Cyber Incident Response Process Ontology (CIRPO)
type: Ontology
created: 2026-05-03
creator: Haula Galadima, Cormac Doherty, Rob Brennan
description: An ontology for modeling cybersecurity incident response processes
license: https://creativecommons.org/licenses/by/4.0/
version info: 6.0

used
type: ObjectProperty
inverse of: was used by
domain: Course of Action
range: Security Analysis
comment: Indicates that a course of action used specific analysis

was associated with
type: ObjectProperty
inverse of: had associated entity
domain: Class
  union of: Analyst
  union of: Artefact
  union of: Security Event
range: Incident
comment: Indicates association with an incident

was generated by
type: ObjectProperty
inverse of: generated
domain: Security Analysis
range: Security Event
comment: Indicates the security event that generated this analysis

was performed by
type: ObjectProperty
inverse of: performed
domain: Class
  union of: Security Analysis
  union of: Security Event
range: Analyst
comment: Indicates the analyst who performed this activity

assigned to COA
type: ObjectProperty
domain: Analyst
range: Course of Action
comment: Inverse of hasCoaAssignedAnalyst. Links an analyst to the courses of action they are assigned to execute.

confirmed incident
type: ObjectProperty
domain: Analyst
range: Incident
comment: Inverse of hasConfirmationAnalyst. Links an analyst to the incidents they confirmed.

contains chat
type: ObjectProperty
inverse of: was posted to
domain: Chat Channel
range: Chat Message
comment: Indicates that a channel contains chat messages.

created artefact
type: ObjectProperty
domain: Analyst
range: Artefact
comment: Inverse of hasArtefactCreationAnalyst. Links an analyst to the artefacts they created.

created COA
type: ObjectProperty
domain: Analyst
range: Course of Action
comment: Inverse of hasCoaCreationAnalyst. Links an analyst to the courses of action they created.

generated
type: ObjectProperty
domain: Security Event
range: Security Analysis
comment: Inverse of prov:wasGeneratedBy. Indicates a security event generated an analysis.

generated chat
type: ObjectProperty
domain: Analyst
range: Chat Message
comment: Inverse of hasChatAnalyst.

had associated entity
type: ObjectProperty
domain: Incident
range: Class
  union of: Analyst
  union of: Artefact
  union of: Security Event
comment: Inverse of prov:wasAssociatedWith. Indicates an incident had an associated entity.

has analysis
type: ObjectProperty
inverse of: is analysis of
domain: Incident
range: Security Analysis
comment: Links an incident to the security analyses performed on it.

has analysis performing analyst
type: ObjectProperty
inverse of: performed analysis
domain: Security Analysis
range: Analyst
comment: Links a security analysis to the analyst who performed it.

has artefact
type: ObjectProperty
inverse of: is artefact of
domain: Incident
range: Artefact
comment: Links an incident to related artefacts/observables collected during the investigation.

has artefact creation analyst
type: ObjectProperty
inverse of: created artefact
domain: Artefact
range: Analyst
comment: Links an artefact to the analyst who collected, created, or documented it.

has channel
type: ObjectProperty
sub property of: has responder communication
inverse of: is channel of
domain: Incident
range: Chat Channel
comment: Links an incident to its chat channel.

has chat analyst
type: ObjectProperty
inverse of: generated chat
domain: Chat Message
range: Analyst
comment: Links a chat message to the analyst who authored it.

has course of action
type: ObjectProperty
inverse of: is COA of
domain: Incident
range: Course of Action
comment: Links an incident to the response actions (COA) taken to resolve it.

has COA assigned analyst
type: ObjectProperty
inverse of: assigned to COA
domain: Course of Action
range: Analyst
comment: Links a course of action to the analyst responsible for executing it.

has COA creation analyst
type: ObjectProperty
inverse of: created COA
domain: Course of Action
range: Analyst
comment: Links a course of action to the analyst who created or planned it.

