# Cyber Threat Intelligence ontologies

**URL:** <https://forum.open-services.net/t/cyber-threat-intelligence-ontologies/246>\
**Category:** Uncategorized\
**Created:** [June 15, 2019, 10:13pm UTC](https://forum.open-services.net/t/cyber-threat-intelligence-ontologies/246 "2019-06-15T22:13:38Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![andrew](https://forum.open-services.net/user_avatar/forum.open-services.net/andrew/32/28_2.png) [@andrew](https://forum.open-services.net/u/andrew)\
**Post date:** [June 15, 2019, 10:13pm UTC](https://forum.open-services.net/t/cyber-threat-intelligence-ontologies/246/1 "2019-06-15T22:13:38Z")

</div>

I asked @packet-rat in another topic about CTI ontologies. Moving the discussion into a separate topic.

---

<div class="post-metadata">

**Author:** ![packet-rat](https://forum.open-services.net/user_avatar/forum.open-services.net/packet-rat/32/53_2.png) [@packet-rat](https://forum.open-services.net/u/packet-rat)\
**Post date:** [June 16, 2019, 3:30pm UTC](https://forum.open-services.net/t/cyber-threat-intelligence-ontologies/246/3 "2019-06-16T15:30:25Z")

</div>

Thanks Andrew for engaging on the topic and breaking CTI ontology out into it’s own thread.

Another good resource in any efforts to define/adopt common CTI terms is the [MISP community](https://github.com/MISP) and the standard JSON based [MISP Taxonomies](https://github.com/MISP/misp-taxonomies).

---

<div class="post-metadata">

**Author:** ![andrew](https://forum.open-services.net/user_avatar/forum.open-services.net/andrew/32/28_2.png) [@andrew](https://forum.open-services.net/u/andrew)\
**Post date:** [June 17, 2019, 9:13pm UTC](https://forum.open-services.net/t/cyber-threat-intelligence-ontologies/246/4 "2019-06-17T21:13:59Z")

</div>

Thanks, Patrick!

I have been reading Casey, E., Barnum, S., Griffith, R., Snyder, J., van Beek, H., & Nelson, A. (2017). _Advancing coordinated cyber-investigations and tool interoperability using a community developed specification language. Digital Investigation, 22, 14–45._ doi:10.1016/j.diin.2017.08.002 and it seems like a very carefully organised effort.

@jamsden, @jad, we should definitely look into that, both from the viewpoint of suggesting that community to create an OSLC domain spec but also taking their use-case needs into account in OSLC Core. Given how far they have come, it could be a rather rewarding effort.

---

<div class="post-metadata">

**Author:** ![packet-rat](https://forum.open-services.net/user_avatar/forum.open-services.net/packet-rat/32/53_2.png) [@packet-rat](https://forum.open-services.net/u/packet-rat)\
**Post date:** [June 17, 2019, 9:26pm UTC](https://forum.open-services.net/t/cyber-threat-intelligence-ontologies/246/5 "2019-06-17T21:26:07Z")

</div>

\<\<\<Sorry – here’s the original post that got lost in the startup process\>\>\>

**UCO/CASE**

The UCO (Unified Cyber Ontology) has active engagement with many of the thought leaders in our decade long efforts to define effective Cyber Domain inter-exchange languages/processes:

[Unified Cyber Ontology](https://github.com/ucoProject/UCO)

[Cyber-Investigation Analysis Standard Expression (CASE)](https://github.com/casework/CASE)

[Threat and Risk Community](http://threatrisk.org/drupal/)

We also have a core group seeking to create high level conceptual models for Threat and Risk in both Cyber and Physical Security Domains. There is a sizable body of work but efforts within the OMG stalled primarily due to a lack of funding and active engagement on developing reference implementations.

Git site is here:

[GitHub](https://github.com/ModelDriven/ConceptLibraries/)

### [ModelDriven/ConceptLibraries](https://github.com/ModelDriven/ConceptLibraries/)

A library of concepts for integration, federation, analytics and reuse - ModelDriven/ConceptLibraries

Note has links to web versions

MDZip files here:

[GitHub](https://github.com/ModelDriven/ConceptLibraries/tree/master/Libraries/FederatedConceptLibrary/SourceModels)

### [ModelDriven/ConceptLibraries](https://github.com/ModelDriven/ConceptLibraries/tree/master/Libraries/FederatedConceptLibrary/SourceModels)

A library of concepts for integration, federation, analytics and reuse - ModelDriven/ConceptLibraries

Additional doc and presentations specific to threat/risk are here:

[GitHub](https://github.com/ModelDriven/ThreatRisk)

### [ModelDriven/ThreatRisk](https://github.com/ModelDriven/ThreatRisk)

The threat-risk archive provides for public access to and comment on the canidate OMG standard for threats and risks - ModelDriven/ThreatRisk