AttackPattern
type: Class
type: NodeShape
comment: An attack pattern is a common approach (set of actions) utilized by a person or organization to carry out malicious activity intended to achieve some particular objective (within a particular context) against a targeted victim.
subclass of: ActionPattern
property:
  class: Objective
  node kind: IRI
  path: hasObjective

CyberKillChain
type: Class
type: NodeShape
comment: An cyber kill chain is an ordered sequence of actions or events describing a lifecycle from some framework.
subclass of: ActionLifecycle

AttackPattern
type: Class
type: NodeShape
comment: A defense pattern is a common approach (set of actions) utilized by a person or organization to carry out defensive activity intended to achieve some particular objective (within a particular context) against malicious activity.
subclass of: ActionPattern
property:
  class: Objective
  node kind: IRI
  path: hasObjective

Access
type: Class
type: NodeShape
comment: An Access action refers to an observed or deduced interaction between an entity and an object.
subclass of: Action
property:
  datatype: string
  has value: Access
  max count: 1
  min count: 1
  node kind: Literal
  path: name

Alert
type: Class
type: NodeShape
comment: An Alert action involves notification to some entity that some condition or event of particular interest has occurred.
subclass of: Action
property:
  datatype: string
  has value: Alert
  max count: 1
  min count: 1
  node kind: Literal
  path: name

Beacon
type: Class
type: NodeShape
comment: An Beacon action is refer to communication between two objects where the performer is an object and the object property is an object or dataTarqet. Beacon is designed to differentiate between actions performed by and onto objects and actions performed by and onto identities.
subclass of: Action
property:
  datatype: string
  has value: Beacon
  max count: 1
  min count: 1
  node kind: Literal
  path: name

Deploy
type: Class
type: NodeShape
comment: A Deploy action involves instantiating some deception objects prior or during an operation.
subclass of: Action
property:
  datatype: string
  has value: Deploy
  max count: 1
  min count: 1
  node kind: Literal
  path: name

Obfuscate
type: Class
type: NodeShape
comment: An Obfuscate action is a transformative action an entity or tool performs to some object to reduce available information associated with that object.
subclass of: Action
property:
  datatype: string
  has value: Obfuscate
  max count: 1
  min count: 1
  node kind: Literal
  path: name

Respond
type: Class
type: NodeShape
comment: A Respond action is a reactive, defensive action to some adversarial detection or alert.
subclass of: Action
property:
  datatype: string
  has value: Respond
  max count: 1
  min count: 1
  node kind: Literal
  path: name

Breadcrumb
type: Class
type: NodeShape
comment: A Breadcrumb is a set of objects placed to be at least partially, sequentially interacted by an adversary to ellicit an explicit response, often in the context of lateral movement.
subclass of: LureObject
property:
  class: UcoObject
  min count: 1
  node kind: IRI
  path: breadcrumbTargetObject
property:
  class: UcoObject
  node kind: IRI
  path: hasCharacterization

BreadcrumbTrail
type: Class
type: NodeShape
comment: A breadcrumb trail is a sequence of observed breadcrumbs where partial order of observation of breadcrumbs matter.
subclass of: UcoObject
property:
  class: Objective
  min count: 1
  node kind: IRI
  path: hasObjective
property:
  class: UcoObject
  min count: 1
  node kind: IRI
  path: breadcrumbTargetObject
property:
  class: Thread
  min count: 1
  node kind: IRI
  path: hasBreadcrumb

DataSource
type: Class
type: NodeShape
comment: A datasource is a grouping of characteristics unique to a specific source of data (e.g. a tool that generates event logs).
subclass of: UcoObject

DataTarget
type: Class
type: NodeShape
comment: A datatarget is a grouping of characteristics unique to a specific target/listener that receives data (e.g. a listening port).
subclass of: UcoObject

Decoy
type: Class
type: NodeShape
comment: A decoy is a placed object that has the perception of enough value to an adversary to pursue but contains no real value.
subclass of: LureObject

HoneyObject
type: Class
type: NodeShape
comment: An domain object that is created to be percieved by an adversary to have high value to pursue in an adversary engagement operation that has no value out of scope of the operation's intended perception.
subclass of: LureObject

