Untitled.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 208,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2022-01-30T17:44:52.442355Z",
     "start_time": "2022-01-30T17:44:52.438432Z"
    }
   },
   "outputs": [],
   "source": [
    "# Imports\n",
    "import json\n",
    "from pprint import pprint\n",
    "from collections import OrderedDict, defaultdict\n",
    "from rdflib import Graph, Namespace\n",
    "from rdflib.term import Literal, URIRef#, _castPythonToLiteral\n",
    "from rdflib.namespace import RDF, RDFS, OWL, XSD\n",
    "import uuid\n",
    "from urllib.parse import quote, unquote\n",
    "import logging\n",
    "import re"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 280,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2022-01-30T19:12:57.192890Z",
     "start_time": "2022-01-30T19:12:57.189885Z"
    }
   },
   "outputs": [],
   "source": [
    "### Constants\n",
    "incident_dir = \"/Users/v685573/Documents/Development/VCDB/data/json/validated/\"\n",
    "schema_filename = \"/Users/v685573/Documents/Development/vzrisk/flow/verisc-owl.json\"\n",
    "attack_flow_namespace = \"https://vz-risk.github.io/flow/attack-flow#\"\n",
    "veris_namespace = \"https://veriscommunity.net/attack-flow#\"\n",
    "\n",
    "incident_filenames = [\"61E18813-E1B8-424E-BD4A-BA4D665A4A6F.json\", # no event chain\n",
    "\"9a244892-42ca-45ff-9307-4ac6aced0c4d.json\", # 1 step\n",
    "\"f247f550-6f38-46f4-9a32-a45cf89d47e3.json\", # duplicate steps\n",
    "\"13247e27-dc13-4c6b-bcac-c0973cba2c50.json\", # duplicate but only 1 asset\n",
    "\"bf7a414b-2d56-4709-8d2d-911af426664e.json\"  # no duplicates\n",
    "]\n",
    "\n",
    "\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 397,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2022-01-30T21:34:06.253793Z",
     "start_time": "2022-01-30T21:34:06.224359Z"
    }
   },
   "outputs": [],
   "source": [
    "### Functions\n",
    "def recurse_instances(d, lbl, owl=owl, exclusions=[]):\n",
    "    \n",
    "    for k, v in d.items():\n",
    "#        if len(lbl) > 0 and lbl[0] == \"asset\":\n",
    "#            print(\"label: {0}, key: {1}, value: {2}\".format(lbl, k, v))\n",
    "        try:\n",
    "            if type(v) in [OrderedDict, dict]:\n",
    "                #keys = keys.union(recurse_keys(v, (lbl + (k,)), keys))\n",
    "                recurse_instances(v, (lbl + (k,)), owl, exclusions=exclusions)\n",
    "            elif type(v) is list: \n",
    "                for item in v:\n",
    "                    if type(item) == dict:\n",
    "                        #print(\"label: {0}, key: {1}, item: {2}\".format(lbl, k, item))\n",
    "                        recurse_instances(item, (lbl + (k,)), owl, exclusions=exclusions)\n",
    "                    elif k == \"variety\":\n",
    "                        # convert it to a class instance of the parent class\n",
    "                        # add it to the incident\n",
    "                        enum_iterator[\".\".join(lbl + (k, item))] += 1 # `lbl + (k, item)` used to be `item`\n",
    "                        instance_name = quote(item + \"_\" + str(enum_iterator[\".\".join(lbl + (k, item))])) # `\".\".join(lbl + (k, item))` used to be `item`\n",
    "                        \n",
    "                        # define instance as an instance and an instance of something\n",
    "                        owl.add((i_ns[instance_name], RDF.type, OWL.NamedIndividual))\n",
    "                        owl.add((i_ns[instance_name], RDF.type, anchor_map.get(\".\".join(lbl), veris_ns[quote(\".\".join(lbl + (k,item)))])))\n",
    "                        \n",
    "                        # Connect instance to flow\n",
    "                        owl.add((i_ns[instance_name], af_ns['flow'], flowURI))\n",
    "\n",
    "                        # if action:\n",
    "                        if lbl[0] == \"action\":\n",
    "                            # (type) = 'action'\n",
    "                            # name = instance_name\n",
    "                            # description\n",
    "                            owl.add((i_ns[instance_name], af_ns[\"description.action\"], Literal(incident[\"action\"][lbl[1]].get(\"notes\", \"no decription\"))))\n",
    "                            # logic_operator = \"\"\n",
    "                            owl.add((i_ns[instance_name], af_ns['logic_operator'], Literal(\"OR\")))\n",
    "            elif k == \"variety\":\n",
    "                # convert it to a class instance of the parent class\n",
    "                # add it to the incident\n",
    "                instance_name = re.sub(\"[^0-9a-zA-Z_.\\-~]+\", \"_\", \".\".join(lbl + (k, v))) # '\".\".join(lbl + (k, v))' used to be `v`\n",
    "                if lbl[0] == \"asset\" and v not in [\"Unknown\", \"Other\"]:\n",
    "                    instance_name = instance_name[4:]\n",
    "                enum_iterator[instance_name] += 1\n",
    "                instance_name = quote(instance_name + \"_\" + str(enum_iterator[instance_name]))\n",
    "\n",
    "                # define instance as an instance and an instance of something\n",
    "                owl.add((i_ns[instance_name], RDF.type, OWL.NamedIndividual))\n",
    "                owl.add((i_ns[instance_name], RDF.type, anchor_map.get(\".\".join(lbl), veris_ns[quote(\".\".join(lbl + (k,v)))])))\n",
    "\n",
    "                # Connect instance to flow\n",
    "                owl.add((i_ns[instance_name], af_ns['flow'], flowURI))\n",
    "        except:\n",
    "            print(\"label: {0}, key: {1}, value: {2}\".format(lbl, k, v))\n",
    "            raise\n",
    "                      \n",
    "    return owl\n",
    "                        \n",
    "                        \n",
    "def recurse_properties(d, lbl, owl, exclusions=[]):\n",
    "    for k, v in d.items():\n",
    "        try:\n",
    "            if type(v) in [OrderedDict, dict]:\n",
    "                owl = recurse_properties(v, (lbl + (k,)), owl, exclusions=exclusions)\n",