has confirmation analyst
type: ObjectProperty
inverse of: confirmed incident
domain: Incident
range: Analyst
comment: Links an incident to the analyst who confirmed it as a genuine security incident.

has event
type: ObjectProperty
inverse of: is event of
domain: Incident
range: Security Event
comment: Links an incident to one or more related security events that triggered or are part of it.

has responder communication
type: ObjectProperty
inverse of: is related to incident
domain: Incident
range: Responder Communication
comment: Links an incident to any responder communication resource.

is analysis of
type: ObjectProperty
domain: Security Analysis
range: Incident
comment: Inverse of hasAnalysis. Links an analysis back to its incident.

is artefact of
type: ObjectProperty
domain: Artefact
range: Incident
comment: Inverse of hasArtefact. Links an artefact back to its incident.

is channel of
type: ObjectProperty
domain: Chat Channel
range: Incident
comment: Inverse of hasChannel.

is COA of
type: ObjectProperty
domain: Course of Action
range: Incident
comment: Inverse of hasCoa. Links a course of action back to its incident.

is event of
type: ObjectProperty
domain: Security Event
range: Incident
comment: Inverse of hasEvent. Links a security event back to its parent incident.

is related to incident
type: ObjectProperty
domain: Responder Communication
range: Incident
comment: Inverse of hasResponderCommunication. Links any responder communication back to the incident it is associated with.

performed
type: ObjectProperty
domain: Analyst
range: Class
  union of: Security Analysis
  union of: Security Event
comment: Inverse of prov:wasPerformedBy. Indicates an analyst performed an activity.

performed analysis
type: ObjectProperty
domain: Analyst
range: Security Analysis
comment: Inverse of hasAnalysisPerformingAnalyst. Links an analyst to the analyses they performed.

was posted to
type: ObjectProperty
domain: Chat Message
range: Chat Channel
comment: Indicates the channel where the chat message was posted.

was used by
type: ObjectProperty
domain: Security Analysis
range: Course of Action
comment: Inverse of prov:used. Indicates an analysis was used by a course of action.

has analyst email
type: DatatypeProperty
domain: Analyst
range: string
comment: Email address of the analyst.

has analyst ID
type: DatatypeProperty
domain: Analyst
range: string
comment: Unique identifier for an analyst.

has artefact creation datetime
type: DatatypeProperty
domain: Artefact
range: dateTime
comment: Timestamp when the artefact was collected.

has artefact data value
type: DatatypeProperty
domain: Artefact
range: string
comment: The actual content or value of the artefact .

has artefact type
type: DatatypeProperty
domain: Artefact
range: string
comment: Classification of the artefact.

has chat channel ID
type: DatatypeProperty
domain: Chat Channel
range: string
comment: Unique identifier of the communication channel (channel_id).

has chat channel name
type: DatatypeProperty
domain: Chat Channel
range: string
comment: Name of the communication channel (channel_name).

has chat message
type: DatatypeProperty
domain: Chat Message
range: string
comment: The content or body of the communication message.

has chat message datetime
type: DatatypeProperty
domain: Chat Message
range: dateTime
comment: Timestamp when the communication occurred.

has chat message ID
type: DatatypeProperty
domain: Chat Message
range: string
comment: Unique identifier of the chat message (post_id).

has chat sentiment
type: DatatypeProperty
domain: Chat Message
range: string
comment: The sentiment or tone of the communication.

has COA creation datetime
type: DatatypeProperty
domain: Course of Action
range: dateTime
comment: Timestamp when the course of action was created.

has COA description
type: DatatypeProperty
domain: Course of Action
range: string
comment: Narrative description of the course of action and its intended effect.

has COA end datetime
type: DatatypeProperty
domain: Course of Action
range: dateTime
comment: Timestamp when execution of the course of action was completed.

has COA start datetime
type: DatatypeProperty
domain: Course of Action
range: dateTime
comment: Timestamp when execution of the course of action was initiated.

has COA status
type: DatatypeProperty
domain: Course of Action
range: string
comment: Current execution status of the course of action.