Honeypot
type: Class
type: NodeShape
comment: A controlled environment intended to be probed, compromised or attacked by adversaries or malware.
subclass of: HoneyObject
property:
  datatype: Action Name Vocabulary
  message: Value is outside the default vocabulary HoneypotInteractionTypeVocab.
  path: honeypotInteractionType
  severity: Info
property:
  max count: 1
  node kind: Literal
  or:
    datatype: Action Name Vocabulary
  or:
    datatype: string
  path: honeypotInteractionType
property:
  message: Value is not member of the vocabulary HoneypotInteractionTypeVocab.
  or:
    datatype: Action Name Vocabulary
    in: High
    in: Low
    in: Dynamic
  or:
    datatype: string
  path: honeypotInteractionType

HoneyToken
type: Class
type: NodeShape
comment: A honey token gives an adversary direct access to a honeypot.
subclass of: HoneyObject

LureObject
type: Class
type: NodeShape
comment: An object or set of objects used to attract an adversary that has the perception of high value regardless if it actually has high value.
subclass of: UcoObject
property:
  class: UcoObject
  min count: 1
  node kind: IRI
  path: hasCharacterization
property:
  class: UcoObject
  min count: 1
  node kind: IRI
  path: hasPerceptionCharacterization
property:
  class: UcoObject
  min count: 1
  node kind: IRI
  path: hasAttackSurface

Malware
type: Class
type: NodeShape
comment: Malware, also known as malicious code and malicious software, refers to a program that is inserted into a system, usually covertly, with the intent of compromising the confidentiality, integrity, or availability of the victim's data, applications, or operating system (OS) or of otherwise annoying or disrupting the victim. Malware such as viruses and worms are usually designed to perform these nefarious functions in such a way that users are unaware of them, at least initially.
subclass of: UcoObject

Event
type: Class
type: NodeShape
comment: An Event characterizes some occurence.
subclass of: UcoObject
property:
  datatype: string
  node kind: Literal
  path: eventType
property:
  node kind: IRI
  class: UcoObject
  path: eventContext
property:
  datatype: string
  node kind: Literal
  path: startTime
property:
  datatype: string
  node kind: Literal
  path: endTime
property:
  node kind: IRI
  class: Dictionary
  path: eventAttribute

Narrative
type: Class
type: NodeShape
comment: A narrative is a script of all expected sequence of actions, events, entities and their interactions.
subclass of: UcoObject
property:
  class: UcoObject
  min count: 1
  node kind: IRI
  path: hasStoryline
property:
  class: UcoObject
  min count: 1
  node kind: IRI
  path: hasObjective

PlannedEvent
type: Class
type: NodeShape
comment: A PlannedEvent is a collection of actions, entities, interactions designated to be performed at some sequentially indexed time in a Storyline or Narrative
subclass of: UcoObject
property:
  class: UcoObject
  min count: 1
  node kind: IRI
  path: eventContext
property:
  class: UcoObject
  min count: 1
  node kind: IRI
  path: hasObjective

PocketLitter
type: Class
type: NodeShape
comment: Pocket litter describes objects placed prior or during an adversary engagement operation for the purpose of realism.
subclass of: UcoObject
property:
  class: UcoObject
  min count: 1
  node kind: IRI
  path: hasCharacterization

Resource
type: Class
type: NodeShape
comment: A resource can be a tool, location or object which requires some operational cost to enable availability.
subclass of: UcoObject

Sandbox
type: Class
type: NodeShape
comment: A controlled environment intended for malware detonation and malware analysis.
subclass of: UcoObject
property:
  class: UcoObject
  min count: 1
  node kind: IRI
  path: hasCharacterization

Storyline
type: Class
type: NodeShape
comment: A Storyline is a sequence of semi-ordered planned events as an expected trajectory for a narrative.
subclass of: UcoObject
property:
  class: Thread
  min count: 1
  node kind: IRI
  path: hasEvent

alertContext
type: ObjectProperty
comment: An alert context describes the association of actions and objects relating to an alert.
range: UcoObject

hasAttackSurface
type: ObjectProperty
type: NodeShape
comment: hasAttackSurface is an object property which describes the UcoObjects which compose the attack surface which is expected to interacted with by an adversary.
range: UcoObject

eventContext
type: ObjectProperty
comment: An event context describes the association of actions and objects relating to an event.
range: UcoObject

eventAttribute
type: ObjectProperty
comment: An event attribute specifies an ad-hoc attribute/value for an event.
range: Dictionary

eventType
type: DatatypeProperty
comment: An event type specifies a classification type for the event.
range: string

breadcrumbTargetObject
type: ObjectProperty
comment: breadcrumbTargetObject specifies the target object or resource which the breadcrumb is luring an adversary to.
range: UcoObject

