https://ontology.solveit-df.org/solveit/core/Technique
A digital forensic technique representing how one might achieve an objective by performing an action. Based on the SOLVE-IT knowledge base. This class is a metaclass: its instances are owl:Class entities whose own instances are investigative actions, planned or performed.
Instances of solveit-core:Technique can have the following properties:
| PROPERTY | TYPE | DESCRIPTION | RANGE |
|---|
By the associated SHACL property shapes, instances of solveit-core:Technique can have the following properties:
| PROPERTY | PROPERTY TYPE | DESCRIPTION | MIN | MAX | VALUE TYPE | OTHER CONSTRAINTS | GLOBAL RANGE |
|---|---|---|---|---|---|---|---|
| solveit-core:Technique | |||||||
rdf:type |
-- | sh:message A SOLVE-IT technique must also be declared an owl:Class, so that performed actions can be typed with it. |
0 | * |
sh:hasValue
owl:Class
|
-- | |
rdfs:subClassOf |
-- | sh:message A SOLVE-IT technique class must have at least one rdfs:subClassOf — either its parent technique, or solveit-core:SolveitInvestigativeAction for a root technique. |
1 | * | sh:IRI | -- | |
| solveit-core:hasCASEInputClass | owl:ObjectProperty | A CASE/UCO term that represents an expected input to this technique. Usually a class (e.g., solveit-observable:WriteProtectedDeviceInterface), but a property where the technique consumes a single value rather than an object (e.g., uco-observable:filePath). No rdfs:range is asserted, because no single one is true of both; :TechniqueIOTermShape carries the constraint instead. sh:message A technique input must be a CASE/UCO class, datatype property or object property, and must be declared as one in the graph. |
0 | * | sh:IRI |
sh:or
( owl:Class | owl:DatatypeProperty | owl:ObjectProperty )
|
-- |
| solveit-core:hasCASEOutputClass | owl:ObjectProperty | A CASE/UCO term that represents an output of this technique. Usually a class (e.g., uco-observable:Image), but a property where the technique produces a single value rather than an object (e.g., case-investigation:exhibitNumber). No rdfs:range is asserted, because no single one is true of both; :TechniqueIOTermShape carries the constraint instead. sh:message A technique output must be a CASE/UCO class, datatype property or object property, and must be declared as one in the graph. |
0 | * | sh:IRI |
sh:or
( owl:Class | owl:DatatypeProperty | owl:ObjectProperty )
|
-- |
| solveit-core:techniqueID | owl:DatatypeProperty | The unique identifier for a SOLVE-IT technique (e.g., T1002). sh:message A SOLVE-IT technique must have exactly one techniqueID. |
1 | 1 | xsd:string | ||
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix solveit-core: <https://ontology.solveit-df.org/solveit/core/> .
@prefix uco-action: <https://ontology.unifiedcyberontology.org/uco/action/> .
solveit-core:Technique a owl:Class ;
rdfs:label "SOLVE-IT Technique"@en ;
rdfs:comment "A digital forensic technique representing how one might achieve an objective by performing an action. Based on the SOLVE-IT knowledge base. This class is a metaclass: its instances are owl:Class entities whose own instances are investigative actions, planned or performed."@en ;
rdfs:subClassOf uco-action:Technique .