    "                \n",
    "            elif k == \"variety\":\n",
    "                pass # varieties are all instances and should already be handled\n",
    "            \n",
    "            elif (type(v) is list):\n",
    "                for item in v:\n",
    "                    if type(item) == dict:\n",
    "                        recurse_properties(item, (lbl + (k,)), owl, exclusions=exclusions)\n",
    "                    else:\n",
    "                        # define it's flow\n",
    "                        owl.add((veris_ns[quote(\".\".join(lbl + (k, item)))], af_ns['flow'], flowURI))\n",
    "                        \n",
    "                        # if we know what instance it goes to, connect it.\n",
    "                        if str(veris_ns[quote(\".\".join(lbl))]) in instances.keys() and len(instances[str(veris_ns[quote(\".\".join(lbl))])]) == 1:\n",
    "                            owl.add((instances[str(veris_ns[quote(\".\".join(lbl))])][0], veris_ns[quote(\".\".join(lbl + (k, )))], veris_ns[quote(\".\".join(lbl + (k, item)))]))\n",
    "            elif (\".\".join((lbl + (k,str(v)))) in exclusions):\n",
    "                pass\n",
    "            \n",
    "            else:\n",
    "                if quote(\".\".join(lbl + (k,))) in obj_props:\n",
    "                    if str(veris_ns[quote(\".\".join(lbl))]) in instances.keys() and len(instances[str(veris_ns[quote(\".\".join(lbl))])]) == 1:\n",
    "                        owl.add((instances[str(veris_ns[quote(\".\".join(lbl))])][0], veris_ns[quote(\".\".join(lbl + (k, )))], veris_ns[quote(\".\".join(lbl + (k, v)))]))\n",
    "                    else:\n",
    "                        owl.add((veris_ns[quote(\".\".join(lbl[:-1]))], af_ns['flow'], flowURI))\n",
    "                        owl.add((veris_ns[quote(\".\".join(lbl[:-1]))], veris_ns[quote(\".\".join(lbl + (k, )))], veris_ns[quote(\".\".join(lbl + (k, v)))]))\n",
    "                elif quote(\".\".join(lbl + (k,))) in data_props:\n",
    "                    if str(veris_ns[quote(\".\".join(lbl))]) in instances.keys() and len(instances[str(veris_ns[quote(\".\".join(lbl))])]) == 1:\n",
    "                        owl.add((instances[str(veris_ns[quote(\".\".join(lbl))])][0], veris_ns[quote(\".\".join(lbl + (k, )))], Literal(v)))\n",
    "                    else:\n",
    "                        owl.add((veris_ns[quote(\".\".join(lbl))], af_ns['flow'], flowURI))\n",
    "                        owl.add((veris_ns[quote(\".\".join(lbl))], veris_ns[quote(\".\".join(lbl + (k, )))], Literal(v)))\n",
    "                else:\n",
    "                    logging.warning(\"{0} is not in the object property or datatype property lists.\".format(\".\".join(lbl + (k,))))\n",
    "                              \n",
    "        except:\n",
    "            print(\"label: {0}, key: {1}, value: {2}\".format(lbl, k, v))\n",
    "            raise\n",
    "               \n",
    "    return owl\n",
    "                              \n",
    "                              "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 398,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2022-01-30T21:34:10.944000Z",
     "start_time": "2022-01-30T21:34:10.923779Z"
    }
   },
   "outputs": [],
   "source": [
    "def guess_temporal_relationships(incident, owl):\n",
    "    ### Ok, there's going to be a _lot_ going on here...\n",
    "    \n",
    "    ### Event chain uses wierd stuff so we'll need to look it up to convert it to what's used \n",
    "    #    in the main schema (and hense the graph)\n",
    "    event_chain_lookup = {\n",
    "        \"ext\": \"external\", \"int\": \"internal\", \"prt\": \"partner\", \"unk\": \"Unknown\",\n",
    "        \"env\": \"environmental\", \"err\": \"Error\", \"hak\": \"hacking\", \"soc\": \"Social\", \n",
    "        \"mal\": \"malware\", \"mis\": \"misuse\", \"phy\": \"Physical\",\n",
    "        \"au\": \"availability\", \"cp\": \"confidentiality\", \"ia\": \"integrity\",\n",
    "        \"emb\": \"E\", \"med\": \"M\", \"net\": \"N\", \"ppl\": \"P\", \"srv\": \"S\", \"ter\": \"T\", \"usr\": \"U\"\n",
    "    }\n",
    "    \n",
    "    \n",
    "    # We also need to collect all the named individuals for multiple reasons\n",
    "    query = (\"\"\"SELECT DISTINCT  ?inst ?thing\n",
    "    WHERE { \n",
    "      ?inst rdf:type owl:NamedIndividual .\n",
    "      ?inst rdf:type ?thing .\n",
    "       FILTER (?thing != owl:NamedIndividual)\n",
    "    }\"\"\")\n",
    "    qres = oincident.query(query)\n",
    "    res = list(qres)\n",
    "    \n",
    "    # NOTE: these are the instances.  They don't tel you what type of action they are.\n",
    "    # This is mostly useful if there's just 1 action and asset\n",
    "    actions = [item[0] for item in res if item[1].split(\"#\")[1].startswith(\"action\")]\n",
    "    assets = [item[0] for item in res if item[1].split(\"#\")[1].startswith(\"asset\")]\n",
    "    attributes = [item[0] for item in res if item[1].split(\"#\")[1].startswith(\"attribute\")]\n",
    "\n",
    "    # So we'll start with the event chain\n",
    "    # Just because it has an event chaind oesn't mean we'll which go in what order...\n",
    "    if \"event_chain\" in incident['plus']:\n",
    "        # first we're going to need to count the number of time each type of actin/asset/attribute occurs\n",
    "        # this is important because if we have multiple occurrences of any of these things it'll be hard\n",
    "        # to tell what step they go with.\n",
    "        occurrence_counts = {\n",
    "#            \"incident\": {\n",
    "#                \"action\": defaultdict(int),\n",
    "#                \"asset\": defaultdict(int),\n",
    "#                \"attribute\": defaultdict(int)\n",
    "#            },\n",
    "            \"oincident\": {\n",
    "                \"action\": defaultdict(list),\n",
    "                \"asset\": defaultdict(list),\n",
    "                \"attribute\": defaultdict(list)\n",
    "            }\n",