hasCharacterization
type: ObjectProperty
type: NodeShape
comment: hasCharacterization is an object property which describes the UcoObjects which compose a deception object or adversary engagement concept.
range: UcoObject

hasPerceptionCharacterization
type: ObjectProperty
type: NodeShape
comment: hasPerceptionCharacterization is an object property which describes the UcoObjects which compose the perception object which an adversary perceives.
range: UcoObject

hasEvent
type: ObjectProperty
comment: hasEvent specifies an ordered list of associated Events.
range: Thread

hasBreadcrumb
type: ObjectProperty
comment: hasBreadcrumb specifies an ordered list of associated Breadcrumbs.
range: Thread

hasStoryline
type: ObjectProperty
comment: hasStoryline identifies a Storyline that is part of a Narrative.
range: Storyline

honeypotInteractionType
type: DatatypeProperty
comment: The interaction class intended for a honeypot.
range: Datatype
  union of: Action Name Vocabulary
  union of: string

Persona
type: Class
type: NodeShape
comment: An persona is a facticious entity created to serve a purpose in a deception operation.
subclass of: Identity

Team
type: Class
type: NodeShape
comment: The conventional reference to group of identities that are associated with some unified identity with a team objective
subclass of: Organization
property:
  class: Objective
  node kind: IRI
  path: hasObjective

Objective
type: Class
type: NodeShape
comment: An objective is some particular condition or state that is desired to be achieved and toward which effort is directed: an aim, goal, or end of action.
subclass of: UcoObject

hasObjective
type: ObjectProperty
type: NodeShape
name: hasObjective
description: An object which can be associated with an objective.
range: Objective

CommandAndControl
type: Objective
name: Command and Control
description: A Command and Control objective is defined by MITRE ATT&CK Tactic TA0011 (Command and Control) and involves an adversary's capability to communicate with compromised systems to control them.

CredentialAccess
type: Objective
name: Access Credentials
description: An Access Credentials (Credential Access) objective is defined by MITRE ATT&CK Tactic TA0006 (Credential Access) and involves an adversary's capability to steal account names and passwords.

DevelopResource
type: Objective
name: Develop Resource
description: A Develop Resource (Resource Development) objective is defined by MITRE ATT&CK Tactic TA0042 (Resource Development) and involves an adversary's capability to establish resources they can use to support operations.

Discover
type: Objective
name: Discover
description: A Discover (Discovery) objective is defined by MITRE ATT&CK Tactic TA0007 (Discovery) and involves an adversary's capability to learn about and understand details of a targeted environment.

EscalatePrivilege
type: Objective
name: Escalate Privilege
description: An Escalate Privilege (PrivilegeEscalation) objective is defined by MITRE ATT&CK Tactic TA0004 (Privilege Escalation) and involves an adversary's capability to gain higher-level permissions within a targeted environment.

Evade
type: Objective
name: Evade
description: An Evade (Defense Evasion) objective is defined by MITRE ATT&CK Tactic TA0005 (Defense Evasion) and involves an adversary's capability to avoid detection from some defense or entity.

Execute
type: Objective
name: Execute
description: An Execute (Execution) objective is defined by MITRE ATT&CK Tactic TA0002 (Execution) and involves an adversary's capability to run malicious code within a targeted environment.

Exfilitrate
type: Objective
name: Exfilitrate
description: An Exfilitrate (Exfiltration) is defined by MITRE ATT&CK Tactic TA0010 (Exfiltration) and involves an adversary's capability to remove stolen data from targeted environments.

GainInitialAccess
type: Objective
name: Gain Initial Access
description: A Gain Initial Access (InitialAccess) objective is defined by MITRE ATT&CK Tactic TA0001 (Initial Access) and involves an adversary's capability to penetrate and gain illicit access to a targeted environment.

Impact
type: Objective
name: Impact
description: An Impact objective is defined by MITRE ATT&CK Tactic TA0040 (Impact) and involves an adversary's capability to manipulate, interrupt, or destroy targeted systems and data.

MoveLaterally
type: Objective
name: MoveLaterally
description: A Move Laterally (Lateral Movement) objective is defined by MITRE ATT&CK Tactic TA0008 (Lateral Movement) and involves an adversary's capability to move through a targeted environment.

Persist
type: Objective
name: Persist
description: A Persist (Persistence) objective is defined by MITRE ATT&CK Tactic TA0003 (Persistence) and involves an adversary's capability to maintain their access foothold within a changing targeted environment.

