stucco_schema.json

{
  "$schema": "http://json-schema.org/draft-04/schema",

  "definitions": {
    "edge":{
      "type":"object",
      "properties":{
        "edgeName": {
          "type":"string",
          "id": "gov.ornl.sava.graphson.normal/graph/edges/base/edgeName"
        },
        "_id": {
          "type":"string",
          "id": "gov.ornl.sava.graphson.normal/graph/edges/base/_id"
        },
        "_inV": {
          "type":"string",
          "id": "gov.ornl.sava.graphson.normal/graph/edges/base/_inV"
        },
        "_outV": {
          "type":"string",
          "id": "gov.ornl.sava.graphson.normal/graph/edges/base/_outV"
        },
        "_label": {
          "type":"string",
          "id": "gov.ornl.sava.graphson.normal/graph/edges/base/_label"
        },
        "_type": {
          "type":"string",
          "id": "gov.ornl.sava.graphson.normal/graph/edges/base/_type"
        },
        "description": {
          "type":"string",
          "id": "gov.ornl.sava.graphson.normal/graph/edges/base/description"
        },
        "score":{
          "id": "gov.ornl.sava.graphson.normal/graph/edges/base/score",
          "description":"the calculated confidence score of this edge",
          "type":"number",
          "minimum": 0.0 ,
          "maximum": 1.0
        }
      },
      "required": ["_id", "_inV", "_outV", "_label", "_type", "description"]
    },
    "vertex":{
      "type":"object",
      "properties":{
        "_id": {
          "type":"string",
          "id": "gov.ornl.sava.graphson.normal/graph/vertices/base/_id"
        },
        "_type": {
          "type":"string",
          "id": "gov.ornl.sava.graphson.normal/graph/vertices/base/_type"
        },
        "score":{
          "id": "gov.ornl.sava.graphson.normal/graph/vertices/base/score",
          "description":"the calculated confidence score of this node",
          "type":"number",
          "minimum": 0.0 ,
          "maximum": 1.0
        }
      },
      "required": ["_id", "_type"]
    },
    "mode": {
      "enum":["NORMAL","EXTENDED"],
      "type":"string",
      "id": "gov.ornl.sava.graphson.normal/graph/mode"
    },
    "user": {
      "objName": "gov.ornl.sava.stucco/graph/vertices/user",
      "title":"user",
      "description":"legitimate, authorized user of some system(s) \nA user owns, is assigned, and/or uses some hardware. \nA user has an associated account.",
      "allOf": [
        { "$ref": "#/definitions/vertex" },
        {
          "properties":{
            "vertexType":{
              "enum":["user"],
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "name":{
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "description":{
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "source":{
              "description":"Data source for this vertex",
              "type":"string",
              "cardinality":"set",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "appendList"
            }
          },
          "required": ["vertexType", "name", "description"],
          "indexes":{
            "composite":[
              {
                "keys":["name"],
                "unique": true
              },
              {
                "keys":["vertexType"]
              },
              {
                "keys":["source"]
              }
            ]
          }
        }
      ]
    },
    "account": {
      "objName": "gov.ornl.sava.stucco/graph/vertices/account",
      "title":"account",
      "description":"account on some specific system(s), either belonging to some specific user or a system account \nAll software runs as some account. \nAll accounts are associated with a user or users (such as system accounts.)",
      "allOf": [
        { "$ref": "#/definitions/vertex" },
        {
          "properties":{
            "vertexType":{
              "enum":["account"],
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "name":{
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "description":{
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "source":{
              "description":"Data source for this vertex",
              "type":"string",
              "cardinality":"set",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "appendList"
            }
          },
          "required": ["vertexType", "name", "description"],
          "indexes":{
            "composite":[
              {
                "keys":["name"],
                "unique": true
              },
              {
                "keys":["vertexType"]
              },
              {
                "keys":["source"]
              }
            ]
          }
        }
      ]
    },
    "host": {
      "objName": "gov.ornl.sava.stucco/graph/vertices/host",
      "title":"host",
      "description":"Any entity on the network, including PCs, routers, switches, virtual machines, etc.",
      "allOf": [
        { "$ref": "#/definitions/vertex" },
        {
          "properties":{
            "vertexType":{
              "enum":["host"],
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "name":{
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "description":{
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "source":{
              "description":"Data source for this vertex",
              "type":"string",
              "cardinality":"set",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "appendList"
            }
          },
          "required": ["vertexType", "name", "description"],
          "indexes":{
            "composite":[
              {
                "keys":["name"],
                "unique": true
              },
              {
                "keys":["vertexType"]
              },
              {
                "keys":["source"]
              }
            ]
          }
        }
      ]
    },
    "software": {
      "objName": "gov.ornl.sava.stucco/graph/vertices/software",
      "title":"software",
      "description":"Any software components on a system, including OSes, applications, services, and libraries.",
      "allOf": [
        { "$ref": "#/definitions/vertex" },
        {
          "properties":{
            "vertexType":{
              "enum":["software"],
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "name":{
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "source":{
              "description":"Data source for this vertex",
              "type":"string",
              "cardinality":"set",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "appendList"
            },
            "description":{
              "description":"description",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "TBD",
              "comparisonWeight": 3.033507781,
              "resolutionFunction": "TBD"
            },
            "nvdId":{
              "description":"NVD ID",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "appendList"
            },
            "status":{
              "description":"status",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "keepNew"
            },
            "modifiedDate":{
              "description":"modified date",
              "type":"number",
              "cardinality":"single",
              "comparisonFunction": "compareTimestamps",
              "comparisonWeight": 1.559187641063191,
              "resolutionFunction": "keepNew"
            },
            "part":{
              "description":"part type",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0.4717679,
              "resolutionFunction": "appendList"
            },
            "vendor":{
              "description":"vendor",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 6.062343,
              "resolutionFunction": "appendList"
            },
            "product":{
              "description":"product name",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 7.6517224,
              "resolutionFunction": "appendList"
            },
            "version":{
              "description":"version",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 8.713991,
              "resolutionFunction": "appendList"
            },
            "update":{
              "description":"update",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "compareTimestamps",
              "comparisonWeight": 1.1007229,
              "resolutionFunction": "keepNew"
            },
            "edition":{
              "description":"edition",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0.540115,
              "resolutionFunction": "appendList"
            },
            "language":{
              "description":"language",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0.008644951,