    "        }\n",
    "        for action in [(item[0], item[1].split(\"#\")[1]) for item in res if item[1].split(\"#\")[1].startswith(\"action\")]:\n",
    "            occurrence_counts['oincident']['action'][action[1].split(\".\")[1]].append(action[0])\n",
    "        for asset in [(item[0], item[1].split(\"#\")[1]) for item in res if item[1].split(\"#\")[1].startswith(\"asset\")]:\n",
    "            occurrence_counts['oincident']['asset'][asset[1].split(\".\")[3].split(\"%20-%20\")[0]].append(asset[0])\n",
    "        for attribute in [(item[0], item[1].split(\"#\")[1]) for item in res if item[1].split(\"#\")[1].startswith(\"attribute\")]:\n",
    "            occurrence_counts['oincident']['attribute'][attribute[1].split(\".\")[1]].append(attribute[0])\n",
    "#        for step in incident['plus']['event_chain']:\n",
    "#            occurrence_counts['incident']['action'][step.get(\"action\", \"Unknown\")] += 1\n",
    "#            occurrence_counts['incident']['asset'][step.get(\"asset\", \"Unknown\")] += 1\n",
    "#            occurrence_counts['incident']['attribute'][step.get(\"attribute\", \"Unknown\")] += 1\n",
    "            \n",
    "        #print(occurrence_counts)\n",
    "\n",
    "### Block below using it seems unneeded\n",
    "#        # One way we can parse is, even if something like an asset occurs multiple places in the \n",
    "#        # event chain, if there's only 1 instance of an asset, we know that asset goes to each\n",
    "#        # both locations in the chain.\n",
    "#        dup_but_can_parse = True\n",
    "#        for a in ['action', 'asset', 'attribute']:\n",
    "#            for k,v in occurrence_counts['incident'][a].items():\n",
    "#                if v > 1 and len(occurrence_counts['oincident'][a][event_chain_lookup[k]]) > 1:\n",
    "#                    dup_but_can_parse = False\n",
    "\n",
    "        \n",
    "        # first we'll check if there's just 1 step.  If there's just one step we know everything goes to that step.\n",
    "        ### NOTE: I think this is duplicative with below\n",
    "        #if len(incident['plus']['event_chain']) == 1 and len(actions) == 1 and len(assets) == 1:\n",
    "        #    print(\"can parse because only 1 step\")\n",
    "        \n",
    "\n",
    "        # If there's more steps, but each action/asset/attribute only occur once in it, we can map instances to it\n",
    "        if (#all([v <= 1 for k,v in occurrence_counts['incident']['action'].items()]) and \n",
    "            #  all([v <= 1 for k,v in occurrence_counts['incident']['asset'].items()]) and\n",
    "            #  all([v <= 1 for k,v in occurrence_counts['incident']['attribute'].items()]) and \n",
    "              all([len(v) <= 1 for k,v in occurrence_counts['oincident']['action'].items()]) and \n",
    "              all([len(v) <= 1 for k,v in occurrence_counts['oincident']['asset'].items()]) and \n",
    "              all([len(v) <= 1 for k,v in occurrence_counts['oincident']['attribute'].items()])):\n",
    "            logging.info(\"can parse because each item only occurs once.\")\n",
    "            old_asset = None\n",
    "            for step in incident['plus']['event_chain']:\n",
    "                attribute = occurrence_counts['oincident']['attribute'].get(event_chain_lookup[step.get('attribute', \"unk\")], veris_ns + \"attribute.unknown\")\n",
    "                action = occurrence_counts['oincident']['action'].get(event_chain_lookup[step.get('action', \"unk\")], None)\n",
    "                asset = occurrence_counts['oincident']['asset'].get(event_chain_lookup[step.get('asset', \"unk\")], None)\n",
    "                if all([action, asset]):\n",
    "                    owl.add((URIRef(attribute), RDFS.subPropertyOf, af_ns['state_change']))\n",
    "                    owl.add((URIRef(action), URIRef(attribute), URIRef(asset)))\n",
    "                if old_asset:\n",
    "                    owl.add((URIRef(old_asset), veris_ns[\"attribute.unknown\"], URIRef(action)))\n",
    "                old_asset = asset\n",
    "                \n",
    "\n",
    "### I think below is equivalent to the above block with the 3 lines commented out so unneeded\n",
    "#        # as noted above, if we have duplicates, we can still map to it as noted above\n",
    "#        elif dup_but_can_parse:\n",
    "#            for step in event_chain\n",
    "#            print(\"can parse because even though duplicate items, they link to only one instance\")\n",
    "\n",
    "    \n",
    "    # if only one action & asset, you can assume the sequence\n",
    "    elif len(assets) == 1 and len(actions) == 1:\n",
    "        logging.info(\"Can parse single action/asset.\")\n",
    "        for attribute in attributes:\n",
    "            owl.add((URIRef(attribute), RDFS.subPropertyOf, af_ns['state_change']))\n",
    "            owl.add((URIRef(actions[0]), URIRef(attribute), URIRef(assets[0])))\n",
    "            \n",
    "    else:\n",
    "        #print(\"No available logic to sequence actions and assets.\")\n",
    "        logging.warning(\"No available logic to sequence actions and assets.\")\n",
    "    \n",
    "    return(owl)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 399,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2022-01-30T21:34:11.450360Z",
     "start_time": "2022-01-30T21:34:11.434447Z"
    }
   },
   "outputs": [],
   "source": [
    "def incident_to_owl(incident):\n",
    "    global obj_props, data_props, enum_iterator, anchor_map, flowURI, instances, asset_map\n",
    "    \n",
    "    exclusions = [\"incident_id\", \"plus.master_id\", \"plus.created\", \"plus.analyst\", \"summary\"]\n",
    "    incident_filename = \"/Users/v685573/Documents/Development/VCDB/data/json/validated/61E18813-E1B8-424E-BD4A-BA4D665A4A6F.json\"\n",
    "    schema_filename = \"/Users/v685573/Documents/Development/vzrisk/flow/verisc-owl.jsonLD\"\n",
    "    attack_flow_namespace = \"https://vz-risk.github.io/flow/attack-flow#\"\n",