Reconnaissance
type: Objective
name: Reconnaissance
description: A Reconnaissance objective is defined by MITRE ATT&CK Tactic TA0043 (Reconnaissance) and involves an adversary's capability to gather information they can use to plan future operations.

Affect
type: Objective
name: Affect
description: An Affect objective is defined by MITRE ENGAGE EGO0002 (Affect) and involves the capability to negatively impact an adversary's operations. Affect is ultimately about changing the cost-value proposition in cyber operations for the adversary. The defender may want to increase the adversary’s cost to operate or drive down the value they derive from their operations. For example, the defender can negatively impact the adversary’s on-network operations to drive up the resource cost of doing operations by slowing down or selectively resetting connections to impact exfiltration. This type of activity increases the adversary’s time on target and wastes their resources. To drive down the value of stolen data, a defender could provide an adversary deliberately conflicting information. Providing such information requires an adversary to either choose to believe one piece of data over another, disregard both, collect more data, or continue with uncertainty.

Collect
type: Objective
name: Collect
description: A Collect (Collection) objective is defined by MITRE ATT&CK Tactic TA0009 (Collection) and by MITRE ENGAGE EAP0001 (Collect) and involves the capability to gather data of interest to a particular goal. MITRE ATT&CK defines this within the context of an adversary's goal to gather data from a targeted environment. MITRE ENGAGE defines this within the context of a defender's goal to gather data about an adversary's tools, tactics, or other raw intelligence about the adversary’s activity.

Detect
type: Objective
name: Detect
description: A Detect objective is defined by MITRE ENGAGE EAP0002 (Detect) and involves the capability to establish or maintain awareness regarding adversary activity. Detection activities focus on the defender’s ability to monitor adversary activity throughout an environment, often by creating high-fidelity detections. These detections can be produced in several ways. For example, a defender can deploy lures as tripwires in the environment. The defender may create custom alerts based on TTPs or IOCs observed during a malware detonation operation. Finally, the defender may write customer decoders to analyze and alert on malicious traffic. In all these cases, detection activities allow the defender to produce a high-fidelity alert to monitor adversary activities. Often Detection activities are also good cybersecurity practices. However, in Engage, these activities will focus exclusively on the intersection of denial, deception, and adversary engagement technologies and the defender’s ability to Expose the adversary.

Direct
type: Objective
name: Direct
description: A Direct objective is defined by MITRE ENGAGE EAP0004 (Direct) and involves the capability to encourage or discourage an adversary from conducting their operation as intended. Direction activities focus on moving the adversary towards or away from an intended path. This forced direction can be accomplished by removing or disabling some resources, while adding or enabling others. The defender can add lures or otherwise manipulate the environment to attempt to elicit specific responses from the adversary. Additionally, the defender can tighten some security controls while leaving others overly permissive or weakened. Finally, the defender can physically move the adversary by moving threats from their intended environment and into a safe engagement environment. For example, a suspicious email attachment can be moved from the intended target to an engagement environment for analysis. No matter how the direction is achieved, the defender hopes to force the adversary to take unintended actions or stop intended actions.

Disrupt
type: Objective
name: Disrupt
description: A Disrupt objective is defined by MITRE ENGAGE EAP0005 (Disrupt) and involves the capability to impair an adversary’s ability to conduct their operation as intended. Disruption activities are used to stop or discourage an adversary from conducting part or all of their mission. This disruption may increase the time, skills, or resources needed for the adversary to accomplish a specific task. For example, a defender may degrade network speeds as the adversary attempts to exfiltrate large blocks of data. As a second example, the defender may manipulate the output of commonly used discovery commands to show targets that do not exist or to hide real targets. In either case, the adversary may waste resources acting on partial or falsified data. Disruptions may also include planting misinformation designed to influence the adversary’s decision-makers to make the wrong decisions or to waste resources.

Elicit
type: Objective
name: Elicit
description: An Elicit objective is defined by MITRE ENGAGE EGO0003 (Elicit) and involves the capability to learn about an adversary's tactics, techniques, and procedures (TTPs). Elicit encourages adversaries to reveal additional or more advanced TTPs and goals while operating in defender-controlled engagement environments. These high-fidelity, synthetic engagement environments are uniquely tailored to engage with specific adversaries. They may contain a combination of documents, browser artifacts, etc. to reassure an adversary and reduce suspicion. Further, they may offer enticing data and exploitable vulnerabilities to motivate an adversary to operate in the defender’s environment. These environments can either be left as a dangle, i.e., honeypot. Other times, the defender may self-infect with malware. In either case, observing an adversary as they operate can provide organizations with actionable cyber threat intelligence and potential understanding of the adversary’s goals.