              "resolutionFunction": "appendList"
            },
            "processPath":{
              "description":"Process Path",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0.45797676,
              "resolutionFunction": "appendList"
            },
            "processPid":{
              "description":"Process PID",
              "type":"integer",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0.5673976,
              "resolutionFunction": "appendList"
            },
            "processPpid":{
              "description":"Process PPID",
              "type":"integer",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0.5673976,
              "resolutionFunction": "appendList"
            },
            "processArgs":{
              "description":"Process Args",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0.43408045,
              "resolutionFunction": "appendList"
            }
          },
          "required": ["vertexType", "name", "description"],
          "indexes":{
            "composite":[
              {
                "keys":["name"],
                "unique": true
              },
              {
                "keys":["vertexType"]
              },
              {
                "keys":["source"]
              },
              {
                "keys":["nvdId"]
              }
            ],
            "mixed":[
              {
                "keys":["modifiedDate"]
              }
            ],
            "text":[
              {
                "keys":["description"]
              }
            ]
          }
        }
      ]
    },
    "vulnerability": {
      "objName": "gov.ornl.sava.stucco/graph/vertices/vulnerability",
      "title":"vulnerability",
      "description":"a flaw in some software, that can cause improper, unintended operation, and can potentially be exploited as part of an attack",
      "allOf": [
        { "$ref": "#/definitions/vertex" },
        {
          "properties":{
            "vertexType":{
              "enum":["vulnerability"],
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "name":{
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "source":{
              "description":"Data source for this vertex",
              "type":"string",
              "cardinality":"set",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "appendList"
            },
            "comments":{
              "description":"comments",
              "anyOf": [
                  { "type": "string" },
                  { "type": "array" }
                ],
              "cardinality":"set",
              "comparisonFunction": "WHIRL",
              "comparisonWeight": 0.30281106,
              "resolutionFunction": "TBD"
            },
            "description":{
              "description":"description",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "WHIRL",
              "comparisonWeight": 3.383410480090717,
              "resolutionFunction": "TBD"
            },
            "shortDescription":{
              "description":"short description",
              "type":"string",
              "comparisonFunction": "WHIRL",
              "comparisonWeight": 6.882437470997878,
              "resolutionFunction": "TBD"
            },
            "solution":{
              "description":"solution",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "WHIRL",
              "comparisonWeight": 6.1163623196299,
              "resolutionFunction": "TBD"
            },
            "phase":{
              "description":"phase",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0.3578151,
              "resolutionFunction": "keepNew"
            },
            "phaseDate":{
              "description":"phase date",
              "type":"number",
              "cardinality":"single",
              "comparisonFunction": "compareTimestamps",
              "comparisonWeight": 7.249643,
              "resolutionFunction": "keepNew"
            },
            "references":{
              "description":"references",
              "anyOf": [
                  { "type": "string" },
                  { "type": "array" }
                ],
              "cardinality":"set",
              "comparisonFunction": "compareReferences",
              "comparisonWeight": 2.212283815035590,
              "resolutionFunction": "appendList"
            },
            "status":{
              "description":"status",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0.17141086,
              "resolutionFunction": "keepNew"
            },
            "publishedDate":{
              "description":"published date",
              "type":"number",
              "cardinality":"single",
              "comparisonFunction": "compareTimestamps",
              "comparisonWeight": 1.373463923761563,
              "resolutionFunction": "keepNew"
            },
            "modifiedDate":{
              "description":"modified date",
              "type":"number",
              "cardinality":"single",
              "comparisonFunction": "compareTimestamps",
              "comparisonWeight": 1.559187641063191,
              "resolutionFunction": "keepNew"
            },
            "cweNumber":{
              "description":"CWE Number",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0.1650552902059562,
              "resolutionFunction": "appendList"
            },
            "cvssScore":{
              "description":"CVSS score",
              "type":"number",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0.7038249561307638,
              "resolutionFunction": "keepConfidence"
            },
            "cvssDate":{
              "description":"CVSS date",
              "type":"number",
              "cardinality":"single",
              "comparisonFunction": "compareTimestamps",
              "comparisonWeight": 1.020710889265377,
              "resolutionFunction": "keepNew"
            },
            "accessVector":{
              "description":"access vector",
              "type":"string",
              "enum":["NETWORK","LOCAL","ADJACENT"],
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0.4045041254793607,
              "resolutionFunction": "appendList"
            },
            "accessComplexity":{
              "description":"access complexity",
              "type":"string",
              "enum":["HIGH","MEDIUM","LOW"],
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0.3687215225000001,
              "resolutionFunction": "appendList"
            },
            "accessAuthentication":{
              "description":"access authentication required",
              "type":"string",
              "enum":["MULTIPLE","SINGLE","NONE"],
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0.2903260237989832,
              "resolutionFunction": "keepNew"
            },
            "confidentialityImpact":{
              "description":"confidentiality impact",
              "type":"string",
              "enum":["NONE","PARTIAL","COMPLETE"],
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0.4752527012618734,
              "resolutionFunction": "appendList"
            },
            "integrityImpact":{
              "description":"integrity impact",
              "type":"string",
              "enum":["NONE","PARTIAL","COMPLETE"],
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0.4755113952459684,
              "resolutionFunction": "appendList"
            },
            "availabilityImpact":{
              "description":"availability impact",
              "type":"string",
              "enum":["NONE","PARTIAL","COMPLETE"],
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0.4761615044335661,
              "resolutionFunction": "appendList"
            }
          },
          "required": ["vertexType", "name", "description"],
          "indexes":{
            "composite":[
              {
                "keys":["name"],
                "unique": true
              },
              {
                "keys":["vertexType"]
              },
              {
                "keys":["source"]
              }
            ],
            "mixed":[
              {
                "keys":["modifiedDate"]
              },
              {
                "keys":["phaseDate"]
              },
              {
                "keys":["publishedDate"]
              }
            ],
            "text":[
              {
                "keys":["description"]
              },
              {
                "keys":["comments"]
              },
              {
                "keys":["shortDescription"]
              },
              {
                "keys":["solution"]
              }
            ]
          }
        }
      ]