    "    veris_namespace = \"https://veriscommunity.net/attack-flow#\"\n",
    "    \n",
    "    # create namespace from victim_id\n",
    "    i_ns = incident['victim'].get('victim_id', uuid.uuid4()).lower()\n",
    "    i_ns = re.sub(\"[^0-9a-zA-Z_.\\-~]+\", \"_\", i_ns)\n",
    "    i_ns = Namespace(\"urn:absolute:\" + quote(i_ns) + \"#\")\n",
    "    af_ns = Namespace(attack_flow_namespace)\n",
    "    veris_ns = Namespace(veris_namespace)\n",
    "    \n",
    "    # open veris schema\n",
    "    veris = Graph()\n",
    "    veris.parse(schema_filename)\n",
    "    # Get object and data properties so we know which are which when parsing them out of the incident\n",
    "    query = (\"\"\"SELECT DISTINCT  ?p \n",
    "    WHERE { \n",
    "      ?p rdf:type owl:ObjectProperty .\n",
    "    }\"\"\")\n",
    "    qres = veris.query(query)\n",
    "    obj_props = list(qres)\n",
    "    obj_props = [item[0].split(\"#\")[1] for item in obj_props]\n",
    "    query = (\"\"\"SELECT DISTINCT  ?p \n",
    "    WHERE { \n",
    "      ?p rdf:type owl:DatatypeProperty .\n",
    "    }\"\"\")\n",
    "    qres = veris.query(query)\n",
    "    data_props = list(qres)\n",
    "    data_props = [item[0].split(\"#\")[1] for item in data_props]   \n",
    "    # all we needed were the property lists\n",
    "    del(veris)\n",
    "    \n",
    "    # to number instances\n",
    "    enum_iterator = defaultdict(int)\n",
    "\n",
    "    # to map from veris_ns to attack flow ns\n",
    "    anchor_map = {\n",
    "        \"action\": af_ns[\"action\"],\n",
    "        \"asset\": af_ns[\"asset\"],\n",
    "        \"extra\": af_ns[\"property\"]\n",
    "    }\n",
    "    \n",
    "    # start the incident's graph\n",
    "    owl = Graph()\n",
    "    \n",
    "    ### create any manditory fields in AF\n",
    "    # Create flow instance, flow id\n",
    "    flowURI = i_ns[incident['plus']['master_id']] # to object\n",
    "    owl.add((flowURI, RDF.type, OWL.NamedIndividual))\n",
    "    owl.add((flowURI, RDF.type, af_ns['attack-flow']))\n",
    "    # flow name literal\n",
    "    owl.add((flowURI, af_ns['name.attack-flow'], Literal(incident['incident_id'])))\n",
    "    # flow created literal\n",
    "    owl.add((flowURI, af_ns['created'], Literal(incident['plus'].get(\"created\", \"1970-01-01T01:00:00Z\"))))\n",
    "    # flow author literal\n",
    "    owl.add((flowURI, af_ns['author'], Literal(incident['plus'].get(\"analyst\", \"Unknown\"))))\n",
    "    # flow description literal\n",
    "    owl.add((flowURI, af_ns['description.attack-flow'], Literal(incident['summary'])))\n",
    "    \n",
    "    recurse_instances(incident, (), owl, exclusions=exclusions)\n",
    "    \n",
    "    query = (\"\"\"SELECT DISTINCT  ?inst ?thing\n",
    "    WHERE { \n",
    "      ?inst rdf:type owl:NamedIndividual .\n",
    "      ?inst rdf:type ?thing .\n",
    "       FILTER (?thing != owl:NamedIndividual)\n",
    "    }\"\"\")\n",
    "    qres = oincident.query(query)\n",
    "    instances = defaultdict(set)\n",
    "    for inst,thing in qres:\n",
    "        instances[str(thing)].add(str(inst))\n",
    "    instances = {\".\".join(k.split(\".\")[:2]):list(v) for k,v in instances.items()}\n",
    "    \n",
    "    recurse_properties(incident, (), owl, exclusions=exclusions)    \n",
    "    \n",
    "    # Determine causal linkages between actions if possible (use value.chain and or single-action)\n",
    "    owl.add((veris_ns[\"attribute.unknown\"], RDFS.subPropertyOf, af_ns['state_change']))\n",
    "    owl = guess_temporal_relationships(incident, owl)\n",
    "    \n",
    "    return(owl)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 400,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2022-01-30T21:34:12.029352Z",
     "start_time": "2022-01-30T21:34:12.025500Z"
    }
   },
   "outputs": [],
   "source": [
    "with open(incident_dir + incident_filenames[2], 'r') as filehandle:\n",
    "    incident = json.load(filehandle)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 405,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2022-01-30T21:34:42.028216Z",
     "start_time": "2022-01-30T21:34:41.730550Z"
    }
   },
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "WARNING:root:plus.analysis_status is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.analyst is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.created is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.dbir_year is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.event_chain.action is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.event_chain.actor is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.event_chain.asset is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.event_chain.attribute is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.event_chain.summary is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.event_chain.action is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.event_chain.actor is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.event_chain.asset is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.event_chain.attribute is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.event_chain.summary is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.event_chain.action is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.event_chain.actor is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.event_chain.asset is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.event_chain.attribute is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.event_chain.summary is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.event_chain.action is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.event_chain.actor is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.event_chain.asset is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.event_chain.attribute is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.event_chain.summary is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.github is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.modified is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.sub_source is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.timeline.notification.day is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.timeline.notification.month is not in the object property or datatype property lists.\n",