Expose
type: Objective
name: Expose
description: An Expose objective is defined by MITRE ENGAGE EGO0001 (Expose) and involves the capability to reveal the presence of ongoing adversary operations. Expose is about discovering previously undetected adversaries engaging in one of two behaviors. First, the adversary may be attempting to gain access to the networks. Second, the adversary may be currently operating on the networks. Both categories of adversary behavior contain vulnerabilities that can be advantageous for a defender seeking to expose the adversary. As an example of such a vulnerability, when an adversary interacts with network or system resources, they are vulnerable to trigger tripwires. The defender can make and leak fake credentials both inside and outside of the network. The defender can then monitor for the use of these credentials. Then, when an adversary uses a fake credential, the defender will receive a high-fidelity alert. In addition, if the credentials are unique, a defender may be able to detect how and when an adversary collected the credentials. Whenever a defender seeks to engage with an adversary, operational safety is paramount. To maintain this safety, it is a best practice to monitor adversaries as they operate in an engagement environment. Additionally, the defender must be able to observe the adversary. Therefore, collection and detection activities can often be utilized even when a defender may have other strategic goals in mind.

Motivate
type: Objective
name: Motivate
description: A Motivate objective is defined by MITRE ENGAGE EAP0007 (Motivate) and involves the capability to encourage an adversary to conduct part or all of their mission. Motivating activities is used to encourage an adversary to conduct part or all of their mission by providing a target-rich environment. To do this, the defender can use unpatched versions of operating systems and software, remove end-point detection software, and use weak passwords. Additionally, the defender can open firewall ports, add proxy capabilities, or introduce elements that an adversary can easily leverage to bypass an obstacle in their operations. Finally, the defender can include enticing data to the environment to encourage the adversary to steal the data.

Plan
type: Objective
name: Plan
description: A Plan objective is defined by MITRE ENGAGE SAP0001 (Plan) and involves the capability to identify and align an operation with a desired end-state. Planning is used to identify and align an operation within the context of strategic goals. By helping the defender to first identify their goals, Planning ensures that all engagement activities are focused and driving forward progress. Additionally, planning ensures that the defender can integrate the inputs of the various stakeholders at the beginning of an operation to ensure that the operation is efficient, effective, and safe. Finally, Planning activities ensure that each operation is informed by the successes and learns from the failures of past operations.

Prepare
type: Objective
name: Prepare
description: A Prepare objective is defined by MITRE ENGAGE SGO0001 (Prepare) and involves the capability to help a defender think about what they want to accomplish with operations. Prepare is used to ensure the defender drives progress during adversary engagement operations towards a desired end-state or Strategic Goal. To support this aim, the defender must first generate a clear picture of their organization and the threat landscape. This understanding should include their current security posture, including known strengths and weaknesses, and an inventory of priority cyber assets, including key intellectual property. The defender should then examine and update the threat models for any identified adversaries. These various assessments and models should enable the defender to identify their strategic goal. At this point, all activities should be aligned with this goal. Once a goal has been selected, the defender must work to plan for the operation by identifying a target adversary, creating the necessary Personas, generating an operational storyboard, etc. Finally, the key stakeholders should be called on to establish rules for operational safety and acceptable risk. At each step in the planning process, the defender should incorporate intelligence gained from previous operations to ensure that future operations can run more effectively and efficiently. Engage seeks to highlight that denial, deception, and adversary engagement activities cannot be viewed as `fire and forget`. Unlike many defensive technologies, these activities must be viewed only in context of how they inform and drive progress towards larger strategic goals. To this end, Prepare is essential to ensure that every action taken in an engagement operation drives progress towards a unified goal.

Prevent
type: Objective
name: Prevent
description: A Prevent objective is defined by MITRE ENGAGE EAP0003 (Prevent) and involves the capability to stop all or part of an adversary’s ability to conduct their operation as intended. Prevention activities focus on stopping the adversary’s ability to conduct their operations as intended. The defender can physically or virtually remove or disable resources, tighten security controls, or otherwise impair the adversary’s ability to operate. A defender might prevent an adversary from operating to force them to reveal different, possibly more advanced, capabilities. Additionally, a defender can use prevention activities to discourage the adversary from operating against a specific target. In this case, the defender may be attempting to encourage the adversary to focus elsewhere in the engagement environment. There are many more prevention activities that are also good cybersecurity practices. However, in Engage, we are focused on a subset of activities. Those are focused exclusively on the intersection of denial, deception, and adversary engagement technologies and the defender’s ability to Affect the adversary.

