or PID, of the process |
| PIN |
"Personal Identification Number (PIN) |
| pointerToSymbolTable |
"Specifies the file offset of the COFF symbol table |
| policyConstraints |
|
| policyMappings |
|
| port |
"Port on which communication takes place |
| postalCode |
The zip-code |
| precededBy |
The link to the preceding item in a list |
| prefetchHash |
"An eight character hash of the location from which the application was run |
| previousItem |
The link to the previous item in a list |
| priority |
"The priority of the email |
| privateKeyUsagePeriodNotAfter |
|
| privateKeyUsagePeriodNotBefore |
|
| processorArchitecture |
"Specifies the specific architecture (e |
| ProcessorArchVocab |
"Defines an open-vocabulary of computer processor architectures |
| profile |
"A profile specifies a particular online service profile |
| profileAccount |
"Specifies the online service account associated with the profile" |
| profileBackgroundHash |
"Specifies hashes of the background associated with the profile" |
| profileBackgroundLocation |
"Specifies the network location of the background associated with the profile... |
| profileBannerHash |
"Specifies hashes of the banner associated with the profile" |
| profileBannerLocation |
"Specifies the network location of the banner associated with the profile" |
| profileCreated |
"Specifies the date and time the profile was created" |
| profileIdentity |
"Specifies the identity associated with the profile" |
| profileImageHash |
"Specifies hashes of the profile image associated with the profile" |
| profileImageLocation |
"Specifies the network location of the profile image associated with the prof... |
| profileIsProtected |
"Specifies whether the twitter profileIsProtected" |
| profileIsVerified |
"Specifies whether the twitter profileIsVerified" |
| profileLanguage |
"Specifies the language associated with the profile |
| profileService |
"Specifies the online service associated with the profile" |
| profileWebsite |
"Specifies the website URL associated with the profile" |
| properties |
"Specifies the properties that were enumerated as a result of the action on t... |
| propertyName |
"Specifies the Name of the property being read |
| protocols |
"Specifies the protocols involved in the network connection, along with their... |
| PUK |
"Personal Unlocking Key (PUK) to unlock the SIM card |
| query |
"Query passed to the resource |
| rangeOffset |
"The offset at which the start of data can be found, relative to the rangeOff... |
| rangeOffsetType |
"The type of offset defined for the range (e |
| rangeSize |
"The size of the data in bytes |
| rate |
"The frequency rate for the occurence of an action |
| receivedLines |
|
| receivedTime |
"The date and time at which the message received |
| recordFieldIsNull |
"Whether the specified database record field is null |
| recordFieldName |
"A field name of a database record value being identified |
| recordFieldValue |
"The field value of a specified database record |
| recordRowID |
"The unique ID that identifies a database record, supplied by the originating... |
| RecoveredObjectStatusVocab |
"Defines the vocabulary for Recovered Object status of data |
| recurrence |
"Recurrence of the event |
| references |
"A list of email message identifiers this email relates to |
| referenceURL |
A URL for some information defined external to the UCO context |
| referralURL |
"Specifies the corresponding referralURL for a registrar |
| referrerURL |
"Specifies the origination point (i |
| region |
The name of the geolocation region (e |
| regionalInternetRegistry |
"specifies the name of the Regional Internet Registry (RIR) which allocated t... |
| RegionalRegistry_typeVocab |
"Defines an open-vocabulary of Regional Internet Registries (RIRs) names, rep... |
| regionEndAddress |
"The regionEndAddress property specifies the ending address of the particular... |
| regionSize |
"The regionSize property specifies the size of the particular memory region, ... |
| regionStartAddress |
"""The regionStartAddress property specifies the starting address of the part... |
| registeredOrganization |
"The organization that this copy of Windows is registered to |
| registeredOwner |
"The person or organization that is the registeredOwner of this copy of Windo... |