      "WARNING:root:plus.timeline.notification.year is not in the object property or datatype property lists.\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "{'oincident': {'action': defaultdict(<class 'list'>, {'malware': [rdflib.term.URIRef('urn:absolute:mass%20event#Ransomware_1')]}), 'asset': defaultdict(<class 'list'>, {'S': [rdflib.term.URIRef('urn:absolute:mass%20event#t.assets.variety.S_-_Unknown_1')]}), 'attribute': defaultdict(<class 'list'>, {'availability': [rdflib.term.URIRef('urn:absolute:mass%20event#Obscuration_1')], 'confidentiality': [rdflib.term.URIRef('urn:absolute:mass%20event#attribute.confidentiality.data.variety.Personal_1')], 'integrity': [rdflib.term.URIRef('urn:absolute:mass%20event#Software%20installation_1')]})}}\n"
     ]
    }
   ],
   "source": [
    "oincident = incident_to_owl(incident)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 402,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2022-01-30T21:34:24.516110Z",
     "start_time": "2022-01-30T21:34:24.509985Z"
    }
   },
   "outputs": [],
   "source": [
    "with open(\"/Users/v685573/Documents/Development/vzrisk/flow/61E18813-E1B8-424E-BD4A-BA4D665A4A6F.owl\", 'w') as filehandle:\n",
    "    filehandle.write(oincident.serialize(format=\"xml\"))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2022-01-29T18:08:07.622414Z",
     "start_time": "2022-01-29T18:08:07.338407Z"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "<Graph identifier=N745bdef112eb4a909071cbf235a1de1d (<class 'rdflib.graph.Graph'>)>"
      ]
     },
     "execution_count": 24,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "schema = Graph()\n",
    "schema.parse(schema_filename)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 382,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2022-01-30T21:21:06.751081Z",
     "start_time": "2022-01-30T21:21:06.744495Z"
    },
    "scrolled": true
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "{'action': {'malware': {'variety': ['Ransomware'], 'vector': ['Unknown']}},\n",
       " 'actor': {'external': {'country': ['Unknown'],\n",
       "   'motive': ['Financial'],\n",
       "   'region': ['000000'],\n",
       "   'variety': ['Organized crime']}},\n",
       " 'asset': {'assets': [{'variety': 'S - Unknown'}],\n",
       "  'cloud': ['Unknown'],\n",
       "  'role': ['IT']},\n",
       " 'attribute': {'availability': {'variety': ['Obscuration']},\n",
       "  'confidentiality': {'data': [{'variety': 'Personal'}],\n",
       "   'data_disclosure': 'Potentially',\n",
       "   'data_victim': ['Patient'],\n",
       "   'state': ['Stored']},\n",
       "  'integrity': {'variety': ['Software installation']}},\n",
       " 'confidence': 'High',\n",
       " 'discovery_method': {'external': {'variety': ['Actor disclosure']}},\n",
       " 'incident_id': '75fb88f0-f6af-11ea-b6fa-6deaa5aa80b0',\n",
       " 'plus': {'analysis_status': 'Reviewed',\n",
       "  'analyst': 'planglois',\n",
       "  'created': '2020-09-14T21:47:28.210Z',\n",
       "  'dbir_year': 2021,\n",
       "  'event_chain': [{'action': 'unk',\n",
       "    'actor': 'ext',\n",
       "    'asset': 'srv',\n",
       "    'attribute': 'ia',\n",
       "    'summary': 'Somehow bad guys accessed system'},\n",
       "   {'action': 'mal',\n",
       "    'actor': 'ext',\n",
       "    'asset': 'srv',\n",
       "    'attribute': 'ia',\n",
       "    'summary': 'Ransomware installed'},\n",
       "   {'action': 'mal',\n",
       "    'actor': 'ext',\n",
       "    'asset': 'srv',\n",
       "    'attribute': 'cp',\n",
       "    'summary': 'Data at risk of breach'},\n",
       "   {'action': 'mal',\n",
       "    'actor': 'ext',\n",
       "    'asset': 'srv',\n",
       "    'attribute': 'au',\n",
       "    'summary': 'Ransomware encrypts data'}],\n",
       "  'github': '16162',\n",
       "  'master_id': 'f247f550-6f38-46f4-9a32-a45cf89d47e3',\n",
       "  'modified': '2020-09-14T21:47:28.210Z',\n",
       "  'sub_source': 'phidbr',\n",
       "  'timeline': {'notification': {'day': 25, 'month': 8, 'year': 2020}}},\n",
       " 'reference': 'https://www.keremeosreview.com/news/north-okanagan-pediatric-clinic-hacked/',\n",
       " 'schema_version': '1.3.6',\n",
       " 'security_incident': 'Confirmed',\n",
       " 'source_id': 'vcdb',\n",
       " 'summary': 'Canadian Pediatric clinic hacked with ransomware',\n",
       " 'targeted': 'Unknown',\n",
       " 'timeline': {'incident': {'month': 6, 'year': 2020}},\n",
       " 'value_chain': {'cash-out': {'notes': 'VERIS 1.3.6: value_chain.development.variety.Cryptocurrency added because action.malware.variety.Ransomware exists.',\n",
       "   'variety': ['Cryptocurrency']}},\n",
       " 'victim': {'country': ['CA'],\n",
       "  'employee_count': 'Small',\n",
       "  'government': ['NA'],\n",
       "  'industry': '624110',\n",
       "  'locations_affected': 1,\n",
       "  'region': ['019021'],\n",
       "  'state': 'BC',\n",
       "  'victim_id': 'North Okanagan Pediatric Clinic'}}"
      ]
     },
     "execution_count": 382,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "incident"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 395,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2022-01-30T21:29:00.421033Z",
     "start_time": "2022-01-30T21:29:00.417608Z"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "defaultdict(int,\n",
       "            {'Ransomware': 1,\n",
       "             'Organized crime': 1,\n",
       "             'Unknown': 1,\n",
       "             'Obscuration': 1,\n",
       "             'Personal': 1,\n",
       "             'Software installation': 1,\n",
       "             'Actor disclosure': 1,\n",
       "             'Cryptocurrency': 1})"