has confirmation datetime
type: DatatypeProperty
domain: Incident
range: dateTime
comment: Timestamp when the incident was confirmed

has end datetime
type: DatatypeProperty
domain: Incident
range: dateTime
comment: Timestamp when incident response was formally concluded.

has event activity
type: DatatypeProperty
domain: Security Event Action
range: string
comment: Description of the specific activity within a security event.

has event activity datetime
type: DatatypeProperty
domain: Security Event Action
range: dateTime
comment: Timestamp when the specific security event activity occurred.

has event description
type: DatatypeProperty
domain: Security Event Action
range: string
comment: Detailed description of the security event.

has event ID
type: DatatypeProperty
domain: Security Event
range: string
comment: Unique identifier for a security event.

has event title
type: DatatypeProperty
domain: Security Event
range: string
comment: Short description or name for the security event.

has incident creation datetime
type: DatatypeProperty
domain: Incident
range: dateTime
comment: Timestamp when the incident record was first created.

has incident description
type: DatatypeProperty
domain: Incident
range: string
comment: Detailed description of an incident.

has incident ID
type: DatatypeProperty
domain: Incident
range: string
comment: Unique identifier for an incident.

has incident name
type: DatatypeProperty
domain: Incident
range: string
comment: Title of the incident.

has incident severity
type: DatatypeProperty
domain: Incident
range: string
comment: The severity level of an incident (Low, Medium, High, Critical).

has incident stage
type: DatatypeProperty
domain: Incident
range: string
comment: Current stage in the incident lifecycle.

has incident status
type: DatatypeProperty
domain: Incident
range: string
comment: Current status of the incident.

has security analysis data value
type: DatatypeProperty
domain: Security Analysis
range: string
comment: The data value to be analysed.

has security analysis datetime
type: DatatypeProperty
domain: Security Analysis
range: dateTime
comment: Timestamp when the security analysis was performed.

has security analysis details
type: DatatypeProperty
domain: Security Analysis
range: string
comment: Detailed findings from the analysis.

has security analysis data type
type: DatatypeProperty
domain: Security Analysis
range: string
comment: The type of analysis performed.

Analysis
type: Class
subclass of: Course of Action
comment: Activities to assess security incidents.

Analyst
type: Class
comment: A security analyst who investigates and responds to incidents.

Artefact
type: Class
comment: An observable piece of evidence collected from an incident.

Chat Channel
type: Class
subclass of: Responder Communication
comment: A communication channel where responders exchange messages

Chat Message
type: Class
subclass of: Responder Communication
comment: A message posted by a responder within a chat channel.

Containment
type: Class
subclass of: Course of Action
comment: Actions to limit the spread and impact of an incident.

Course of Action
type: Class
comment: A planned response action to a security incident.

Detection
type: Class
subclass of: Course of Action
comment: Activities in detection of security incidents.

Eradication
type: Class
subclass of: Course of Action
comment: Actions to remove threats and root causes from affected systems.

Incident
type: Class
comment: A security incident that requires investigation and response.

Post-Incident Activity
type: Class
subclass of: Course of Action
comment: Activities conducted after incident resolution (e.g., lessons learned, reporting).

Recovery
type: Class
subclass of: Course of Action
comment: Actions to restore systems to normal operation.

Responder Communication
type: Class
comment: Any communication resource involved in incident response activities,including channels and individual chat messages

Security Analysis
type: Class
comment: The analysis of observables from security events leading to an incident

Security Event
type: Class
comment: An observable occurrence relevant to system security (e.g., alert from SIEM, IDS).

Security Event Action
type: Class
subclass of: Security Event
comment: A specific action taken or observed within a security event.

Tier 1
type: Class
subclass of: Analyst
comment: First responder performing initial triage and categorization.

Tier 2
type: Class
subclass of: Analyst
comment: Incident responder handling deeper investigation and analysis.

Tier 3
type: Class
subclass of: Analyst
comment: Senior analyst or subject matter expert handling complex investigations.