| registrantContactInfo |
"Specifies contact info for the registrant of a domain within a WHOIS entity |
| registrantIDs |
"Specifies the registrantIDs associated with a domain lookup |
| registrarGUID |
"Specifies the Registrar GUID field of a Whois entry |
| registrarID |
"Specifies the Registrar ID field of a Whois entry |
| registrarInfo |
"Specifies registrarInfo that would be returned from a registrar lookup |
| registrarName |
"The name of the registrar organization |
| RegistryDatatypeVocab |
|
| registryValues |
"The values that were enumerated as a result of the action on the object |
| remarks |
"Specifies any remarks associated with this Whois entry |
| remindTime |
|
| requestMethod |
"Specifies the HTTP method portion of the HTTP request line, as a lowercase s... |
| requestValue |
"Specifies the value (typically a resource path) portion of the HTTP request ... |
| requestVersion |
"Specifies the HTTP version portion of the HTTP request line, as a lowercase ... |
| result |
"The things resulting from performing an action |
| resultContent |
"Structured content expressing the results of an analysis action |
| rowCondition |
|
| rowIndex |
|
| ruid |
"Specifies the real user ID, which represents the Unix user who created the p... |
| runningStatus |
|
| scale |
"The time scale utilized for the frequency rate count for the occurence of an... |
| scheme |
"Identifies the type of URL |
| sectionAlignment |
"Specifies the alignment (in bytes) of PE sections when they are loaded into ... |
| sections |
"Specifies metadata about the sections in the PE file |
| sectorSize |
"The sectorSize of the volume in bytes |
| securityAttributes |
|
| sender |
|
| sentTime |
"The date and time at which the message sent |
| serialNumber |
|
| serverName |
"Specifies the corresponding serverName for a Whois entry |
| serviceName |
|
| servicePack |
"An appropriate service pack descriptor for a particular tool |
| serviceType |
|
| servicStatus |
|
| sessionID |
"An identifier for the session from which the message originates |
| shell |
|
| showMessageBody |
"Specifies the messageText that is displayed in the body of the message box b... |
| showMessageTitle |
"Specifies the title of the message box shown by the action |
| sid |
|
| signalStrength |
"The strength of the antenna signal |
| signature |
"A" |
| signatureAlgorithm |
|
| signatureDescription |
|
| signatureExists |
|
| signatureVerified |
|
| SIMForm |
"The form of SIM card such as SIM, Micro SIM, Nano SIM |
| SIMFormVocab |
"Defines an open-vocabulary of common SIM card form factors |
| SIMType |
"The type of SIM card such as SIM, USIM, UICC |
| SIMTypeVocab |
"Defines an open-vocabulary of common SIM card types |
| sipAddress |
"A SIP address specifies Session Initiation Protocol (SIP) identifier |
| size |
The number of item belonging to a collection |
| sizeInBytes |
"The size of the data in bytes |
| sizeOfCode |
"Specifies the size of the code (text) section |
| sizeOfHeaders |
"Specifies the combined size of the MS-DOS, PE header, and section headers, r... |
| sizeOfHeapCommit |
"Specifies the size of the local heap space to commit |
| sizeOfHeapReserve |
"Specifies the size of the local heap space to reserve |
| sizeOfImage |
"Specifies the size, in bytes, of the image, including all headers, as the im... |
| sizeOfInitializedData |
"Specifies the size of the initialized data section |
| sizeOfOptionalHeader |
"Specifies the size of the optionalHeader of the PE binary |
| sizeOfStackCommit |
"Specifies the size of the stack to commit |
| sizeOfStackReserve |
"Specifies the size of the stack to reserve |
| sizeOfUninitializedData |
"Specifies the size of the uninitialized data section |
| skew |
"The angle in degrees of the radial rotation around its main beam direction |
| source |
The originating node of a specified relationship |
| sourceApplication |
"Source application specifies the software application that a particular cont... |
| sourceFlags |
"Specifies the source TCP flags |
| sourcePort |
"Specifies the sourcePort used in the connection, as an integer in the range ... |
| spaceLeft |
"Specifies the amount of spaceLeft on the partition, in bytes |
| spaceUsed |
"Specifies the amount of spaceUsed on the partition, in bytes |
| specVersion |