      ]
     },
     "execution_count": 395,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "enum_iterator"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 383,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2022-01-30T21:22:19.367688Z",
     "start_time": "2022-01-30T21:22:19.358213Z"
    },
    "scrolled": true
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[\n",
      "  {\n",
      "    \"@id\": \"https://veriscommunity.net/attack-flow#\",\n",
      "    \"https://veriscommunity.net/attack-flow#confidence\": [\n",
      "      {\n",
      "        \"@id\": \"https://veriscommunity.net/attack-flow#confidence.High\"\n",
      "      }\n",
      "    ],\n",
      "    \"https://veriscommunity.net/attack-flow#incident_id\": [\n",
      "      {\n",
      "        \"@value\": \"75fb88f0-f6af-11ea-b6fa-6deaa5aa80b0\"\n",
      "      }\n",
      "    ],\n",
      "    \"https://veriscommunity.net/attack-flow#reference\": [\n",
      "      {\n",
      "        \"@value\": \"https://www.keremeosreview.com/news/north-okanagan-pediatric-clinic-hacked/\"\n",
      "      }\n",
      "    ],\n",
      "    \"https://veriscommunity.net/attack-flow#schema_version\": [\n",
      "      {\n",
      "        \"@value\": \"1.3.6\"\n",
      "      }\n",
      "    ],\n",
      "    \"https://veriscommunity.net/attack-flow#security_incident\": [\n",
      "      {\n",
      "        \"@id\": \"https://veriscommunity.net/attack-flow#security_incident.Confirmed\"\n",
      "      }\n",
      "    ],\n",
      "    \"https://veriscommunity.net/attack-flow#source_id\": [\n",
      "      {\n",
      "        \"@value\": \"vcdb\"\n",
      "      }\n",
      "    ],\n",
      "    \"https://veriscommunity.net/attack-flow#summary\": [\n",
      "      {\n",
      "        \"@value\": \"Canadian Pediatric clinic hacked with ransomware\"\n",
      "      }\n",
      "    ],\n",
      "    \"https://veriscommunity.net/attack-flow#targeted\": [\n",
      "      {\n",
      "        \"@id\": \"https://veriscommunity.net/attack-flow#targeted.Unknown\"\n",
      "      }\n",
      "    ],\n",
      "    \"https://veriscommunity.net/attack-flow#victim.employee_count\": [\n",
      "      {\n",
      "        \"@id\": \"https://veriscommunity.net/attack-flow#victim.employee_count.Small\"\n",
      "      }\n",
      "    ],\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#flow\": [\n",
      "      {\n",
      "        \"@id\": \"urn:absolute:north_okanagan_pediatric_clinic#f247f550-6f38-46f4-9a32-a45cf89d47e3\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"https://veriscommunity.net/attack-flow#victim\",\n",
      "    \"https://veriscommunity.net/attack-flow#victim.industry\": [\n",
      "      {\n",
      "        \"@value\": \"624110\"\n",
      "      }\n",
      "    ],\n",
      "    \"https://veriscommunity.net/attack-flow#victim.locations_affected\": [\n",
      "      {\n",
      "        \"@value\": 1\n",
      "      }\n",
      "    ],\n",
      "    \"https://veriscommunity.net/attack-flow#victim.state\": [\n",
      "      {\n",
      "        \"@value\": \"BC\"\n",
      "      }\n",
      "    ],\n",
      "    \"https://veriscommunity.net/attack-flow#victim.victim_id\": [\n",
      "      {\n",
      "        \"@value\": \"North Okanagan Pediatric Clinic\"\n",
      "      }\n",
      "    ],\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#flow\": [\n",
      "      {\n",
      "        \"@id\": \"urn:absolute:north_okanagan_pediatric_clinic#f247f550-6f38-46f4-9a32-a45cf89d47e3\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"https://veriscommunity.net/attack-flow#actor.external.motive.Financial\",\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#flow\": [\n",
      "      {\n",
      "        \"@id\": \"urn:absolute:north_okanagan_pediatric_clinic#f247f550-6f38-46f4-9a32-a45cf89d47e3\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"urn:absolute:mass%20event#Software%20installation_1\",\n",
      "    \"@type\": [\n",
      "      \"http://www.w3.org/2002/07/owl#NamedIndividual\",\n",
      "      \"https://veriscommunity.net/attack-flow#attribute.integrity.variety.Software%20installation\"\n",
      "    ],\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#flow\": [\n",
      "      {\n",
      "        \"@id\": \"urn:absolute:north_okanagan_pediatric_clinic#f247f550-6f38-46f4-9a32-a45cf89d47e3\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"https://veriscommunity.net/attack-flow#value_chain.cash-out\",\n",
      "    \"https://veriscommunity.net/attack-flow#value_chain.cash-out.notes\": [\n",
      "      {\n",
      "        \"@value\": \"VERIS 1.3.6: value_chain.development.variety.Cryptocurrency added because action.malware.variety.Ransomware exists.\"\n",
      "      }\n",
      "    ],\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#flow\": [\n",
      "      {\n",
      "        \"@id\": \"urn:absolute:north_okanagan_pediatric_clinic#f247f550-6f38-46f4-9a32-a45cf89d47e3\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"https://veriscommunity.net/attack-flow#asset.cloud.Unknown\",\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#flow\": [\n",
      "      {\n",
      "        \"@id\": \"urn:absolute:north_okanagan_pediatric_clinic#f247f550-6f38-46f4-9a32-a45cf89d47e3\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"https://veriscommunity.net/attack-flow#attribute.confidentiality.state.Stored\",\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#flow\": [\n",
      "      {\n",
      "        \"@id\": \"urn:absolute:north_okanagan_pediatric_clinic#f247f550-6f38-46f4-9a32-a45cf89d47e3\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"https://veriscommunity.net/attack-flow#attribute.confidentiality.data_victim.Patient\",\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#flow\": [\n",
      "      {\n",
      "        \"@id\": \"urn:absolute:north_okanagan_pediatric_clinic#f247f550-6f38-46f4-9a32-a45cf89d47e3\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"[rdflib.term.URIRef('urn:absolute:mass%20event#Ransomware_1')]\",\n",