    },
    "address": {
      "objName": "gov.ornl.sava.stucco/graph/vertices/address",
      "title":"address",
      "description":"any address, either inside or outside of the network",
      "allOf": [
        { "$ref": "#/definitions/vertex" },
        {
          "properties":{
            "vertexType":{
              "enum":["address"],
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "name":{
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "description":{
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "source":{
              "description":"Data source for this vertex",
              "type":"string",
              "cardinality":"set",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "appendList"
            }
          },
          "required": ["vertexType", "name", "description"],
          "indexes":{
            "composite":[
              {
                "keys":["name"],
                "unique": true
              },
              {
                "keys":["vertexType"]
              },
              {
                "keys":["source"]
              }
            ]
          }
        }
      ]
    },
    "DNSName": {
      "objName": "gov.ornl.sava.stucco/graph/vertices/DNSName",
      "title":"DNSName",
      "description":"a DNS name (and possibly associated info - registration info, etc.)",
      "allOf": [
        { "$ref": "#/definitions/vertex" },
        {
          "properties":{
            "vertexType":{
              "enum":["DNSName"],
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "name":{
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "description":{
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "source":{
              "description":"Data source for this vertex",
              "type":"string",
              "cardinality":"set",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "appendList"
            },
            "ns1":{
              "description":"name server (1)",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": "TBD",
              "resolutionFunction": "appendList"
            },
            "ns2":{
              "description":"name server (2)",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": "TBD",
              "resolutionFunction": "appendList"
            },
            "ns3":{
              "description":"name server (3)",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": "TBD",
              "resolutionFunction": "appendList"
            },
            "ns4":{
              "description":"name server (4)",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": "TBD",
              "resolutionFunction": "appendList"
            },
            "ns5":{
              "description":"name server (5)",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": "TBD",
              "resolutionFunction": "appendList"
            }
          },
          "required": ["vertexType", "name", "description"],
          "indexes":{
            "composite":[
              {
                "keys":["name"],
                "unique": true
              },
              {
                "keys":["vertexType"]
              },
              {
                "keys":["source"]
              }
            ]
          }
        }
      ]
    },
    "IP": {
      "objName": "gov.ornl.sava.stucco/graph/vertices/IP",
      "title":"IP",
      "description":"a specific IP address",
      "allOf": [
        { "$ref": "#/definitions/vertex" },
        {
          "properties":{
            "vertexType":{
              "enum":["IP"],
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "name":{
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "description":{
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "source":{
              "description":"Data source for this vertex",
              "type":"string",
              "cardinality":"set",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "appendList"
            },
            "tags":{
              "description":"Descriptive tags for this IP",
              "type":"string",
              "cardinality":"set",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "appendList"
            },
            "ipInt":{
              "description":"start IP, as integer",
              "type":"integer",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": "TBD",
              "resolutionFunction": "appendList"
            }
          },
          "required": ["vertexType", "name", "description", "ipInt"],
          "indexes":{
            "composite":[
              {
                "keys":["name"],
                "unique": true
              },
              {
                "keys":["vertexType"]
              },
              {
                "keys":["source"]
              }
            ],
            "mixed":[
              {
                "keys":["ipInt"]
              }
            ]
          }
        }
      ]
    },
    "port": {
      "objName": "gov.ornl.sava.stucco/graph/vertices/port",
      "title":"port",
      "description":"a specific port",
      "allOf": [
        { "$ref": "#/definitions/vertex" },
        {
          "properties":{
            "vertexType":{
              "enum":["port"],
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "name":{
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "description":{
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "source":{
              "description":"Data source for this vertex",
              "type":"string",
              "cardinality":"set",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "appendList"
            }
          },
          "required": ["vertexType", "name", "description"],
          "indexes":{
            "composite":[
              {
                "keys":["name"],
                "unique": true
              },
              {
                "keys":["vertexType"]
              },
              {
                "keys":["source"]
              }
            ]
          }
        }
      ]
    },
    "addressRange": {
      "objName": "gov.ornl.sava.stucco/graph/vertices/addressRange",
      "title":"addressRange",
      "description":"address range",
      "allOf": [
        { "$ref": "#/definitions/vertex" },
        {
          "properties":{
            "vertexType":{
              "enum":["addressRange"],
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "name":{
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "source":{
              "description":"Data source for this vertex",
              "type":"string",
              "cardinality":"set",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "appendList"
            },
            "startIP":{
              "description":"start IP",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "TBD",
              "comparisonWeight": "TBD",
              "resolutionFunction": "TBD"
            },
            "endIP":{
              "description":"end IP",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "TBD",
              "comparisonWeight": "TBD",
              "resolutionFunction": "TBD"
            },
            "startIPInt":{
              "description":"start IP, as integer",
              "type":"integer",
              "cardinality":"single",
              "comparisonFunction": "TBD",
              "comparisonWeight": "TBD",
              "resolutionFunction": "TBD"
            },
            "endIPInt":{
              "description":"end IP, as integer",
              "type":"integer",
              "cardinality":"single",
              "comparisonFunction": "TBD",
              "comparisonWeight": "TBD",
              "resolutionFunction": "TBD"
            },
            "countryCode":{
              "description":"Country Code",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "TBD",
              "comparisonWeight": "TBD",
              "resolutionFunction": "TBD"
            },
            "countryName":{
              "description":"Country Name",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "TBD",
              "comparisonWeight": "TBD",
              "resolutionFunction": "TBD"
            },
            "netname":{
              "description":"network name",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "TBD",
              "comparisonWeight": "TBD",
              "resolutionFunction": "TBD"
            },
            "description":{
              "description":"description",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "WHIRL",
              "comparisonWeight": 3.383410480090717,
              "resolutionFunction": "TBD"
            },
            "asNum":{
              "description":"AS Number",
              "type":"integer",
