Skip to content

Commit

Permalink
MITRE CASE Python API (v0.1.0) prototype uploaded.
Browse files Browse the repository at this point in the history
  • Loading branch information
vikhari committed Apr 9, 2018
1 parent 598dd31 commit 65426c6
Show file tree
Hide file tree
Showing 10 changed files with 6,145 additions and 170 deletions.
21 changes: 21 additions & 0 deletions LICENSE.txt
@@ -0,0 +1,21 @@
NOTICE

This software (or technical data) was produced for the U. S.
Government under contract SB-1341-14-CQ-0010, and is subject to the Rights in Data-General Clause 52.227-14, Alt. IV (DEC 2007)

© 2018 The MITRE Corporation. All Rights Reserved.


Copyright 2018, The MITRE Corporation

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
5,033 changes: 5,033 additions & 0 deletions NLG.py

Large diffs are not rendered by default.

138 changes: 16 additions & 122 deletions README.md
@@ -1,132 +1,26 @@
# CASE/UCO Python API
### CASE API
This repository will serve as a PoC of Digital Forensic tool mappings.
The CASE-API wraps [RDFLib](https://rdflib.readthedocs.io/en/stable/) for a JSON-LD
schematic.

This is a low-level API for the [CASE/UCO](https://casework.github.io/case) ontology
used to *generate* RDF graphs.
This API is designed to be a thin wrapper around the rdflib library used to create
RDF graphs. The rdflib library can then be used to inject and read already
created graphs.

*NOTE: This API currently does not perform any validation and therefore requires the
user to know how to properly structure CASE/UCO elements.*
#### Quickstart
1.``` python setup.py install```

## Install
```
git clone https://github.com/casework/case-api-python.git
pip install case-api-python
```


## Usage
Below is an example of using the case API to generate a json-ld file.

```python
import case
import datetime
#### src
This directory contains all source files for the CASE-API.
* **case.py**: Original PoC API implementation of the ontology on [github](www.github.com/caseworks/case).
APIs for various tools will likely inherent from classes within this script.
* **case-example.py** : Example implementation of CASE/UCO as defined on the public facing github.


document = case.Document()

instrument = document.create_uco_object(
'Tool',
name='Super Forensic Tool 3000',
version='3.4.5',
toolType='Extraction',
creator='Frank Grimes')
#### Unittests
This directory contains all unit test files for the Python
CASE-API. The unittest module is being used for all Python testing within this repo.

performer = document.create_uco_object('Identity')
performer.create_property_bundle(
'SimpleName',
givenName='John',
familyName='Doe')

action = document.create_uco_object(
'ForensicAction',
startTime=datetime.datetime(2017, 7, 21, 13, 32),
endTime=datetime.datetime(2017, 7, 21, 14, 12))
action.create_property_bundle(
'ActionReferences',
performer=performer,
instrument=instrument,
# object and result should be filled with
# input and output uco objects for this Forensic action.
object=None,
result=[])

document.serialize(format='json-ld', destination='output.json')
##### Running Unittests
```

output.json :
```json
{
"@context": {
"@vocab": "http://case.example.org/core#",
"case": "http://case.example.org/core#",
"rdf": "http://www.w3.org/1999/02/22-rdf-syntax-ns#",
"rdfs": "http://www.w3.org/2000/01/rdf-schema#",
"xsd": "http://www.w3.org/2001/XMLSchema#"
},
"@graph": [
{
"@id": "_:15249350-6615-48b4-b332-c983dc16af7e",
"@type": "ActionReferences",
"instrument": {
"@id": "f0a52e1f-d90a-4e60-8f66-b01c1e73051c"
},
"performer": {
"@id": "e706a541-3ca0-486a-ab47-e30ef983ad9d"
}
},
{
"@id": "f0a52e1f-d90a-4e60-8f66-b01c1e73051c",
"@type": "Tool",
"createdTime": {
"@type": "xsd:dateTime",
"@value": "2017-07-21T13:43:59.182000"
},
"creator": "Frank Grimes",
"name": "Super Forensic Tool 3000",
"toolType": "Extraction",
"version": "3.4.5"
},
{
"@id": "_:469c1da9-403b-4cc9-9d95-de38b0a92ce9",
"@type": "SimpleName",
"familyName": "Doe",
"givenName": "John"
},
{
"@id": "963e9e35-b8b5-4696-a7db-b1681b22e90c",
"@type": "ForensicAction",
"createdTime": {
"@type": "xsd:dateTime",
"@value": "2017-07-21T13:43:59.183000"
},
"endTime": {
"@type": "xsd:dateTime",
"@value": "2017-07-21T14:12:00"
},
"propertyBundle": {
"@id": "_:15249350-6615-48b4-b332-c983dc16af7e"
},
"startTime": {
"@type": "xsd:dateTime",
"@value": "2017-07-21T13:32:00"
}
},
{
"@id": "e706a541-3ca0-486a-ab47-e30ef983ad9d",
"@type": "Identity",
"createdTime": {
"@type": "xsd:dateTime",
"@value": "2017-07-21T13:43:59.182000"
},
"propertyBundle": {
"@id": "_:469c1da9-403b-4cc9-9d95-de38b0a92ce9"
}
}
]
}
python unittest.test
```

*(For a more in-depth example, see the [case-implementation-plaso](https://github.com/ucoProject/CASE-Plaso-Implementation)
repo which uses this API to export events from a [plaso](https://github.com/log2timeline/plaso) storage file.)*
11 changes: 11 additions & 0 deletions __init__.py
@@ -0,0 +1,11 @@
# NOTICE
#
# This software was produced for the U.S. Government under
# contract SB-1341-14-CQ-0010, and is subject to the Rights
# in Data-General Clause 52.227-14, Alt. IV (DEC 2007)
#
# (c) 2018 The MITRE Corporation. All Rights Reserved.


#====================================================
all = ["case"]

0 comments on commit 65426c6

Please sign in to comment.