      "    \"[rdflib.term.URIRef('urn:absolute:mass%20event#Obscuration_1')]\": [\n",
      "      {\n",
      "        \"@id\": \"[rdflib.term.URIRef('urn:absolute:mass%20event#Unknown_1')]\"\n",
      "      }\n",
      "    ],\n",
      "    \"[rdflib.term.URIRef('urn:absolute:mass%20event#Personal_1')]\": [\n",
      "      {\n",
      "        \"@id\": \"[rdflib.term.URIRef('urn:absolute:mass%20event#Unknown_1')]\"\n",
      "      }\n",
      "    ],\n",
      "    \"[rdflib.term.URIRef('urn:absolute:mass%20event#Software%20installation_1')]\": [\n",
      "      {\n",
      "        \"@id\": \"[rdflib.term.URIRef('urn:absolute:mass%20event#Unknown_1')]\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"https://veriscommunity.net/attack-flow#action.malware.vector.Unknown\",\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#flow\": [\n",
      "      {\n",
      "        \"@id\": \"urn:absolute:north_okanagan_pediatric_clinic#f247f550-6f38-46f4-9a32-a45cf89d47e3\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"https://veriscommunity.net/attack-flow#victim.government.NA\",\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#flow\": [\n",
      "      {\n",
      "        \"@id\": \"urn:absolute:north_okanagan_pediatric_clinic#f247f550-6f38-46f4-9a32-a45cf89d47e3\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"[rdflib.term.URIRef('urn:absolute:mass%20event#Personal_1')]\",\n",
      "    \"http://www.w3.org/2000/01/rdf-schema#subPropertyOf\": [\n",
      "      {\n",
      "        \"@id\": \"https://vz-risk.github.io/flow/attack-flow#state_change\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"https://veriscommunity.net/attack-flow#attribute.unknown\",\n",
      "    \"http://www.w3.org/2000/01/rdf-schema#subPropertyOf\": [\n",
      "      {\n",
      "        \"@id\": \"https://vz-risk.github.io/flow/attack-flow#state_change\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"urn:absolute:mass%20event#Organized%20crime_1\",\n",
      "    \"@type\": [\n",
      "      \"http://www.w3.org/2002/07/owl#NamedIndividual\",\n",
      "      \"https://veriscommunity.net/attack-flow#actor.external.variety.Organized%20crime\"\n",
      "    ],\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#flow\": [\n",
      "      {\n",
      "        \"@id\": \"urn:absolute:north_okanagan_pediatric_clinic#f247f550-6f38-46f4-9a32-a45cf89d47e3\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"https://veriscommunity.net/attack-flow#plus\",\n",
      "    \"https://veriscommunity.net/attack-flow#plus.master_id\": [\n",
      "      {\n",
      "        \"@value\": \"f247f550-6f38-46f4-9a32-a45cf89d47e3\"\n",
      "      }\n",
      "    ],\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#flow\": [\n",
      "      {\n",
      "        \"@id\": \"urn:absolute:north_okanagan_pediatric_clinic#f247f550-6f38-46f4-9a32-a45cf89d47e3\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"https://veriscommunity.net/attack-flow#timeline.incident\",\n",
      "    \"https://veriscommunity.net/attack-flow#timeline.incident.month\": [\n",
      "      {\n",
      "        \"@value\": 6\n",
      "      }\n",
      "    ],\n",
      "    \"https://veriscommunity.net/attack-flow#timeline.incident.year\": [\n",
      "      {\n",
      "        \"@value\": 2020\n",
      "      }\n",
      "    ],\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#flow\": [\n",
      "      {\n",
      "        \"@id\": \"urn:absolute:north_okanagan_pediatric_clinic#f247f550-6f38-46f4-9a32-a45cf89d47e3\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"urn:absolute:mass%20event#Cryptocurrency_1\",\n",
      "    \"@type\": [\n",
      "      \"http://www.w3.org/2002/07/owl#NamedIndividual\",\n",
      "      \"https://veriscommunity.net/attack-flow#value_chain.cash-out.variety.Cryptocurrency\"\n",
      "    ],\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#flow\": [\n",
      "      {\n",
      "        \"@id\": \"urn:absolute:north_okanagan_pediatric_clinic#f247f550-6f38-46f4-9a32-a45cf89d47e3\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"https://veriscommunity.net/attack-flow#victim.region.019021\",\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#flow\": [\n",
      "      {\n",
      "        \"@id\": \"urn:absolute:north_okanagan_pediatric_clinic#f247f550-6f38-46f4-9a32-a45cf89d47e3\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"[rdflib.term.URIRef('urn:absolute:mass%20event#Unknown_1')]\",\n",
      "    \"https://veriscommunity.net/attack-flow#attribute.unknown\": [\n",
      "      {\n",
      "        \"@id\": \"[rdflib.term.URIRef('urn:absolute:mass%20event#Ransomware_1')]\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"https://veriscommunity.net/attack-flow#asset.role.IT\",\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#flow\": [\n",
      "      {\n",
      "        \"@id\": \"urn:absolute:north_okanagan_pediatric_clinic#f247f550-6f38-46f4-9a32-a45cf89d47e3\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"urn:absolute:mass%20event#Actor%20disclosure_1\",\n",
      "    \"@type\": [\n",
      "      \"http://www.w3.org/2002/07/owl#NamedIndividual\",\n",
      "      \"https://veriscommunity.net/attack-flow#discovery_method.external.variety.Actor%20disclosure\"\n",
      "    ],\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#flow\": [\n",
      "      {\n",
      "        \"@id\": \"urn:absolute:north_okanagan_pediatric_clinic#f247f550-6f38-46f4-9a32-a45cf89d47e3\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"urn:absolute:north_okanagan_pediatric_clinic#f247f550-6f38-46f4-9a32-a45cf89d47e3\",\n",
      "    \"@type\": [\n",
      "      \"http://www.w3.org/2002/07/owl#NamedIndividual\",\n",
      "      \"https://vz-risk.github.io/flow/attack-flow#attack-flow\"\n",
      "    ],\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#author\": [\n",
      "      {\n",
      "        \"@value\": \"planglois\"\n",
      "      }\n",