Reassure
type: Objective
name: Reassure
description: A Reassure objective is defined by MITRE ENGAGE EAP0006 (Reassure) and involves the capability to add authenticity to deceptive components to convince an adversary that an environment is real. Reassurance activities are used to add authenticity to deceptive components to reduce adversary suspicion about the legitimacy of the environment. Activities include adding realistic user accounts, files, system activity, and any other content that an adversary might expect to find on the system. These activities may add new artifacts, such as peripherals and pocket litter, while concealing others, such as how recently an environment was stood up. If done correctly, reassuring an adversary may help to make them feel more comfortable upon landing in a new environment. This initial level of comfort can help anchor the adversary in the environment, increasing their tolerance to faults or weaknesses discovered later.

Relationship-Analyze-Understand
type: Relationship
kind of relationship: Supports Objective
source: Analyze
target: Understand

Relationship-Collect-Expose
type: Relationship
kind of relationship: Supports Objective
source: Collect
target: Expose

Relationship-Detect-Expose
type: Relationship
kind of relationship: Supports Objective
source: Detect
target: Expose

Relationship-Direct-Affect
type: Relationship
kind of relationship: Supports Objective
source: Direct
target: Affect

Relationship-Disrupt-Affect
type: Relationship
kind of relationship: Supports Objective
source: Disrupt
target: Affect

Relationship-Motivate-Elicit
type: Relationship
kind of relationship: Supports Objective
source: Motivate
target: Elicit

Relationship-Plan-Prepare
type: Relationship
kind of relationship: Supports Objective
source: Plan
target: Prepare

Relationship-Prevent-Affect
type: Relationship
kind of relationship: Supports Objective
source: Prevent
target: Affect

Relationship-Reassure-Elicit
type: Relationship
kind of relationship: Supports Objective
source: Reassure
target: Elicit

Analyze
type: Objective
name: Analyze
description: An Analyze objective is defined by MITRE ENGAGE SP0002 (Analyze) and involves the capability to retrospectively review information gained from an operation. Analysis is used to aggregate, examine, and evaluate the results of an operation. Analysis is useful for improving the defender’s security posture through the synthesis of operational data. Additionally, analysis can be used to turn data into actionable intelligence about an adversary’s motivators, behaviors, tactics, and techniques. Defenders can use analysis to gain insight into adversary activity and thus inform detection and analytics refinements. Reviewing the execution of an operation also provides feedback for the team to improve the quality of future operations. Finally, Analysis activities ensure that each operation is informed by the successes and learns from the failures of past operations.

Deny
type: Objective
name: Deny
description: A Deny (Denial) objective is to limit an adversary's capabilities or accessibility to a resource.

ElicitBehavior
type: Objective
name: Elicit Behavior
description: An Elicit Behavior objective is to have an adversary or target object to exhibit some expected behavior.

Lure
type: Objective
name: Lure
description: A Lure objective is to have an adversary laterally move or take actions to reach some target lure, usually performed through the deployment of breadcrumbs and honeypots.

TimeSink
type: Objective
name: Time Sink
description: A Time Sink objective is to increase an adversary's operation time cost by having them interact with objects in a network.

Track
type: Objective
name: Track
description: A Track objective is to be capable of identifying and tracing an adversary throughout a network.

Trap
type: Objective
name: Trap
description: A Trap objective is to limit an adversary's scope of reachability to a confined environment.

Adversary
type: Role
name: Adversary
description: An adversary is an instance of a contextualized role that holds opposing interests to a defender role.

BlueTeam
type: Role
name: Blue Team
description: An organizational role focused on ensuring the defensibility of targeted environments against attack.

Defender
type: Role
name: Defender
description: An defender is an instance of a contextualized role that defends some object or asset for some objective.

PurpleTeam
type: Role
name: Purple Team
description: An organizational role focused on evaluating and ensuring the defensibility of targeted environments against attack through a collaborative combination of BlueTeam (outward focused defense) and RedTeam (inward focused emulation of adversary attack) roles.

RedTeam
type: Role
name: Red Team
description: An organizational role focused on evaluating the defensibility of targeted environments against attack by actively emulating the persona, perspective, practices and actions of adversaries.

Action Name Vocabulary
type: Datatype
comment: Defines a vocabulary of honeypot interaction characteristics.
subclass of: Resource
one of: High
one of: Low
one of: Dynamic