Haula Galadima, Cormac Doherty, Rob Brennan
An ontology for modeling cybersecurity incident response processes
Cyber Incident Response Process Ontology (CIRPO)
Indicates that a course of action used specific analysis
Indicates the security event that generated this analysis
Indicates the analyst who performed this activity
Inverse of hasCoaAssignedAnalyst. Links an analyst to the courses of action they are assigned to execute.
Inverse of hasConfirmationAnalyst. Links an analyst to the incidents they confirmed.
Indicates that a channel contains chat messages.
Inverse of hasArtefactCreationAnalyst. Links an analyst to the artefacts they created.
Inverse of hasCoaCreationAnalyst. Links an analyst to the courses of action they created.
Inverse of prov:wasGeneratedBy. Indicates a security event generated an analysis.
Inverse of prov:wasAssociatedWith. Indicates an incident had an associated entity.
Links an incident to the security analyses performed on it.
Links a security analysis to the analyst who performed it.
Links an incident to related artefacts/observables collected during the investigation.
Links an artefact to the analyst who collected, created, or documented it.
Links a chat message to the analyst who authored it.
Links an incident to the response actions (COA) taken to resolve it.
Links a course of action to the analyst responsible for executing it.
Links a course of action to the analyst who created or planned it.
Links an incident to the analyst who confirmed it as a genuine security incident.
Links an incident to one or more related security events that triggered or are part of it.
Links an incident to any responder communication resource.
Inverse of hasAnalysis. Links an analysis back to its incident.
Inverse of hasArtefact. Links an artefact back to its incident.
Inverse of hasCoa. Links a course of action back to its incident.
Inverse of hasEvent. Links a security event back to its parent incident.
Inverse of hasResponderCommunication. Links any responder communication back to the incident it is associated with.
Inverse of prov:wasPerformedBy. Indicates an analyst performed an activity.
Inverse of hasAnalysisPerformingAnalyst. Links an analyst to the analyses they performed.
Indicates the channel where the chat message was posted.
Inverse of prov:used. Indicates an analysis was used by a course of action.
Timestamp when the artefact was collected.
The actual content or value of the artefact .
Unique identifier of the communication channel (channel_id).
Name of the communication channel (channel_name).
The content or body of the communication message.
Timestamp when the communication occurred.
Unique identifier of the chat message (post_id).
The sentiment or tone of the communication.
Timestamp when the course of action was created.
Narrative description of the course of action and its intended effect.
Timestamp when execution of the course of action was completed.
Timestamp when execution of the course of action was initiated.
Current execution status of the course of action.
Timestamp when the incident was confirmed
Timestamp when incident response was formally concluded.
Description of the specific activity within a security event.
Timestamp when the specific security event activity occurred.
Detailed description of the security event.
Short description or name for the security event.
Timestamp when the incident record was first created.
The severity level of an incident (Low, Medium, High, Critical).
Current stage in the incident lifecycle.
Timestamp when the security analysis was performed.
Activities to assess security incidents.
A security analyst who investigates and responds to incidents.
An observable piece of evidence collected from an incident.
A communication channel where responders exchange messages
A message posted by a responder within a chat channel.
Actions to limit the spread and impact of an incident.
A planned response action to a security incident.
Activities in detection of security incidents.
Actions to remove threats and root causes from affected systems.
A security incident that requires investigation and response.
Activities conducted after incident resolution (e.g., lessons learned, reporting).
Actions to restore systems to normal operation.
Any communication resource involved in incident response activities,including channels and individual chat messages
The analysis of observables from security events leading to an incident
An observable occurrence relevant to system security (e.g., alert from SIEM, IDS).
A specific action taken or observed within a security event.
First responder performing initial triage and categorization.
Incident responder handling deeper investigation and analysis.
Senior analyst or subject matter expert handling complex investigations.