              "cardinality":"single",
              "comparisonFunction": "TBD",
              "comparisonWeight": "TBD",
              "resolutionFunction": "TBD"
            },
            "assignedBy":{
              "description":"assigned by",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "TBD",
              "comparisonWeight": "TBD",
              "resolutionFunction": "TBD"
            }
          },
          "required": ["vertexType", "name", "description", "startIP", "endIP", "startIPInt", "endIPInt"],
          "indexes":{
            "composite":[
              {
                "keys":["name"],
                "unique": true
              },
              {
                "keys":["vertexType"]
              },
              {
                "keys":["source"]
              },
              {
                "keys":["countryCode"]
              },
              {
                "keys":["countryName"]
              }
            ],
            "mixed":[
              {
                "keys":["startIP"]
              },
              {
                "keys":["startIPInt"]
              },
              {
                "keys":["endIP"]
              },
              {
                "keys":["endIPInt"]
              }
            ],
            "text":[
              {
                "keys":["description"]
              }
            ]
          }
        }
      ]
    },
    "service": {
      "objName": "gov.ornl.sava.stucco/graph/vertices/service",
      "title":"service",
      "description":"expected or actual service using some port",
      "allOf": [
        { "$ref": "#/definitions/vertex" },
        {
          "properties":{
            "vertexType":{
              "enum":["service"],
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "name":{
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "description":{
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "reference":{
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "notes":{
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "source":{
              "description":"Data source for this vertex",
              "type":"string",
              "cardinality":"set",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "appendList"
            }
          },
          "required": ["vertexType", "name", "description"],
          "indexes":{
            "composite":[
              {
                "keys":["name"],
                "unique": true
              },
              {
                "keys":["vertexType"]
              },
              {
                "keys":["source"]
              }
            ]
          }
        }
      ]
    },
    "malware": {
      "objName": "gov.ornl.sava.stucco/graph/vertices/malware",
      "title":"malware",
      "description":"any malicious software.  This can refer to either a stored binary or a running instance. \nMalware can contain code to launch an exploit. \nMalware can itself be an asset that an attacker uses in future attacks (eg. a backdoor left on a compromised system.) or can automatically launch additional attacks on behalf of the original attacker. \nMalware can be hosted by or communicate with servers controlled by the attacker. \nMalware can contain code to load other malware. \nMalware can reuse components from other malware samples.",
      "allOf": [
        { "$ref": "#/definitions/vertex" },
        {
          "properties":{
            "vertexType":{
              "enum":["malware"],
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "name":{
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "source":{
              "description":"Data source for this vertex",
              "type":"string",
              "cardinality":"set",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "appendList"
            },
            "avName":{
              "description":"AV vendor's name for this malware",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "SmithWaterman",
              "comparisonWeight": "TBD",
              "resolutionFunction": "TBD"
            },
            "sha1hashes":{
              "description":"known SHA1 hashes for this malware family",
              "anyOf": [
                  { "type": "string" },
                  { "type": "array" }
                ],
              "cardinality":"set",
              "comparisonFunction": "exact",
              "comparisonWeight": "TBD",
              "resolutionFunction": "appendList"
            },
            "md5hashes":{
              "description":"known MD5 hashes for this malware family",
              "anyOf": [
                  { "type": "string" },
                  { "type": "array" }
                ],
              "cardinality":"set",
              "comparisonFunction": "exact",
              "comparisonWeight": "TBD",
              "resolutionFunction": "appendList"
            },
            "platform":{
              "description":"platform(s) effected by this malware",
              "anyOf": [
                  { "type": "string" },
                  { "type": "array" }
                ],
              "cardinality":"set",
              "comparisonFunction": "exact",
              "comparisonWeight": "TBD",
              "resolutionFunction": "appendList"
            },
            "filesCreated":{
              "description":"files that may be created by this malware",
              "anyOf": [
                  { "type": "string" },
                  { "type": "array" }
                ],
              "cardinality":"set",
              "comparisonFunction": "exact",
              "comparisonWeight": "TBD",
              "resolutionFunction": "appendList"
            },
            "filesModified":{
              "description":"files that may be modified by this malware",
              "anyOf": [
                  { "type": "string" },
                  { "type": "array" }
                ],
              "cardinality":"set",
              "comparisonFunction": "exact",
              "comparisonWeight": "TBD",
              "resolutionFunction": "appendList"
            },
            "registryKeysCreated":{
              "description":"registry keys that may be created by this malware",
              "anyOf": [
                  { "type": "string" },
                  { "type": "array" }
                ],
              "cardinality":"set",
              "comparisonFunction": "exact",
              "comparisonWeight": "TBD",
              "resolutionFunction": "appendList"
            },
            "registryKeysModified":{
              "description":"registry keys that may be modified by this malware",
              "anyOf": [
                  { "type": "string" },
                  { "type": "array" }
                ],
              "cardinality":"set",
              "comparisonFunction": "exact",
              "comparisonWeight": "TBD",
              "resolutionFunction": "appendList"
            },
            "malwareType":{
              "description":"descriptive malware type(s), eg. 'Trojan' or 'spyware'",
              "anyOf": [
                  { "type": "string" },
                  { "type": "array" }
                ],
              "cardinality":"set",
              "comparisonFunction": "exact",
              "comparisonWeight": 1.4822443,
              "resolutionFunction": "appendList"
            },
            "discoveryDate":{
              "description":"date when the first known sample was observed",
              "type":"number",
              "cardinality":"single",
              "comparisonFunction": "compareTimestamps",
              "comparisonWeight": 3.5570278,
              "resolutionFunction": "keepNew"
            },
            "signatureDate":{
              "description":"date when the first known signature was created",
              "type":"number",
              "cardinality":"single",
              "comparisonFunction": "compareTimestamps",
              "comparisonWeight": "TBD",
              "resolutionFunction": "keepNew"
            },
            "modifiedDate":{
              "description":"date that the most recent source document was last updated",
              "type":"number",
              "cardinality":"single",
              "comparisonFunction": "compareTimestamps",
              "comparisonWeight": 1.559187641063191,
              "resolutionFunction": "keepNew"
            },
            "description":{
              "description":"descriptive summary of this malware family",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "WHIRL",
              "comparisonWeight": 5.8790593,
              "resolutionFunction": "combine"
            },
            "details":{