      "    ],\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#created\": [\n",
      "      {\n",
      "        \"@value\": \"2020-09-14T21:47:28.210Z\"\n",
      "      }\n",
      "    ],\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#description.attack-flow\": [\n",
      "      {\n",
      "        \"@value\": \"Canadian Pediatric clinic hacked with ransomware\"\n",
      "      }\n",
      "    ],\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#name.attack-flow\": [\n",
      "      {\n",
      "        \"@value\": \"75fb88f0-f6af-11ea-b6fa-6deaa5aa80b0\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"urn:absolute:mass%20event#Ransomware_1\",\n",
      "    \"@type\": [\n",
      "      \"http://www.w3.org/2002/07/owl#NamedIndividual\",\n",
      "      \"https://veriscommunity.net/attack-flow#action.malware.variety.Ransomware\"\n",
      "    ],\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#description.action\": [\n",
      "      {\n",
      "        \"@value\": \"no decription\"\n",
      "      }\n",
      "    ],\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#flow\": [\n",
      "      {\n",
      "        \"@id\": \"urn:absolute:north_okanagan_pediatric_clinic#f247f550-6f38-46f4-9a32-a45cf89d47e3\"\n",
      "      }\n",
      "    ],\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#logic_operator\": [\n",
      "      {\n",
      "        \"@value\": \"OR\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"https://veriscommunity.net/attack-flow#actor.external.region.000000\",\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#flow\": [\n",
      "      {\n",
      "        \"@id\": \"urn:absolute:north_okanagan_pediatric_clinic#f247f550-6f38-46f4-9a32-a45cf89d47e3\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"https://veriscommunity.net/attack-flow#victim.country.CA\",\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#flow\": [\n",
      "      {\n",
      "        \"@id\": \"urn:absolute:north_okanagan_pediatric_clinic#f247f550-6f38-46f4-9a32-a45cf89d47e3\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"https://veriscommunity.net/attack-flow#actor.external.country.Unknown\",\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#flow\": [\n",
      "      {\n",
      "        \"@id\": \"urn:absolute:north_okanagan_pediatric_clinic#f247f550-6f38-46f4-9a32-a45cf89d47e3\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"urn:absolute:mass%20event#Obscuration_1\",\n",
      "    \"@type\": [\n",
      "      \"http://www.w3.org/2002/07/owl#NamedIndividual\",\n",
      "      \"https://veriscommunity.net/attack-flow#attribute.availability.variety.Obscuration\"\n",
      "    ],\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#flow\": [\n",
      "      {\n",
      "        \"@id\": \"urn:absolute:north_okanagan_pediatric_clinic#f247f550-6f38-46f4-9a32-a45cf89d47e3\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"urn:absolute:mass%20event#Unknown_1\",\n",
      "    \"@type\": [\n",
      "      \"http://www.w3.org/2002/07/owl#NamedIndividual\",\n",
      "      \"https://veriscommunity.net/attack-flow#asset.assets.variety.S%20-%20Unknown\"\n",
      "    ],\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#flow\": [\n",
      "      {\n",
      "        \"@id\": \"urn:absolute:north_okanagan_pediatric_clinic#f247f550-6f38-46f4-9a32-a45cf89d47e3\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"https://veriscommunity.net/attack-flow#attribute\",\n",
      "    \"https://veriscommunity.net/attack-flow#attribute.confidentiality.data_disclosure\": [\n",
      "      {\n",
      "        \"@id\": \"https://veriscommunity.net/attack-flow#attribute.confidentiality.data_disclosure.Potentially\"\n",
      "      }\n",
      "    ],\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#flow\": [\n",
      "      {\n",
      "        \"@id\": \"urn:absolute:north_okanagan_pediatric_clinic#f247f550-6f38-46f4-9a32-a45cf89d47e3\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"[rdflib.term.URIRef('urn:absolute:mass%20event#Obscuration_1')]\",\n",
      "    \"http://www.w3.org/2000/01/rdf-schema#subPropertyOf\": [\n",
      "      {\n",
      "        \"@id\": \"https://vz-risk.github.io/flow/attack-flow#state_change\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"urn:absolute:mass%20event#Personal_1\",\n",
      "    \"@type\": [\n",
      "      \"http://www.w3.org/2002/07/owl#NamedIndividual\",\n",
      "      \"https://veriscommunity.net/attack-flow#attribute.confidentiality.data.variety.Personal\"\n",
      "    ],\n",
      "    \"https://vz-risk.github.io/flow/attack-flow#flow\": [\n",
      "      {\n",
      "        \"@id\": \"urn:absolute:north_okanagan_pediatric_clinic#f247f550-6f38-46f4-9a32-a45cf89d47e3\"\n",
      "      }\n",
      "    ]\n",
      "  },\n",
      "  {\n",
      "    \"@id\": \"[rdflib.term.URIRef('urn:absolute:mass%20event#Software%20installation_1')]\",\n",
      "    \"http://www.w3.org/2000/01/rdf-schema#subPropertyOf\": [\n",
      "      {\n",
      "        \"@id\": \"https://vz-risk.github.io/flow/attack-flow#state_change\"\n",
      "      }\n",
      "    ]\n",
      "  }\n",
      "]\n"
     ]
    }
   ],
   "source": [
    "print(oincident.serialize(format=\"json-ld\"))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 325,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2022-01-30T20:09:38.628846Z",
     "start_time": "2022-01-30T20:09:38.624938Z"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'attribute.integrity.variety.Defacement'"
      ]
     },
     "execution_count": 325,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "attribute"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.6"
  },
  "toc": {
   "base_numbering": 1,
   "nav_menu": {},
   "number_sections": true,
   "sideBar": true,
   "skip_h1_title": false,
   "title_cell": "Table of Contents",
   "title_sidebar": "Contents",
   "toc_cell": false,
   "toc_position": {},
   "toc_section_display": true,
   "toc_window_display": false
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}