The version of UCO ontology or subontology specification used to characterize... |
| sponsoringRegistrar |
"Specifies the name of the sponsoringRegistrar for a domain |
| src |
"Specifies the source(s) of the network connection |
| srcBytes |
|
| srcPackets |
|
| srcPayload |
|
| ssid |
"network identifier |
| stackSize |
|
| startAddress |
|
| startCommandLine |
|
| startTime |
The initial time of a time range |
| startType |
|
| startupInfo |
|
| state |
the particular condition that someone or something is in at a specific time |
| statement |
A textual statement of an assertion |
| status |
"Specifies a list of statuses for a given Whois entry |
| statusesCount |
"Specifies the number of tweets that this profile has issued" |
| storageCapacityInBytes |
"The number of bytes that can be stored on a SIM card |
| street |
The name of the street |
| strings |
|
| stringValue |
"Specifies the actual value of the extracted string |
| structuredText |
"Expresses string-based data in some information structuring format (e |
| subaction |
"References to other actions that make up part of a larger more complex actio... |
| subject |
"The subject of the email |
| subjectAlternativeName |
|
| subjectDirectoryAttributes |
|
| subjectHash |
"A hash calculated on the certificate subject name |
| subjectKeyIdentifier |
|
| subjectPublicKeyAlgorithm |
|
| subjectPublicKeyExponent |
|
| subjectPublicKeyModulus |
|
| subsystem |
"Specifies the subsystem (e |
| swid |
"Specifies the SWID tag for the software |
| symbolicName |
"The symbolicName of a global flag |
| systemTime |
|
| tableName |
"The table containing a specified database record |
| tableSchema |
"The schema that contains the identified database record |
| tag |
A generic tag/label |
| target |
The terminating node of a specified relationship |
| targetFile |
"Specifies the file targeted by a symbolic link |
| TaskActionTypeVocab |
"Defines an open-vocabulary of task action types |
| taskComment |
"Specifies a comment for the scheduled task |
| taskCreator |
"Specifies the name of the creator of the scheduled task |
| TaskFlagVocab |
"Defines an open-vocabulary of the run flags for a task scheduler task |
| TaskPriorityVocab |
"Defines an open-vocabulary of the priority levels of task scheduler tasks |
| TaskStatusVocab |
"Defines an open-vocabulary of the possible statuses of a scheduled task |
| tdop |
The temporal dilution of precision of the GPS location |
| termsOfUse |
Specifies the terms of use that apply to the structure for which the Marking ... |
| text |
|
| threadID |
|
| threadNextItem |
"The link to a next item in a thread |
| threadOriginItem |
"A link to an item of the thread known to have no predecessor |
| threadPredecessor |
"The link to the preceding item in a thread |
| threadPreviousItem |
"A direct link to a previous item in a thread |
| ThreadRunningStatusVocab |
"Defines an open-vocabulary of the various states that a thread may be in bef... |
| threadSuccessor |
"A link to a following item in a thread |
| threadTerminalItem |
"A link to an item of the thread known to have no successor |
| thumbprintHash |
"A hash calculated on the entire certificate including signature |
| timeDateStamp |
"Specifies the time when the PE binary was created |
| timesExecuted |
"The number of times the prefetch application has executed |
| TimestampPrecisionVocab |
"Defines an open-vocabulary of timestamp precision granularities |
| timezoneDST |
"Specifies the time zone used by the system, taking daylight savings time (DS... |
| timezoneStandard |
"Specifies the time zone used by the system, without taking daylight savings ... |
| to |
"The receiver's phone number |
| toolType |
"The type of tool |
| totalFragments |
|
| totalRam |
"Specifies the total amount of physical memory present on the system, in byte... |
| totalSpace |
"Specifies the total amount of space available on the partition, in bytes |
| trend |
"A characterization of the frequency trend for the occurence of an action |
| TrendVocab |
"Defines an open-vocabulary of trend values |
| triggerBeginTime |
"Specifies the date/time that the trigger is activated |
| triggerDelay |
"Specifies the delay that takes place between when the task is registered and... |
| triggerEndTime |