              "description":"additional text description of this malware",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "WHIRL",
              "comparisonWeight": 5.8044763,
              "resolutionFunction": "combine"
            },
            "behavior":{
              "description":"description of this malware's observed behaviour",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "WHIRL",
              "comparisonWeight": "TBD",
              "resolutionFunction": "combine"
            },
            "removal":{
              "description":"description of removal procedure",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "TBD",
              "comparisonWeight": "TBD",
              "resolutionFunction": "TBD"
            },
            "prevalence":{
              "description":"prevalence of this malware 'in the wild' (currently a descriptive phrase, may convert these to a numeric range later)",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "TBD",
              "comparisonWeight": "TBD",
              "resolutionFunction": "TBD"
            },
            "distribution":{
              "description":"known distribution methods for this malware",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "TBD",
              "comparisonWeight": "TBD",
              "resolutionFunction": "TBD"
            },
            "aliases":{
              "description":"other known names for this malware family (typically from different AV vendors)",
              "anyOf": [
                  { "type": "string" },
                  { "type": "array" }
                ],
              "cardinality":"set",
              "comparisonFunction": "TBD",
              "comparisonWeight": "TBD",
              "resolutionFunction": "appendList"
            },
            "knownFileTypes":{
              "description":"known file types associated with this file (eg file extensions, mime types, etc.)",
              "anyOf": [
                  { "type": "string" },
                  { "type": "array" }
                ],
              "cardinality":"set",
              "comparisonFunction": "TBD",
              "comparisonWeight": "TBD",
              "resolutionFunction": "appendList"
            },
            "processesCreated":{
              "description":"description of processes created by this malware (eg. executable name with args)",
              "anyOf": [
                  { "type": "string" },
                  { "type": "array" }
                ],
              "cardinality":"set",
              "comparisonFunction": "TBD",
              "comparisonWeight": "TBD",
              "resolutionFunction": "appendList"
            },
            "urlsUsed":{
              "description":"URLs requested by this malware, or URLs distributing this malware, or othewise associated with this malware.",
              "anyOf": [
                  { "type": "string" },
                  { "type": "array" }
                ],
              "cardinality":"set",
              "comparisonFunction": "TBD",
              "comparisonWeight": "TBD",
              "resolutionFunction": "appendList"
            }
          },
          "required": ["vertexType", "name", "description"],
          "indexes":{
            "composite":[
              {
                "keys":["name"],
                "unique": true
              },
              {
                "keys":["vertexType"]
              },
              {
                "keys":["source"]
              }
            ],
            "mixed":[
              {
                "keys":["discoveryDate"]
              },
              {
                "keys":["modifiedDate"]
              },
              {
                "keys":["signatureDate"]
              }
            ],
            "text":[
              {
                "keys":["details"]
              },
              {
                "keys":["removal"]
              },
              {
                "keys":["behavior"]
              },
              {
                "keys":["description"]
              }
            ]
          }
        }
      ]
    },
    "flow": {
      "objName": "gov.ornl.sava.stucco/graph/vertices/flow",
      "title":"flow",
      "description":"a flow of traffic between two addresses",
      "allOf": [
        { "$ref": "#/definitions/vertex" },
        {
          "properties":{
            "vertexType":{
              "enum":["flow"],
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "name":{
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "description":{
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "source":{
              "description":"Data source for this vertex",
              "type":"string",
              "cardinality":"set",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "appendList"
            },
            "keyStrokeNStroke":{
              "description":"detected SSH keystroke count",
              "type":"integer",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": "TBD",
              "resolutionFunction": "appendList"
            },
            "proto":{
              "description":"transaction protocol",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": "TBD",
              "resolutionFunction": "appendList"
            },
            "appBytes":{
              "description":"total application bytes",
              "type":"integer",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": "TBD",
              "resolutionFunction": "keepConfidence"
            },
            "srcAppBytes":{
              "description":"src application bytes",
              "type":"integer",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": "TBD",
              "resolutionFunction": "keepConfidence"
            },
            "dstAppBytes":{
              "description":"dst application bytes",
              "type":"integer",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": "TBD",
              "resolutionFunction": "keepConfidence"
            },
            "state":{
              "description":"transaction state",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": "TBD",
              "resolutionFunction": "keepNew"
            },
            "startTime":{
              "description":"record start time",
              "type":"number",
              "cardinality":"single",
              "comparisonFunction": "compareTimestamps",
              "comparisonWeight": 1.5362262,
              "resolutionFunction": "keepNew"
            },
            "duration":{
              "description":"flow duration",
              "type":"number",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": "TBD",
              "resolutionFunction": "keepConfidence"
            },
            "appByteRatio":{
              "description":"ratio between source appbytes and dest appbytes",
              "type":"number",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": "TBD",
              "resolutionFunction": "keepConfidence"
            },
            "dir":{
              "description":"direction of transaction",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": "TBD",
              "resolutionFunction": "appendList"
            },
            "flags":{
              "description":"flow state flags seen in transaction",
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": "TBD",
              "resolutionFunction": "appendList"
            },
            "dstPkts":{
              "description":"dst -> src packet count.",
              "type":"integer",
              "cardinality":"single",
              "comparisonFunction": "TBD",
              "comparisonWeight": "TBD",
              "resolutionFunction": "TBD"
            },
            "srcPkts":{
              "description":"src -> dst packet count.",
              "type":"integer",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": "TBD",
              "resolutionFunction": "appendList"
            },
            "totalPkts":{
              "description":"total transaction packet count",
              "type":"integer",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0.74484295,
              "resolutionFunction": "keepConfidence"
            },
            "totalBytes":{
              "description":"total transaction bytes",
              "type":"integer",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0.76540166,
              "resolutionFunction": "keepConfidence"
            },
            "situAnomalyScore":{
              "description":"Anomaly score given by situ",
              "type":"number",
              "cardinality":"single",
              "comparisonFunction": "TBD",
              "comparisonWeight": "TBD",
              "resolutionFunction": "TBD"
            },
            "situMaliciousnessScore":{
              "description":"Maliciousness score given by situ",
              "type":"number",
              "cardinality":"single",
              "comparisonFunction": "TBD",
              "comparisonWeight": "TBD",
              "resolutionFunction": "TBD"
            },
            "site":{
              "description":"location where this flow was collected",
              "type":"number",
              "cardinality":"single",
              "comparisonFunction": "TBD",
              "comparisonWeight": "TBD",
              "resolutionFunction": "TBD"
            }
          },
          "required": ["vertexType", "name", "description"],
          "indexes":{
            "composite":[
              {
                "keys":["name"],
                "unique": true
              },
              {
                "keys":["vertexType"]
              },
              {
                "keys":["source"]
              }
            ],
            "mixed":[
              {
                "keys":["startTime"]
              }
            ]
          }
        }
      ]
    },
    "attack": {
      "objName": "gov.ornl.sava.stucco/graph/vertices/attack",
      "title":"attack",
      "description":"a machine-generated alert of potentially malicious activity, such as from an IDS.",
      "allOf": [
        { "$ref": "#/definitions/vertex" },
        {
          "properties":{
            "vertexType":{
              "enum":["attack"],
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "name":{
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "description":{
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "source":{
              "description":"Data source for this vertex",
              "type":"string",
              "cardinality":"set",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "appendList"
            }
          },
          "required": ["vertexType", "name", "description"],
          "indexes":{
            "composite":[
              {
                "keys":["name"],
                "unique": true
              },
              {
                "keys":["vertexType"]
              },
              {
                "keys":["source"]
              }
            ]
          }
        }
      ]
    },
    "attacker": {
      "objName": "gov.ornl.sava.stucco/graph/vertices/attacker",
      "title":"attacker",
      "description":"a known or suspected adversary",
      "allOf": [
        { "$ref": "#/definitions/vertex" },
        {
          "properties":{
            "vertexType":{
              "enum":["attacker"],
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "name":{
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "description":{
              "type":"string",
              "cardinality":"single",
              "comparisonFunction": "exact",
              "comparisonWeight": 0,
              "resolutionFunction": "none"
            },
            "source":{
              "description":"Data source for this vertex",
              "type":"string",
              "cardinality":"set",
              "comparisonFunction": "none",
              "comparisonWeight": 0,
              "resolutionFunction": "appendList"
            }
          },
          "required": ["vertexType", "name", "description"],
          "indexes":{
            "composite":[
              {
                "keys":["name"],
                "unique": true
              },
              {
                "keys":["vertexType"]
              },
              {
                "keys":["source"]
              }
            ]
          }
        }
      ]
    },
    "hasAccount": {
      "objName": "gov.ornl.sava.stucco/graph/edges/hasAccount",
      "title":"hasAccount",
      "description":"'user' -'has account'-> 'account'",
      "multiplicity":"simple",
      "allOf": [
        { "$ref": "#/definitions/edge" },
        {
          "properties":{
            "inVType":{
              "enum":["account"],
              "type":"string"
            },
            "outVType":{
              "enum":["user"],
              "type":"string"
            }
          },
          "required": ["inVType", "outVType"]
        }
      ]
    },
    "logsInTo": {
      "objName": "gov.ornl.sava.stucco/graph/edges/logsInTo",
      "title":"logsInTo",
      "description":"'account' -'logsInTo'-> 'host'",
      "multiplicity":"multi",
      "allOf": [
        { "$ref": "#/definitions/edge" },
        {
          "properties":{
            "inVType":{
              "enum":["host"],
              "type":"string"
            },
            "outVType":{
              "enum":["account"],
              "type":"string"
            },
            "timeStamp":{
              "type":"string"
            },
            "status":{
              "type":"string"
            }
          },
          "required": ["inVType", "outVType"]
        }
      ]
    },
    "logsInFrom": {
      "objName": "gov.ornl.sava.stucco/graph/edges/logsInFrom",
      "title":"logsInFrom",
      "description":"'account' -'logsInFrom'-> 'host'",
      "multiplicity":"multi",
      "allOf": [
        { "$ref": "#/definitions/edge" },
        {
          "properties":{
            "inVType":{
              "enum":["host"],
              "type":"string"
            },
            "outVType":{
              "enum":["account"],
              "type":"string"
            },
            "timeStamp":{
              "type":"string"
            },
            "status":{
              "type":"string"
            }
          },
          "required": ["inVType", "outVType"]
        }
      ]
    },
    "runs": {
      "objName": "gov.ornl.sava.stucco/graph/edges/runs",
      "title":"runs",
      "description":"'host' -'runs'-> 'software'",
      "multiplicity":"multi",
      "allOf": [
        { "$ref": "#/definitions/edge" },
        {
          "properties":{
            "inVType":{
              "enum":["software"],
              "type":"string"
            },
            "outVType":{
              "enum":["host"],
              "type":"string"
            }
          },
          "required": ["inVType", "outVType"]
        }
      ]
    },
    "runsAs": {
      "objName": "gov.ornl.sava.stucco/graph/edges/runsAs",
      "title":"runsAs",
      "description":"'software' -'runsAs'-> 'account'",
      "multiplicity":"simple",
      "allOf": [
        { "$ref": "#/definitions/edge" },
        {
          "properties":{
            "inVType":{
              "enum":["account"],
              "type":"string"
            },
            "outVType":{
              "enum":["software"],
              "type":"string"
            }
          },
          "required": ["inVType", "outVType"]
        }
      ]
    },
    "hasVulnerability": {
      "objName": "gov.ornl.sava.stucco/graph/edges/hasVulnerability",
      "title":"hasVulnerability",
      "description":"'software' -'hasVulnerability'-> 'vulnerability'",
      "multiplicity":"simple",
      "allOf": [
        { "$ref": "#/definitions/edge" },
        {
          "properties":{
            "inVType":{
              "enum":["vulnerability"],
              "type":"string"
            },
            "outVType":{
              "enum":["software"],
              "type":"string"
            }
          },
          "required": ["inVType", "outVType"]
        }
      ]
    },
    "usesAddress": {
      "objName": "gov.ornl.sava.stucco/graph/edges/usesAddress",
      "title":"usesAddress",
      "description":"'host or attacker' -'usesAddress'-> 'address'",
      "multiplicity":"simple",
      "allOf": [
        { "$ref": "#/definitions/edge" },
        {
          "properties":{
            "inVType":{
              "enum":["address"],
              "type":"string"
            },
            "outVType":{
              "enum":["host", "attacker"],
              "type":"string"
            }
          },
          "required": ["inVType", "outVType"]
        }
      ]
    },
    "hasDNSName": {
      "objName": "gov.ornl.sava.stucco/graph/edges/hasDNSName",
      "title":"hasDNSName",
      "description":"'address' -'hasDNSName'-> 'DNSName'",
      "multiplicity":"simple",
      "allOf": [
        { "$ref": "#/definitions/edge" },
        {
          "properties":{
            "inVType":{
              "enum":["DNSName"],
              "type":"string"
            },
            "outVType":{
              "enum":["address"],
              "type":"string"
            },
            "reverse":{
              "type": "boolean",
              "description":"flag for reverse lookups.  Assume False by default."