"Specifies the date/time that the trigger is deactivated |
| triggerFrequency |
"Specifies the frequency at which the trigger repeats |
| TriggerFrequencyVocab |
"Defines an open-vocabulary of the frequency types that a trigger may use |
| triggerList |
"Specifies a set of triggers used by the scheduled task |
| triggerMaxRunTime |
"The maximum amount of time that the task launched by the trigger is allowed ... |
| triggerSessionChangeType |
"Specifies the type of Terminal Server session change that would trigger a ta... |
| triggerType |
"Specifies the type of the task trigger |
| TriggerTypeVocab |
"Defines an open-vocabulary of the types of triggers associated with a task |
| twitterHandle |
"Specifies the twitterHandle associated with the profile" |
| twitterId |
"Specifies the twitter id associated with the profile" |
| uninstallDate |
"Specifies the date the operating system or application was uninstalled |
| units |
"The units of measure utilized for the frequency rate count for the occurence... |
| UnixProcessStateVocab |
"Defines an open-vocabulary of Unix process states" |
| updatedDate |
"Specifies the date in which the registered domain information was last updat... |
| uptime |
"Specifies the duration that represents the current amount of time that the s... |
| url |
"Specifies a URL associated with a particular observable object or facet |
| urlHistoryEntry |
"Specifies a URL history record stored in the browser's history |
| urlTargeted |
"The target of the bookmark |
| urlTransitionType |
"Specifies how a browser navigated to a particular URL on a particular visit |
| URLTransitionTypeVocab |
"Defines an open-vocabulary of types of URL transitions |
| usageContextAssumptions |
Description of the various relevant usage context assumptions for a tool or o... |
| userLocationString |
"Specifies the user-provided location string associated with the profile" |
| userName |
"Username used to authenticate to this resource |
| usesConfiguration |
A configuration used by an object |
| validityNotAfter |
|
| validityNotBefore |
|
| value |
A string value |
| values |
"The values that were enumerated as a result of the action on the object |
| vdop |
The vertical dilution of precision of the GPS location |
| version |
|
| visibility |
|
| visitCount |
"Specifies the number of times a URL has been visited by a particular web bro... |
| visitDuration |
"Specifies the duration of a specific visit of a URL within a particular brow... |
| visitTime |
"Specifies the date/time of a specific visit of a URL within a particular bro... |
| volume |
"The volume from which the prefetch application was run |
| volumeID |
"The unique identifier of the volume |
| whoisContactType |
"Specifies what type of WHOIS contact this is |
| WhoisContactTypeVocab |
"Defines an open-vocabulary of types of registrar contacts listed in a whois ... |
| WhoisDNSSECTypeVocab |
"Defines an open-vocabulary of acceptable values for the DNSSEC field in a Wh... |
| whoisServer |
"Specifies the corresponding Whois server for a registrar |
| WhoisStatusTypeVocab |
"Defines an open-vocabulary of all valid statuses for a domain within a whois... |
| win32VersionValue |
"Specifies the reserved win32VersionValue |
| windowsDirectory |
"The Windows_Directory field specifies the fully-qualified path to the Window... |
| WindowsDriveTypeVocab |
"Defines an open-vocabulary of possible drive types, as enumerated by the WIN... |
| windowsSystemDirectory |
"The Windows_System_Directory field specifies the fully-qualified path to the... |
| windowsTempDirectory |
"The Windows_Temp_Directory field specifies the fully-qualified path to the W... |
| windowsVolumeAttributes |
"Specifies the attributes of a windows volume |
| WindowsVolumeAttributeVocab |
"Defines an open-vocabulary of attributes that may be returned by the diskpar... |
| windowTitle |
|
| wirelessNetworkSecurityMode |
"Specifies the security mode of a wireless network (None, WEP, WPA, etc) |
| WirelessNetworkSecurityModeVocab |
"Defines an open-vocabulary of security modes that may be configured for wire... |
| workingDirectory |
'Specifies the workingDirectory for the scheduled task |
| workItemData |
"Specifies application defined data associated with the scheduled task |
| x509v3extensions |
|
| xMailer |
|
| xOriginatingIP |
|