            }
          },
          "required": ["inVType", "outVType"]
        }
      ]
    },
    "hasIP": {
      "objName": "gov.ornl.sava.stucco/graph/edges/hasIP",
      "title":"hasIP",
      "description":"'address' -'hasIP'-> 'IP'",
      "multiplicity":"simple",
      "allOf": [
        { "$ref": "#/definitions/edge" },
        {
          "properties":{
            "inVType":{
              "enum":["IP"],
              "type":"string"
            },
            "outVType":{
              "enum":["host","address","DNSName"],
              "type":"string"
            }
          },
          "required": ["inVType", "outVType"]
        }
      ]
    },
    "hasPort": {
      "objName": "gov.ornl.sava.stucco/graph/edges/hasPort",
      "title":"hasPort",
      "description":"'address' -'hasPort'-> 'port'",
      "multiplicity":"simple",
      "allOf": [
        { "$ref": "#/definitions/edge" },
        {
          "properties":{
            "inVType":{
              "enum":["port"],
              "type":"string"
            },
            "outVType":{
              "enum":["address"],
              "type":"string"
            }
          },
          "required": ["inVType", "outVType"]
        }
      ]
    },
    "inAddressRange": {
      "objName": "gov.ornl.sava.stucco/graph/edges/inAddressRange",
      "title":"inAddressRange",
      "description":"'IP' -'inAddressRange'-> 'addressRange'",
      "multiplicity":"simple",
      "allOf": [
        { "$ref": "#/definitions/edge" },
        {
          "properties":{
            "inVType":{
              "enum":["addressRange"],
              "type":"string"
            },
            "outVType":{
              "enum":["IP"],
              "type":"string"
            }
          },
          "required": ["inVType", "outVType"]
        }
      ]
    },
    "hasKnownService": {
      "objName": "gov.ornl.sava.stucco/graph/edges/hasKnownService",
      "title":"hasKnownService",
      "description":"'port' -'hasKnownService'-> 'service'",
      "multiplicity":"simple",
      "allOf": [
        { "$ref": "#/definitions/edge" },
        {
          "properties":{
            "inVType":{
              "enum":["service"],
              "type":"string"
            },
            "outVType":{
              "enum":["address","port"],
              "type":"string"
            }
          },
          "required": ["inVType", "outVType"]
        }
      ]
    },
    "dstAddress": {
      "objName": "gov.ornl.sava.stucco/graph/edges/dstAddress",
      "title":"dstAddress",
      "description":"'flow' -'dstAddress'-> 'address'",
      "multiplicity":"simple",
      "allOf": [
        { "$ref": "#/definitions/edge" },
        {
          "properties":{
            "inVType":{
              "enum":["address"],
              "type":"string"
            },
            "outVType":{
              "enum":["flow"],
              "type":"string"
            }
          },
          "required": ["inVType", "outVType"]
        }
      ]
    },
    "srcAddress": {
      "objName": "gov.ornl.sava.stucco/graph/edges/srcAddress",
      "title":"srcAddress",
      "description":"'flow' -'srcAddress'-> 'address'",
      "multiplicity":"simple",
      "allOf": [
        { "$ref": "#/definitions/edge" },
        {
          "properties":{
            "inVType":{
              "enum":["address"],
              "type":"string"
            },
            "outVType":{
              "enum":["flow"],
              "type":"string"
            }
          },
          "required": ["inVType", "outVType"]
        }
      ]
    },
    "hasFlow": {
      "objName": "gov.ornl.sava.stucco/graph/edges/hasFlow",
      "title":"hasFlow",
      "description":"'software' -'hasFlow'-> 'flow'",
      "multiplicity":"simple",
      "allOf": [
        { "$ref": "#/definitions/edge" },
        {
          "properties":{
            "inVType":{
              "enum":["flow"],
              "type":"string"
            },
            "outVType":{
              "enum":["software"],
              "type":"string"
            }
          },
          "required": ["inVType", "outVType"]
        }
      ]
    },
    "exploits": {
      "objName": "gov.ornl.sava.stucco/graph/edges/exploits",
      "title":"exploits",
      "description":"'malware' -'exploits'-> 'vulnerability'",
      "multiplicity":"simple",
      "allOf": [
        { "$ref": "#/definitions/edge" },
        {
          "properties":{
            "inVType":{
              "enum":["vulnerability"],
              "type":"string"
            },
            "outVType":{
              "enum":["malware"],
              "type":"string"
            }
          },
          "required": ["inVType", "outVType"]
        }
      ]
    },
    "involvesMalware": {
      "objName": "gov.ornl.sava.stucco/graph/edges/involvesMalware",
      "title":"involvesMalware",
      "description":"'attack' -'involvesMalware'-> 'malware'",
      "multiplicity":"simple",
      "allOf": [
        { "$ref": "#/definitions/edge" },
        {
          "properties":{
            "inVType":{
              "enum":["malware"],
              "type":"string"
            },
            "outVType":{
              "enum":["attack"],
              "type":"string"
            }
          },
          "required": ["inVType", "outVType"]
        }
      ]
    },
    "includesFlow": {
      "objName": "gov.ornl.sava.stucco/graph/edges/includesFlow",
      "title":"includesFlow",
      "description":"'attack' -'includesFlow'-> 'flow'",
      "multiplicity":"simple",
      "allOf": [
        { "$ref": "#/definitions/edge" },
        {
          "properties":{
            "inVType":{
              "enum":["flow"],
              "type":"string"
            },
            "outVType":{
              "enum":["attack"],
              "type":"string"
            }
          },
          "required": ["inVType", "outVType"]
        }
      ]
    },
    "communicatesWith": {
      "objName": "gov.ornl.sava.stucco/graph/edges/communicatesWith",
      "title":"communicatesWith",
      "description":"'malware' -'communicatesWith'-> 'address'",
      "multiplicity":"simple",
      "allOf": [
        { "$ref": "#/definitions/edge" },
        {
          "properties":{
            "inVType":{
              "enum":["address"],
              "type":"string"
            },
            "outVType":{
              "enum":["malware"],
              "type":"string"
            }
          },
          "required": ["inVType", "outVType"]
        }
      ]
    },
    "causes": {
      "objName": "gov.ornl.sava.stucco/graph/edges/causes",
      "title":"causes",
      "description":"'attacker' -'causes'-> 'attack'",
      "multiplicity":"simple",
      "allOf": [
        { "$ref": "#/definitions/edge" },
        {
          "properties":{
            "inVType":{
              "enum":["attack"],
              "type":"string"
            },
            "outVType":{
              "enum":["attacker"],
              "type":"string"
            }
          },
          "required": ["inVType", "outVType"]
        }
      ]
    },
    "usesMalware": {
      "objName": "gov.ornl.sava.stucco/graph/edges/usesMalware",
      "title":"usesMalware",
      "description":"'attacker' -'usesMalware'-> 'malware'",
      "multiplicity":"simple",
      "allOf": [
        { "$ref": "#/definitions/edge" },
        {
          "properties":{
            "inVType":{
              "enum":["attacker"],
              "type":"string"
            },
            "outVType":{
              "enum":["malware"],
              "type":"string"
            }
          },
          "required": ["inVType", "outVType"]
        }
      ]
    },
    "sameAs": {
      "objName": "gov.ornl.sava.stucco/graph/edges/sameAs",
      "title":"sameAs",
      "description":"indicates that a vertex may be the same as another; should include some confidence score",
      "multiplicity":"simple",
      "allOf": [
        { "$ref": "#/definitions/edge" },
        {
          "properties":{
            "inVType":{
              "type":"string"
            },
            "outVType":{
              "type":"string"
            }
          },
          "required": ["inVType", "outVType"]
        }
      ]
    }
  },

  "description":"The top level of the graph",
  "type":"object",
  "objName": "gov.ornl.sava.stucco/graph",
  "properties":{
    "mode": { "$ref": "#/definitions/mode" },
    "edges": {
      "title":"edges",
      "description":"The list of edges in this graph",
      "type":"array",
      "objName": "gov.ornl.sava.stucco/graph/edges",
      "items":{
        "anyOf": [
          { "$ref": "#/definitions/hasAccount" },
          { "$ref": "#/definitions/logsInTo" },
          { "$ref": "#/definitions/logsInFrom" },
          { "$ref": "#/definitions/runs" },
          { "$ref": "#/definitions/runsAs" },
          { "$ref": "#/definitions/hasVulnerability" },
          { "$ref": "#/definitions/usesAddress" },
          { "$ref": "#/definitions/hasDNSName" },
          { "$ref": "#/definitions/hasIP" },
          { "$ref": "#/definitions/hasPort" },
          { "$ref": "#/definitions/inAddressRange" },
          { "$ref": "#/definitions/hasKnownService" },
          { "$ref": "#/definitions/dstAddress" },
          { "$ref": "#/definitions/srcAddress" },
          { "$ref": "#/definitions/hasFlow" },
          { "$ref": "#/definitions/exploits" },
          { "$ref": "#/definitions/involvesMalware" },
          { "$ref": "#/definitions/includesFlow" },
          { "$ref": "#/definitions/communicatesWith" },
          { "$ref": "#/definitions/causes" },
          { "$ref": "#/definitions/usesMalware" },
          { "$ref": "#/definitions/sameAs" }
        ]
      }
    },
    "vertices": {
      "title":"vertices",
      "description":"The list of vertices in this graph",
      "type":"array",
      "objName": "gov.ornl.sava.stucco/graph/vertices",
      "items":{
        "anyOf": [
          { "$ref": "#/definitions/user" },
          { "$ref": "#/definitions/account" },
          { "$ref": "#/definitions/host" },
          { "$ref": "#/definitions/software" },
          { "$ref": "#/definitions/vulnerability" },
          { "$ref": "#/definitions/address" },
          { "$ref": "#/definitions/DNSName" },
          { "$ref": "#/definitions/IP" },
          { "$ref": "#/definitions/port" },
          { "$ref": "#/definitions/addressRange" },
          { "$ref": "#/definitions/service" },
          { "$ref": "#/definitions/malware" },
          { "$ref": "#/definitions/flow" },
          { "$ref": "#/definitions/attack" },
          { "$ref": "#/definitions/attacker" }
        ]
      }
    }
  }
}